mainwp / class / class-mainwp-post-base-handler.php

class-mainwp-post-base-handler.php in MainWP Dashboard: Self-hosted WordPress Management for Agencies 4.1, at class/class-mainwp-post-base-handler.php

136 lines 3.0 KB

Raw Download Zip

1	<?php
2	/**
3	* This class handles the security for MainWP Post.
4	*
5	* @package MainWP/Dashboard
6	*/
7
8	namespace MainWP\Dashboard;
9
10	/**
11	* Class MainWP_Post_Base_Handler
12	*
13	* @package MainWP\Dashboard
14	*/
15	abstract class MainWP_Post_Base_Handler {
16
17	/**
18	* Protected static variable to hold security nounces.
19	*
20	* @var string Security nonce.
21	*/
22	protected static $security_nonces;
23
24	/**
25	* Method init()
26	*
27	* Force Extending class to define this method.
28	*
29	* @return void
30	*/
31	abstract protected function init();
32
33
34	/**
35	* Method secure_request()
36	*
37	* Add security check to request parameter
38	*
39	* @param string $action Action to perform.
40	* @param string $query_arg Query argument.
41	*/
42	public function secure_request( $action = '', $query_arg = 'security' ) {
43	if ( ! MainWP_System_Utility::is_admin() ) {
44	die( 0 );
45	}
46	if ( '' === $action ) {
47	return;
48	}
49
50	if ( ! $this->check_security( $action, $query_arg ) ) {
51	die( wp_json_encode( array( 'error' => __( 'Invalid request!', 'mainwp' ) ) ) );
52	}
53
54	if ( isset( $_POST['dts'] ) ) {
55	$ajaxPosts = get_option( 'mainwp_ajaxposts' );
56	if ( ! is_array( $ajaxPosts ) ) {
57	$ajaxPosts = array();
58	}
59
60	// If already processed, just quit!
61	if ( isset( $ajaxPosts[ $action ] ) && ( $ajaxPosts[ $action ] == $_POST['dts'] ) ) {
62	die( wp_json_encode( array( 'error' => __( 'Double request!', 'mainwp' ) ) ) );
63	}
64
65	$ajaxPosts[ $action ] = sanitize_text_field( wp_unslash( $_POST['dts'] ) );
66	MainWP_Utility::update_option( 'mainwp_ajaxposts', $ajaxPosts );
67	}
68	}
69
70	/**
71	* Method check_security()
72	*
73	* Check security request.
74	*
75	* @param string $action Action to perform.
76	* @param string $query_arg Query argument.
77	*
78	* @return bool true or false
79	*/
80	public function check_security( $action = - 1, $query_arg = 'security' ) {
81	if ( - 1 === $action ) {
82	return false;
83	}
84
85	$adminurl = strtolower( admin_url() );
86	$referer = strtolower( wp_get_referer() );
87	$result = isset( $_REQUEST[ $query_arg ] ) ? wp_verify_nonce( sanitize_key( $_REQUEST[ $query_arg ] ), $action ) : false;
88	if ( ! $result && ! ( - 1 === $action && 0 === strpos( $referer, $adminurl ) ) ) {
89	return false;
90	}
91
92	return true;
93	}
94
95	/**
96	* Method add_action()
97	*
98	* Add ajax action.
99	*
100	* @param string $action Action to perform.
101	* @param string $callback Callback to perform.
102	*/
103	public function add_action( $action, $callback ) {
104	add_action( 'wp_ajax_' . $action, $callback );
105	$this->add_security_nonce( $action );
106	}
107
108	/**
109	* Method add_security_nonce()
110	*
111	* Add security nonce.
112	*
113	* @param string $action Action to perform.
114	*/
115	public function add_security_nonce( $action ) {
116	if ( ! is_array( self::$security_nonces ) ) {
117	self::$security_nonces = array();
118	}
119
120	if ( ! function_exists( 'wp_create_nonce' ) ) {
121	include_once ABSPATH . WPINC . '/pluggable.php';
122	}
123	self::$security_nonces[ $action ] = wp_create_nonce( $action );
124	}
125
126	/**
127	* Return the security nonces.
128	*
129	* @return self $security_nonces.
130	*/
131	public function get_security_nonces() {
132	return self::$security_nonces;
133	}
134
135	}
136