mainwp / class / class-mainwp-post-base-handler.php

class-mainwp-post-base-handler.php in MainWP Dashboard: Self-hosted WordPress Management for Agencies 4.4.1, at class/class-mainwp-post-base-handler.php

173 lines 4.2 KB

Raw Download Zip

1	<?php
2	/**
3	* This class handles the security for MainWP Post.
4	*
5	* @package MainWP/Dashboard
6	*/
7
8	namespace MainWP\Dashboard;
9
10	/**
11	* Class MainWP_Post_Base_Handler
12	*
13	* @package MainWP\Dashboard
14	*/
15	abstract class MainWP_Post_Base_Handler {
16
17	/**
18	* Protected static variable to hold security nounces.
19	*
20	* @var string Security nonce.
21	*/
22	protected static $security_nonces;
23
24	/**
25	* Protected static variable to hold security nounces.
26	*
27	* @var string Security nonce.
28	*/
29	protected static $security_names;
30
31	/**
32	* Method init()
33	*
34	* Force Extending class to define this method.
35	*
36	* @return void
37	*/
38	abstract protected function init();
39
40
41	/**
42	* Method secure_request()
43	*
44	* Add security check to request parameter
45	*
46	* @param string $action Action to perform.
47	* @param string $query_arg Query argument.
48	*
49	* @uses \MainWP\Dashboard\MainWP_System_Utility::is_admin()
50	* @uses \MainWP\Dashboard\MainWP_Utility::update_option()
51	*/
52	public function secure_request( $action = '', $query_arg = 'security' ) {
53	if ( ! MainWP_System_Utility::is_admin() ) {
54	die( 0 );
55	}
56	if ( '' === $action ) {
57	return;
58	}
59
60	$this->check_security( $action, $query_arg );
61
62	if ( isset( $_POST['dts'] ) ) {
63	$ajaxPosts = get_option( 'mainwp_ajaxposts' );
64	if ( ! is_array( $ajaxPosts ) ) {
65	$ajaxPosts = array();
66	}
67
68	// If already processed, just quit!
69	if ( isset( $ajaxPosts[ $action ] ) && ( $ajaxPosts[ $action ] == $_POST['dts'] ) ) {
70	die( wp_json_encode( array( 'error' => esc_html__( 'Double request!', 'mainwp' ) ) ) );
71	}
72
73	$ajaxPosts[ $action ] = sanitize_text_field( wp_unslash( $_POST['dts'] ) );
74	MainWP_Utility::update_option( 'mainwp_ajaxposts', $ajaxPosts );
75	}
76	}
77
78	/**
79	* Method check_security()
80	*
81	* Check security request.
82	*
83	* @param string $action Action to perform.
84	* @param string $query_arg Query argument.
85	* @param bool $die return or exit.
86	*
87	* @return bool true or false
88	*/
89	public function check_security( $action = - 1, $query_arg = 'security', $die = true ) {
90	$secure = true;
91	if ( - 1 === $action ) {
92	$secure = false;
93	} else {
94	$adminurl = strtolower( admin_url() );
95	$referer = strtolower( wp_get_referer() );
96	$result = isset( $_REQUEST[ $query_arg ] ) ? wp_verify_nonce( sanitize_key( $_REQUEST[ $query_arg ] ), $action ) : false;
97
98	if ( ! $result ) {
99	$secure = false;
100	}
101
102	$is_admin_referer = ( 0 === strpos( $referer, $adminurl ) ) ? true : false;
103	$admin_referer_is_accepted = apply_filters( 'mainwp_secure_check_admin_referer_is_accepted', true );
104
105	if ( ! $secure ) {
106	if ( $is_admin_referer & $admin_referer_is_accepted ) {
107	$secure = true;
108	}
109	}
110	}
111
112	if ( ! $secure ) {
113	if ( $die ) {
114	die( wp_json_encode( array( 'error' => esc_html__( 'Insecure request! Please try again. If you keep experiencing the problem, please review MainWP Knowledgebase, and if you still have issues, please let us know in the MainWP Community.', 'mainwp' ) ) ) );
115	} else {
116	return false;
117	}
118	}
119	return true;
120	}
121
122	/**
123	* Method add_action()
124	*
125	* Add ajax action.
126	*
127	* @param string $action Action to perform.
128	* @param string $callback Callback to perform.
129	*/
130	public function add_action( $action, $callback ) {
131	add_action( 'wp_ajax_' . $action, $callback );
132	$this->add_action_nonce( $action ); // to fix conflict with Post S M T P plugin.
133	}
134
135	/**
136	* Method add_action_nonce()
137	*
138	* Add security nonce.
139	*
140	* @param string $action Action to perform.
141	*/
142	public function add_action_nonce( $action ) {
143	if ( ! is_array( self::$security_names ) ) {
144	self::$security_names = array();
145	}
146	self::$security_names[] = $action;
147	}
148
149	/**
150	* Create the security nonces.
151	*
152	* @return self $security_nonces.
153	*/
154	public function create_security_nonces() {
155
156	if ( ! is_array( self::$security_nonces ) ) {
157	self::$security_nonces = array();
158	}
159	self::$security_names = apply_filters( 'mainwp_create_security_nonces', self::$security_names );
160	if ( ! empty( self::$security_names ) ) {
161	if ( ! function_exists( 'wp_create_nonce' ) ) {
162	include_once ABSPATH . WPINC . '/pluggable.php';
163	}
164	foreach ( self::$security_names as $action ) {
165	self::$security_nonces[ $action ] = wp_create_nonce( $action );
166	}
167	}
168
169	return self::$security_nonces;
170	}
171
172	}
173