Skip to content

Replace llms_verify_nonce with standard WP nonce verification #3123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brianhogg merged 1 commit into from
Apr 9, 2026
Merged

Replace llms_verify_nonce with standard WP nonce verification #3123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changelogs/llms-verify-nonce-removal.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
significance: patch
type: changed
entry: Using standard WP nonce check functions instead of llms_verify_nonce.
2 changes: 1 addition & 1 deletion includes/abstracts/abstract.llms.admin.metabox.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -466,7 +466,7 @@ public function register() {
*/
protected function save( $post_id ) {

if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) || ! current_user_can( $this->capability, $post_id ) ) {
if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) || ! current_user_can( $this->capability, $post_id ) ) {
return -1;
}

Expand Down
2 changes: 1 addition & 1 deletion includes/abstracts/llms-abstract-admin-wizard.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,7 +377,7 @@ public function save(): ?WP_Error {
$nonce = "llms_{$this->id}_nonce";
$action = "llms_{$this->id}_save";

if ( ! isset( $_POST[ $nonce ] ) || ! llms_verify_nonce( $nonce, $action ) || ! current_user_can( 'manage_lifterlms' ) ) {
if ( ! isset( $_POST[ $nonce ] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST[ $nonce ] ) ), $action ) || ! current_user_can( 'manage_lifterlms' ) ) {
return null;
}

Expand Down
7 changes: 2 additions & 5 deletions includes/abstracts/llms-abstract-controller-user-engagements.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,11 +158,8 @@ public function maybe_handle_awarded_engagement_sync_actions() {
}

// Verify nonce.
if ( ! llms_verify_nonce(
"_llms_{$this->engagement_type}_sync_actions_nonce",
"llms-{$this->engagement_type}-sync-actions",
'GET'
) ) {
$nonce_field = "_llms_{$this->engagement_type}_sync_actions_nonce";
if ( ! isset( $_REQUEST[ $nonce_field ] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST[ $nonce_field ] ) ), "llms-{$this->engagement_type}-sync-actions" ) ) {
$result = new WP_Error(
"llms-sync-awarded-{$this->engagement_type}s-invalid-nonce",
$this->get_text( self::TEXT_SYNC_AWARDED_ENGAGEMENTS_INVALID_NONCE )
Expand Down
3 changes: 2 additions & 1 deletion includes/abstracts/llms-abstract-email-provider.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -253,7 +253,8 @@ public function ajax_callback_remote_install_verify() {
*/
protected function can_remote_install() {

if ( ! llms_verify_nonce( '_llms_' . $this->id . '_nonce', 'llms-' . $this->id . '-install' ) ) {
$nonce_field = '_llms_' . $this->id . '_nonce';
if ( ! isset( $_REQUEST[ $nonce_field ] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST[ $nonce_field ] ) ), 'llms-' . $this->id . '-install' ) ) {
return array(
'code' => 'llms_' . $this->id . '_install_nonce_failure',
'message' => esc_html__( 'Security check failed.', 'lifterlms' ),
Expand Down
2 changes: 1 addition & 1 deletion includes/admin/class-llms-admin-export-download.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ public function maybe_serve_export() {
}

// Verify nonce.
if ( ! llms_verify_nonce( 'llms_dl_export_nonce', LLMS_Abstract_Exportable_Admin_Table::EXPORT_NONCE_ACTION, 'GET' ) ) {
if ( ! isset( $_REQUEST['llms_dl_export_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms_dl_export_nonce'] ) ), LLMS_Abstract_Exportable_Admin_Table::EXPORT_NONCE_ACTION ) ) {
wp_die( esc_html__( 'Cheatin’ huh?', 'lifterlms' ) );
}

Expand Down
2 changes: 1 addition & 1 deletion includes/admin/class-llms-admin-review.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ public function admin_footer( $text ) {
*/
public function dismiss() {

if ( ! current_user_can( 'manage_lifterlms' ) || ! llms_verify_nonce( 'nonce', 'llms-admin-review-request-dismiss' ) ) {
if ( ! current_user_can( 'manage_lifterlms' ) || ! isset( $_REQUEST['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) ), 'llms-admin-review-request-dismiss' ) ) {
wp_die();
}

Expand Down
2 changes: 1 addition & 1 deletion includes/admin/class.llms.admin.addons.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,7 +239,7 @@ private function get_products_for_cat( $cat, $include_bundles = true ) {
public function handle_actions() {

// Activate & deactivate addons.
if ( llms_verify_nonce( '_llms_manage_addon_nonce', 'llms_manage_addon' ) ) {
if ( isset( $_REQUEST['_llms_manage_addon_nonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_llms_manage_addon_nonce'] ) ), 'llms_manage_addon' ) ) {

$this->handle_manage_addons();
LLMS_Admin_Notices::output_notices();
Expand Down
4 changes: 2 additions & 2 deletions includes/admin/class.llms.admin.import.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ public function add_help_tabs() {
*/
public function cloud_import() {

if ( ! llms_verify_nonce( 'llms_cloud_importer_nonce', 'llms-cloud-importer' ) || ! current_user_can( 'manage_lifterlms' ) ) {
if ( ! isset( $_REQUEST['llms_cloud_importer_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms_cloud_importer_nonce'] ) ), 'llms-cloud-importer' ) || ! current_user_can( 'manage_lifterlms' ) ) {
return false;
}

Expand Down Expand Up @@ -277,7 +277,7 @@ protected function show_error( $error ) {
*/
public function upload_import() {

if ( ! llms_verify_nonce( 'llms_importer_nonce', 'llms-importer' ) || ! current_user_can( 'manage_lifterlms' ) || empty( $_FILES['llms_import'] ) ) {
if ( ! isset( $_REQUEST['llms_importer_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms_importer_nonce'] ) ), 'llms-importer' ) || ! current_user_can( 'manage_lifterlms' ) || empty( $_FILES['llms_import'] ) ) {
return false;
}

Expand Down
2 changes: 1 addition & 1 deletion includes/admin/class.llms.admin.notices.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,7 +246,7 @@ public static function has_notice( $notice_id ) {
*/
public static function hide_notices() {
if ( ( isset( $_GET['llms-hide-notice'] ) || isset( $_GET['llms-remind-notice'] ) ) && isset( $_GET['_llms_notice_nonce'] ) ) {
if ( ! llms_verify_nonce( '_llms_notice_nonce', 'llms_hide_notices_nonce', 'GET' ) ) {
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_llms_notice_nonce'] ) ), 'llms_hide_notices_nonce' ) ) {
wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'lifterlms' ) );
}
if ( ! current_user_can( 'manage_options' ) ) {
Expand Down
4 changes: 2 additions & 2 deletions includes/admin/class.llms.admin.page.status.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ public static function add_core_tools( $tools ) {
*/
private static function do_tool() {

if ( ! llms_verify_nonce( '_wpnonce', 'llms_tool' ) || ! current_user_can( 'manage_lifterlms' ) ) {
if ( ! isset( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'llms_tool' ) || ! current_user_can( 'manage_lifterlms' ) ) {
wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'lifterlms' ) );
}

Expand Down Expand Up @@ -265,7 +265,7 @@ public static function output() {
*/
private static function remove_log_file() {

if ( ! llms_verify_nonce( '_wpnonce', 'delete_log', 'GET' ) || ! current_user_can( 'manage_lifterlms' ) ) {
if ( ! isset( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'delete_log' ) || ! current_user_can( 'manage_lifterlms' ) ) {
wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'lifterlms' ) );
}

Expand Down
2 changes: 1 addition & 1 deletion includes/admin/class.llms.admin.settings.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ public static function get_settings_tabs() {
public static function save() {

global $current_tab;
if ( isset( $_POST['_wpnonce'] ) && ! llms_verify_nonce( '_wpnonce', 'lifterlms-settings' ) ) {
if ( isset( $_POST['_wpnonce'] ) && ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ), 'lifterlms-settings' ) ) {
die( esc_html__( 'Whoa! something went wrong there!. Please refresh the page and retry.', 'lifterlms' ) );
}

Expand Down
2 changes: 1 addition & 1 deletion includes/admin/post-types/class.llms.meta.boxes.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -285,7 +285,7 @@ public function validate_post( $post_id, $post ) {
return false;
} elseif ( defined( 'DOING_AUTOSAVE' ) || is_int( wp_is_post_revision( $post ) ) || is_int( wp_is_post_autosave( $post ) ) ) {
return false;
} elseif ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
} elseif ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
return false;
} elseif ( empty( $_POST['post_ID'] ) || $_POST['post_ID'] != $post_id ) {
return false;
Expand Down
5 changes: 4 additions & 1 deletion includes/admin/post-types/meta-boxes/class.llms.meta.box.coupon.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,7 +247,10 @@ public function get_fields() {
*/
protected function save( $post_id ) {

if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
return;
}

Expand Down
5 changes: 4 additions & 1 deletion includes/admin/post-types/meta-boxes/class.llms.meta.box.course.options.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -574,7 +574,10 @@ function_exists( 'llms_blocks_is_post_migrated' ) && llms_blocks_is_post_migrate
*/
protected function save_before( $post_id ) {

if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
return;
}

Expand Down
5 changes: 4 additions & 1 deletion includes/admin/post-types/meta-boxes/class.llms.meta.box.engagement.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,7 +251,10 @@ public function get_fields() {
*/
public function save( $post_id ) {

if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
return;
}

Expand Down
5 changes: 4 additions & 1 deletion includes/admin/post-types/meta-boxes/class.llms.meta.box.membership.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -375,7 +375,10 @@ public function get_fields() {
*/
public function save( $post_id ) {

if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
return -1;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
return -1;
}

Expand Down
5 changes: 4 additions & 1 deletion includes/admin/post-types/meta-boxes/class.llms.meta.box.order.details.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,10 @@ public function output() {
*/
public function save( $post_id ) {

if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
return -1;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
return -1;
}

Expand Down
5 changes: 4 additions & 1 deletion includes/admin/post-types/meta-boxes/class.llms.meta.box.order.submit.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,10 @@ public function output() {
*/
public function save( $post_id ) {

if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
return;
}

Expand Down
5 changes: 4 additions & 1 deletion includes/admin/post-types/meta-boxes/class.llms.meta.box.order.transactions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,10 @@ private function resend_receipt( $post_id ) {
*/
public function save( $post_id ) {

if ( ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
if ( ! isset( $_REQUEST['lifterlms_meta_nonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
return;
}

Expand Down
5 changes: 4 additions & 1 deletion includes/admin/post-types/meta-boxes/class.llms.meta.box.visibility.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,10 @@ public function output() {
*/
public function save( $post_id ) {

if ( ! llms_verify_nonce( 'llms_catalog_visibility_nonce', 'llms-catalog-visibility-nonce' ) ) {
if ( ! isset( $_REQUEST['llms_catalog_visibility_nonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms_catalog_visibility_nonce'] ) ), 'llms-catalog-visibility-nonce' ) ) {
return;
}

Expand Down
2 changes: 1 addition & 1 deletion includes/admin/post-types/meta-boxes/class.llms.meta.box.voucher.export.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ public static function output( $post ) {
*/
public static function export() {

if ( empty( llms_filter_input( INPUT_POST, 'llms_generate_export' ) ) || ! llms_verify_nonce( 'lifterlms_export_nonce', 'lifterlms_csv_export_data' ) ) {
if ( empty( llms_filter_input( INPUT_POST, 'llms_generate_export' ) ) || ! isset( $_REQUEST['lifterlms_export_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_export_nonce'] ) ), 'lifterlms_csv_export_data' ) ) {
return false;
}

Expand Down
2 changes: 1 addition & 1 deletion includes/admin/post-types/meta-boxes/class.llms.meta.box.voucher.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,7 +257,7 @@ private function redemption_section_html() {
*/
public function save( $post_id ) {

if ( ! empty( llms_filter_input( INPUT_POST, 'llms_generate_export' ) ) || ! llms_verify_nonce( 'lifterlms_meta_nonce', 'lifterlms_save_data' ) ) {
if ( ! empty( llms_filter_input( INPUT_POST, 'llms_generate_export' ) ) || ! isset( $_REQUEST['lifterlms_meta_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['lifterlms_meta_nonce'] ) ), 'lifterlms_save_data' ) ) {
return false;
}

Expand Down
5 changes: 4 additions & 1 deletion includes/admin/settings/class.llms.settings.checkout.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -404,7 +404,10 @@ private function get_settings_gateway( $curr_section ) {
*/
public function save() {

if ( ! llms_verify_nonce( '_wpnonce', 'lifterlms-settings' ) ) {
if ( ! isset( $_REQUEST['_wpnonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'lifterlms-settings' ) ) {
return;
}

Expand Down
10 changes: 8 additions & 2 deletions includes/admin/settings/class.llms.settings.notifications.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,10 @@ public function merge_code_button() {
*/
public function before_save() {

if ( ! llms_verify_nonce( '_wpnonce', 'lifterlms-settings' ) ) {
if ( ! isset( $_REQUEST['_wpnonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'lifterlms-settings' ) ) {
return;
}

Expand All @@ -266,7 +269,10 @@ public function before_save() {
*/
public function after_save() {

if ( ! llms_verify_nonce( '_wpnonce', 'lifterlms-settings' ) ) {
if ( ! isset( $_REQUEST['_wpnonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'lifterlms-settings' ) ) {
return;
}

Expand Down
2 changes: 1 addition & 1 deletion includes/class-llms-staging.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ public static function handle_staging_notice_actions() {
return;
}

if ( ! llms_verify_nonce( '_llms_staging_nonce', 'llms_staging_status', 'GET' ) || ! current_user_can( 'manage_options' ) ) {
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_llms_staging_nonce'] ) ), 'llms_staging_status' ) || ! current_user_can( 'manage_options' ) ) {
wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'lifterlms' ) );
}

Expand Down
2 changes: 1 addition & 1 deletion includes/class.llms.install.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -691,7 +691,7 @@ public static function update_actions() {
return;
}

if ( ! llms_verify_nonce( 'llms-db-update', 'do_db_updates', 'GET' ) ) {
if ( ! isset( $_REQUEST['llms-db-update'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['llms-db-update'] ) ), 'do_db_updates' ) ) {
wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'lifterlms' ) );
}

Expand Down
2 changes: 1 addition & 1 deletion includes/class.llms.view.manager.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,7 +220,7 @@ public static function get_url( $role, $href = false, $args = array() ) {
*/
private function get_view() {

if ( ! llms_verify_nonce( 'view_nonce', 'llms-view-as', 'GET' ) ) {
if ( ! isset( $_REQUEST['view_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['view_nonce'] ) ), 'llms-view-as' ) ) {
return 'self';
}

Expand Down
15 changes: 12 additions & 3 deletions includes/controllers/class-llms-controller-checkout.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -462,7 +462,10 @@ private function start_ajax( $method ) {
public function switch_payment_source() {

// Invalid nonce or the form wasn't submitted.
if ( ! llms_verify_nonce( '_switch_source_nonce', self::ACTION_SWITCH_PAYMENT_SOURCE ) ) {
if ( ! isset( $_REQUEST['_switch_source_nonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_switch_source_nonce'] ) ), self::ACTION_SWITCH_PAYMENT_SOURCE ) ) {
return;
}

Expand Down Expand Up @@ -490,7 +493,10 @@ public function switch_payment_source() {
public function switch_payment_source_ajax() {

// Invalid nonce or the form wasn't submitted.
if ( ! llms_verify_nonce( self::AJAX_QS_VAR, self::ACTION_SWITCH_PAYMENT_SOURCE ) ) {
if ( ! isset( $_REQUEST[ self::AJAX_QS_VAR ] ) ) {
return null;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST[ self::AJAX_QS_VAR ] ) ), self::ACTION_SWITCH_PAYMENT_SOURCE ) ) {
return null;
}

Expand Down Expand Up @@ -676,7 +682,10 @@ private function switch_payment_source_success( $args, $note = false ) {
*/
private function verify_request( $field, $nonce ) {

if ( ! llms_verify_nonce( $field, $nonce, 'POST' ) ) {
if ( ! isset( $_REQUEST[ $field ] ) ) {
return null;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST[ $field ] ) ), $nonce ) ) {
return null;
}

Expand Down
5 changes: 4 additions & 1 deletion includes/controllers/class.llms.controller.achievements.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,10 @@ protected function get_text( $text_type, $variables = array() ) {
*/
public function maybe_handle_reporting_actions() {

if ( ! llms_verify_nonce( '_llms_achievement_actions_nonce', 'llms-achievement-actions' ) ) {
if ( ! isset( $_REQUEST['_llms_achievement_actions_nonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_llms_achievement_actions_nonce'] ) ), 'llms-achievement-actions' ) ) {
return;
}

Expand Down
5 changes: 4 additions & 1 deletion includes/controllers/class.llms.controller.admin.quiz.attempts.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,10 @@ public function __construct() {
*/
public function maybe_run_actions() {

if ( ! llms_verify_nonce( '_llms_quiz_attempt_nonce', 'llms_quiz_attempt_actions', 'POST' ) ) {
if ( ! isset( $_REQUEST['_llms_quiz_attempt_nonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_llms_quiz_attempt_nonce'] ) ), 'llms_quiz_attempt_actions' ) ) {
return;
}

Expand Down
5 changes: 4 additions & 1 deletion includes/controllers/class.llms.controller.certificates.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,10 @@ public function maybe_authenticate_export_generation() {
* @return void
*/
public function maybe_handle_reporting_actions() {
if ( ! llms_verify_nonce( '_llms_cert_actions_nonce', 'llms-cert-actions' ) ) {
if ( ! isset( $_REQUEST['_llms_cert_actions_nonce'] ) ) {
return;
}
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_llms_cert_actions_nonce'] ) ), 'llms-cert-actions' ) ) {
return;
}

Expand Down
Loading
Loading