mainwp / class / class-mainwp-post-base-handler.php

class-mainwp-post-base-handler.php in MainWP Dashboard: Self-hosted WordPress Management for Agencies 5.0, at class/class-mainwp-post-base-handler.php

163 lines 4.4 KB

Raw Download Zip

1	<?php
2	/**
3	* This class handles the security for MainWP Post.
4	*
5	* @package MainWP/Dashboard
6	*/
7
8	namespace MainWP\Dashboard;
9
10	/**
11	* Class MainWP_Post_Base_Handler
12	*
13	* @package MainWP\Dashboard
14	*/
15	abstract class MainWP_Post_Base_Handler {
16
17	/**
18	* Protected static variable to hold security nounces.
19	*
20	* @var string Security nonce.
21	*/
22	protected static $security_nonces;
23
24	/**
25	* Protected static variable to hold security nounces.
26	*
27	* @var string Security nonce.
28	*/
29	protected static $security_names;
30
31	/**
32	* Method init()
33	*
34	* Force Extending class to define this method.
35	*
36	* @return void
37	*/
38	abstract protected function init();
39
40
41	/**
42	* Method secure_request()
43	*
44	* Add security check to request parameter
45	*
46	* @param string $action Action to perform.
47	* @param string $query_arg Query argument.
48	*
49	* @uses \MainWP\Dashboard\MainWP_System_Utility::is_admin()
50	* @uses \MainWP\Dashboard\MainWP_Utility::update_option()
51	*/
52	public function secure_request( $action = '', $query_arg = 'security' ) {
53	if ( ! MainWP_System_Utility::is_admin() ) {
54	die( 0 );
55	}
56	if ( '' === $action ) {
57	return;
58	}
59
60	$this->check_security( $action, $query_arg );
61
62	if ( isset( $_POST['dts'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
63	$ajaxPosts = get_option( 'mainwp_ajaxposts' );
64	if ( ! is_array( $ajaxPosts ) ) {
65	$ajaxPosts = array();
66	}
67
68	// If already processed, just quit!
69	if ( isset( $ajaxPosts[ $action ] ) && ( $ajaxPosts[ $action ] === $_POST['dts'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
70	die( wp_json_encode( array( 'error' => esc_html__( 'Double request!', 'mainwp' ) ) ) );
71	}
72
73	$ajaxPosts[ $action ] = sanitize_text_field( wp_unslash( $_POST['dts'] ) ); // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
74	MainWP_Utility::update_option( 'mainwp_ajaxposts', $ajaxPosts );
75	}
76	}
77
78	/**
79	* Method check_security()
80	*
81	* Check security request.
82	*
83	* @param string $action Action to perform.
84	* @param string $query_arg Query argument.
85	* @param bool $out_die return or exit.
86	*
87	* @return bool true or false
88	*/
89	public function check_security( $action = - 1, $query_arg = 'security', $out_die = true ) {
90	$secure = true;
91	if ( - 1 === $action ) {
92	$secure = false;
93	} else {
94	$result = isset( $_REQUEST[ $query_arg ] ) ? wp_verify_nonce( sanitize_key( $_REQUEST[ $query_arg ] ), $action ) : false; // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
95
96	if ( ! $result ) {
97	$secure = false;
98	}
99	}
100
101	if ( ! $secure ) {
102	if ( $out_die ) {
103	die( wp_json_encode( array( 'error' => esc_html__( 'Insecure request! Please try again. If you keep experiencing the problem, please review MainWP Knowledgebase, and if you still have issues, please let us know in the MainWP Community.', 'mainwp' ) ) ) );
104	} else {
105	return false;
106	}
107	}
108	return true;
109	}
110
111	/**
112	* Method add_action()
113	*
114	* Add ajax action.
115	*
116	* @param string $action Action to perform.
117	* @param string $callback Callback to perform.
118	* @param int $priority priority aciton.
119	* @param int $accepted number args.
120	*/
121	public function add_action( $action, $callback, $priority = 10, $accepted = 2 ) {
122	add_action( 'wp_ajax_' . $action, $callback, $priority, $accepted );
123	$this->add_action_nonce( $action ); // to fix conflict with Post S M T P plugin.
124	}
125
126	/**
127	* Method add_action_nonce()
128	*
129	* Add security nonce.
130	*
131	* @param string $action Action to perform.
132	*/
133	public function add_action_nonce( $action ) {
134	if ( ! is_array( self::$security_names ) ) {
135	self::$security_names = array();
136	}
137	self::$security_names[] = $action;
138	}
139
140	/**
141	* Create the security nonces.
142	*
143	* @return self $security_nonces.
144	*/
145	public function create_security_nonces() {
146
147	if ( ! is_array( self::$security_nonces ) ) {
148	self::$security_nonces = array();
149	}
150	self::$security_names = apply_filters( 'mainwp_create_security_nonces', self::$security_names );
151	if ( ! empty( self::$security_names ) ) {
152	if ( ! function_exists( 'wp_create_nonce' ) ) {
153	include_once ABSPATH . WPINC . '/pluggable.php';
154	}
155	foreach ( self::$security_names as $action ) {
156	self::$security_nonces[ $action ] = wp_create_nonce( $action );
157	}
158	}
159
160	return self::$security_nonces;
161	}
162	}
163