← All changes | includes/frontend/class-wpsc-frontend.php +42 -12 3.4.4 → 3.5.4 View file →

		@@ -37,8 +37,16 @@
37	37	if ( ! $ticket->id ) {
38	38	return;
39	39	}
40	40
	41	+ // Validate the submitted auth code against the stored one before
	42	+ // doing anything with the ticket. Never redirect to (and thereby
	43	+ // disclose) the real ticket URL/auth code for an invalid guess.
	44	+ $submitted_auth_code = sanitize_text_field( wp_unslash( $_REQUEST['auth_code'] ) ); // phpcs:ignore
	45	+ if ( ! $ticket->auth_code || ! $submitted_auth_code || ! hash_equals( (string) $ticket->auth_code, $submitted_auth_code ) ) {
	46	+ return;
	47	+ }
	48	+
41	49	wp_safe_redirect( $ticket->get_url() );
42	50	exit;
43	51	}
44	52	}
		@@ -50,10 +58,9 @@
50	58	*/
51	59	public static function load_scripts() {
52	60
53	61	// Check load scripts setting to load script on perticular page.
54		- $page_settings = get_option( 'wpsc-gs-page-settings' );
55		- if ( $page_settings['load-scripts'] == 'custom' && ! in_array( get_the_id(), $page_settings['load-script-pages'] ) ) {
	62	+ if ( ! WPSC_Functions::is_load_scripts_page() ) {
56	63	return;
57	64	}
58	65
59	66	// jquery.
		@@ -205,10 +212,10 @@
205	212	</div>
206	213	<?php
207	214
208	215	// recaptcha.
209		- if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) :
210		- $unique_id = uniqid( 'wpsc_' )
	216	+ if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) :
	217	+ $unique_id = uniqid( 'wpsc_' );
211	218	?>
212	219	<script src="https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit" async defer></script> <?php // phpcs:ignore ?>
213	220	<div id="<?php echo esc_attr( $unique_id ); ?>" style="margin-bottom: 5px;"></div>
214	221	<script>
		@@ -223,13 +230,21 @@
223	230	}
224	231	</script>
225	232	<?php
226	233	endif;
227		- if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) :
	234	+ if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) :
228	235	?>
229	236	<script src="https://www.google.com/recaptcha/api.js?render=<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>"></script> <?php // phpcs:ignore ?>
230	237	<?php
231	238	endif;
	239	+ if ( $recaptcha['captcha-provider'] === 'cloudflare-turnstile' && $recaptcha['cloudflare-site-key'] && $recaptcha['cloudflare-secret-key'] ) :
	240	+ ?>
	241	+ <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script> <?php // phpcs:ignore ?>
	242	+ <div class="wpsc-tff turnstile wpsc-xs-12 wpsc-sm-12 wpsc-md-12 wpsc-lg-12 required wpsc-visible" data-cft="turnstile">
	243	+ <div class="cf-turnstile" data-sitekey="<?php echo esc_attr( $recaptcha['cloudflare-site-key'] ); ?>"></div>
	244	+ </div>
	245	+ <?php
	246	+ endif;
232	247	?>
233	248
234	249	<button class="wpsc-button normal primary" onclick="wpsc_submit_login_form(this)"><?php esc_attr_e( 'Sign In', 'supportcandy' ); ?></button>
235	250	<input type="hidden" name="action" value="wpsc_default_login"/>
		@@ -277,15 +292,15 @@
277	292	<?php
278	293	}
279	294	if ( $otp_login && $page_settings['otp-login'] && in_array( 'guest', $gs['allow-create-ticket'] ) ) :
280	295	?>
281		- <a class="wpsc-link wpsc-otp-signin" href="javascript:wpsc_get_guest_sign_in();"><?php esc_attr_e( 'Sign-in using one time password', 'supportcandy' ); ?></a>
	296	+ <span class="wpsc-link wpsc-otp-signin" onclick="wpsc_get_guest_sign_in();"><?php esc_attr_e( 'Sign-in using one time password', 'supportcandy' ); ?></span>
282	297	<?php
283	298	endif;
284	299
285	300	if ( $additional_links && in_array( 'guest', $gs['allow-create-ticket'] ) ) :
286	301	?>
287		- <a class="wpsc-link wpsc-guest-create-ticket" href="javascript:wpsc_get_guest_ticket_form();"><?php esc_attr_e( 'Create new ticket as guest', 'supportcandy' ); ?></a>
	302	+ <span class="wpsc-link wpsc-guest-create-ticket" onclick="wpsc_get_guest_ticket_form();"><?php esc_attr_e( 'Create new ticket as guest', 'supportcandy' ); ?></span>
288	303	<?php
289	304	endif;
290	305
291	306	if ( $additional_links && $page_settings['open-ticket-page'] ) :
		@@ -309,9 +324,9 @@
309	324	alert(supportcandy.translations.req_fields_missing);
310	325	return;
311	326	}
312	327	<?php
313		- if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
	328	+ if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
314	329	?>
315	330	grecaptcha.ready(function() {
316	331	grecaptcha.execute('<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>', {action: 'submit_login'}).then(function(token) {
317	332	dataform.append('g-recaptcha-response', token);
		@@ -318,13 +333,13 @@
318	333	wpsc_post_login_form(el, dataform);
319	334	});
320	335	});
321	336	<?php
322		- } elseif ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
	337	+ } elseif ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
323	338	?>
324	339	var token = dataform.get('g-recaptcha-response');
325	340	if (!token) {
326		- alert("<?php esc_attr_e( 'Captcha not set!', 'supportcandy' ); ?>");
	341	+ alert("<?php esc_attr_e( 'Security verification failed. Please refresh the page and try again.', 'supportcandy' ); ?>");
327	342	return;
328	343	}
329	344	wpsc_post_login_form(el, dataform);
330	345	<?php
		@@ -463,9 +478,9 @@
463	478	return;
464	479	}
465	480
466	481	<?php
467		- if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
	482	+ if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
468	483	?>
469	484	grecaptcha.ready(function() {
470	485	grecaptcha.execute('<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>', {action: 'submit_registration'}).then(function(token) {
471	486	dataform.append('g-recaptcha-response', token);
		@@ -472,9 +487,9 @@
472	487	wpsc_authenticate_registration(el, dataform);
473	488	});
474	489	});
475	490	<?php
476		- } elseif ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
	491	+ } elseif ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 2 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) {
477	492	?>
478	493	var token = dataform.get('g-recaptcha-response');
479	494	if (!token) {
480	495	alert("<?php esc_attr_e( 'Captcha not set!', 'supportcandy' ); ?>");
		@@ -481,8 +496,23 @@
481	496	return;
482	497	}
483	498	wpsc_authenticate_registration(el, dataform);
484	499	<?php
	500	+ } elseif ( $recaptcha['captcha-provider'] === 'cloudflare-turnstile' && $recaptcha['cloudflare-site-key'] && $recaptcha['cloudflare-secret-key'] ) {
	501	+ ?>
	502	+ var token = dataform.get('cf-turnstile-response');
	503	+ if (!token) {
	504	+ alert("<?php esc_attr_e( 'Security verification failed. Please refresh the page and try again.', 'supportcandy' ); ?>");
	505	+ return;
	506	+ }
	507	+
	508	+ dataform.set(
	509	+ 'cf-turnstile-response',
	510	+ token
	511	+ );
	512	+ wpsc_authenticate_registration(el, dataform);
	513	+ <?php
	514	+
485	515	} else {
486	516	?>
487	517
488	518	wpsc_authenticate_registration(el, dataform);