ShopperListsNonceCheck.php — WooCommerce 10.9.4

woocommerce / src / StoreApi / Routes / V1 / ShopperListsNonceCheck.php

woocommerce / src / StoreApi / Routes / V1 Last commit date

ShopperListsNonceCheck.php

113 lines

1	<?php
2	declare( strict_types = 1 );
3
4	namespace Automattic\WooCommerce\StoreApi\Routes\V1;
5
6	/**
7	* Stopgap CSRF guard for the write-capable shopper-lists routes.
8	*
9	* Enforces a `wc_store_api` Nonce header on writes and refreshes the
10	* client nonce via response headers on every reply. Same shape as the
11	* cart's existing flow, scoped to the nonce concern.
12	*
13	* To be replaced by a reusable Store API-wide nonce trait once that
14	* lands on trunk.
15	*
16	* @internal
17	*/
18	trait ShopperListsNonceCheck {
19	/**
20	* Nonce action used to sign and verify Store API write requests.
21	*
22	* @var string
23	*/
24	private static $store_api_nonce_action = 'wc_store_api';
25
26	/**
27	* Override of {@see AbstractRoute::get_response} that enforces the
28	* `wc_store_api` Nonce header on writes and refreshes it on every reply.
29	*
30	* @param \WP_REST_Request $request Request object.
31	* @phpstan-param \WP_REST_Request<array<string, mixed>> $request
32	* @return \WP_REST_Response
33	*/
34	public function get_response( \WP_REST_Request $request ) {
35	if ( $this->is_write_request( $request ) ) {
36	$nonce_check = $this->check_store_api_nonce( $request );
37	if ( is_wp_error( $nonce_check ) ) {
38	return $this->add_nonce_response_headers( $this->error_to_response( $nonce_check ) );
39	}
40	}
41
42	$response = parent::get_response( $request );
43
44	return $this->add_nonce_response_headers( rest_ensure_response( $response ) );
45	}
46
47	/**
48	* Whether the request mutates state. Mirrors `AbstractCartRoute::is_update_request`.
49	*
50	* @param \WP_REST_Request $request Request object.
51	* @phpstan-param \WP_REST_Request<array<string, mixed>> $request
52	* @return bool
53	*/
54	private function is_write_request( \WP_REST_Request $request ): bool {
55	return in_array( $request->get_method(), array( 'POST', 'PUT', 'PATCH', 'DELETE' ), true );
56	}
57
58	/**
59	* Verify the `Nonce` request header against the `wc_store_api` action.
60	*
61	* @param \WP_REST_Request $request Request object.
62	* @phpstan-param \WP_REST_Request<array<string, mixed>> $request
63	* @return true\|\WP_Error True on success, WP_Error on missing/invalid nonce.
64	*/
65	private function check_store_api_nonce( \WP_REST_Request $request ) {
66	/**
67	* Filters whether to disable the Store API nonce check.
68	*
69	* This filter is documented in src/StoreApi/Routes/V1/AbstractCartRoute.php.
70	*
71	* @since 4.5.0
72	*
73	* @param bool $disable_nonce_check If true, nonce checks will be disabled.
74	*/
75	if ( apply_filters( 'woocommerce_store_api_disable_nonce_check', false ) ) {
76	return true;
77	}
78
79	$nonce = $request->get_header( 'Nonce' );
80	if ( null === $nonce \|\| '' === $nonce ) {
81	return $this->get_route_error_response(
82	'woocommerce_rest_missing_nonce',
83	__( 'Missing the Nonce header. This endpoint requires a valid nonce.', 'woocommerce' ),
84	401
85	);
86	}
87
88	if ( ! wp_verify_nonce( $nonce, self::$store_api_nonce_action ) ) {
89	return $this->get_route_error_response(
90	'woocommerce_rest_invalid_nonce',
91	__( 'Nonce is invalid.', 'woocommerce' ),
92	403
93	);
94	}
95
96	return true;
97	}
98
99	/**
100	* Attach a fresh `wc_store_api` nonce to the response.
101	*
102	* @param \WP_REST_Response $response Response object.
103	* @return \WP_REST_Response
104	*/
105	private function add_nonce_response_headers( \WP_REST_Response $response ): \WP_REST_Response {
106	$response->header( 'Nonce', wp_create_nonce( self::$store_api_nonce_action ) );
107	$response->header( 'Nonce-Timestamp', (string) time() );
108	$response->header( 'Cache-Control', 'no-store' );
109
110	return $response;
111	}
112	}
113