← All changes | modules/oauth/components/connect.php +11 -11 1.5.0 → 1.7.7 View file →

		@@ -45,9 +45,9 @@
45	45	* maybe_handle_admin_connect_page
46	46	* @return bool
47	47	*/
48	48	public static function maybe_handle_admin_connect_page(): bool {
49		- if ( ! isset( $_GET['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['nonce'] ) ), 'nonce_actionget_token' ) ) {
	49	+ if ( ! isset( $_GET['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['nonce'] ) ), 'get_token' ) ) {
50	50	return false;
51	51	}
52	52
53	53	$args = [
		@@ -79,9 +79,9 @@
79	79	return;
80	80	}
81	81
82	82	// validate nonce
83		- if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['nonce'] ) ), 'nonce_actionget_token' ) ) {
	83	+ if ( empty( $_GET['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['nonce'] ) ), 'get_token' ) ) {
84	84	wp_die( 'Nonce verification failed', 'image-optimization' );
85	85	}
86	86
87	87	$token_response = wp_remote_request( self::API_URL . '/get_token', [
		@@ -89,14 +89,14 @@
89	89	'body' => [
90	90	'app' => 'library',
91	91	'grant_type' => 'authorization_code',
92	92	'client_id' => Data::get_client_id(),
93		- 'code' => sanitize_text_field( $_GET['code'] ),
	93	+ 'code' => isset( $_GET['code'] ) ? sanitize_text_field( wp_unslash( $_GET['code'] ) ) : null,
94	94	],
95	95	] );
96	96
97	97	if ( is_wp_error( $token_response ) ) {
98		- wp_die( $token_response->get_error_message(), 'image-optimization' );
	98	+ wp_die( esc_html( $token_response->get_error_message() ), 'image-optimization' );
99	99	}
100	100
101	101	$data = json_decode( wp_remote_retrieve_body( $token_response ), true );
102	102	Data::set_connect_data( $data );
		@@ -140,9 +140,9 @@
140	140	Logger::LEVEL_ERROR,
141	141	'Error while sending connection initialization request: ' . $t->getMessage()
142	142	);
143	143
144		- throw new Auth_Error( $t->getMessage() );
	144	+ throw new Auth_Error( esc_html( $t->getMessage() ) );
145	145	}
146	146
147	147	$data = json_decode( wp_remote_retrieve_body( $response ) );
148	148
		@@ -170,12 +170,12 @@
170	170	'redirect_uri' => rawurlencode( add_query_arg( [
171	171	'page' => 'elementor-connect',
172	172	'app' => 'library',
173	173	'action' => 'get_token',
174		- 'nonce' => wp_create_nonce( 'nonce_action' . 'get_token' ),
	174	+ 'nonce' => wp_create_nonce( 'get_token' ),
175	175	], admin_url( 'admin.php' ) ) ),
176	176	'may_share_data' => 0,
177		- 'reconnect_nonce' => wp_create_nonce( 'nonce_action' . 'reconnect' ),
	177	+ 'reconnect_nonce' => wp_create_nonce( 'reconnect' ),
178	178	], Route_Base::SITE_URL . 'library' );
179	179	}
180	180
181	181	/**
		@@ -196,9 +196,9 @@
196	196	] );
197	197	} catch ( Throwable $t ) {
198	198	Logger::log( Logger::LEVEL_ERROR, 'Error while sending disconnection request: ' . $t->getMessage() );
199	199
200		- throw new Auth_Error( $t->getMessage() );
	200	+ throw new Auth_Error( esc_html( $t->getMessage() ) );
201	201	} finally {
202	202	Data::reset();
203	203	}
204	204	}
		@@ -221,9 +221,9 @@
221	221	);
222	222	} catch ( Throwable $t ) {
223	223	Logger::log( Logger::LEVEL_ERROR, 'Error while sending activation request: ' . $t->getMessage() );
224	224
225		- throw new Auth_Error( $t->getMessage() );
	225	+ throw new Auth_Error( esc_html( $t->getMessage() ) );
226	226	}
227	227
228	228	if ( ! isset( $response->id ) ) {
229	229	Logger::log( Logger::LEVEL_ERROR, 'Invalid response from server' );
		@@ -261,9 +261,9 @@
261	261	);
262	262	} catch ( Throwable $t ) {
263	263	Logger::log( Logger::LEVEL_ERROR, 'Error while sending deactivation request: ' . $t->getMessage() );
264	264
265		- throw new Auth_Error( $t->getMessage() );
	265	+ throw new Auth_Error( esc_html( $t->getMessage() ) );
266	266	} finally {
267	267	Data::delete_activation_state();
268	268	}
269	269
		@@ -291,9 +291,9 @@
291	291	);
292	292	} catch ( Throwable $t ) {
293	293	Logger::log( Logger::LEVEL_ERROR, 'Error while fetching subscriptions: ' . $t->getMessage() );
294	294
295		- throw new Auth_Error( $t->getMessage() );
	295	+ throw new Auth_Error( esc_html( $t->getMessage() ) );
296	296	}
297	297
298	298	if ( ! isset( $response->subscriptions ) ) {
299	299	Logger::log( Logger::LEVEL_ERROR, 'Invalid response from server' );