Skip to content

Commit c472865

Browse files
krugazulkrugazul
committed
Adding in the retry nonce.
1 parent fe4cbbf commit c472865

File tree

5 files changed

+39
-18
lines changed

5 files changed

+39
-18
lines changed

‎assets/js/paystack-public.js‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -296,6 +296,8 @@ function PffPaystackFee()
296296
var firstName = names[0] || "";
297297
var lastName = names[1] || "";
298298
var quantity = data.quantity;
299+
300+
$("#pf-nonce").val(data.invoiceNonce);
299301

300302
if (data.plan == "none" || data.plan == "" || data.plan == "no") {
301303
var handler = PaystackPop.setup(
@@ -316,9 +318,10 @@ function PffPaystackFee()
316318
$.post(
317319
$form.attr("action"),
318320
{
319-
action: "pff_paystack_confirm_payment",
320-
code: response.trxref,
321-
quantity: quantity
321+
action: "pff_paystack_confirm_payment",
322+
code: response.trxref,
323+
quantity: quantity,
324+
nonce: data.confirmNonce
322325
},
323326
function (newdata) {
324327
data = JSON.parse(newdata);
@@ -378,7 +381,8 @@ function PffPaystackFee()
378381
$form.attr("action"),
379382
{
380383
action: "pff_paystack_confirm_payment",
381-
code: response.trxref
384+
code: response.trxref,
385+
nonce: data.confirmNonce
382386
},
383387
function (newdata) {
384388
data = JSON.parse(newdata);
@@ -422,7 +426,7 @@ function PffPaystackFee()
422426

423427
handler.openIframe();
424428
} else {
425-
alert(data.message);
429+
alert(data.error_message);
426430
}
427431

428432
},

‎includes/classes/class-confirm-payment.php‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,18 @@ protected function setup_data( $payment ) {
102102
* Confirm Payment Functionality.
103103
*/
104104
public function confirm_payment() {
105+
106+
if ( ! isset( $_POST['nonce'] ) || false === wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'pff-paystack-confirm' ) ) {
107+
$response = array(
108+
'error' => true,
109+
'error_message' => __( 'Nonce verification is required.', 'pff-paystack' ),
110+
);
111+
112+
exit( wp_json_encode( $response ) );
113+
}
114+
115+
// This is a false positive, we are using isset as WPCS suggest in the PCP plugin.
116+
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput
105117
if ( ! isset( $_POST['code'] ) || '' === trim( wp_unslash( $_POST['code'] ) ) ) {
106118
$response = array(
107119
'error' => true,
@@ -202,7 +214,10 @@ protected function update_sold_inventory() {
202214

203215
if ( 'yes' === $usequantity ) {
204216
$quantity = 1;
217+
// Nonce is checked above in the parent function confirm_payment().
218+
// phpcs:ignore WordPress.Security.NonceVerification
205219
if ( isset( $_POST['quantity'] ) ) {
220+
// phpcs:ignore WordPress.Security.NonceVerification
206221
$quantity = (int) sanitize_text_field( wp_unslash( $_POST['quantity'] ) );
207222
}
208223
$sold = $this->meta['sold'];

‎includes/classes/class-form-shortcode.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -499,7 +499,7 @@ public function get_retry_form( $code = '' ) {
499499

500500
$html[] = '<input type="hidden" name="action" value="pff_paystack_retry_action">';
501501
$html[] = '<input type="hidden" name="code" value="' . esc_html( $code ) . '" />';
502-
502+
$html[] = wp_nonce_field( 'pff-paystack-retry', 'pf-nonce', true, false );
503503

504504
$html[] = '<div class="content">';
505505

‎includes/classes/class-form-submit.php‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,6 @@ protected function valid_submission() {
101101
return false;
102102
}
103103

104-
105104
if ( ! isset( $_POST['pf-id'] ) || '' == trim( sanitize_text_field( wp_unslash( $_POST['pf-id'] ) ) ) ) {
106105
$this->response['result'] = 'failed';
107106
$this->response['message'] = __( 'A form ID is required', 'pff-paystack' );
@@ -249,9 +248,6 @@ public function process_images() {
249248
}
250249

251250
public function submit_action() {
252-
/**
253-
* TODO - Needs better security checks - NONCE
254-
*/
255251
if ( ! $this->valid_submission() ) {
256252
// Exit here, for not processing further because of the error
257253
exit( wp_json_encode( $this->response ) );
@@ -299,14 +295,10 @@ public function submit_action() {
299295
* This function will exit early if one of the images is too large to be uploaded.
300296
*/
301297
$this->process_images();
302-
303298
$this->process_recurring_plans( $amount );
304-
305299
$this->fixed_metadata = json_decode( wp_json_encode( $this->fixed_metadata, JSON_NUMERIC_CHECK ), true );
306300
$this->fixed_metadata = array_merge( $this->untouched, $this->fixed_metadata );
307301

308-
309-
310302
$insert = array(
311303
'post_id' => $this->form_data['pf-id'],
312304
'email' => $this->form_data['pf-pemail'],
@@ -400,10 +392,11 @@ public function submit_action() {
400392
'transaction_charge' => $transaction_charge,
401393
);
402394

403-
//-------------------------------------------------------------------------------------------
404-
405-
// $pstk_logger = new paystack_plugin_tracker('pff-paystack', Kkd_Pff_Paystack_Public::fetchPublicKey());
406-
// $pstk_logger->log_transaction_attempt($code);*/
395+
// We create 2 nonces here
396+
// 1 incase the payment fails, and the user needs to try again.
397+
// 2 if the payment is successful and the confirmation ajax needs to run.
398+
$response['invoiceNonce'] = wp_create_nonce( 'pff-paystack-invoice' );
399+
$response['confirmNonce'] = wp_create_nonce( 'pff-paystack-confirm' );
407400

408401
echo wp_json_encode( $response );
409402
die();

‎includes/classes/class-retry-submit.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,15 @@ protected function setup_data() {
8888
* @return void
8989
*/
9090
public function retry_action() {
91+
if ( ! isset( $_POST['pf-nonce'] ) || false === wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['pf-nonce'] ) ), 'pff-paystack-retry' ) ) {
92+
$response = array(
93+
'result' => 'failed',
94+
'message' => __( 'Nonce verification is required.', 'pff-paystack' ),
95+
);
96+
// Exit here, for not processing further because of the error.
97+
exit( wp_json_encode( $response ) );
98+
}
99+
91100
if ( isset( $_POST['code'] ) && '' !== trim( wp_unslash( $_POST['code'] ) ) ) {
92101
$this->code = sanitize_text_field( wp_unslash( $_POST['code'] ) );
93102
} else {

0 commit comments

Comments
 (0)