← All changes | includes/gateways/actions.php +28 -9 2.3.0 → 4.16.9 View file →

		@@ -3,9 +3,9 @@
3	3	* Gateway Actions
4	4	*
5	5	* @package Give
6	6	* @subpackage Gateways
7		- * @copyright Copyright (c) 2016, WordImpress
	7	+ * @copyright Copyright (c) 2016, GiveWP
8	8	* @license https://opensource.org/licenses/gpl-license GNU Public License
9	9	* @since 1.0
10	10	*/
11	11
		@@ -13,8 +13,11 @@
13	13	if ( ! defined( 'ABSPATH' ) ) {
14	14	exit;
15	15	}
16	16
	17	+use Give\Helpers\Form\Utils as FormUtils;
	18	+use Give\Helpers\Frontend\Shortcode as ShortcodeUtils;
	19	+
17	20	/**
18	21	* Processes gateway select on checkout. Only for users without ajax / javascript
19	22	*
20	23	* @since 1.0
		@@ -22,9 +25,9 @@
22	25	* @param $data
23	26	*/
24	27	function give_process_gateway_select( $data ) {
25	28	if ( isset( $_POST['gateway_submit'] ) ) {
26		- wp_redirect( esc_url( add_query_arg( 'payment-mode', $_POST['payment-mode'] ) ) );
	29	+ wp_redirect( esc_url_raw( add_query_arg( 'payment-mode', $_POST['payment-mode'] ) ) );
27	30	exit;
28	31	}
29	32	}
30	33
		@@ -44,12 +47,12 @@
44	47	if (
45	48	! isset( $post_data['nonce'] )
46	49	|| ! give_verify_donation_form_nonce( $post_data['nonce'], $post_data['give_form_id'] )
47	50	) {
48		- Give_Notices::print_frontend_notice( __( 'Nonce verification has failed.', 'give' ), true, 'error' );
	51	+ Give_Notices::print_frontend_notice( __( 'We\'re unable to recognize your session. Please refresh the screen to try again; otherwise contact your website administrator for assistance.', 'give' ), true, 'error' );
49	52	exit();
50	53
51		- }elseif ( isset( $post_data['give_payment_mode'] ) ) {
	54	+ } elseif ( isset( $post_data['give_payment_mode'] ) ) {
52	55
53	56	$form_id_prefix = ! empty( $post_data['give_form_id_prefix'] ) ? $post_data['give_form_id_prefix'] : '';
54	57
55	58	$args = array(
		@@ -74,8 +77,9 @@
74	77	* Create wp nonce using Ajax call.
75	78	*
76	79	* Use give_donation_form_nonce() js fn to create nonce.
77	80	*
	81	+ * @since 4.16.6 Bail early when the form ID is not a give_forms post or is a Visual Form Builder (v3) form.
78	82	* @since 2.0
79	83	*
80	84	* @return void
81	85	*/
		@@ -84,8 +88,17 @@
84	88
85	89	// Get donation form id.
86	90	$form_id = is_numeric( $_POST['give_form_id'] ) ? absint( $_POST['give_form_id'] ) : 0;
87	91
	92	+ if ( ! ShortcodeUtils::isValidForm( $form_id ) ) {
	93	+ wp_send_json_error( [ 'error' => 'give_invalid_donation_form' ], 400 );
	94	+ }
	95	+
	96	+ // Visual Form Builder (v3) forms use route signatures instead of the legacy nonce endpoint.
	97	+ if ( FormUtils::isV3Form( $form_id ) ) {
	98	+ wp_send_json_error( [ 'error' => 'give_unsupported_form_version' ], 400 );
	99	+ }
	100	+
88	101	// Send nonce json data.
89	102	wp_send_json_success( wp_create_nonce( "give_donation_form_nonce_{$form_id}" ) );
90	103	}
91	104	}
		@@ -97,21 +110,27 @@
97	110	/**
98	111	* Create all nonce of donation form using Ajax call.
99	112	* Note: only for internal use
100	113	*
	114	+ * @since 4.16.6 Bail early when the form ID is not a give_forms post.
	115	+ * @since 4.9.0 rename function - PHP 8 compatibility
101	116	* @since 2.2.0
102	117	*
103	118	* @return void
104	119	*/
105		-function __give_donation_form_reset_all_nonce() {
	120	+function give_donation_form_reset_all_nonce() {
106	121	if ( isset( $_POST['give_form_id'] ) ) {
107	122
108	123	// Get donation form id.
109	124	$form_id = is_numeric( $_POST['give_form_id'] ) ? absint( $_POST['give_form_id'] ) : 0;
110	125
	126	+ if ( ! ShortcodeUtils::isValidForm( $form_id ) ) {
	127	+ wp_send_json_error( [ 'error' => 'give_invalid_donation_form' ], 400 );
	128	+ }
	129	+
111	130	$data = array(
112	131	'give_form_hash' => wp_create_nonce( "give_donation_form_nonce_{$form_id}" ),
113		- 'give_form_user_register_hash' => wp_create_nonce( "give_form_create_user_nonce_{$form_id}" )
	132	+ 'give_form_user_register_hash' => wp_create_nonce( "give_form_create_user_nonce_{$form_id}" ),
114	133	);
115	134
116	135	/**
117	136	* Filter the ajax request data
		@@ -116,9 +135,8 @@
116	135	/**
117	136	* Filter the ajax request data
118	137	*
119	138	* @since 2.2.0
120		- *
121	139	*/
122	140	$data = apply_filters( 'give_donation_form_reset_all_nonce_data', $data );
123	141
124	142	// Send nonce json data.
		@@ -127,13 +145,14 @@
127	145
128	146	wp_send_json_error();
129	147	}
130	148
131		-add_action( 'wp_ajax_give_donation_form_reset_all_nonce', '__give_donation_form_reset_all_nonce' );
132		-add_action( 'wp_ajax_nopriv_give_donation_form_reset_all_nonce', '__give_donation_form_reset_all_nonce' );
	149	+add_action( 'wp_ajax_give_donation_form_reset_all_nonce', 'give_donation_form_reset_all_nonce');
	150	+add_action( 'wp_ajax_nopriv_give_donation_form_reset_all_nonce', 'give_donation_form_reset_all_nonce');
133	151
134	152	/**
135	153	* Sets an error within the donation form if no gateways are enabled.
	154	+ *
136	155	* @todo: we can deprecate this function in future because gateways will not empty if get via Give API.
137	156	*
138	157	* @since 1.0
139	158	*