Fix XSS issue caused by debugging

joedolson · joedolson · commit 8af35fe575e0 · 2023-12-06T12:28:04.000-06:00
diff --git a/src/wp-accessibility-stats.php b/src/wp-accessibility-stats.php
@@ -213,7 +213,7 @@ function wpa_stats_action() {
 	if ( isset( $_REQUEST['action'] ) && 'wpa_stats_action' === $_REQUEST['action'] ) {
 		$security = $_REQUEST['security'];
 		if ( ! wp_verify_nonce( $security, 'wpa-stats-action' ) ) {
-			wp_send_json( array( 'failed' => $_REQUEST ) );
+			wp_die();
 		}
 		$stats   = map_deep( $_REQUEST['stats'], 'sanitize_text_field' );
 		$post_id = absint( $_REQUEST['post_id'] );

Original file line number	Diff line number	Diff line change
`@@ -213,7 +213,7 @@ function wpa_stats_action() {`
`213`	`213`	`if ( isset( $_REQUEST['action'] ) && 'wpa_stats_action' === $_REQUEST['action'] ) {`
`214`	`214`	`$security = $_REQUEST['security'];`
`215`	`215`	`if ( ! wp_verify_nonce( $security, 'wpa-stats-action' ) ) {`
`216`		`- wp_send_json( array( 'failed' => $_REQUEST ) );`
	`216`	`+ wp_die();`
`217`	`217`	`}`
`218`	`218`	`$stats = map_deep( $_REQUEST['stats'], 'sanitize_text_field' );`
`219`	`219`	`$post_id = absint( $_REQUEST['post_id'] );`