← All changes | includes/widgets/Form_Builder/helpers/Upload_Email_File.php +18 -6 51.1.37 → 51.1.83 View file →

		@@ -254,22 +254,34 @@
254	254	return $mime_type;
255	255	}
256	256
257	257	/**
258		- * AJAX handler for generating fresh nonce
259		- * Security fix: Provides dynamic nonce generation instead of public exposure
	258	+ * AJAX handler for generating a fresh form nonce.
	259	+ *
	260	+ * This nonce is a CSRF token for Form Builder AJAX. It is not authorization
	261	+ * to read or change a submission: payment reuse requires the per-submission
	262	+ * access secret issued when that submission was created.
	263	+ *
	264	+ * Requires a published page that actually contains the Form Builder widget.
	265	+ * A bare form_public flag is not accepted.
	266	+ *
	267	+ * @return void
260	268	*/
261	269	public function get_fresh_nonce()
262	270	{
263		- // Only allow if user has upload permissions or if it's a public form
264		- if (!current_user_can('upload_files') && !isset($_POST['form_public'])) {
265		- wp_send_json_error(['message' => 'Insufficient permissions']);
	271	+ $page_id = absint($_POST['page_id'] ?? 0);
	272	+
	273	+ if (!Form_Builder_Security::page_has_form_builder($page_id)) {
	274	+ wp_send_json_error([
	275	+ 'message' => esc_html__('Insufficient permissions.', 'king-addons'),
	276	+ ]);
266	277	}
267	278
268	279	wp_send_json_success([
269	280	'nonce' => wp_create_nonce('king-addons-js'),
270		- 'timestamp' => time()
	281	+ 'timestamp' => time(),
271	282	]);
272	283	}
	284	+
273	285	}
274	286
275	287	new Upload_Email_File();