← All changes
|
src/Addons/RequestAQuote/Frontend/API/SubmitQuoteEndpoint.php
+26
-15
7.1.5
→
8.0.2
View file →
| @@ -18,11 +18,35 @@ | ||
| 18 | 18 | public function register_routes() { |
| 19 | 19 | register_rest_route( 'tier-pricing-table/v1', '/quote-request', array( |
| 20 | 20 | 'methods' => WP_REST_Server::CREATABLE, |
| 21 | 21 | 'callback' => array( $this, 'submitQuote' ), |
| 22 | - 'permission_callback' => '__return_true', // Publicly accessible | |
| 22 | + 'permission_callback' => array( $this, 'permissionCallback' ), | |
| 23 | 23 | ) ); |
| 24 | 24 | } |
| 25 | + | |
| 26 | + /** | |
| 27 | + * A public form: visitors may submit. Without reCAPTCHA keys the request must carry the REST nonce of | |
| 28 | + * the page that rendered the form; with keys, the handler verifies the reCAPTCHA token instead. | |
| 29 | + * | |
| 30 | + * @return true|WP_Error | |
| 31 | + */ | |
| 32 | + public function permissionCallback( WP_REST_Request $request ) { | |
| 33 | + $globalSettings = get_option( 'tier_pricing_table_quote_global_settings', array() ); | |
| 34 | + | |
| 35 | + if ( ! empty( $globalSettings['recaptcha_site_key'] ) && ! empty( $globalSettings['recaptcha_secret_key'] ) ) { | |
| 36 | + return true; | |
| 37 | + } | |
| 38 | + | |
| 39 | + $nonce = $request->get_param( '_wpnonce' ) ? sanitize_text_field( (string) $request->get_param( '_wpnonce' ) ) : (string) $request->get_header( 'x_wp_nonce' ); | |
| 40 | + | |
| 41 | + if ( ! $nonce || ! wp_verify_nonce( $nonce, 'wp_rest' ) ) { | |
| 42 | + return new WP_Error( 'invalid_nonce', | |
| 43 | + __( 'Security check failed. Please refresh the page and try again.', 'tier-pricing-table' ), | |
| 44 | + array( 'status' => 403 ) ); | |
| 45 | + } | |
| 46 | + | |
| 47 | + return true; | |
| 48 | + } | |
| 25 | 49 | |
| 26 | 50 | public function submitQuote( WP_REST_Request $request ) { |
| 27 | 51 | $params = $request->get_params(); |
| 28 | 52 | $formId = isset( $params['form_id'] ) ? sanitize_text_field( $params['form_id'] ) : ''; |
| @@ -85,23 +109,10 @@ | ||
| 85 | 109 | return new WP_Error( 'spam_detected', |
| 86 | 110 | __( 'Anti-Spam verification failed. Score too low.', 'tier-pricing-table' ), |
| 87 | 111 | array( 'status' => 400 ) ); |
| 88 | 112 | } |
| 89 | - } else { | |
| 90 | - // If reCAPTCHA is not configured, fallback to basic nonce check | |
| 91 | - $nonce = isset( $params['_wpnonce'] ) ? sanitize_text_field( $params['_wpnonce'] ) : ''; | |
| 92 | - | |
| 93 | - // Try to get nonce from header if not in params | |
| 94 | - if ( empty( $nonce ) ) { | |
| 95 | - $nonce = $request->get_header( 'x_wp_nonce' ); | |
| 96 | - } | |
| 97 | - | |
| 98 | - if ( ! wp_verify_nonce( $nonce, 'wp_rest' ) ) { | |
| 99 | - return new WP_Error( 'invalid_nonce', | |
| 100 | - __( 'Security check failed. Please refresh the page and try again.', 'tier-pricing-table' ), | |
| 101 | - array( 'status' => 403 ) ); | |
| 102 | - } | |
| 103 | 113 | } |
| 114 | + // without reCAPTCHA keys the REST nonce was verified by the permission callback | |
| 104 | 115 | |
| 105 | 116 | $quote = new QuoteRequest(); |
| 106 | 117 | |
| 107 | 118 | $quote->setProductId( $productId ); |