← All changes | src/BetaFeatures/Repositories/FeatureFlagRepository.php +14 -1 4.16.3 → 4.16.9 View file →

		@@ -1,8 +1,10 @@
1	1	<?php
2	2
3	3	namespace Give\BetaFeatures\Repositories;
4	4
	5	+use Give\Framework\Permissions\Facades\UserPermissions;
	6	+
5	7	class FeatureFlagRepository
6	8	{
7	9	/**
8	10	* @since 3.6.0
		@@ -37,17 +39,28 @@
37	39	update_option('givewp_feature_flag_notifications_count', 0);
38	40	}
39	41
40	42	/**
	43	+ * @since 4.16.8.1 Only trust $_POST during a verified settings-save request, not any request.
41	44	* @since 3.6.0
42	45	*/
43	46	public function enabled($feature, $default = false): bool
44	47	{
45	48	// Workaround so that the updated option is available at the start of the request.
46		- $option = isset($_POST["enable_$feature"])
	49	+ $option = ($this->isVerifiedSettingsSaveRequest() && isset($_POST["enable_$feature"]))
47	50	? give_clean($_POST["enable_$feature"])
48	51	: give_get_option("enable_$feature", $default);
49	52
50	53	return give_is_setting_enabled($option);
51	54
	55	+ }
	56	+
	57	+ /**
	58	+ * @since 4.16.8.1
	59	+ */
	60	+ private function isVerifiedSettingsSaveRequest(): bool
	61	+ {
	62	+ return UserPermissions::settings()->canManage()
	63	+ && class_exists('Give_Admin_Settings')
	64	+ && \Give_Admin_Settings::verify_nonce();
52	65	}
53	66	}