| 1 |
<?php |
| 2 |
|
| 3 |
declare(strict_types=1); |
| 4 |
|
| 5 |
namespace Metricool\Http\Middleware; |
| 6 |
|
| 7 |
use Metricool\Interfaces\MiddlewareInterface; |
| 8 |
use Metricool\Traits\HasNonces; |
| 9 |
use Metricool\Traits\HasRestAccess; |
| 10 |
|
| 11 |
/** |
| 12 |
* Verify the nonce for incoming REST API requests. For methods that modify data (POST, PUT, PATCH, DELETE), the request must include a valid nonce in the 'nonce' parameter. |
| 13 |
*/ |
| 14 |
class VerifyNonce implements MiddlewareInterface |
| 15 |
{ |
| 16 |
use HasRestAccess; |
| 17 |
use HasNonces; |
| 18 |
|
| 19 |
/** |
| 20 |
* @throws \Exception when not called with a capability |
| 21 |
*/ |
| 22 |
public function handle(\WP_REST_Request $request): ?\WP_REST_Response |
| 23 |
{ |
| 24 |
$method = $request->get_method(); |
| 25 |
$nonce = $request->get_param('nonce'); |
| 26 |
|
| 27 |
// For methods that modify data, verify the nonce |
| 28 |
$methodsRequiringNonce = ['POST', 'PUT', 'PATCH', 'DELETE']; |
| 29 |
if (in_array($method, $methodsRequiringNonce) && ($this->verifyNonce($nonce) === false)) { |
| 30 |
return $this->sendHttpErrorResponse( |
| 31 |
__('Forbidden', 'metricool'), |
| 32 |
null, |
| 33 |
403 |
| 34 |
); |
| 35 |
} |
| 36 |
|
| 37 |
return null; |
| 38 |
} |
| 39 |
} |
| 40 |
|
