| @@ -257,9 +257,9 @@ | ||
| 257 | 257 | } |
| 258 | 258 | |
| 259 | 259 | <?php |
| 260 | 260 | $recaptcha = get_option( 'wpsc-recaptcha-settings' ); |
| 261 | - if ( $recaptcha['allow-recaptcha'] === 1 && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) { | |
| 261 | + if ( $recaptcha['captcha-provider'] === 'google-recaptcha' && $recaptcha['recaptcha-version'] == 3 && $recaptcha['recaptcha-site-key'] && $recaptcha['recaptcha-secret-key'] ) { | |
| 262 | 262 | ?> |
| 263 | 263 | grecaptcha.ready(function() { |
| 264 | 264 | grecaptcha.execute('<?php echo esc_attr( $recaptcha['recaptcha-site-key'] ); ?>', {action: 'submit_ticket'}).then(function(token) { |
| 265 | 265 | dataform.append('g-recaptcha-response', token); |
| @@ -266,8 +266,23 @@ | ||
| 266 | 266 | wpsc_post_ticket_form(dataform); |
| 267 | 267 | }); |
| 268 | 268 | }); |
| 269 | 269 | <?php |
| 270 | + } elseif ( $recaptcha['captcha-provider'] === 'cloudflare-turnstile' && $recaptcha['cloudflare-site-key'] && $recaptcha['cloudflare-secret-key'] ) { | |
| 271 | + ?> | |
| 272 | + var token = dataform.get('cf-turnstile-response'); | |
| 273 | + if (!token) { | |
| 274 | + alert("<?php esc_attr_e( 'Security verification failed. Please refresh the page and try again.', 'supportcandy' ); ?>"); | |
| 275 | + return; | |
| 276 | + } | |
| 277 | + | |
| 278 | + dataform.set( | |
| 279 | + 'cf-turnstile-response', | |
| 280 | + token | |
| 281 | + ); | |
| 282 | + wpsc_post_ticket_form(dataform); | |
| 283 | + <?php | |
| 284 | + | |
| 270 | 285 | } else { |
| 271 | 286 | ?> |
| 272 | 287 | wpsc_post_ticket_form(dataform); |
| 273 | 288 | <?php |
| @@ -532,11 +547,18 @@ | ||
| 532 | 547 | |
| 533 | 548 | do_action( 'wpsc_create_new_ticket', $ticket ); |
| 534 | 549 | |
| 535 | 550 | // tinymce img attachments. |
| 536 | - if ( preg_match_all( '/' . preg_quote( home_url( '/' ), '/' ) . '\?wpsc_attachment=(\d*)(&auth_code=[^&\s]*)?/', $description, $matches ) ) { | |
| 537 | - foreach ( $matches[1] as $id ) { | |
| 538 | - $attachment = new WPSC_Attachment( $id ); | |
| 551 | + if ( preg_match_all( '/' . preg_quote( home_url( '/' ), '/' ) . '\?wpsc_attachment=(\d*)(?:&auth_code=[^&\s"\']*)?(?:&(?:amp;)?wpsc_nonce=([a-f0-9]*))?/', $description, $matches ) ) { | |
| 552 | + foreach ( $matches[1] as $key => $id ) { | |
| 553 | + $attachment = new WPSC_Attachment( $id ); | |
| 554 | + // Only the uploader may bind their own, not-yet-bound | |
| 555 | + // attachment, proven by the recorded uploader identity or | |
| 556 | + // by the per-attachment nonce carried in the image url. | |
| 557 | + $nonce = isset( $matches[2][ $key ] ) ? $matches[2][ $key ] : ''; | |
| 558 | + if ( ! WPSC_Attachment::can_claim( $attachment, $nonce ) ) { | |
| 559 | + continue; | |
| 560 | + } | |
| 539 | 561 | $attachment->is_active = 1; |
| 540 | 562 | $attachment->source_id = $thread->id; |
| 541 | 563 | $attachment->ticket_id = $ticket->id; |
| 542 | 564 | $attachment->source = 'img_editor'; |
