Skip to content

Commit 005bf2b

Browse files
evgenyvolfertsevgenyvolferts
committed
Add nonces in admin-ajax.php
1 parent 5f06910 commit 005bf2b

File tree

8 files changed

+203
-17
lines changed

8 files changed

+203
-17
lines changed

‎class.tilda-admin.php‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -458,6 +458,10 @@ public static function ajax_add_new_key() {
458458
wp_die( '<p>' . __( 'You need a higher level of permission.' ) . '<p>', 403 );
459459
}
460460

461+
if ( ! wp_verify_nonce( $_POST['t_nonce'], 't_add_new_key' ) ) {
462+
wp_die( '<p>' . __( 'Invalid request' ) . '<p>', 403 );
463+
}
464+
461465
$request = Tilda_Admin::options_sanitize( $_POST );
462466
$defaults = [
463467
'store_html_only' => true,
@@ -517,6 +521,10 @@ public static function ajax_delete_key() {
517521
wp_die( '<p>' . __( 'You need a higher level of permission.' ) . '<p>', 403 );
518522
}
519523

524+
if ( ! wp_verify_nonce( $_GET['t_nonce'], 't_delete_key' ) ) {
525+
wp_die( '<p>' . __( 'Invalid request' ) . '<p>', 403 );
526+
}
527+
520528
$request = Tilda_Admin::options_sanitize( $_GET );
521529

522530
if ( ! isset( $request['id'] ) ) {
@@ -539,6 +547,10 @@ public static function ajax_update_key() {
539547
wp_die( '<p>' . __( 'You need a higher level of permission.' ) . '<p>', 403 );
540548
}
541549

550+
if ( ! wp_verify_nonce( $_GET['t_nonce'], 't_update_key' ) ) {
551+
wp_die( '<p>' . __( 'Invalid request' ) . '<p>', 403 );
552+
}
553+
542554
$request = Tilda_Admin::options_sanitize( $_GET );
543555

544556
if ( ! isset( $request['id'] ) ) {
@@ -568,6 +580,10 @@ public static function ajax_refresh_key() {
568580
wp_die( '<p>' . __( 'You need a higher level of permission.' ) . '<p>', 403 );
569581
}
570582

583+
if ( ! wp_verify_nonce( $_GET['t_nonce'], 't_refresh_key' ) ) {
584+
wp_die( '<p>' . __( 'Invalid request' ) . '<p>', 403 );
585+
}
586+
571587
$request = Tilda_Admin::options_sanitize( $_GET );
572588

573589
if ( empty( $request['id'] ) ) {
@@ -605,6 +621,10 @@ public static function ajax_get_projects() {
605621
wp_die( '<p>' . __( 'You need a higher level of permission.' ) . '<p>', 403 );
606622
}
607623

624+
if ( ! wp_verify_nonce( $_GET['t_nonce'], 't_get_projects' ) ) {
625+
wp_die( '<p>' . __( 'Invalid request' ) . '<p>', 403 );
626+
}
627+
608628
$projects = Tilda::get_local_projects();
609629
if ( empty( $projects ) ) {
610630
$projects = [];
@@ -620,6 +640,10 @@ public static function ajax_update_project() {
620640
wp_die( '<p>' . __( 'You need a higher level of permission.' ) . '<p>', 403 );
621641
}
622642

643+
if ( ! wp_verify_nonce( $_POST['t_nonce'], 't_update_project' ) ) {
644+
wp_die( '<p>' . __( 'Invalid request' ) . '<p>', 403 );
645+
}
646+
623647
$request = Tilda_Admin::project_sanitize( $_POST );
624648

625649
if ( ! isset( $request['id'] ) ) {
@@ -646,6 +670,10 @@ public static function ajax_get_keys() {
646670
wp_die( '<p>' . __( 'You need a higher level of permission.' ) . '<p>', 403 );
647671
}
648672

673+
if ( ! wp_verify_nonce( $_POST['t_nonce'], 't_get_keys' ) ) {
674+
wp_die( '<p>' . __( 'Invalid request' ) . '<p>', 403 );
675+
}
676+
649677
wp_send_json( Tilda::get_local_keys(), 200 );
650678
}
651679

@@ -657,6 +685,10 @@ public static function ajax_update_common_settings() {
657685
wp_die( '<p>' . __( 'You need a higher level of permission.' ) . '<p>', 403 );
658686
}
659687

688+
if ( ! wp_verify_nonce( $_POST['t_nonce'], 't_update_common_settings' ) ) {
689+
wp_die( '<p>' . __( 'Invalid request' ) . '<p>', 403 );
690+
}
691+
660692
$options = get_option( Tilda_Admin::OPTION_OPTIONS );
661693
$request = Tilda_Admin::options_sanitize( $_POST );
662694

@@ -1362,6 +1394,10 @@ public static function ajax_sync() {
13621394
wp_die( '<p>' . __( 'You need a higher level of permission.' ) . '<p>', 403 );
13631395
}
13641396

1397+
if ( ! wp_verify_nonce( $_POST['t_nonce'], 't_admin_sync' ) ) {
1398+
wp_die( '<p>' . __( 'Invalid request' ) . '<p>', 403 );
1399+
}
1400+
13651401
$arResult = [];
13661402
if ( empty( $_REQUEST['page_id'] ) || empty( $_REQUEST['project_id'] ) || empty( $_REQUEST['post_id'] ) ) {
13671403
$arResult['error'] = __( 'Bad request line. Missing parameter: projectid', 'tilda' );
@@ -1414,6 +1450,10 @@ public static function ajax_export_file() {
14141450
wp_die( '<p>' . __( 'You need a higher level of permission.' ) . '<p>', 403 );
14151451
}
14161452

1453+
if ( ! wp_verify_nonce( $_POST['t_nonce'], 't_admin_export_file' ) ) {
1454+
wp_die( '<p>' . __( 'Invalid request' ) . '<p>', 403 );
1455+
}
1456+
14171457
if ( empty( self::$ts_start_plugin ) ) {
14181458
self::$ts_start_plugin = time();
14191459
}
@@ -1498,6 +1538,10 @@ public static function ajax_switcher_status() {
14981538
wp_die( '<p>' . __( 'You need a higher level of permission.' ) . '<p>', 403 );
14991539
}
15001540

1541+
if ( ! wp_verify_nonce( $_POST['t_nonce'], 't_admin_switcher_status' ) ) {
1542+
wp_die( '<p>' . __( 'Invalid request' ) . '<p>', 403 );
1543+
}
1544+
15011545
if (
15021546
empty( $_REQUEST['post_id'] )
15031547
|| empty( $_REQUEST['tilda_status'] )

‎js/configuration.js‎

Lines changed: 51 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -145,23 +145,23 @@
145145
w.switchStore = function (element, id) {
146146
var checkbox = $('#store_checkbox_' + id);
147147
var current = checkbox.prop('checked');
148-
$('#store_checkbox_' + id).prop('checked', !current);
148+
checkbox.prop('checked', !current);
149149
$(element).attr('src', (!current) ? imgSwitcherOn : imgSwitcherOff);
150150
ajaxChangeKey(id, 'store_html_only', !current);
151151
}
152152

153153
w.switchApplyCss = function (element, id) {
154154
var checkbox = $('#apply_css_checkbox_' + id);
155155
var current = checkbox.prop('checked');
156-
$('#apply_css_checkbox_' + id).prop('checked', !current);
156+
checkbox.prop('checked', !current);
157157
$(element).attr('src', (!current) ? imgSwitcherOn : imgSwitcherOff);
158158
ajaxChangeKey(id, 'apply_css_in_list', !current);
159159
}
160160

161161
w.switchEnableProject = function (element, id) {
162162
var checkbox = $('#project_enable_checkbox_' + id);
163163
var current = checkbox.prop('checked');
164-
$('#project_enable_checkbox_' + id).prop('checked', !current);
164+
checkbox.prop('checked', !current);
165165
$(element).attr('src', (!current) ? imgSwitcherOn : imgSwitcherOff);
166166
ajaxChangeProjectEnabled(id, !current);
167167
}
@@ -204,38 +204,77 @@
204204

205205
function ajaxGetKeyList() {
206206
return new Promise(function (resolve) {
207-
$.post(w.ajaxurl, {action: 'get_keys'}, resolve);
207+
$.post(
208+
w.ajaxurl,
209+
{
210+
action: 'get_keys',
211+
t_nonce: $("#t_get_keys_nonce").val()
212+
},
213+
resolve
214+
);
208215
});
209216
}
210217

211218
function ajaxGetProjectList() {
212219
return new Promise(function (resolve) {
213-
$.get(w.ajaxurl, {action: 'get_projects'}, resolve);
220+
$.get(
221+
w.ajaxurl,
222+
{
223+
action: 'get_projects',
224+
t_nonce: $("#t_get_projects_nonce").val()
225+
},
226+
resolve
227+
);
214228
});
215229
}
216230

217231
function ajaxKeyRefresh(id) {
218232
return new Promise(function (resolve) {
219-
$.get(w.ajaxurl, {action: 'refresh_key', id: id}, resolve);
233+
$.get(
234+
w.ajaxurl,
235+
{
236+
action: 'refresh_key',
237+
id: id,
238+
t_nonce: $("#t_refresh_key_nonce").val()
239+
},
240+
resolve
241+
);
220242
});
221243
}
222244

223245
function ajaxKeyDelete(id) {
224246
return new Promise(function (resolve) {
225-
$.get(w.ajaxurl, {action: 'delete_key', id: id}, resolve);
247+
$.get(
248+
w.ajaxurl,
249+
{
250+
action: 'delete_key',
251+
id: id,
252+
t_nonce: $("#t_delete_key_nonce").val()
253+
},
254+
resolve
255+
);
226256
});
227257
}
228258

229259
function ajaxChangeKey(id, param_name, param_value) {
230-
var data = {action: 'update_key', id: id};
260+
var data = {
261+
action: 'update_key',
262+
id: id,
263+
t_nonce: $("#t_update_key_nonce").val()
264+
};
231265
data[param_name] = param_value;
232266
return new Promise(function (resolve) {
233267
$.get(w.ajaxurl, data, resolve);
234268
});
235269
}
236270

237271
function ajaxChangeProjectEnabled(id, newvalue) {
238-
var data = {action: 'update_project', id: id, enabled: newvalue};
272+
var data = {
273+
action: 'update_project',
274+
id: id,
275+
enabled: newvalue,
276+
t_nonce: $("#t_update_project_nonce").val()
277+
};
239278
return new Promise(function (resolve) {
240279
$.post(w.ajaxurl, data, resolve);
241280
});
@@ -248,6 +287,7 @@
248287
secret_key: secret_key,
249288
store_html_only: store_html_only,
250289
apply_css_in_list: apply_css_in_list,
290+
t_nonce: $("#t_add_new_key_nonce").val()
251291
}
252292
return new Promise(function(resolve, reject){
253293
$.post(w.ajaxurl, data)
@@ -268,7 +308,8 @@
268308
var data = {
269309
action: 'tilda_admin_update_common_settings',
270310
enabledposttypes: enabledposttypes,
271-
storageforfiles: $commonSettingsForm.storageforfiles.val()
311+
storageforfiles: $commonSettingsForm.storageforfiles.val(),
312+
t_nonce: $("#t_update_common_settings_nonce").val()
272313
};
273314

274315
return new Promise(function (resolve) {

‎js/plugin.js‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,10 @@
6767
$tilda_status.val(val);
6868

6969
var data = {
70-
'action': 'tilda_admin_switcher_status',
71-
'tilda_status': val,
72-
'post_id': $('#post_ID').val()
70+
action: 'tilda_admin_switcher_status',
71+
tilda_status: val,
72+
post_id: $('#post_ID').val(),
73+
t_nonce: $("#t_admin_switcher_status_nonce").val()
7374
};
7475

7576
$.post('admin-ajax.php', data, function(json) {
@@ -135,6 +136,7 @@
135136
function tilda_export_files() {
136137
var data = {
137138
action: 'tilda_admin_export_file',
139+
t_nonce: $("#t_admin_export_file_nonce").val()
138140
};
139141

140142
$.post('admin-ajax.php', data, function(json) {
@@ -173,7 +175,8 @@
173175
action: 'tilda_admin_sync',
174176
project_id: $project_id,
175177
page_id: $page_id,
176-
post_id: $post_id
178+
post_id: $post_id,
179+
t_nonce: $("#t_admin_sync_nonce").val()
177180
};
178181

179182
$('#tilda_progress_bar').hide();

‎readme.txt‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ Donate link: https://wordpress.org/plugins/tilda-publishing/
44
Tags: blog, bulk, convert, crawl, data, import, importer, migrate, move, posts, publishing, tilda, export
55
Requires at least: 3.0.1
66
Tested up to: 6.4.3
7-
Stable tag: 0.3.23
7+
Stable tag: 0.3.24
88
License: GPLv2 or later
99
License URI: http://www.gnu.org/licenses/gpl-2.0.html
1010

@@ -62,6 +62,9 @@ A: Please create an issue on the [GitHub page](https://github.com/TildaPublishin
6262

6363
== Changelog ==
6464

65+
= 0.3.24 =
66+
* Add nonces in admin-ajax.php
67+
6568
= 0.3.23 =
6669
* Fix unicode in zero forms
6770

‎tilda-wordpress-plugin.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,13 @@
22
/*
33
Plugin Name: Tilda Publishing
44
Description: Tilda позволяет делать яркую подачу материала, качественную верстку и эффектную типографику, близкую к журнальной. Каким бы ни был ваш контент — Tilda знает, как его показать. С чего начать: 1) Нажмите ссылку «Активировать» слева от этого описания; 2) <a href="http://www.tilda.cc/" target="_blank">Зарегистрируйтесь</a>, чтобы получить API-ключ; 3) Перейдите на страницу настройки Tilda Publishing и введите свой API-ключ. Читайте подробную инструкцию по подключению.
5-
Version: 0.3.23
5+
Version: 0.3.24
66
Author: Tilda Publishing
77
License: GPLv2 or later
88
Text Domain: api tilda
99
10+
Update 0.3.24 - add nonces in admin-ajax.php
11+
1012
Update 0.3.23 - fix unicode in zero forms
1113
1214
Update 0.3.22 - fix cURL encoding
@@ -128,7 +130,7 @@
128130
exit;
129131
}
130132

131-
define( 'TILDA_VERSION', '0.3.23' );
133+
define( 'TILDA_VERSION', '0.3.24' );
132134
define( 'TILDA_MINIMUM_WP_VERSION', '3.1' );
133135
define( 'TILDA_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
134136
define( 'TILDA_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

0 commit comments

Comments
 (0)