← All changes | app/Controllers/Frontend/Ajax/AddToCart.php +11 -3 2.1.7 → 3.2.6 View file →

		@@ -40,9 +40,9 @@
40	40	*
41	41	* @return void
42	42	*/
43	43	public function response() {
44		- if ( ! Fns::verify_nonce() ) {
	44	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) ) {
45	45	wp_send_json_error();
46	46	}
47	47
48	48	$product_id = apply_filters( 'woocommerce_add_to_cart_product_id', ( isset( $_POST['product_id'] ) ? absint( $_POST['product_id'] ) : null ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
		@@ -48,10 +48,18 @@
48	48	$product_id = apply_filters( 'woocommerce_add_to_cart_product_id', ( isset( $_POST['product_id'] ) ? absint( $_POST['product_id'] ) : null ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
49	49	$quantity = empty( $_POST['quantity'] ) ? 1 : apply_filters( 'woocommerce_stock_amount', absint( $_POST['quantity'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
50	50	$variation_id = isset( $_POST['variation_id'] ) ? absint( $_POST['variation_id'] ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Missing
51	51	$passed_validation = apply_filters( 'woocommerce_add_to_cart_validation', true, $product_id, $quantity );
52		-
53		- if ( $passed_validation && WC()->cart->add_to_cart( $product_id, $quantity, $variation_id ) ) {
	52	+ // Safe fetch of the variation array.
	53	+ $raw_variation = filter_input( INPUT_POST, 'variation', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY );
	54	+ $variation = [];
	55	+ // Build variation attributes safely.
	56	+ if ( ! empty( $raw_variation ) && is_array( $raw_variation ) ) {
	57	+ foreach ( $raw_variation as $key => $value ) {
	58	+ $variation[ $key ] = wc_clean( $value );
	59	+ }
	60	+ }
	61	+ if ( $passed_validation && WC()->cart->add_to_cart( $product_id, $quantity, $variation_id, $variation ) ) {
54	62	do_action( 'woocommerce_ajax_added_to_cart', $product_id );
55	63	WC_AJAX::get_refreshed_fragments();
56	64	} else {
57	65	$data = [