mainwp / class / class-mainwp-post-base-handler.php

class-mainwp-post-base-handler.php in MainWP Dashboard: Self-hosted WordPress Management for Agencies 6.1.5, at class/class-mainwp-post-base-handler.php

168 lines 5.3 KB

Raw Download Zip

1	<?php
2	/**
3	* This class handles the security for MainWP Post.
4	*
5	* @package MainWP/Dashboard
6	*/
7
8	namespace MainWP\Dashboard;
9
10	// Exit if accessed directly.
11	if ( ! defined( 'ABSPATH' ) ) {
12	exit;
13	}
14
15	/**
16	* Class MainWP_Post_Base_Handler
17	*
18	* @package MainWP\Dashboard
19	*/
20	abstract class MainWP_Post_Base_Handler { // phpcs:ignore Generic.Classes.OpeningBraceSameLine.ContentAfterBrace -- NOSONAR.
21
22	/**
23	* Protected static variable to hold security nounces.
24	*
25	* @var string Security nonce.
26	*/
27	protected static $security_nonces;
28
29	/**
30	* Protected static variable to hold security nounces.
31	*
32	* @var string Security nonce.
33	*/
34	protected static $security_names;
35
36	/**
37	* Method init()
38	*
39	* Force Extending class to define this method.
40	*
41	* @return void
42	*/
43	abstract protected function init();
44
45
46	/**
47	* Method secure_request()
48	*
49	* Add security check to request parameter
50	*
51	* @param string $action Action to perform.
52	* @param string $query_arg Query argument.
53	*
54	* @uses \MainWP\Dashboard\MainWP_System_Utility::is_admin()
55	* @uses \MainWP\Dashboard\MainWP_Utility::update_option()
56	*/
57	public function secure_request( $action = '', $query_arg = 'security' ) {
58	if ( ! MainWP_System_Utility::is_admin() ) {
59	die( 0 );
60	}
61	if ( '' === $action ) {
62	return;
63	}
64
65	$this->check_security( $action, $query_arg );
66
67	if ( isset( $_POST['dts'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
68	$ajaxPosts = get_option( 'mainwp_ajaxposts' );
69	if ( ! is_array( $ajaxPosts ) ) {
70	$ajaxPosts = array();
71	}
72
73	// If already processed, just quit!
74	if ( isset( $ajaxPosts[ $action ] ) && ( $ajaxPosts[ $action ] === $_POST['dts'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
75	die( wp_json_encode( array( 'error' => esc_html__( 'Double request!', 'mainwp' ) ) ) );
76	}
77
78	$ajaxPosts[ $action ] = sanitize_text_field( wp_unslash( $_POST['dts'] ) ); // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
79	MainWP_Utility::update_option( 'mainwp_ajaxposts', $ajaxPosts );
80	}
81	}
82
83	/**
84	* Method check_security()
85	*
86	* Check security request.
87	*
88	* @param string $action Action to perform.
89	* @param string $query_arg Query argument.
90	* @param bool $out_die return or exit.
91	*
92	* @return bool true or false
93	*/
94	public function check_security( $action = - 1, $query_arg = 'security', $out_die = true ) {
95	$secure = true;
96	if ( - 1 === $action ) {
97	$secure = false;
98	} else {
99	$result = isset( $_REQUEST[ $query_arg ] ) ? wp_verify_nonce( sanitize_key( $_REQUEST[ $query_arg ] ), $action ) : false; // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
100
101	if ( ! $result ) {
102	$secure = false;
103	}
104	}
105
106	if ( ! $secure ) {
107	if ( $out_die ) {
108	die( wp_json_encode( array( 'error' => esc_html__( 'Insecure request! Please try again. If you keep experiencing the problem, please review MainWP Knowledgebase, and if you still have issues, please let us know in the MainWP Community.', 'mainwp' ) ) ) );
109	} else {
110	return false;
111	}
112	}
113	return true;
114	}
115
116	/**
117	* Method add_action()
118	*
119	* Add ajax action.
120	*
121	* @param string $action Action to perform.
122	* @param mixed $callback Callback to perform.
123	* @param int $priority priority aciton.
124	* @param int $accepted number args.
125	*/
126	public function add_action( $action, $callback, $priority = 10, $accepted = 2 ) {
127	add_action( 'wp_ajax_' . $action, $callback, $priority, $accepted );
128	$this->add_action_nonce( $action ); // to fix conflict with Post S M T P plugin.
129	}
130
131	/**
132	* Method add_action_nonce()
133	*
134	* Add security nonce.
135	*
136	* @param string $action Action to perform.
137	*/
138	public function add_action_nonce( $action ) {
139	if ( ! is_array( static::$security_names ) ) {
140	static::$security_names = array();
141	}
142	static::$security_names[] = $action;
143	}
144
145	/**
146	* Create the security nonces.
147	*
148	* @return self $security_nonces.
149	*/
150	public function create_security_nonces() {
151
152	if ( ! is_array( static::$security_nonces ) ) {
153	static::$security_nonces = array();
154	}
155	static::$security_names = apply_filters( 'mainwp_create_security_nonces', static::$security_names );
156	if ( ! empty( static::$security_names ) ) {
157	if ( ! function_exists( 'wp_create_nonce' ) ) {
158	include_once ABSPATH . WPINC . '/pluggable.php'; // NOSONAR - WP compatible.
159	}
160	foreach ( static::$security_names as $action ) {
161	static::$security_nonces[ $action ] = wp_create_nonce( $action );
162	}
163	}
164
165	return static::$security_nonces;
166	}
167	}
168