| @@ -368,13 +368,15 @@ | ||
| 368 | 368 | add_action( 'admin_head', [ __CLASS__, 'enqueue_scripts' ] ); |
| 369 | 369 | } |
| 370 | 370 | |
| 371 | 371 | public static function dismiss_ajax_call() { |
| 372 | - $post_arr = filter_input_array( INPUT_POST, FILTER_SANITIZE_STRING ); | |
| 373 | - $notice_id = ( isset( $post_arr['notice_id'] ) ) ? $post_arr['notice_id'] : ''; | |
| 374 | - $dismissible = ( isset( $post_arr['dismissible'] ) ) ? $post_arr['dismissible'] : ''; | |
| 375 | - $expired_time = ( isset( $post_arr['expired_time'] ) ) ? $post_arr['expired_time'] : ''; | |
| 372 | + check_ajax_referer( 'wpmet_notice_dismiss', 'nonce' ); | |
| 376 | 373 | |
| 374 | + $post_arr = wp_unslash( $_POST ); | |
| 375 | + $notice_id = ( isset( $post_arr['notice_id'] ) ) ? sanitize_key( $post_arr['notice_id'] ) : ''; | |
| 376 | + $dismissible = ( isset( $post_arr['dismissible'] ) ) ? sanitize_text_field( $post_arr['dismissible'] ) : ''; | |
| 377 | + $expired_time = ( isset( $post_arr['expired_time'] ) ) ? absint( $post_arr['expired_time'] ) : 0; | |
| 378 | + | |
| 377 | 379 | if ( ! empty( $notice_id ) ) { |
| 378 | 380 | if ( 'user' === $dismissible ) { |
| 379 | 381 | update_user_meta( get_current_user_id(), $notice_id, true ); |
| 380 | 382 | } else { |
| @@ -387,8 +389,9 @@ | ||
| 387 | 389 | wp_send_json_error(); |
| 388 | 390 | } |
| 389 | 391 | |
| 390 | 392 | public static function enqueue_scripts() { |
| 393 | + $nonce = wp_create_nonce( 'wpmet_notice_dismiss' ); | |
| 391 | 394 | echo " |
| 392 | 395 | <script> |
| 393 | 396 | jQuery(document).ready(function ($) { |
| 394 | 397 | $( '.wpmet-notice.is-dismissible' ).on( 'click', '.notice-dismiss', function() { |
| @@ -408,8 +411,9 @@ | ||
| 408 | 411 | action : 'wpmet-notices', |
| 409 | 412 | notice_id : notice_id, |
| 410 | 413 | dismissible : dismissible, |
| 411 | 414 | expired_time : expired_time, |
| 415 | + nonce : '" . esc_js( $nonce ) . "', | |
| 412 | 416 | }, |
| 413 | 417 | }); |
| 414 | 418 | }); |
| 415 | 419 | }); |
