← All changes | admin/class-wpstream-admin.php +12 -48 4.12.2 → 4.11.1 View file →

		@@ -182,9 +182,8 @@
182	182	wp_enqueue_script('wpstream-admin-control', plugin_dir_url( __FILE__ ) .'js/admin_control.js?v='.time(),array(), WPSTREAM_PLUGIN_VERSION, true);
183	183	wp_localize_script('wpstream-admin-control', 'wpstream_admin_control_vars',
184	184	array(
185	185	'admin_url' => get_admin_url(),
186		- 'multipart_upload_nonce' => wp_create_nonce( 'wpstream_multipart_upload_nonce' ),
187	186	'loading_url' => WPSTREAM_PLUGIN_DIR_URL.'/img/loading.gif',
188	187	'download_mess' => esc_html__('Click to download!','wpstream'),
189	188	'uploading' => esc_html__('We are uploading your file. Do not close this window!','wpstream'),
190	189	'upload_complete2' => esc_html__('Upload Complete! You can upload another file!','wpstream'),
		@@ -644,10 +643,8 @@
644	643	$obs_stream = get_post_meta($the_id,'obs_stream',true);
645	644	$webcaster_url = get_post_meta($the_id,'webcaster_url',true);
646	645	$rtmp_ip_uri = '';
647	646
648		- $ajax_nonce = wp_create_nonce( 'wpstream_start_event_nonce' );
649		- print '<input type="hidden" id="wpstream_start_event_nonce" value="'.$ajax_nonce.'">';
650	647	print '<div class="event_list_unit '.$live_class.' '.$pending_streaming_class.' event_unit_style_'.esc_attr($is_front).'" data-show-id="'.intval($the_id).'" data-server-id="'.$server_id.'" data-server-url="'.$rtmp_ip_uri.'"">';
651	648
652	649	print '<div class="wpstream_channel_status">'.$channel_status.'</div>';
653	650
		@@ -665,9 +662,10 @@
665	662	print '<div class="wpstream_channel_item_id">'.esc_html( '#ID' ).' '.$the_id.'</div>';
666	663	print '</div>';
667	664
668	665
669		- print '<div class="start_event wpstream_button wpstream_tooltip_wrapper" data-show-id="'.$the_id.'" data-nonce="' . esc_attr( $ajax_nonce ) . '" > ' . $button_status;
	666	+ $start_event_nonce = wp_create_nonce( 'wpstream_start_event_nonce' );
	667	+ print '<div class="start_event wpstream_button wpstream_tooltip_wrapper" data-show-id="'.$the_id.'" data-nonce="' . esc_attr( $start_event_nonce ) . '" > ' . $button_status;
670	668	print '<div class="wpstream_tooltip">'.esc_html__('Channel is now OFF. Click to turn ON.','wpestream').'</div>';
671	669	print '</div>';
672	670
673	671	print '<div class="wpstream_options_col1 wpstream_stream_browser_wrapper">';
		@@ -2552,9 +2550,8 @@
2552	2550
2553	2551	public function wpstream_publish_wpstream_product($post_id,$post){
2554	2552	if( $post->post_type == 'wpstream_product' ){
2555	2553	update_post_meta ($post_id,'local_event_options_test','working_on_'.$post_id);
2556		- update_post_meta ($post_id, 'use_global_event_options', true);
2557	2554	$to_save_option=array();
2558	2555
2559	2556	$global_options= get_option('wpstream_user_streaming_global_channel_options');
2560	2557
		@@ -3149,10 +3146,9 @@
3149	3146
3150	3147	$plugin_slug = 'wpstream/wpstream.php';
3151	3148	$update_data = get_site_transient('update_plugins');
3152	3149
3153		- if ( is_object( $update_data ) &&
3154		- property_exists( $update_data, 'response' ) &&
	3150	+ if ( property_exists( $update_data, 'response' ) &&
3155	3151	is_array($update_data->response) &&
3156	3152	key_exists($plugin_slug, $update_data->response)
3157	3153	) {
3158	3154	$new_version = $update_data->response[$plugin_slug]->new_version;
		@@ -3481,13 +3477,12 @@
3481	3477	<span class="" ><?php esc_html_e('We\'ll send the password to the email you attached. ', 'wpstream') ?></span>
3482	3478	</div>
3483	3479
3484	3480
3485		- <!-- Altcha Widget (requires HTTPS/secure context) -->
3486		- <?php if ( isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' ) : ?>
	3481	+ <!-- Altcha Widget -->
3487	3482	<script async defer src="https://cdn.jsdelivr.net/gh/altcha-org/altcha/dist/altcha.min.js" type="module"></script>
3488	3483	<div class="wpstream_option" style="display:none;">
3489		- <altcha-widget
	3484	+ <altcha-widget
3490	3485	challengeurl="<?php echo esc_url( WPSTREAM_API . '/v2/user/getcaptcha' ); ?>"
3491	3486	name="altcha"
3492	3487	auto="onload"
3493	3488	hidefooter
		@@ -3494,9 +3489,8 @@
3494	3489	hidelogo
3495	3490	strings='{"label": "<?php esc_html_e('I am not a robot', 'wpstream'); ?>", "error": "<?php esc_html_e('Verification failed', 'wpstream'); ?>", "wait": "<?php esc_html_e('Verifying...', 'wpstream'); ?>"}'
3496	3491	></altcha-widget>
3497	3492	</div>
3498		- <?php endif; ?>
3499	3493
3500	3494	<div class="wpstream_option wpstream_terms_agreement">
3501	3495	<!-- Add "by registering you agree to the privacy terms" checkbox-->
3502	3496	<input id="wpstream_register_privacy" type="checkbox" name="wpstream_register_privacy" />
		@@ -4099,10 +4093,8 @@
4099	4093	$password = $_POST['api_password'];
4100	4094	update_option('wpstream_api_username',$username);
4101	4095	update_option('wpstream_api_password',$password);
4102	4096
4103		- delete_transient( 'wpstream_token_api' );
4104		-
4105	4097	$token = $this->main->wpstream_live_connection->wpstream_get_token();
4106	4098	$videos_list = $this->main->wpstream_live_connection->wpstream_get_videos();
4107	4099	// cleanup any previous echo before sending json
4108	4100	ob_end_clean();
		@@ -4132,35 +4124,14 @@
4132	4124	}
4133	4125
4134	4126
4135	4127	public function wpstream_register_refresh_capthca(){
4136		-
	4128	+
4137	4129	if(current_user_can('administrator')){
4138		-
	4130	+
4139	4131	}
4140	4132	}
4141	4133
4142		- /**
4143		- * AJAX proxy: fetch a captcha challenge from the baker API and return it.
4144		- * Used on HTTP sites where the Altcha widget cannot run (requires Web Crypto / HTTPS).
4145		- * The JS side solves the PoW locally and sends back the full base64 Altcha payload.
4146		- */
4147		- public function wpstream_get_captcha_challenge() {
4148		- $api_url = WPSTREAM_API . '/v2/user/getcaptcha';
4149		- $response = wp_remote_get( $api_url, array( 'timeout' => 10 ) );
4150		-
4151		- if ( is_wp_error( $response ) ) {
4152		- echo json_encode( array( 'success' => false, 'error' => 'Could not reach captcha service.' ) );
4153		- die();
4154		- }
4155		-
4156		- $body = wp_remote_retrieve_body( $response );
4157		- // Forward the challenge JSON directly to the browser
4158		- header( 'Content-Type: application/json' );
4159		- echo $body;
4160		- die();
4161		- }
4162		-
4163	4134	/**
4164	4135	* @param $challenge
4165	4136	* @param $difficulty
4166	4137	*
		@@ -4198,18 +4169,15 @@
4198	4169	echo json_encode($validate);
4199	4170	die();
4200	4171	}
4201	4172
4202		- $wpstream_altcha = isset($_POST['wpstream_altcha']) ? trim( $_POST['wpstream_altcha'] ) : '';
4203		- $is_https = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';
	4173	+ $wpstream_altcha = isset($_POST['wpstream_altcha']) ? $_POST['wpstream_altcha'] : '';
4204	4174
4205	4175	if ( empty($wpstream_altcha) ) {
4206		- if ( $is_https ) {
4207		- $message = esc_html__('Captcha verification failed. Please try again.', 'wpstream');
4208		- } else {
4209		- $message = esc_html__('Security check not ready yet. Please wait a moment and try again.', 'wpstream');
4210		- }
4211		- echo json_encode( array( 'success' => false, 'message' => $message ) );
	4176	+ echo json_encode(array(
	4177	+ 'success' => false,
	4178	+ 'message' => esc_html__('Captcha verification failed. Please try again.', 'wpstream')
	4179	+ ));
4212	4180	die();
4213	4181	}
4214	4182
4215	4183	$url='v2/user/create';
		@@ -4347,10 +4315,8 @@
4347	4315	*
4348	4316	* @since 3.0.1
4349	4317	*/
4350	4318	public function handle_initiate_multipart_upload() {
4351		- check_ajax_referer( 'wpstream_multipart_upload_nonce', 'security' );
4352		-
4353	4319	// Security check - only admins can do this
4354	4320	if (!current_user_can('administrator')) {
4355	4321	wp_send_json_error('Unauthorized access');
4356	4322	return;
		@@ -4410,10 +4376,8 @@
4410	4376	*
4411	4377	* @since 3.0.1
4412	4378	*/
4413	4379	public function handle_complete_multipart_upload() {
4414		- check_ajax_referer( 'wpstream_multipart_upload_nonce', 'security' );
4415		-
4416	4380	// Security check - only admins can do this
4417	4381	if (!current_user_can('administrator')) {
4418	4382	wp_send_json_error('Unauthorized access');
4419	4383	return;