| @@ -645,9 +645,9 @@ | ||
| 645 | 645 | // Initialize or restore conversation |
| 646 | 646 | register_rest_route(self::API_NAMESPACE, '/support/conversation/init', [ |
| 647 | 647 | 'methods' => 'POST', |
| 648 | 648 | 'callback' => [$this, 'rest_init_conversation'], |
| 649 | - 'permission_callback' => '__return_true', | |
| 649 | + 'permission_callback' => [$this, 'can_access_public_rest'], | |
| 650 | 650 | ]); |
| 651 | 651 | |
| 652 | 652 | // Send message |
| 653 | 653 | register_rest_route(self::API_NAMESPACE, '/support/message/send', [ |
| @@ -652,9 +652,9 @@ | ||
| 652 | 652 | // Send message |
| 653 | 653 | register_rest_route(self::API_NAMESPACE, '/support/message/send', [ |
| 654 | 654 | 'methods' => 'POST', |
| 655 | 655 | 'callback' => [$this, 'rest_send_message'], |
| 656 | - 'permission_callback' => '__return_true', | |
| 656 | + 'permission_callback' => [$this, 'can_access_public_rest'], | |
| 657 | 657 | ]); |
| 658 | 658 | |
| 659 | 659 | // Poll for new messages |
| 660 | 660 | register_rest_route(self::API_NAMESPACE, '/support/messages/poll', [ |
| @@ -659,9 +659,9 @@ | ||
| 659 | 659 | // Poll for new messages |
| 660 | 660 | register_rest_route(self::API_NAMESPACE, '/support/messages/poll', [ |
| 661 | 661 | 'methods' => 'GET', |
| 662 | 662 | 'callback' => [$this, 'rest_poll_messages'], |
| 663 | - 'permission_callback' => '__return_true', | |
| 663 | + 'permission_callback' => [$this, 'can_access_public_rest'], | |
| 664 | 664 | ]); |
| 665 | 665 | |
| 666 | 666 | // Mark messages as read |
| 667 | 667 | register_rest_route(self::API_NAMESPACE, '/support/messages/read', [ |
| @@ -666,9 +666,9 @@ | ||
| 666 | 666 | // Mark messages as read |
| 667 | 667 | register_rest_route(self::API_NAMESPACE, '/support/messages/read', [ |
| 668 | 668 | 'methods' => 'POST', |
| 669 | 669 | 'callback' => [$this, 'rest_mark_read'], |
| 670 | - 'permission_callback' => '__return_true', | |
| 670 | + 'permission_callback' => [$this, 'can_access_public_rest'], | |
| 671 | 671 | ]); |
| 672 | 672 | |
| 673 | 673 | // Contact Form submission |
| 674 | 674 | register_rest_route(self::API_NAMESPACE, '/support/contact', [ |
| @@ -673,12 +673,19 @@ | ||
| 673 | 673 | // Contact Form submission |
| 674 | 674 | register_rest_route(self::API_NAMESPACE, '/support/contact', [ |
| 675 | 675 | 'methods' => 'POST', |
| 676 | 676 | 'callback' => [$this, 'rest_submit_contact_form'], |
| 677 | - 'permission_callback' => '__return_true', | |
| 677 | + 'permission_callback' => [$this, 'can_access_public_rest'], | |
| 678 | 678 | ]); |
| 679 | 679 | } |
| 680 | 680 | |
| 681 | + public function can_access_public_rest(\WP_REST_Request $request): bool | |
| 682 | + { | |
| 683 | + $nonce = $request->get_header('X-WP-Nonce'); | |
| 684 | + | |
| 685 | + return is_string($nonce) && wp_verify_nonce($nonce, 'wp_rest'); | |
| 686 | + } | |
| 687 | + | |
| 681 | 688 | /** |
| 682 | 689 | * REST: Submit contact form (Contact Form mode). |
| 683 | 690 | * |
| 684 | 691 | * @param \WP_REST_Request $request Request object. |
| @@ -992,13 +999,22 @@ | ||
| 992 | 999 | |
| 993 | 1000 | $table = $wpdb->prefix . self::TABLE_CONVERSATIONS; |
| 994 | 1001 | $messages_table = $wpdb->prefix . self::TABLE_MESSAGES; |
| 995 | 1002 | |
| 996 | - // Verify and update | |
| 1003 | + $conv = $wpdb->get_row($wpdb->prepare( | |
| 1004 | + "SELECT id FROM $table WHERE id = %d AND visitor_id = %s", | |
| 1005 | + $conversation_id, | |
| 1006 | + $visitor_id | |
| 1007 | + )); | |
| 1008 | + | |
| 1009 | + if (!$conv) { | |
| 1010 | + return new \WP_REST_Response(['success' => false], 403); | |
| 1011 | + } | |
| 1012 | + | |
| 997 | 1013 | $updated = $wpdb->update( |
| 998 | 1014 | $table, |
| 999 | 1015 | ['unread_visitor' => 0], |
| 1000 | - ['id' => $conversation_id, 'visitor_id' => $visitor_id] | |
| 1016 | + ['id' => $conversation_id] | |
| 1001 | 1017 | ); |
| 1002 | 1018 | |
| 1003 | 1019 | // Mark admin messages as read |
| 1004 | 1020 | $wpdb->query($wpdb->prepare( |
