← All changes | modules/oauth/components/connect.php +15 -14 1.2.0 → trunk View file →

		@@ -45,9 +45,9 @@
45	45	* maybe_handle_admin_connect_page
46	46	* @return bool
47	47	*/
48	48	public static function maybe_handle_admin_connect_page(): bool {
49		- if ( ! isset( $_GET['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['nonce'] ) ), 'nonce_actionget_token' ) ) {
	49	+ if ( ! isset( $_GET['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['nonce'] ) ), 'get_token' ) ) {
50	50	return false;
51	51	}
52	52
53	53	$args = [
		@@ -79,9 +79,9 @@
79	79	return;
80	80	}
81	81
82	82	// validate nonce
83		- if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['nonce'] ) ), 'nonce_actionget_token' ) ) {
	83	+ if ( empty( $_GET['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['nonce'] ) ), 'get_token' ) ) {
84	84	wp_die( 'Nonce verification failed', 'image-optimization' );
85	85	}
86	86
87	87	$token_response = wp_remote_request( self::API_URL . '/get_token', [
		@@ -89,14 +89,14 @@
89	89	'body' => [
90	90	'app' => 'library',
91	91	'grant_type' => 'authorization_code',
92	92	'client_id' => Data::get_client_id(),
93		- 'code' => sanitize_text_field( $_GET['code'] ),
	93	+ 'code' => isset( $_GET['code'] ) ? sanitize_text_field( wp_unslash( $_GET['code'] ) ) : null,
94	94	],
95	95	] );
96	96
97	97	if ( is_wp_error( $token_response ) ) {
98		- wp_die( $token_response->get_error_message(), 'image-optimization' );
	98	+ wp_die( esc_html( $token_response->get_error_message() ), 'image-optimization' );
99	99	}
100	100
101	101	$data = json_decode( wp_remote_retrieve_body( $token_response ), true );
102	102	Data::set_connect_data( $data );
		@@ -140,9 +140,9 @@
140	140	Logger::LEVEL_ERROR,
141	141	'Error while sending connection initialization request: ' . $t->getMessage()
142	142	);
143	143
144		- throw new Auth_Error( $t->getMessage() );
	144	+ throw new Auth_Error( esc_html( $t->getMessage() ) );
145	145	}
146	146
147	147	$data = json_decode( wp_remote_retrieve_body( $response ) );
148	148
		@@ -170,12 +170,12 @@
170	170	'redirect_uri' => rawurlencode( add_query_arg( [
171	171	'page' => 'elementor-connect',
172	172	'app' => 'library',
173	173	'action' => 'get_token',
174		- 'nonce' => wp_create_nonce( 'nonce_action' . 'get_token' ),
	174	+ 'nonce' => wp_create_nonce( 'get_token' ),
175	175	], admin_url( 'admin.php' ) ) ),
176	176	'may_share_data' => 0,
177		- 'reconnect_nonce' => wp_create_nonce( 'nonce_action' . 'reconnect' ),
	177	+ 'reconnect_nonce' => wp_create_nonce( 'reconnect' ),
178	178	], Route_Base::SITE_URL . 'library' );
179	179	}
180	180
181	181	/**
		@@ -181,10 +181,8 @@
181	181	/**
182	182	* Disconnects a user and removes connection data from the DB.
183	183	*/
184	184	public static function disconnect() {
185		- Data::reset();
186		-
187	185	do_action( Checkpoint::ON_DISCONNECT );
188	186
189	187	try {
190	188	return wp_remote_request( self::API_URL . '/disconnect', [
		@@ -198,9 +196,11 @@
198	196	] );
199	197	} catch ( Throwable $t ) {
200	198	Logger::log( Logger::LEVEL_ERROR, 'Error while sending disconnection request: ' . $t->getMessage() );
201	199
202		- throw new Auth_Error( $t->getMessage() );
	200	+ throw new Auth_Error( esc_html( $t->getMessage() ) );
	201	+ } finally {
	202	+ Data::reset();
203	203	}
204	204	}
205	205
206	206	/**
		@@ -221,9 +221,9 @@
221	221	);
222	222	} catch ( Throwable $t ) {
223	223	Logger::log( Logger::LEVEL_ERROR, 'Error while sending activation request: ' . $t->getMessage() );
224	224
225		- throw new Auth_Error( $t->getMessage() );
	225	+ throw new Auth_Error( esc_html( $t->getMessage() ) );
226	226	}
227	227
228	228	if ( ! isset( $response->id ) ) {
229	229	Logger::log( Logger::LEVEL_ERROR, 'Invalid response from server' );
		@@ -247,9 +247,8 @@
247	247	*
248	248	* @throws Auth_Error
249	249	*/
250	250	public static function deactivate( string $license_key ) {
251		- Data::delete_activation_state();
252	251
253	252	do_action( Checkpoint::ON_DEACTIVATE, $license_key );
254	253
255	254	try {
		@@ -262,9 +261,11 @@
262	261	);
263	262	} catch ( Throwable $t ) {
264	263	Logger::log( Logger::LEVEL_ERROR, 'Error while sending deactivation request: ' . $t->getMessage() );
265	264
266		- throw new Auth_Error( $t->getMessage() );
	265	+ throw new Auth_Error( esc_html( $t->getMessage() ) );
	266	+ } finally {
	267	+ Data::delete_activation_state();
267	268	}
268	269
269	270	if ( ! isset( $response->id ) ) {
270	271	Logger::log( Logger::LEVEL_ERROR, 'Invalid response from server' );
		@@ -290,9 +291,9 @@
290	291	);
291	292	} catch ( Throwable $t ) {
292	293	Logger::log( Logger::LEVEL_ERROR, 'Error while fetching subscriptions: ' . $t->getMessage() );
293	294
294		- throw new Auth_Error( $t->getMessage() );
	295	+ throw new Auth_Error( esc_html( $t->getMessage() ) );
295	296	}
296	297
297	298	if ( ! isset( $response->subscriptions ) ) {
298	299	Logger::log( Logger::LEVEL_ERROR, 'Invalid response from server' );