← All changes | includes/gateways/actions.php +18 -0 4.16.5 → 4.16.9 View file →

		@@ -13,8 +13,11 @@
13	13	if ( ! defined( 'ABSPATH' ) ) {
14	14	exit;
15	15	}
16	16
	17	+use Give\Helpers\Form\Utils as FormUtils;
	18	+use Give\Helpers\Frontend\Shortcode as ShortcodeUtils;
	19	+
17	20	/**
18	21	* Processes gateway select on checkout. Only for users without ajax / javascript
19	22	*
20	23	* @since 1.0
		@@ -74,8 +77,9 @@
74	77	* Create wp nonce using Ajax call.
75	78	*
76	79	* Use give_donation_form_nonce() js fn to create nonce.
77	80	*
	81	+ * @since 4.16.6 Bail early when the form ID is not a give_forms post or is a Visual Form Builder (v3) form.
78	82	* @since 2.0
79	83	*
80	84	* @return void
81	85	*/
		@@ -84,8 +88,17 @@
84	88
85	89	// Get donation form id.
86	90	$form_id = is_numeric( $_POST['give_form_id'] ) ? absint( $_POST['give_form_id'] ) : 0;
87	91
	92	+ if ( ! ShortcodeUtils::isValidForm( $form_id ) ) {
	93	+ wp_send_json_error( [ 'error' => 'give_invalid_donation_form' ], 400 );
	94	+ }
	95	+
	96	+ // Visual Form Builder (v3) forms use route signatures instead of the legacy nonce endpoint.
	97	+ if ( FormUtils::isV3Form( $form_id ) ) {
	98	+ wp_send_json_error( [ 'error' => 'give_unsupported_form_version' ], 400 );
	99	+ }
	100	+
88	101	// Send nonce json data.
89	102	wp_send_json_success( wp_create_nonce( "give_donation_form_nonce_{$form_id}" ) );
90	103	}
91	104	}
		@@ -97,8 +110,9 @@
97	110	/**
98	111	* Create all nonce of donation form using Ajax call.
99	112	* Note: only for internal use
100	113	*
	114	+ * @since 4.16.6 Bail early when the form ID is not a give_forms post.
101	115	* @since 4.9.0 rename function - PHP 8 compatibility
102	116	* @since 2.2.0
103	117	*
104	118	* @return void
		@@ -107,8 +121,12 @@
107	121	if ( isset( $_POST['give_form_id'] ) ) {
108	122
109	123	// Get donation form id.
110	124	$form_id = is_numeric( $_POST['give_form_id'] ) ? absint( $_POST['give_form_id'] ) : 0;
	125	+
	126	+ if ( ! ShortcodeUtils::isValidForm( $form_id ) ) {
	127	+ wp_send_json_error( [ 'error' => 'give_invalid_donation_form' ], 400 );
	128	+ }
111	129
112	130	$data = array(
113	131	'give_form_hash' => wp_create_nonce( "give_donation_form_nonce_{$form_id}" ),
114	132	'give_form_user_register_hash' => wp_create_nonce( "give_form_create_user_nonce_{$form_id}" ),