Adding in Nonce verification for the form submission

Author: krugazul

includes/classes/class-form-submit.php

@@ -95,20 +95,24 @@ public function __construct() {
 	 */
 	protected function valid_submission() {
 
-		/**
-		 * TODO - Needs better security checks - NONCE
-		 */
+		if ( ! isset( $_POST['pf-nonce'] ) || false === wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['pf-nonce'] ) ) ) ) {
+			$this->response['result']  = 'failed';
+			$this->response['message'] = __( 'Nonce verification is required.', 'pff-paystack' );
+			return false;			
+		}
+
+
 		if ( ! isset( $_POST['pf-id'] ) || '' == trim( sanitize_text_field( wp_unslash( $_POST['pf-id'] ) ) ) ) {
 			$this->response['result']  = 'failed';
-			$this->response['message'] = 'A form ID is required';
+			$this->response['message'] = __( 'A form ID is required', 'pff-paystack' );
 			return false;
 		} else {
 			$this->form_id = sanitize_text_field( wp_unslash( $_POST['pf-id'] ) );
 		}
 
 		if ( ! isset( $_POST['pf-pemail'] ) || '' == trim( sanitize_text_field( wp_unslash( $_POST['pf-pemail'] ) ) ) ) {
 			$this->response['result']  = 'failed';
-			$this->response['message'] = 'Email is required';
+			$this->response['message'] = __( 'Email is required', 'pff-paystack' );
 			return false;
 		}
 		return true;
@@ -210,7 +214,11 @@ public function process_amount_quantity( $amount = 0 ) {
 	 */
 	public function process_images() {
 		$max_file_size = $this->meta['filelimit'] * 1024 * 1024;
+
+		// Our nonce is checked in the Form_Submit::valid_submission() function
+		// phpcs:ignore WordPress.Security.NonceVerification
 		if ( ! empty( $_FILES ) ) {
+			// phpcs:ignore WordPress.Security.NonceVerification
 			foreach ( $_FILES as $key_name => $value ) {
 				if ( $value['size'] > 0 ) {
 					if ( $value['size'] > $max_file_size ) {

includes/classes/class-setup.php

@@ -135,18 +135,18 @@ public function enqueue_scripts() {
 			return;
 		}
 
-		wp_enqueue_script( 'blockUI', PFF_PAYSTACK_PLUGIN_URL . '/assets/js/jquery.blockUI.min.js', array( 'jquery', 'jquery-ui-core' ), PFF_PAYSTACK_VERSION, true, true );
+		wp_enqueue_script( 'blockUI', PFF_PAYSTACK_PLUGIN_URL . '/assets/js/jquery.blockUI.min.js', array( 'jquery', 'jquery-ui-core' ), PFF_PAYSTACK_VERSION, true );
 
-		wp_register_script( 'Paystack', 'https://js.paystack.co/v1/inline.js', false, true );
+		wp_register_script( 'Paystack', 'https://js.paystack.co/v1/inline.js', false, PFF_PAYSTACK_VERSION, true );
 		wp_enqueue_script( 'Paystack' );
 
-		wp_enqueue_script( PFF_PLUGIN_NAME . '-public', PFF_PAYSTACK_PLUGIN_URL . '/assets/js/paystack-public.js', array( 'jquery' ), PFF_PAYSTACK_VERSION, true, true);
+		wp_enqueue_script( PFF_PLUGIN_NAME . '-public', PFF_PAYSTACK_PLUGIN_URL . '/assets/js/paystack-public.js', array( 'jquery' ), PFF_PAYSTACK_VERSION, true );
 
 		$helpers = new Helpers();
 		$js_args = [
 			'key' => $helpers->get_public_key(),
 			'fee' => $helpers->get_fees(),
 		];
-		wp_localize_script( PFF_PLUGIN_NAME . '-public', 'pffSettings', $js_args , PFF_PAYSTACK_VERSION, true, true);
+		wp_localize_script( PFF_PLUGIN_NAME . '-public', 'pffSettings', $js_args , PFF_PAYSTACK_VERSION, true );
 	}
 }