| @@ -1012,9 +1012,10 @@ | ||
| 1012 | 1012 | * @return bool |
| 1013 | 1013 | */ |
| 1014 | 1014 | public static function url_is_allowed( $download_url ) { |
| 1015 | 1015 | return ( |
| 1016 | - FrmAppHelper::validate_url_is_in_s3_bucket( $download_url, 'zip' ) || in_array( $download_url, self::allowed_external_urls(), true ) | |
| 1016 | + FrmAppHelper::validate_url_is_in_s3_bucket( $download_url, 'zip' ) || | |
| 1017 | + ( strpos( $download_url, 'https://downloads.wordpress.org/plugin' ) === 0 && substr_compare( $download_url, '.zip', -4 ) === 0 ) | |
| 1017 | 1018 | ); |
| 1018 | 1019 | } |
| 1019 | 1020 | |
| 1020 | 1021 | /** |
| @@ -1023,10 +1024,8 @@ | ||
| 1023 | 1024 | * |
| 1024 | 1025 | * @since 3.04.02 |
| 1025 | 1026 | */ |
| 1026 | 1027 | protected static function install_addon() { |
| 1027 | - FrmAppHelper::permission_check( 'install_plugins' ); | |
| 1028 | - | |
| 1029 | 1028 | require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php'; |
| 1030 | 1029 | |
| 1031 | 1030 | $download_url = self::get_current_plugin(); |
| 1032 | 1031 | |
| @@ -1177,12 +1176,8 @@ | ||
| 1177 | 1176 | * |
| 1178 | 1177 | * @return bool |
| 1179 | 1178 | */ |
| 1180 | 1179 | public static function can_install_addon_api() { |
| 1181 | - if ( ! current_user_can( 'activate_plugins' ) ) { | |
| 1182 | - return false; | |
| 1183 | - } | |
| 1184 | - | |
| 1185 | 1180 | // Verify params present (auth & download link). |
| 1186 | 1181 | $post_auth = FrmAppHelper::get_param( 'token', '', 'request', 'sanitize_text_field' ); |
| 1187 | 1182 | $post_url = FrmAppHelper::get_param( 'file_url', '', 'request', 'sanitize_text_field' ); |
| 1188 | 1183 | |
| @@ -1318,40 +1313,8 @@ | ||
| 1318 | 1313 | } |
| 1319 | 1314 | |
| 1320 | 1315 | echo json_encode( self::get_addon_activation_response() ); |
| 1321 | 1316 | wp_die(); |
| 1322 | - } | |
| 1323 | - | |
| 1324 | - /** | |
| 1325 | - * Allowed URLs used for internal source of plugins installation. | |
| 1326 | - * | |
| 1327 | - * @since 6.3.1 | |
| 1328 | - * | |
| 1329 | - * @return array | |
| 1330 | - */ | |
| 1331 | - private static function allowed_external_urls() { | |
| 1332 | - $allowed_url_list = array( | |
| 1333 | - 'https://downloads.wordpress.org/plugin/formidable-gravity-forms-importer.zip', | |
| 1334 | - 'https://downloads.wordpress.org/plugin/formidable-import-pirate-forms.zip', | |
| 1335 | - 'https://downloads.wordpress.org/plugin/wp-mail-smtp.zip', | |
| 1336 | - ); | |
| 1337 | - | |
| 1338 | - /** | |
| 1339 | - * List of URLs used in plugin formidable internal installation. | |
| 1340 | - * | |
| 1341 | - * @since 6.3.1 | |
| 1342 | - * | |
| 1343 | - * @param array $allowed_url_list List of URLs. | |
| 1344 | - */ | |
| 1345 | - $allowed_url_list = apply_filters( 'frm_allowed_external_urls', $allowed_url_list ); | |
| 1346 | - | |
| 1347 | - if ( ! is_array( $allowed_url_list ) ) { | |
| 1348 | - _doing_it_wrong( __METHOD__, 'Only an array of URLs could be used within this filter.', '6.3.1' ); | |
| 1349 | - | |
| 1350 | - return array(); | |
| 1351 | - } | |
| 1352 | - | |
| 1353 | - return $allowed_url_list; | |
| 1354 | 1317 | } |
| 1355 | 1318 | |
| 1356 | 1319 | /** |
| 1357 | 1320 | * @since 4.06.02 |
