Merge pull request #219 from TycheSoftwares/branch-218

fix #218

Author: kartikparmar

includes/component/tracking-data/ts-tracking.php

@@ -134,9 +134,10 @@ public static function ts_add_new_settings_field ( $ts_settings ) {
 	/**
 	 * It will delete the tracking option from the database.
 	 */
-	public static function ts_reset_tracking_setting () {
+	public static function ts_reset_tracking_setting() {
+
+		if ( isset( $_GET['ts_action'] ) && 'wcdn_reset_tracking' === $_GET['ts_action'] && isset( $_GET[ self::$plugin_prefix . '_tracker_reset_nonce' ] ) && wp_verify_nonce( sanitize_key( $_GET[ self::$plugin_prefix . '_tracker_reset_nonce' ] ), self::$plugin_prefix . '_tracker_reset' ) ) {
 
-		if ( isset ( $_GET [ 'ts_action' ] ) && 'wcdn_reset_tracking' == $_GET [ 'ts_action' ] ) {
 			delete_option( self::$plugin_prefix . '_allow_tracking' );
 			delete_option( 'wcdn_ts_tracker_last_send' );
 			$ts_url = remove_query_arg( 'ts_action' );
@@ -154,7 +155,8 @@ public static function ts_add_reset_tracking_setting ( $value ) {
 		if ( '' == self::$ts_add_setting_on_page && '' == self::$ts_add_setting_on_section && '' == self::$ts_register_setting ) {
 			if ( $value['id'] == 'ts_reset_tracking' ) {
 			$description = WC_Admin_Settings::get_field_description( $value );
-			$ts_action = self::$ts_settings_page . "&ts_action=" . self::$plugin_prefix . "_reset_tracking";
+			$nonce       = wp_create_nonce( self::$plugin_prefix . '_tracker_reset' );
+			$ts_action   = add_query_arg( array( self::$plugin_prefix . '_tracker_reset_nonce' => $nonce, 'ts_action' => self::$plugin_prefix . '_reset_tracking' ), self::$ts_settings_page );
 		?>
 
         <tr valign="top">
@@ -197,17 +199,19 @@ public static function ts_reset_tracking_setting_section_callback ( ) {
 
 	/**
 	 * It will add the Reset button on the settings page.
-	 * @param array $args
+	 *
+	 * @param array $args Arguments.
 	 */
-	public static function ts_rereset_tracking_callback ( $args ) {
+	public static function ts_rereset_tracking_callback( $args ) {
 		$wcap_restrict_domain_address = get_option( 'wcap_restrict_domain_address' );
 		$domain_value                 = isset( $wcap_restrict_domain_address ) ? esc_attr( $wcap_restrict_domain_address ) : '';
-		// Next, we update the name attribute to access this element's ID in the context of the display options array
-		// We also access the show_header element of the options collection in the call to the checked() helper function
-		$ts_action = self::$ts_settings_page . "&amp;ts_action=" . self::$plugin_prefix . "_reset_tracking"; 
+		// Next, we update the name attribute to access this element's ID in the context of the display options array.
+		// We also access the show_header element of the options collection in the call to the checked() helper function.
+		$nonce       = wp_create_nonce( self::$plugin_prefix . '_tracker_reset' );
+		$ts_action   = add_query_arg( array( self::$plugin_prefix . '_tracker_reset_nonce' => $nonce, 'ts_action' => self::$plugin_prefix . '_reset_tracking' ), self::$ts_settings_page );
 		printf( '<a href="'.$ts_action.'" class="button button-large reset_tracking">Reset</a>' );
-		
-		// Here, we'll take the first argument of the array and add it to a label next to the checkbox
+
+		// Here, we'll take the first argument of the array and add it to a label next to the checkbox.
 		$html = '<label for="wcap_restrict_domain_address_label"> '  . $args[0] . '</label>';
 		echo $html;
 	}