← All changes
|
app/Services/Integrations/MailChimp/MailChimpIntegration.php
+16
-5
6.2.5
→
6.2.14
View file →
| @@ -4,8 +4,9 @@ | ||
| 4 | 4 | |
| 5 | 5 | defined('ABSPATH') or die; |
| 6 | 6 | |
| 7 | 7 | use FluentForm\App\Http\Controllers\IntegrationManagerController; |
| 8 | +use FluentForm\App\Modules\Acl\Acl; | |
| 8 | 9 | use FluentForm\App\Services\Integrations\MailChimp\MailChimpSubscriber as Subscriber; |
| 9 | 10 | use FluentForm\Framework\Foundation\Application; |
| 10 | 11 | use FluentForm\Framework\Helpers\ArrayHelper; |
| 11 | 12 | |
| @@ -35,9 +36,9 @@ | ||
| 35 | 36 | add_action('wp_ajax_fluentform_mailchimp_interest_groups', [$this, 'fetchInterestGroups']); |
| 36 | 37 | |
| 37 | 38 | add_filter('fluentform/save_integration_value_mailchimp', [$this, 'sanitizeSettings'], 10, 3); |
| 38 | 39 | |
| 39 | -// add_filter('fluentform/notifying_async_mailchimp', '__return_false'); | |
| 40 | + // add_filter('fluentform/notifying_async_mailchimp', '__return_false'); | |
| 40 | 41 | } |
| 41 | 42 | |
| 42 | 43 | public function getGlobalFields($fields) |
| 43 | 44 | { |
| @@ -210,9 +211,12 @@ | ||
| 210 | 211 | 'component' => 'chained_fields', |
| 211 | 212 | 'sub_type' => 'radio', |
| 212 | 213 | 'category_label' => __('Select Interest Category', 'fluentform'), |
| 213 | 214 | 'subcategory_label' => __('Select Interest', 'fluentform'), |
| 214 | - 'remote_url' => admin_url('admin-ajax.php?action=fluentform_mailchimp_interest_groups'), | |
| 215 | + 'remote_url' => add_query_arg([ | |
| 216 | + 'action' => 'fluentform_mailchimp_interest_groups', | |
| 217 | + 'form_id' => (int) $formId, | |
| 218 | + ], admin_url('admin-ajax.php')), | |
| 215 | 219 | 'inline_tip' => __('Select the mailchimp interest category and interest', 'fluentform'), |
| 216 | 220 | ], |
| 217 | 221 | [ |
| 218 | 222 | 'key' => 'tags', |
| @@ -371,11 +375,18 @@ | ||
| 371 | 375 | } |
| 372 | 376 | |
| 373 | 377 | public function fetchInterestGroups() |
| 374 | 378 | { |
| 375 | - $settings = wp_unslash($this->app->request->get('settings')); | |
| 379 | + // SECURITY (FINDING-04): this AJAX action reads the site's global Mailchimp API key and | |
| 380 | + // issues an authenticated request on the caller's behalf; it had no capability/nonce check. | |
| 381 | + // Acl::verify enforces both the capability and the fluent_forms_admin_nonce for AJAX. | |
| 382 | + $formId = Acl::verifyFormId($this->app->request->get('form_id')); | |
| 383 | + Acl::verify('fluentform_forms_manager', $formId); | |
| 376 | 384 | |
| 377 | - $listId = ArrayHelper::get($settings, 'list_id'); | |
| 385 | + $settings = $this->app->request->get('settings', []); | |
| 386 | + $settings = is_array($settings) ? wp_unslash($settings) : []; | |
| 387 | + | |
| 388 | + $listId = sanitize_text_field((string) ArrayHelper::get($settings, 'list_id')); | |
| 378 | 389 | if (! $listId) { |
| 379 | 390 | wp_send_json_success([ |
| 380 | 391 | 'categories' => [], |
| 381 | 392 | 'subcategories' => [], |
| @@ -382,9 +393,9 @@ | ||
| 382 | 393 | 'reset_values' => true, |
| 383 | 394 | ]); |
| 384 | 395 | } |
| 385 | 396 | |
| 386 | - $categoryId = ArrayHelper::get($settings, 'interest_group.category'); | |
| 397 | + $categoryId = sanitize_text_field((string) ArrayHelper::get($settings, 'interest_group.category')); | |
| 387 | 398 | $categories = $this->getInterestCategories($listId); |
| 388 | 399 | |
| 389 | 400 | $subCategories = []; |
| 390 | 401 | if ($categoryId) { |