| @@ -252,12 +252,15 @@ | ||
| 252 | 252 | |
| 253 | 253 | /** |
| 254 | 254 | * Handle installation and connection for SendWP via ajax |
| 255 | 255 | * |
| 256 | + * @since 2.33.4 added nonce check | |
| 256 | 257 | * @since 2.9.15 |
| 257 | 258 | */ |
| 258 | 259 | function give_sendwp_remote_install_handler () { |
| 259 | 260 | |
| 261 | + check_ajax_referer( 'give_sendwp_remote_install'); | |
| 262 | + | |
| 260 | 263 | if ( ! current_user_can( 'manage_give_settings' ) ) { |
| 261 | 264 | wp_send_json_error( array( |
| 262 | 265 | 'error' => __( 'You do not have permission to do this.', 'give' ) |
| 263 | 266 | ) ); |
| @@ -327,11 +330,14 @@ | ||
| 327 | 330 | |
| 328 | 331 | /** |
| 329 | 332 | * Handle deactivation of SendWP via ajax |
| 330 | 333 | * |
| 334 | + * @since 2.33.4 add nonce check | |
| 331 | 335 | * @since 2.9.15 |
| 332 | 336 | */ |
| 333 | 337 | function give_sendwp_disconnect () { |
| 338 | + | |
| 339 | + check_ajax_referer( 'give_sendwp_disconnect'); | |
| 334 | 340 | |
| 335 | 341 | if ( ! current_user_can( 'manage_give_settings' ) ) { |
| 336 | 342 | wp_send_json_error( array( |
| 337 | 343 | 'error' => __( 'You do not have permission to do this.', 'give' ) |
