← All changes | includes/class-wpo-ajax.php +97 -27 3.3.0 → 4.7.0 View file →

		@@ -15,16 +15,32 @@
15	15	private $commands;
16	16
17	17	private $results;
18	18
	19	+ const HEARTBEAT_INTERVAL = 15; // in seconds
	20	+
19	21	/**
20	22	* Constructor
21	23	*/
22	24	private function __construct() {
23	25	add_action('wp_ajax_wp_optimize_ajax', array($this, 'handle_ajax_requests'));
	26	+ add_filter('wp_optimize_heartbeat_ajax', array($this, 'handle_heartbeat_requests'));
	27	+ add_filter('wp_optimize_is_heartbeat_valid_ajax_command', array($this, 'is_heartbeat_command_valid'));
24	28	}
25	29
26	30	/**
	31	+ * Check if a command is valid for this class
	32	+ *
	33	+ * @param string $command
	34	+ * @return bool
	35	+ */
	36	+ public function is_heartbeat_command_valid($command) {
	37	+ $this->set_heartbeat_subaction($command);
	38	+ $this->set_commands();
	39	+ return !$this->is_invalid_command();
	40	+ }
	41	+
	42	+ /**
27	43	* Return singleton instance
28	44	*
29	45	* @return WPO_Ajax Returns WPO_Ajax object
30	46	*/
		@@ -36,8 +52,48 @@
36	52	return $instance;
37	53	}
38	54
39	55	/**
	56	+ * Handles heartbeat requests
	57	+ *
	58	+ * @param string $action The action we want to run
	59	+ * @return mixed
	60	+ */
	61	+ public function handle_heartbeat_requests($action) {
	62	+ $this->set_heartbeat_subaction($action);
	63	+
	64	+ if (!WP_Optimize()->current_user_can()) {
	65	+ return wp_json_encode($this->send_user_capability_error_response(false));
	66	+ }
	67	+
	68	+ if (is_multisite() && !WP_Optimize()->current_user_can('manage_network_options')) {
	69	+ if (!$this->is_valid_multisite_command()) {
	70	+ return wp_json_encode($this->send_invalid_multisite_command_error_response(false));
	71	+ }
	72	+ }
	73	+
	74	+ $this->set_commands();
	75	+ if ($this->is_invalid_command()) {
	76	+ $this->add_invalid_command_error_log_entry();
	77	+ $this->set_invalid_command_error_response();
	78	+ } else {
	79	+ $this->execute_command();
	80	+ $this->maybe_fix_status_box_content();
	81	+ $this->set_error_response_on_wp_error();
	82	+ $this->maybe_set_results_as_null();
	83	+ }
	84	+
	85	+ $this->json_encode_results();
	86	+
	87	+ $json_last_error = json_last_error();
	88	+ if ($json_last_error) {
	89	+ $this->set_error_response_on_json_encode_error($json_last_error);
	90	+ }
	91	+
	92	+ return $this->results;
	93	+ }
	94	+
	95	+ /**
40	96	* Handles ajax requests
41	97	*
42	98	* @return void
43	99	*/
		@@ -49,13 +105,13 @@
49	105	if (!$this->is_valid_request()) {
50	106	$this->send_security_check_failed_error_response();
51	107	}
52	108
53		- if (!$this->is_user_capable()) {
	109	+ if (!WP_Optimize()->current_user_can()) {
54	110	$this->send_user_capability_error_response();
55	111	}
56	112
57		- if (is_multisite() && !current_user_can('manage_network_options')) {
	113	+ if (is_multisite() && !WP_Optimize()->current_user_can('manage_network_options')) {
58	114	if (!$this->is_valid_multisite_command()) {
59	115	$this->send_invalid_multisite_command_error_response();
60	116	}
61	117	}
		@@ -81,9 +137,9 @@
81	137	if ($json_last_error) {
82	138	$this->set_error_response_on_json_encode_error($json_last_error);
83	139	}
84	140
85		- echo $this->results;
	141	+ echo $this->results; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Output already escaped
86	142	die;
87	143	}
88	144
89	145	/**
		@@ -89,9 +145,9 @@
89	145	/**
90	146	* Sets nonce property value
91	147	*/
92	148	private function set_nonce() {
93		- $this->nonce = empty($_POST['nonce']) ? '' : $_POST['nonce'];
	149	+ $this->nonce = empty($_POST['nonce']) ? '' : sanitize_key(wp_unslash($_POST['nonce'])); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- is_valid_request() checks nonce
94	150	}
95	151
96	152	/**
97	153	* Sets subaction property value
		@@ -96,16 +152,25 @@
96	152	/**
97	153	* Sets subaction property value
98	154	*/
99	155	private function set_subaction() {
100		- $this->subaction = empty($_POST['subaction']) ? '' : stripcslashes($_POST['subaction']);
	156	+ $this->subaction = empty($_POST['subaction']) ? '' : sanitize_key(wp_unslash($_POST['subaction'])); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- is_valid_request() checks nonce
101	157	}
102	158
103	159	/**
	160	+ * Sets heartbeat subaction property value
	161	+ *
	162	+ * @param string $action_name The name of the heartbeat action to run
	163	+ */
	164	+ private function set_heartbeat_subaction($action_name) {
	165	+ $this->subaction = $action_name;
	166	+ }
	167	+
	168	+ /**
104	169	* Sets data property value
105	170	*/
106	171	private function set_data() {
107		- $this->data = isset($_POST['data']) ? stripslashes_deep($_POST['data']) : null;
	172	+ $this->data = isset($_POST['data']) ? stripslashes_deep($_POST['data']) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- is_valid_request() checks nonce, sanitization takes place later
108	173	}
109	174
110	175	/**
111	176	* Checks whether the request is valid or not
		@@ -126,27 +191,25 @@
126	191	'error_message' => __('The security check failed; try refreshing the page.', 'wp-optimize')
127	192	));
128	193	}
129	194
130		-
131	195	/**
132		- * Checks whether current user capable of doing this action or not
	196	+ * Send user capability check failed error response to browser and possibly die
133	197	*
134		- * @return bool
	198	+ * @param boolean $send - if true, then the response is output; otherwise, it is returned
135	199	*/
136		- private function is_user_capable() {
137		- return current_user_can(WP_Optimize()->capability_required());
138		- }
139		-
140		- /**
141		- * Send user capability check failed error response to browser and die
142		- */
143		- private function send_user_capability_error_response() {
144		- wp_send_json(array(
	200	+ private function send_user_capability_error_response($send = true) {
	201	+ $error = array(
145	202	'result' => false,
146	203	'error_code' => 'security_check',
147	204	'error_message' => __('You are not allowed to run this command.', 'wp-optimize')
148		- ));
	205	+ );
	206	+
	207	+ if ($send) {
	208	+ wp_send_json($error);
	209	+ } else {
	210	+ return $error;
	211	+ }
149	212	}
150	213
151	214	/**
152	215	* Checks whether subaction is a valid multisite command
		@@ -163,14 +226,20 @@
163	226
164	227	/**
165	228	* Send invalid multisite command error response to browser and die
166	229	*/
167		- private function send_invalid_multisite_command_error_response() {
168		- wp_send_json(array(
	230	+ private function send_invalid_multisite_command_error_response($send = true) {
	231	+ $error = array(
169	232	'result' => false,
170	233	'error_code' => 'update_failed',
171	234	'error_message' => __('Options can only be saved by network admin', 'wp-optimize')
172		- ));
	235	+ );
	236	+
	237	+ if ($send) {
	238	+ wp_send_json($error);
	239	+ } else {
	240	+ return $error;
	241	+ }
173	242	}
174	243
175	244	/**
176	245	* Checks if subaction is a notice dismissal or not
		@@ -206,9 +275,9 @@
206	275	if (in_array($this->subaction, array('dismiss_dash_notice_until', 'dismiss_season'))) {
207	276	$options->update_option($this->subaction, (time() + 366 * 86400));
208	277	} elseif (in_array($this->subaction, array('dismiss_page_notice_until', 'dismiss_notice'))) {
209	278	$options->update_option($this->subaction, (time() + 84 * 86400));
210		- } elseif ('dismiss_review_notice' == $this->subaction) {
	279	+ } elseif ('dismiss_review_notice' === $this->subaction) {
211	280	if (empty($this->data['dismiss_forever'])) {
212	281	$options->update_option($this->subaction, time() + 84 * 86400);
213	282	} else {
214	283	$options->update_option($this->subaction, 100 * (365.25 * 86400));
		@@ -219,9 +288,9 @@
219	288	/**
220	289	* Sets commands property value
221	290	*/
222	291	private function set_commands() {
223		- $this->commands = new WP_Optimize_Commands();
	292	+ $this->commands = apply_filters('wpo_premium_ajax_commands', new WP_Optimize_Commands());
224	293
225	294	$minify_commands = $this->get_minify_commands();
226	295	if ($this->is_subaction_a_minify_command($minify_commands)) {
227	296	$this->commands = $minify_commands;
		@@ -290,9 +359,9 @@
290	359	/**
291	360	* Log an error message for invalid ajax command
292	361	*/
293	362	private function add_invalid_command_error_log_entry() {
294		- error_log("WP-Optimize: ajax_handler: no such command (" . $this->subaction . ")");
	363	+ error_log("WP-Optimize: ajax_handler: no such command (" . $this->subaction . ")"); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Edge case, used for debugging
295	364	}
296	365
297	366	/**
298	367	* Set `results` property with error response array for invalid ajax command
		@@ -302,8 +371,9 @@
302	371	private function set_invalid_command_error_response() {
303	372	$this->results = array(
304	373	'result' => false,
305	374	'error_code' => 'command_not_found',
	375	+ // translators: %s is an ajax command name
306	376	'error_message' => sprintf(__('The command "%s" was not found', 'wp-optimize'), $this->subaction)
307	377	);
308	378	}
309	379
		@@ -365,9 +435,9 @@
365	435	'error_message' => 'json_encode error : ' . $json_last_error,
366	436	'error_data' => '',
367	437	);
368	438
369		- $this->results = json_encode($this->results);
	439	+ $this->results = wp_json_encode($this->results);
370	440	}
371	441
372	442	/**
373	443	* Json encode the `results` property value
		@@ -372,9 +442,9 @@
372	442	/**
373	443	* Json encode the `results` property value
374	444	*/
375	445	private function json_encode_results() {
376		- $this->results = json_encode($this->results);
	446	+ $this->results = wp_json_encode($this->results);
377	447	}
378	448	}
379	449
380	450	endif;