← All changes | admin/admin-bar.php +9 -9 4.0.25 → trunk View file →

		@@ -173,9 +173,9 @@
173	173
174	174	function handle_clear_cache_action()
175	175	{
176	176	// Check if the user has the necessary nonce and the action matches
177		- if (isset($_GET['action']) && $_GET['action'] === 'clear_cache' && wp_verify_nonce($_GET['_wpnonce'], 'clear_cache_action')) {
	177	+ if (isset($_GET['action']) && $_GET['action'] === 'clear_cache' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'clear_cache_action')) {
178	178
179	179	$cache = berqCache::getInstance();
180	180	$cache->delete_cache_files(is_multisite()); // If is multisite flush all sites
181	181
		@@ -195,9 +195,9 @@
195	195
196	196	function handle_warmup_cache_action()
197	197	{
198	198	// Check if the user has the necessary nonce and the action matches
199		- if (isset($_GET['action']) && $_GET['action'] === 'warmup_cache' && wp_verify_nonce($_GET['_wpnonce'], 'warmup_cache_action')) {
	199	+ if (isset($_GET['action']) && $_GET['action'] === 'warmup_cache' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'warmup_cache_action')) {
200	200
201	201	// trigger cache warmup
202	202	do_action('berqwp_cache_warmup');
203	203
		@@ -211,11 +211,11 @@
211	211
212	212	function handle_purge_page_action()
213	213	{
214	214	// Check if the user has the necessary nonce and the action matches
215		- if (isset($_GET['action']) && $_GET['action'] === 'berq_purge_page' && wp_verify_nonce($_GET['_wpnonce'], 'berq_purge_page_action')) {
	215	+ if (isset($_GET['action']) && $_GET['action'] === 'berq_purge_page' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'berq_purge_page_action')) {
216	216
217		- $page_url = $_GET['uri'];
	217	+ $page_url = esc_url_raw(wp_unslash($_GET['uri'] ?? ''));
218	218
219	219	berqCache::purge_page($page_url, true);
220	220
221	221	if (is_admin()) {
		@@ -230,11 +230,11 @@
230	230
231	231	function handle_request_cache_action()
232	232	{
233	233	// Check if the user has the necessary nonce and the action matches
234		- if (isset($_GET['action']) && $_GET['action'] === 'berq_request_cache' && wp_verify_nonce($_GET['_wpnonce'], 'berq_request_cache_action')) {
	234	+ if (isset($_GET['action']) && $_GET['action'] === 'berq_request_cache' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'berq_request_cache_action')) {
235	235
236		- $page_url = $_GET['uri'];
	236	+ $page_url = esc_url_raw(wp_unslash($_GET['uri'] ?? ''));
237	237	$slug = bwp_url_into_path($page_url);
238	238
239	239	if (is_admin()) {
240	240	set_transient('berq_force_cache_notice', $page_url, 60);
		@@ -251,9 +251,9 @@
251	251
252	252	function handle_flush_cdn_action()
253	253	{
254	254	// Check if the user has the necessary nonce and the action matches
255		- if (isset($_GET['action']) && $_GET['action'] === 'berq_flush_cdn' && wp_verify_nonce($_GET['_wpnonce'], 'berq_flush_cdn_action')) {
	255	+ if (isset($_GET['action']) && $_GET['action'] === 'berq_flush_cdn' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'berq_flush_cdn_action')) {
256	256
257	257	$cache = berqCache::getInstance();
258	258	$cache->flush_cdn();
259	259
		@@ -267,9 +267,9 @@
267	267
268	268	function handle_berq_flush_site_action()
269	269	{
270	270	// Check if the user has the necessary nonce and the action matches
271		- if (isset($_GET['action']) && isset($_GET['site_id']) && $_GET['action'] === 'berq_flush_site' && wp_verify_nonce($_GET['_wpnonce'], 'berq_flush_site_action')) {
	271	+ if (isset($_GET['action']) && isset($_GET['site_id']) && $_GET['action'] === 'berq_flush_site' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'berq_flush_site_action')) {
272	272
273	273	$site_id = (int) sanitize_text_field($_GET['site_id']);
274	274	$cache = berqCache::getInstance();
275	275
		@@ -292,9 +292,9 @@
292	292
293	293	function handle_flush_criticalcss_action()
294	294	{
295	295	// Check if the user has the necessary nonce and the action matches
296		- if (isset($_GET['action']) && $_GET['action'] === 'berq_flush_criticalcss' && wp_verify_nonce($_GET['_wpnonce'], 'berq_flush_criticalcss_action')) {
	296	+ if (isset($_GET['action']) && $_GET['action'] === 'berq_flush_criticalcss' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'berq_flush_criticalcss_action')) {
297	297
298	298	$parsed_url = wp_parse_url(home_url());
299	299	$domain = $parsed_url['host'];
300	300