| @@ -22,11 +22,11 @@ | ||
| 22 | 22 | */ |
| 23 | 23 | public function ultp_install_plugin_callback() { |
| 24 | 24 | |
| 25 | 25 | $nonce = isset( $_POST['wpnonce'] ) ? sanitize_key( wp_unslash( $_POST['wpnonce'] ) ) : ''; |
| 26 | - $plugin = isset( $_POST['plugin'] ) ? $_POST['plugin'] : ''; | |
| 26 | + $plugin = isset( $_POST['plugin'] ) ? sanitize_key( wp_unslash( $_POST['plugin'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verified just below, before $plugin is used. | |
| 27 | 27 | |
| 28 | - if ( ! wp_verify_nonce( $nonce, 'ultp-nonce' ) || ! current_user_can( 'manage_options' ) ) { | |
| 28 | + if ( ! wp_verify_nonce( $nonce, 'ultp-admin-nonce' ) || ! current_user_can( 'manage_options' ) ) { | |
| 29 | 29 | wp_send_json_error( array( 'message' => 'No plugin specified' ) ); |
| 30 | 30 | |
| 31 | 31 | } |
| 32 | 32 | |
