← All changes | modules/security/csrf/module.php +20 -10 3.6.1 → 3.6.6 View file →

		@@ -23,10 +23,9 @@
23	23	use Base_Module_Dir_Trait;
24	24	use Base_Module_Url_Trait;
25	25	use Base_Module_Handle_Trait;
26	26
27		- private $token;
28		- private $client;
	27	+ private $client_id = '';
29	28
30	29	public function rep_item_id() {
31	30	return 'csrf';
32	31	}
		@@ -74,31 +73,42 @@
74	73	if ( ! jet_fb_live_args()->is_use_csrf() ) {
75	74	return $request;
76	75	}
77	76
78		- $this->token = $request[ Csrf_Tools::FIELD ] ?? false;
79		- $this->client = Csrf_Tools::client_id( jet_fb_live()->form_id );
	77	+ $token = $request[ Csrf_Tools::FIELD ] ?? false;
	78	+ $this->client_id = Csrf_Tools::client_id( jet_fb_live()->form_id );
80	79
81	80	// delete all old tokens
82	81	Csrf_Token_Model::clear();
83	82
84		- if ( ! Csrf_Tools::verify( $this->token, $this->client ) ) {
	83	+ if ( ! Csrf_Tools::consume( $token, $this->client_id ) ) {
85	84	// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
86	85	throw new Spam_Exception( self::SPAM_EXCEPTION );
87	86	}
88	87
89		- // delete verified token only on success
90		- add_action( 'jet-form-builder/form-handler/after-send', array( $this, 'handle_after_send' ) );
	88	+ add_action( 'jet-form-builder/form-handler/after-send', array( $this, 'handle_after_send' ), 10, 2 );
91	89
92	90	return $request;
93	91	}
94	92
95		- public function handle_after_send() {
96		- if ( ! jet_fb_handler()->is_success ) {
	93	+ public function handle_after_send( $handler, bool $is_success ) {
	94	+ remove_action( 'jet-form-builder/form-handler/after-send', array( $this, 'handle_after_send' ), 10 );
	95	+
	96	+ if ( ! $handler->is_ajax() ) {
97	97	return;
98	98	}
99	99
100		- Csrf_Tools::delete( $this->token, $this->client );
	100	+ try {
	101	+ $token = Csrf_Tools::add( Csrf_Tools::generate(), $this->client_id );
	102	+ } catch ( \Exception $exception ) {
	103	+ return;
	104	+ }
	105	+
	106	+ $handler->add_response_data(
	107	+ array(
	108	+ Csrf_Tools::FIELD => $token,
	109	+ )
	110	+ );
101	111	}
102	112
103	113	public function handle_messages( array $messages ): array {
104	114	$messages[ self::SPAM_EXCEPTION ] = array(