← All changes | includes/gateways/actions.php +22 -3 2.30.0 → 4.16.9 View file →

		@@ -13,8 +13,11 @@
13	13	if ( ! defined( 'ABSPATH' ) ) {
14	14	exit;
15	15	}
16	16
	17	+use Give\Helpers\Form\Utils as FormUtils;
	18	+use Give\Helpers\Frontend\Shortcode as ShortcodeUtils;
	19	+
17	20	/**
18	21	* Processes gateway select on checkout. Only for users without ajax / javascript
19	22	*
20	23	* @since 1.0
		@@ -74,8 +77,9 @@
74	77	* Create wp nonce using Ajax call.
75	78	*
76	79	* Use give_donation_form_nonce() js fn to create nonce.
77	80	*
	81	+ * @since 4.16.6 Bail early when the form ID is not a give_forms post or is a Visual Form Builder (v3) form.
78	82	* @since 2.0
79	83	*
80	84	* @return void
81	85	*/
		@@ -84,8 +88,17 @@
84	88
85	89	// Get donation form id.
86	90	$form_id = is_numeric( $_POST['give_form_id'] ) ? absint( $_POST['give_form_id'] ) : 0;
87	91
	92	+ if ( ! ShortcodeUtils::isValidForm( $form_id ) ) {
	93	+ wp_send_json_error( [ 'error' => 'give_invalid_donation_form' ], 400 );
	94	+ }
	95	+
	96	+ // Visual Form Builder (v3) forms use route signatures instead of the legacy nonce endpoint.
	97	+ if ( FormUtils::isV3Form( $form_id ) ) {
	98	+ wp_send_json_error( [ 'error' => 'give_unsupported_form_version' ], 400 );
	99	+ }
	100	+
88	101	// Send nonce json data.
89	102	wp_send_json_success( wp_create_nonce( "give_donation_form_nonce_{$form_id}" ) );
90	103	}
91	104	}
		@@ -97,18 +110,24 @@
97	110	/**
98	111	* Create all nonce of donation form using Ajax call.
99	112	* Note: only for internal use
100	113	*
	114	+ * @since 4.16.6 Bail early when the form ID is not a give_forms post.
	115	+ * @since 4.9.0 rename function - PHP 8 compatibility
101	116	* @since 2.2.0
102	117	*
103	118	* @return void
104	119	*/
105		-function __give_donation_form_reset_all_nonce() {
	120	+function give_donation_form_reset_all_nonce() {
106	121	if ( isset( $_POST['give_form_id'] ) ) {
107	122
108	123	// Get donation form id.
109	124	$form_id = is_numeric( $_POST['give_form_id'] ) ? absint( $_POST['give_form_id'] ) : 0;
110	125
	126	+ if ( ! ShortcodeUtils::isValidForm( $form_id ) ) {
	127	+ wp_send_json_error( [ 'error' => 'give_invalid_donation_form' ], 400 );
	128	+ }
	129	+
111	130	$data = array(
112	131	'give_form_hash' => wp_create_nonce( "give_donation_form_nonce_{$form_id}" ),
113	132	'give_form_user_register_hash' => wp_create_nonce( "give_form_create_user_nonce_{$form_id}" ),
114	133	);
		@@ -126,10 +145,10 @@
126	145
127	146	wp_send_json_error();
128	147	}
129	148
130		-add_action( 'wp_ajax_give_donation_form_reset_all_nonce', '__give_donation_form_reset_all_nonce' );
131		-add_action( 'wp_ajax_nopriv_give_donation_form_reset_all_nonce', '__give_donation_form_reset_all_nonce' );
	149	+add_action( 'wp_ajax_give_donation_form_reset_all_nonce', 'give_donation_form_reset_all_nonce');
	150	+add_action( 'wp_ajax_nopriv_give_donation_form_reset_all_nonce', 'give_donation_form_reset_all_nonce');
132	151
133	152	/**
134	153	* Sets an error within the donation form if no gateways are enabled.
135	154	*