| @@ -79,22 +79,10 @@ | ||
| 79 | 79 | if ( empty( $return_url ) ) { |
| 80 | 80 | $return_url = admin_url( 'admin.php?page=templately' ); |
| 81 | 81 | } |
| 82 | 82 | |
| 83 | - // Unique random state — doubles as cache busting and as the CSRF token the | |
| 84 | - // callback validates. Only minted into a transient for a logged-in user: | |
| 85 | - // this endpoint is public, and an anonymous caller could otherwise flood | |
| 86 | - // wp_options with tokens that can never authorize anything. | |
| 87 | - $state = wp_generate_password( 32, false ); | |
| 88 | - $state_owner = get_current_user_id(); | |
| 89 | - | |
| 90 | - if ( $state_owner > 0 ) { | |
| 91 | - Database::set_transient( 'google_state_' . $state, $state_owner, 15 * MINUTE_IN_SECONDS ); | |
| 92 | - } | |
| 93 | - | |
| 94 | 83 | $return_params = [ |
| 95 | 84 | 'templately_google_login' => '1', |
| 96 | - 'templately_state' => $state, | |
| 97 | 85 | ]; |
| 98 | 86 | |
| 99 | 87 | // Add redirect-to parameter if provided |
| 100 | 88 | if (!empty($redirect_to)) { |
| @@ -105,9 +93,9 @@ | ||
| 105 | 93 | |
| 106 | 94 | $query_params = [ |
| 107 | 95 | 'site_url' => urlencode($site_url_with_params), |
| 108 | 96 | 'site_ip' => Helper::get_ip(), |
| 109 | - 'state' => $state, | |
| 97 | + 'state' => wp_generate_password(32, false) // Add unique random state for cache busting | |
| 110 | 98 | ]; |
| 111 | 99 | |
| 112 | 100 | return add_query_arg($query_params, $auth_url); |
| 113 | 101 | } |
| @@ -125,9 +113,9 @@ | ||
| 125 | 113 | case is_string( $value ) && ( $value === 'true' || $value === 'false' ): |
| 126 | 114 | $prepareArgs .= "$key:" . $value . ","; |
| 127 | 115 | break; |
| 128 | 116 | default: |
| 129 | - $prepareArgs .= "$key:" . '"' . Helper::esc_json_string( $value ) . '"' . ","; | |
| 117 | + $prepareArgs .= "$key:" . '"' . $value . '"' . ","; | |
| 130 | 118 | break; |
| 131 | 119 | } |
| 132 | 120 | } |
| 133 | 121 | |
| @@ -192,9 +180,8 @@ | ||
| 192 | 180 | } |
| 193 | 181 | |
| 194 | 182 | $headers = [ |
| 195 | 183 | 'Content-Type' => 'application/json', |
| 196 | - 'Accept' => 'application/json', | |
| 197 | 184 | 'x-templately-ip' => Helper::get_ip(), |
| 198 | 185 | 'x-templately-url' => home_url( '/' ), |
| 199 | 186 | 'x-templately-version' => TEMPLATELY_VERSION, |
| 200 | 187 | ]; |
| @@ -209,9 +196,9 @@ | ||
| 209 | 196 | Helper::log( 'QUERY: ' . $query ); |
| 210 | 197 | } |
| 211 | 198 | |
| 212 | 199 | $_default_args = [ |
| 213 | - 'timeout' => $this->dev_mode ? 120 : 30, | |
| 200 | + 'timeout' => $this->dev_mode ? 40 : 30, | |
| 214 | 201 | 'headers' => $headers, |
| 215 | 202 | 'body' => wp_json_encode( [ |
| 216 | 203 | 'query' => $query |
| 217 | 204 | ] ) |
