← All changes | includes/frontend/class-wpsc-frontend.php +8 -0 3.5.1 → 3.5.4 View file →

		@@ -37,8 +37,16 @@
37	37	if ( ! $ticket->id ) {
38	38	return;
39	39	}
40	40
	41	+ // Validate the submitted auth code against the stored one before
	42	+ // doing anything with the ticket. Never redirect to (and thereby
	43	+ // disclose) the real ticket URL/auth code for an invalid guess.
	44	+ $submitted_auth_code = sanitize_text_field( wp_unslash( $_REQUEST['auth_code'] ) ); // phpcs:ignore
	45	+ if ( ! $ticket->auth_code || ! $submitted_auth_code || ! hash_equals( (string) $ticket->auth_code, $submitted_auth_code ) ) {
	46	+ return;
	47	+ }
	48	+
41	49	wp_safe_redirect( $ticket->get_url() );
42	50	exit;
43	51	}
44	52	}