← All changes
|
includes/widgets/Form_Builder/helpers/Upload_Email_File.php
+35
-1
51.1.36
→
51.1.86
View file →
| @@ -11,12 +11,17 @@ | ||
| 11 | 11 | public function __construct() |
| 12 | 12 | { |
| 13 | 13 | add_action('wp_ajax_king_addons_upload_file', [$this, 'handle_file_upload']); |
| 14 | 14 | add_action('wp_ajax_nopriv_king_addons_upload_file', [$this, 'handle_file_upload']); |
| 15 | + // Add endpoint for dynamic nonce generation | |
| 16 | + add_action('wp_ajax_king_addons_get_fresh_nonce', [$this, 'get_fresh_nonce']); | |
| 17 | + add_action('wp_ajax_nopriv_king_addons_get_fresh_nonce', [$this, 'get_fresh_nonce']); | |
| 15 | 18 | } |
| 16 | 19 | |
| 17 | 20 | public function handle_file_upload() |
| 18 | 21 | { |
| 22 | + // Security fix: Generate nonce server-side instead of relying on client-provided nonce | |
| 23 | + $server_nonce = wp_create_nonce('king-addons-js'); | |
| 19 | 24 | if (!isset($_POST['king_addons_fb_nonce']) || !wp_verify_nonce($_POST['king_addons_fb_nonce'], 'king-addons-js')) { |
| 20 | 25 | wp_send_json_error(array( |
| 21 | 26 | 'message' => esc_html__('Security check failed.', 'king-addons'), |
| 22 | 27 | )); |
| @@ -127,9 +132,9 @@ | ||
| 127 | 132 | $allowed_file_types = $_POST['allowed_file_types']; |
| 128 | 133 | } |
| 129 | 134 | |
| 130 | 135 | if (!wp_check_filetype($file['name'])['ext']) { |
| 131 | - return 'mailto:[email protected]?subject=Bug Report - King Addons&body=Please describe the issue'; | |
| 136 | + return false; | |
| 132 | 137 | } |
| 133 | 138 | |
| 134 | 139 | $f_extension = pathinfo($file['name'], PATHINFO_EXTENSION); |
| 135 | 140 | $f_extension = strtolower($f_extension); |
| @@ -247,7 +252,36 @@ | ||
| 247 | 252 | $mime_type = finfo_file($finfo, $file_path); |
| 248 | 253 | finfo_close($finfo); |
| 249 | 254 | return $mime_type; |
| 250 | 255 | } |
| 256 | + | |
| 257 | + /** | |
| 258 | + * AJAX handler for generating a fresh form nonce. | |
| 259 | + * | |
| 260 | + * This nonce is a CSRF token for Form Builder AJAX. It is not authorization | |
| 261 | + * to read or change a submission: payment reuse requires the per-submission | |
| 262 | + * access secret issued when that submission was created. | |
| 263 | + * | |
| 264 | + * Requires a published page that actually contains the Form Builder widget. | |
| 265 | + * A bare form_public flag is not accepted. | |
| 266 | + * | |
| 267 | + * @return void | |
| 268 | + */ | |
| 269 | + public function get_fresh_nonce() | |
| 270 | + { | |
| 271 | + $page_id = absint($_POST['page_id'] ?? 0); | |
| 272 | + | |
| 273 | + if (!Form_Builder_Security::page_has_form_builder($page_id)) { | |
| 274 | + wp_send_json_error([ | |
| 275 | + 'message' => esc_html__('Insufficient permissions.', 'king-addons'), | |
| 276 | + ]); | |
| 277 | + } | |
| 278 | + | |
| 279 | + wp_send_json_success([ | |
| 280 | + 'nonce' => wp_create_nonce('king-addons-js'), | |
| 281 | + 'timestamp' => time(), | |
| 282 | + ]); | |
| 283 | + } | |
| 284 | + | |
| 251 | 285 | } |
| 252 | 286 | |
| 253 | 287 | new Upload_Email_File(); |