← All changes | App/Classes/Freemius.php +5 -0 3.5.8 → 3.5.9 View file →

		@@ -105,8 +105,13 @@
105	105	/**
106	106	* Prevent request parameters from overriding trusted pricing-page config.
107	107	*/
108	108	public static function sanitizePricingRequest() : void {
	109	+ // Only sanitize when rendering the pricing page — never on admin-ajax,
	110	+ // where the pricing JS legitimately passes these same params (incl. `action`).
	111	+ if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
	112	+ return;
	113	+ }
109	114	$page = ( isset( $_GET['page'] ) && is_string( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : '' );
110	115	if ( SLUG . '-pricing' !== $page ) {
111	116	return;
112	117	}