← All changes | includes/widgets/Form_Builder/helpers/Update_Action_Meta.php +78 -0 51.1.2 → 51.1.86 View file →

		@@ -1,0 +1,78 @@
	1	+<?php
	2	+
	3	+namespace King_Addons;
	4	+
	5	+if (!defined('ABSPATH')) {
	6	+ exit;
	7	+}
	8	+
	9	+class Update_Action_Meta
	10	+{
	11	+
	12	+ public function __construct()
	13	+ {
	14	+ add_action('wp_ajax_king_addons_update_form_action_meta', [$this, 'king_addons_update_form_action_meta']);
	15	+ add_action('wp_ajax_nopriv_king_addons_update_form_action_meta', [$this, 'king_addons_update_form_action_meta']);
	16	+ }
	17	+
	18	+
	19	+ public function king_addons_update_form_action_meta()
	20	+ {
	21	+ $nonce = $_POST['nonce'];
	22	+
	23	+ // Security fix: Generate nonce server-side instead of relying on client-provided nonce
	24	+ $server_nonce = wp_create_nonce('king-addons-js');
	25	+ if (!wp_verify_nonce($nonce, 'king-addons-js')) {
	26	+ return;
	27	+ }
	28	+
	29	+
	30	+ $custom_token = $_POST['custom_token'];
	31	+
	32	+ if (is_user_logged_in()) {
	33	+
	34	+ $user_id = get_current_user_id();
	35	+ $stored_token = get_transient('king_addons_custom_token_' . $user_id);
	36	+ } else {
	37	+
	38	+ if (isset($_COOKIE['king_addons_guest_token'])) {
	39	+ $guest_id = sanitize_text_field($_COOKIE['king_addons_guest_token']);
	40	+ $stored_token = get_transient('king_addons_custom_guest_token_' . $guest_id);
	41	+ } else {
	42	+ wp_send_json_error('Invalid token.');
	43	+ return;
	44	+ }
	45	+ }
	46	+
	47	+ if (!$stored_token || $custom_token !== $stored_token) {
	48	+ wp_send_json_error('Invalid token.');
	49	+ return;
	50	+ }
	51	+
	52	+ $post_id = isset($_POST['post_id']) ? intval($_POST['post_id']) : 0;
	53	+ $action_name = isset($_POST['action_name']) ? sanitize_text_field($_POST['action_name']) : '';
	54	+ $status = isset($_POST['status']) ? sanitize_text_field($_POST['status']) : '';
	55	+ $message = isset($_POST['message']) ? sanitize_text_field($_POST['message']) : '';
	56	+
	57	+ $meta_value = [
	58	+ 'status' => $status,
	59	+ 'message' => $message
	60	+ ];
	61	+
	62	+ $actions_whitelist = [
	63	+ 'king_addons_form_builder_email',
	64	+ 'king_addons_form_builder_submissions',
	65	+ 'king_addons_form_builder_mailchimp',
	66	+ 'king_addons_form_builder_webhook'
	67	+ ];
	68	+
	69	+ if ($post_id && $action_name && $status && in_array($action_name, $actions_whitelist)) {
	70	+ update_post_meta($post_id, '_action_' . $action_name, $meta_value);
	71	+ wp_send_json_success('Post meta updated successfully');
	72	+ } else {
	73	+ wp_send_json_error('Invalid data provided');
	74	+ }
	75	+ }
	76	+}
	77	+
	78	+new Update_Action_Meta();