| @@ -14,8 +14,37 @@ | ||
| 14 | 14 | use const WPIDE\Constants\NAME; |
| 15 | 15 | use const WPIDE\Constants\SLUG; |
| 16 | 16 | use const WPIDE\Constants\VERSION; |
| 17 | 17 | class Freemius { |
| 18 | + private const RESERVED_PRICING_REQUEST_PARAMETERS = [ | |
| 19 | + 'action', | |
| 20 | + 'bundle_id', | |
| 21 | + 'contact_url', | |
| 22 | + 'disable_single_package', | |
| 23 | + 'fs_wp_endpoint_url', | |
| 24 | + 'home_url', | |
| 25 | + 'is_production', | |
| 26 | + 'license', | |
| 27 | + 'menu_slug', | |
| 28 | + 'mode', | |
| 29 | + 'module_id', | |
| 30 | + 'plugin_icon', | |
| 31 | + 'plugin_id', | |
| 32 | + 'plugin_public_key', | |
| 33 | + 'plugin_version', | |
| 34 | + 'pricing_action', | |
| 35 | + 'request_handler_url', | |
| 36 | + 's_ctx_id', | |
| 37 | + 's_ctx_secure', | |
| 38 | + 's_ctx_ts', | |
| 39 | + 's_ctx_type', | |
| 40 | + 'sandbox', | |
| 41 | + 'security', | |
| 42 | + 'selector', | |
| 43 | + 'show_annual_in_monthly', | |
| 44 | + 'unique_affix' | |
| 45 | + ]; | |
| 46 | + | |
| 18 | 47 | public static $fs; |
| 19 | 48 | |
| 20 | 49 | public static $api; |
| 21 | 50 | |
| @@ -25,8 +54,9 @@ | ||
| 25 | 54 | * @throws \Freemius_Exception |
| 26 | 55 | */ |
| 27 | 56 | public static function init() { |
| 28 | 57 | if ( !isset( self::$fs ) ) { |
| 58 | + self::sanitizePricingRequest(); | |
| 29 | 59 | if ( !defined( 'WP_FS__PRODUCT_' . FS_ID . '_MULTISITE' ) ) { |
| 30 | 60 | define( 'WP_FS__PRODUCT_' . FS_ID . '_MULTISITE', true ); |
| 31 | 61 | } |
| 32 | 62 | // Init Freemius SDK. |
| @@ -68,8 +98,26 @@ | ||
| 68 | 98 | add_action( 'admin_enqueue_scripts', [__CLASS__, 'admin_enqueue_scripts'] ); |
| 69 | 99 | self::$loaded = true; |
| 70 | 100 | // Signal that SDK was initiated. |
| 71 | 101 | do_action( 'wpide_fs_loaded' ); |
| 102 | + } | |
| 103 | + } | |
| 104 | + | |
| 105 | + /** | |
| 106 | + * Prevent request parameters from overriding trusted pricing-page config. | |
| 107 | + */ | |
| 108 | + public static function sanitizePricingRequest() : void { | |
| 109 | + // Only sanitize when rendering the pricing page — never on admin-ajax, | |
| 110 | + // where the pricing JS legitimately passes these same params (incl. `action`). | |
| 111 | + if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) { | |
| 112 | + return; | |
| 113 | + } | |
| 114 | + $page = ( isset( $_GET['page'] ) && is_string( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : '' ); | |
| 115 | + if ( SLUG . '-pricing' !== $page ) { | |
| 116 | + return; | |
| 117 | + } | |
| 118 | + foreach ( self::RESERVED_PRICING_REQUEST_PARAMETERS as $parameter ) { | |
| 119 | + unset($_GET[$parameter], $_REQUEST[$parameter]); | |
| 72 | 120 | } |
| 73 | 121 | } |
| 74 | 122 | |
| 75 | 123 | public static function admin_enqueue_scripts() { |
