| @@ -456,8 +456,19 @@ | ||
| 456 | 456 | } |
| 457 | 457 | } |
| 458 | 458 | } |
| 459 | 459 | |
| 460 | + // Check if this is a WooCommerce endpoint request and add verification token. | |
| 461 | + if ( $this->is_woocommerce_request( $url ) ) { | |
| 462 | + // Generate a unique token for this specific request. | |
| 463 | + $token = wp_generate_password( 32, false ); | |
| 464 | + set_transient( 'visualizer_wc_token_' . $token, time(), 60 ); | |
| 465 | + if ( ! isset( $args['headers'] ) ) { | |
| 466 | + $args['headers'] = array(); | |
| 467 | + } | |
| 468 | + $args['headers']['X-Visualizer-Token'] = $token; | |
| 469 | + } | |
| 470 | + | |
| 460 | 471 | do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Connecting to %s with args = %s ', $url, print_r( $args, true ) ), 'debug', __FILE__, __LINE__ ); |
| 461 | 472 | return wp_remote_request( $url, $args ); |
| 462 | 473 | } |
| 463 | 474 | |
| @@ -485,8 +496,53 @@ | ||
| 485 | 496 | $data[] = $this->_normalizeData( $data_row ); |
| 486 | 497 | } |
| 487 | 498 | $this->_data = $data; |
| 488 | 499 | return true; |
| 500 | + } | |
| 501 | + | |
| 502 | + /** | |
| 503 | + * Check if the URL is a WooCommerce endpoint request. | |
| 504 | + * | |
| 505 | + * @access private | |
| 506 | + * @param string $url The URL to check. | |
| 507 | + * @return bool True if it's a WooCommerce request, false otherwise. | |
| 508 | + */ | |
| 509 | + private function is_woocommerce_request( $url ) { | |
| 510 | + if ( empty( $url ) ) { | |
| 511 | + return false; | |
| 512 | + } | |
| 513 | + | |
| 514 | + $parsed_url = function_exists( 'wp_parse_url' ) ? wp_parse_url( $url ) : parse_url( $url ); | |
| 515 | + if ( empty( $parsed_url ) || empty( $parsed_url['host'] ) || empty( $parsed_url['path'] ) ) { | |
| 516 | + return false; | |
| 517 | + } | |
| 518 | + | |
| 519 | + $site_url = function_exists( 'home_url' ) ? home_url() : ( function_exists( 'site_url' ) ? site_url() : '' ); | |
| 520 | + $site_parts = $site_url ? ( function_exists( 'wp_parse_url' ) ? wp_parse_url( $site_url ) : parse_url( $site_url ) ) : array(); | |
| 521 | + if ( empty( $site_parts['host'] ) ) { | |
| 522 | + return false; | |
| 523 | + } | |
| 524 | + | |
| 525 | + $target_host = strtolower( $parsed_url['host'] ); | |
| 526 | + $site_host = strtolower( $site_parts['host'] ); | |
| 527 | + if ( $target_host !== $site_host ) { | |
| 528 | + return false; | |
| 529 | + } | |
| 530 | + | |
| 531 | + $path = '/' . ltrim( $parsed_url['path'], '/' ); | |
| 532 | + $wc_patterns = array( | |
| 533 | + '/wp-json/wc/', | |
| 534 | + '/wp-json/wc-analytics/', | |
| 535 | + '/wc-analytics/', | |
| 536 | + ); | |
| 537 | + | |
| 538 | + foreach ( $wc_patterns as $pattern ) { | |
| 539 | + if ( strpos( $path, $pattern ) !== false ) { | |
| 540 | + return true; | |
| 541 | + } | |
| 542 | + } | |
| 543 | + | |
| 544 | + return false; | |
| 489 | 545 | } |
| 490 | 546 | |
| 491 | 547 | /** |
| 492 | 548 | * Returns source name. |
