← All changes | includes/class-wpo-ajax.php +33 -30 3.3.2 → 4.7.0 View file →

		@@ -22,13 +22,25 @@
22	22	* Constructor
23	23	*/
24	24	private function __construct() {
25	25	add_action('wp_ajax_wp_optimize_ajax', array($this, 'handle_ajax_requests'));
26		-
27		- add_filter('wp_optimize_heartbeat', array($this, 'handle_heartbeat_requests'), 10, 1);
	26	+ add_filter('wp_optimize_heartbeat_ajax', array($this, 'handle_heartbeat_requests'));
	27	+ add_filter('wp_optimize_is_heartbeat_valid_ajax_command', array($this, 'is_heartbeat_command_valid'));
28	28	}
29	29
30	30	/**
	31	+ * Check if a command is valid for this class
	32	+ *
	33	+ * @param string $command
	34	+ * @return bool
	35	+ */
	36	+ public function is_heartbeat_command_valid($command) {
	37	+ $this->set_heartbeat_subaction($command);
	38	+ $this->set_commands();
	39	+ return !$this->is_invalid_command();
	40	+ }
	41	+
	42	+ /**
31	43	* Return singleton instance
32	44	*
33	45	* @return WPO_Ajax Returns WPO_Ajax object
34	46	*/
		@@ -48,15 +60,15 @@
48	60	*/
49	61	public function handle_heartbeat_requests($action) {
50	62	$this->set_heartbeat_subaction($action);
51	63
52		- if (!$this->is_user_capable()) {
53		- return json_encode($this->send_user_capability_error_response(false));
	64	+ if (!WP_Optimize()->current_user_can()) {
	65	+ return wp_json_encode($this->send_user_capability_error_response(false));
54	66	}
55	67
56		- if (is_multisite() && !current_user_can('manage_network_options')) {
	68	+ if (is_multisite() && !WP_Optimize()->current_user_can('manage_network_options')) {
57	69	if (!$this->is_valid_multisite_command()) {
58		- return json_encode($this->send_invalid_multisite_command_error_response(false));
	70	+ return wp_json_encode($this->send_invalid_multisite_command_error_response(false));
59	71	}
60	72	}
61	73
62	74	$this->set_commands();
		@@ -93,13 +105,13 @@
93	105	if (!$this->is_valid_request()) {
94	106	$this->send_security_check_failed_error_response();
95	107	}
96	108
97		- if (!$this->is_user_capable()) {
	109	+ if (!WP_Optimize()->current_user_can()) {
98	110	$this->send_user_capability_error_response();
99	111	}
100	112
101		- if (is_multisite() && !current_user_can('manage_network_options')) {
	113	+ if (is_multisite() && !WP_Optimize()->current_user_can('manage_network_options')) {
102	114	if (!$this->is_valid_multisite_command()) {
103	115	$this->send_invalid_multisite_command_error_response();
104	116	}
105	117	}
		@@ -125,9 +137,9 @@
125	137	if ($json_last_error) {
126	138	$this->set_error_response_on_json_encode_error($json_last_error);
127	139	}
128	140
129		- echo $this->results;
	141	+ echo $this->results; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Output already escaped
130	142	die;
131	143	}
132	144
133	145	/**
		@@ -133,9 +145,9 @@
133	145	/**
134	146	* Sets nonce property value
135	147	*/
136	148	private function set_nonce() {
137		- $this->nonce = empty($_POST['nonce']) ? '' : $_POST['nonce'];
	149	+ $this->nonce = empty($_POST['nonce']) ? '' : sanitize_key(wp_unslash($_POST['nonce'])); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- is_valid_request() checks nonce
138	150	}
139	151
140	152	/**
141	153	* Sets subaction property value
		@@ -140,9 +152,9 @@
140	152	/**
141	153	* Sets subaction property value
142	154	*/
143	155	private function set_subaction() {
144		- $this->subaction = empty($_POST['subaction']) ? '' : stripcslashes($_POST['subaction']);
	156	+ $this->subaction = empty($_POST['subaction']) ? '' : sanitize_key(wp_unslash($_POST['subaction'])); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- is_valid_request() checks nonce
145	157	}
146	158
147	159	/**
148	160	* Sets heartbeat subaction property value
		@@ -156,9 +168,9 @@
156	168	/**
157	169	* Sets data property value
158	170	*/
159	171	private function set_data() {
160		- $this->data = isset($_POST['data']) ? stripslashes_deep($_POST['data']) : null;
	172	+ $this->data = isset($_POST['data']) ? stripslashes_deep($_POST['data']) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- is_valid_request() checks nonce, sanitization takes place later
161	173	}
162	174
163	175	/**
164	176	* Checks whether the request is valid or not
		@@ -179,22 +191,12 @@
179	191	'error_message' => __('The security check failed; try refreshing the page.', 'wp-optimize')
180	192	));
181	193	}
182	194
183		-
184	195	/**
185		- * Checks whether current user capable of doing this action or not
186		- *
187		- * @return bool
188		- */
189		- private function is_user_capable() {
190		- return current_user_can(WP_Optimize()->capability_required());
191		- }
192		-
193		- /**
194	196	* Send user capability check failed error response to browser and possibly die
195	197	*
196		- * @param Boolean $send - if true, then the response is output; otherwise, it is returned
	198	+ * @param boolean $send - if true, then the response is output; otherwise, it is returned
197	199	*/
198	200	private function send_user_capability_error_response($send = true) {
199	201	$error = array(
200	202	'result' => false,
		@@ -201,9 +203,9 @@
201	203	'error_code' => 'security_check',
202	204	'error_message' => __('You are not allowed to run this command.', 'wp-optimize')
203	205	);
204	206
205		- if (true == $send) {
	207	+ if ($send) {
206	208	wp_send_json($error);
207	209	} else {
208	210	return $error;
209	211	}
		@@ -231,9 +233,9 @@
231	233	'error_code' => 'update_failed',
232	234	'error_message' => __('Options can only be saved by network admin', 'wp-optimize')
233	235	);
234	236
235		- if (true == $send) {
	237	+ if ($send) {
236	238	wp_send_json($error);
237	239	} else {
238	240	return $error;
239	241	}
		@@ -273,9 +275,9 @@
273	275	if (in_array($this->subaction, array('dismiss_dash_notice_until', 'dismiss_season'))) {
274	276	$options->update_option($this->subaction, (time() + 366 * 86400));
275	277	} elseif (in_array($this->subaction, array('dismiss_page_notice_until', 'dismiss_notice'))) {
276	278	$options->update_option($this->subaction, (time() + 84 * 86400));
277		- } elseif ('dismiss_review_notice' == $this->subaction) {
	279	+ } elseif ('dismiss_review_notice' === $this->subaction) {
278	280	if (empty($this->data['dismiss_forever'])) {
279	281	$options->update_option($this->subaction, time() + 84 * 86400);
280	282	} else {
281	283	$options->update_option($this->subaction, 100 * (365.25 * 86400));
		@@ -286,9 +288,9 @@
286	288	/**
287	289	* Sets commands property value
288	290	*/
289	291	private function set_commands() {
290		- $this->commands = new WP_Optimize_Commands();
	292	+ $this->commands = apply_filters('wpo_premium_ajax_commands', new WP_Optimize_Commands());
291	293
292	294	$minify_commands = $this->get_minify_commands();
293	295	if ($this->is_subaction_a_minify_command($minify_commands)) {
294	296	$this->commands = $minify_commands;
		@@ -357,9 +359,9 @@
357	359	/**
358	360	* Log an error message for invalid ajax command
359	361	*/
360	362	private function add_invalid_command_error_log_entry() {
361		- error_log("WP-Optimize: ajax_handler: no such command (" . $this->subaction . ")");
	363	+ error_log("WP-Optimize: ajax_handler: no such command (" . $this->subaction . ")"); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Edge case, used for debugging
362	364	}
363	365
364	366	/**
365	367	* Set `results` property with error response array for invalid ajax command
		@@ -369,8 +371,9 @@
369	371	private function set_invalid_command_error_response() {
370	372	$this->results = array(
371	373	'result' => false,
372	374	'error_code' => 'command_not_found',
	375	+ // translators: %s is an ajax command name
373	376	'error_message' => sprintf(__('The command "%s" was not found', 'wp-optimize'), $this->subaction)
374	377	);
375	378	}
376	379
		@@ -432,9 +435,9 @@
432	435	'error_message' => 'json_encode error : ' . $json_last_error,
433	436	'error_data' => '',
434	437	);
435	438
436		- $this->results = json_encode($this->results);
	439	+ $this->results = wp_json_encode($this->results);
437	440	}
438	441
439	442	/**
440	443	* Json encode the `results` property value
		@@ -439,9 +442,9 @@
439	442	/**
440	443	* Json encode the `results` property value
441	444	*/
442	445	private function json_encode_results() {
443		- $this->results = json_encode($this->results);
	446	+ $this->results = wp_json_encode($this->results);
444	447	}
445	448	}
446	449
447	450	endif;