| @@ -8,10 +8,8 @@ | ||
| 8 | 8 | */ |
| 9 | 9 | |
| 10 | 10 | namespace ULTP; |
| 11 | 11 | |
| 12 | -use ULTP\Includes\Durbin\Xpo; | |
| 13 | - | |
| 14 | 12 | defined( 'ABSPATH' ) || exit; |
| 15 | 13 | |
| 16 | 14 | /** |
| 17 | 15 | * RequestAPI class. |
| @@ -411,18 +409,8 @@ | ||
| 411 | 409 | * @return ARRAY | Data of the Premade |
| 412 | 410 | */ |
| 413 | 411 | public function get_single_premade_callback( $server ) { |
| 414 | 412 | |
| 415 | - $is_active = ultimate_post()->is_lc_active(); | |
| 416 | - $obj_count = wp_count_posts( 'ultp_builder' ); | |
| 417 | - if ( ! $is_active ) { | |
| 418 | - $p_count = isset( $obj_count->publish ) ? $obj_count->publish : 0; | |
| 419 | - $d_count = isset( $obj_count->draft ) ? $obj_count->draft : 0; | |
| 420 | - if ( ( $p_count + $d_count ) > 0 ) { | |
| 421 | - return array( 'success' => false ); | |
| 422 | - } | |
| 423 | - } | |
| 424 | - | |
| 425 | 413 | $post = $server->get_params(); |
| 426 | 414 | $id = isset( $post['ID'] ) ? sanitize_text_field( $post['ID'] ) : ''; |
| 427 | 415 | $api_endpoint = isset( $post['apiEndPoint'] ) ? sanitize_text_field( $post['apiEndPoint'] ) : ''; |
| 428 | 416 | $s_type = isset( $post['type'] ) ? ultimate_post()->ultp_rest_sanitize_params( $post['type'] ) : ''; |
| @@ -427,14 +415,26 @@ | ||
| 427 | 415 | $api_endpoint = isset( $post['apiEndPoint'] ) ? sanitize_text_field( $post['apiEndPoint'] ) : ''; |
| 428 | 416 | $s_type = isset( $post['type'] ) ? ultimate_post()->ultp_rest_sanitize_params( $post['type'] ) : ''; |
| 429 | 417 | |
| 430 | 418 | if ( $id ) { |
| 431 | - $import_single = array( | |
| 432 | - 'id' => $id, | |
| 433 | - 'type' => 'single', | |
| 434 | - 'license' => Xpo::get_lc_key(), | |
| 419 | + // SSRF protection: only the template service, over HTTPS. | |
| 420 | + if ( 0 !== strpos( $api_endpoint, 'https://' ) || ! ultimate_post()->is_allowed_template_endpoint( $api_endpoint ) ) { | |
| 421 | + return rest_ensure_response( | |
| 422 | + array( | |
| 423 | + 'success' => false, | |
| 424 | + 'message' => __( 'Invalid API endpoint. Only trusted domains are allowed.', 'ultimate-post' ), | |
| 425 | + ) | |
| 426 | + ); | |
| 427 | + } | |
| 428 | + | |
| 429 | + $import_single = ultimate_post()->get_template_request_body( | |
| 430 | + array( | |
| 431 | + 'id' => $id, | |
| 432 | + 'type' => 'single', | |
| 433 | + ), | |
| 434 | + 'builder_premade' | |
| 435 | 435 | ); |
| 436 | - $response = wp_remote_get( | |
| 436 | + $response = wp_safe_remote_post( | |
| 437 | 437 | $api_endpoint . '/wp-json/importer/single', |
| 438 | 438 | array( |
| 439 | 439 | 'method' => 'POST', |
| 440 | 440 | 'timeout' => 120, |
| @@ -441,15 +441,23 @@ | ||
| 441 | 441 | 'body' => $import_single, |
| 442 | 442 | ) |
| 443 | 443 | ); |
| 444 | 444 | |
| 445 | - $response_data = json_decode( $response['body'] ); | |
| 445 | + if ( is_wp_error( $response ) ) { | |
| 446 | + return rest_ensure_response( | |
| 447 | + array( | |
| 448 | + 'success' => false, | |
| 449 | + 'data' => 'Something went wrong:' . $response->get_error_message(), | |
| 450 | + ) | |
| 451 | + ); | |
| 452 | + } | |
| 446 | 453 | |
| 447 | - if ( ! $response_data->success ) { | |
| 448 | - wp_send_json( | |
| 454 | + $response_data = json_decode( wp_remote_retrieve_body( $response ) ); | |
| 455 | + | |
| 456 | + if ( empty( $response_data->success ) || ! isset( $response_data->content[0]->content ) ) { | |
| 457 | + return rest_ensure_response( | |
| 449 | 458 | array( |
| 450 | 459 | 'success' => false, |
| 451 | - 'data' => 'Something went wrong:' . $response->get_error_message(), | |
| 452 | 460 | ) |
| 453 | 461 | ); |
| 454 | 462 | } |
| 455 | 463 | |
