| 1 |
<?php |
| 2 |
|
| 3 |
namespace King_Addons; |
| 4 |
|
| 5 |
if (!defined('ABSPATH')) { |
| 6 |
exit; |
| 7 |
} |
| 8 |
|
| 9 |
class Create_Submission |
| 10 |
{ |
| 11 |
|
| 12 |
public function __construct() |
| 13 |
{ |
| 14 |
add_action('wp_ajax_king_addons_form_builder_submissions', [$this, 'add_to_submissions']); |
| 15 |
add_action('wp_ajax_nopriv_king_addons_form_builder_submissions', [$this, 'add_to_submissions']); |
| 16 |
add_action('save_post', [$this, 'update_submissions_post_meta']); |
| 17 |
} |
| 18 |
|
| 19 |
public function add_to_submissions() |
| 20 |
{ |
| 21 |
|
| 22 |
$nonce = $_POST['nonce']; |
| 23 |
|
| 24 |
// Security fix: Generate nonce server-side instead of relying on client-provided nonce |
| 25 |
$server_nonce = wp_create_nonce('king-addons-js'); |
| 26 |
if (!wp_verify_nonce($nonce, 'king-addons-js')) { |
| 27 |
wp_send_json_error(array( |
| 28 |
'message' => esc_html__('Security check failed.', 'king-addons'), |
| 29 |
)); |
| 30 |
} |
| 31 |
|
| 32 |
// Add capability check |
| 33 |
if (!current_user_can('read')) { |
| 34 |
wp_send_json_error(array( |
| 35 |
'message' => esc_html__('Insufficient permissions.', 'king-addons'), |
| 36 |
)); |
| 37 |
} |
| 38 |
|
| 39 |
$new = [ |
| 40 |
'post_status' => 'publish', |
| 41 |
'post_type' => 'king-addons-fb-sub' |
| 42 |
]; |
| 43 |
|
| 44 |
$post_id = wp_insert_post($new); |
| 45 |
|
| 46 |
// Security fix: Validate and sanitize form_content before saving to database |
| 47 |
$form_content = isset($_POST['form_content']) && is_array($_POST['form_content']) ? $_POST['form_content'] : []; |
| 48 |
|
| 49 |
foreach ($form_content as $key => $value) { |
| 50 |
if (!is_array($value) || count($value) < 3) { |
| 51 |
continue; // Skip malformed fields |
| 52 |
} |
| 53 |
|
| 54 |
// Sanitize all form field data before saving |
| 55 |
$sanitized_key = sanitize_key($key); |
| 56 |
$sanitized_value = [ |
| 57 |
sanitize_text_field($value[0]), // field type |
| 58 |
is_array($value[1]) ? array_map('sanitize_text_field', $value[1]) : sanitize_text_field($value[1]), // field value |
| 59 |
sanitize_text_field($value[2]) // field label |
| 60 |
]; |
| 61 |
|
| 62 |
update_post_meta($post_id, $sanitized_key, $sanitized_value); |
| 63 |
} |
| 64 |
|
| 65 |
$sanitized_form_name = sanitize_text_field($_POST['form_name'] ?? ''); |
| 66 |
$sanitized_form_id = sanitize_text_field($_POST['form_id'] ?? ''); |
| 67 |
$sanitized_form_page = sanitize_text_field($_POST['form_page'] ?? ''); |
| 68 |
$sanitized_form_page_id = sanitize_text_field($_POST['form_page_id'] ?? ''); |
| 69 |
|
| 70 |
update_post_meta($post_id, 'king_addons_form_name', $sanitized_form_name); |
| 71 |
update_post_meta($post_id, 'king_addons_form_id', $sanitized_form_id); |
| 72 |
update_post_meta($post_id, 'king_addons_form_page', $sanitized_form_page); |
| 73 |
update_post_meta($post_id, 'king_addons_form_page_id', $sanitized_form_page_id); |
| 74 |
update_post_meta($post_id, 'king_addons_user_agent', sanitize_textarea_field(wp_unslash($_SERVER['HTTP_USER_AGENT']))); |
| 75 |
update_post_meta($post_id, 'king_addons_user_ip', Core::getClientIP()); |
| 76 |
|
| 77 |
if ($post_id) { |
| 78 |
wp_send_json_success(array( |
| 79 |
'action' => 'king_addons_form_builder_submissions', |
| 80 |
'post_id' => $post_id, |
| 81 |
'message' => esc_html__('Submission created successfully', 'king-addons'), |
| 82 |
'status' => 'success' |
| 83 |
// Security fix: Removed unsanitized form_content from response to prevent XSS |
| 84 |
)); |
| 85 |
} else { |
| 86 |
wp_send_json_success(array( |
| 87 |
'action' => 'king_addons_form_builder_submissions', |
| 88 |
'post_id' => $post_id, |
| 89 |
'message' => esc_html__('Submit action failed', 'king-addons'), |
| 90 |
'status' => 'error' |
| 91 |
)); |
| 92 |
} |
| 93 |
} |
| 94 |
|
| 95 |
public function update_submissions_post_meta($post_id) |
| 96 |
{ |
| 97 |
// Security fix: Validate nonce and capabilities |
| 98 |
if (!current_user_can('edit_post', $post_id)) { |
| 99 |
return; |
| 100 |
} |
| 101 |
|
| 102 |
if (isset($_POST['king_addons_submission_changes']) && !empty($_POST['king_addons_submission_changes'])) { |
| 103 |
// Security fix: Sanitize JSON input and validate structure |
| 104 |
$raw_changes = sanitize_textarea_field(stripslashes($_POST['king_addons_submission_changes'])); |
| 105 |
$changes = json_decode($raw_changes, true); |
| 106 |
|
| 107 |
if (!is_array($changes)) { |
| 108 |
return; // Invalid JSON structure |
| 109 |
} |
| 110 |
|
| 111 |
foreach ($changes as $key => $value) { |
| 112 |
// Security fix: Validate and sanitize keys and values |
| 113 |
$sanitized_key = sanitize_key($key); |
| 114 |
if (empty($sanitized_key)) { |
| 115 |
continue; // Skip invalid keys |
| 116 |
} |
| 117 |
|
| 118 |
// Sanitize values based on type |
| 119 |
if (is_array($value)) { |
| 120 |
$sanitized_value = array_map('sanitize_text_field', $value); |
| 121 |
} else { |
| 122 |
$sanitized_value = sanitize_text_field($value); |
| 123 |
} |
| 124 |
|
| 125 |
update_post_meta($post_id, $sanitized_key, $sanitized_value); |
| 126 |
} |
| 127 |
} |
| 128 |
} |
| 129 |
} |
| 130 |
|
| 131 |
new Create_Submission(); |
