Skip to content

Commit b21059c

Browse files
lelinhtinhlelinhtinh
committed
fix: unsafe request params
1 parent 681161c commit b21059c

File tree

4 files changed

+67
-53
lines changed

4 files changed

+67
-53
lines changed

‎admin/class-coupon-admin.php‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -117,13 +117,13 @@ public function options_admin()
117117
public function create_coupon()
118118
{
119119
check_ajax_referer($this->plugin_prefix . $this->plugin_name . '_create_nonce');
120-
if (!$_POST['action'] || $_POST['action'] !== 'oms_coupon_create' || !current_user_can('administrator')) {
120+
if (get_request_parameter('action') !== 'oms_coupon_create' || !current_user_can('administrator')) {
121121
header('Status: 403 Forbidden', true, 403);
122122
wp_die();
123123
}
124124

125125
$user_id = get_current_user_id();
126-
$code = sanitize_key($_POST['code']);
126+
$code = sanitize_key(get_request_parameter('code'));
127127

128128
global $wpdb;
129129
$findOne = $wpdb->get_row($wpdb->prepare(
@@ -137,14 +137,19 @@ public function create_coupon()
137137
], 400);
138138
}
139139

140-
$type = in_array($_POST['type'], ['percentage', 'numeric']) ? $_POST['type'] : 'percentage';
141-
$value = !empty($_POST['value']) ? intval($_POST['value']) : null;
142-
$limit = !empty($_POST['limit']) ? intval($_POST['limit']) : null;
143-
$activated_at = !empty($_POST['activated_at']) ? tz_strtodate($_POST['activated_at']) : null;
144-
$expired_at = !empty($_POST['expired_at']) ? tz_strtodate($_POST['expired_at']) : null;
140+
$type = get_request_parameter('type', 'percentage');
141+
$type = in_array($type, ['percentage', 'numeric'], true) ? $type : 'percentage';
142+
$value = get_request_parameter('value');
143+
$value = !$value ? null : intval($value);
144+
$limit = get_request_parameter('limit');
145+
$limit = !$limit ? null : intval($limit);
146+
$activated_at = get_request_parameter('activated_at');
147+
$activated_date = !$activated_at ? null : tz_strtodate($activated_at);
148+
$expired_at = get_request_parameter('expired_at');
149+
$expired_date = !$expired_at ? null : tz_strtodate($expired_at);
145150
if (
146151
!is_null($activated_at) && !is_null($expired_at)
147-
&& tz_strtodate($_POST['activated_at'], true) > tz_strtodate($_POST['expired_at'], true)
152+
&& tz_strtodate($activated_at, true) > tz_strtodate($expired_at, true)
148153
) {
149154
wp_send_json([
150155
'status' => 'error',
@@ -157,8 +162,8 @@ public function create_coupon()
157162
'type' => $type,
158163
'value' => $value,
159164
'limit' => $limit,
160-
'activated_at' => $activated_at,
161-
'expired_at' => $expired_at,
165+
'activated_at' => $activated_date,
166+
'expired_at' => $expired_date,
162167
'created_by' => $user_id,
163168
];
164169
$wpdb->insert(

‎admin/partials/coupon-admin-table.php‎

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,7 @@ protected function column_cb($item)
187187
*/
188188
protected function column_code($item)
189189
{
190-
$page = wp_unslash($_REQUEST['page']);
190+
$page = get_request_parameter('page', 1);
191191

192192
// Build hide row action.
193193
$hide_query_args = [
@@ -297,9 +297,13 @@ protected function get_bulk_actions()
297297
protected function process_bulk_action()
298298
{
299299
global $wpdb;
300-
if (isset($_GET[$this->_args['singular']])) {
301-
$coupon_params = wp_unslash($_GET[$this->_args['singular']]);
302-
$ids = is_array($coupon_params) ? implode(',', $coupon_params) : $coupon_params;
300+
301+
if (isset($_REQUEST[$this->_args['singular']])) {
302+
$coupon_params = get_request_parameter($this->_args['singular']);
303+
$ids = is_array($coupon_params)
304+
? implode(',', array_map('intval', $coupon_params))
305+
: intval($coupon_params);
306+
303307
switch ($this->current_action()) {
304308
case 'hide':
305309
$wpdb->query($wpdb->prepare(
@@ -382,27 +386,27 @@ public function prepare_items()
382386
$this->process_bulk_action();
383387

384388
// If no sort, default to ID.
385-
$orderby = !empty($_REQUEST['orderby']) && in_array($_REQUEST['orderby'], $sortable, true) ? $_REQUEST['orderby'] : 'ID';
386-
$order = !empty($_REQUEST['order']) && 'ASC' === strtoupper($_REQUEST['order']) ? 'ASC' : 'DESC';
389+
$orderby = get_request_parameter('orderby', 'ID');
390+
if (!in_array($orderby, array_keys($sortable), true)) {
391+
$orderby = 'ID';
392+
}
393+
$order = 'ASC' === strtoupper(get_request_parameter('order')) ? 'ASC' : 'DESC';
387394
$orderby_sql = 'c.' . sanitize_sql_orderby("{$orderby} {$order}");
388395

389396
/*
390397
* GET THE DATA!
391398
*/
392399
$data = $wpdb->get_results($wpdb->prepare(
393-
"
394-
SELECT
400+
"SELECT
395401
c.ID, c.code, c.type, c.value, c.limit, c.activated_at, c.expired_at,
396402
GROUP_CONCAT(u.display_name SEPARATOR ', ') AS used_by, COUNT(u.ID) AS number_of_uses
397403
FROM {$wpdb->prefix}oms_coupons AS c
398404
LEFT JOIN {$wpdb->prefix}oms_coupons_user AS cu ON cu.oms_coupon_id = c.ID
399405
LEFT JOIN {$wpdb->prefix}users AS u ON cu.user_id = u.ID
400406
WHERE c.active = 1
401407
GROUP BY c.ID, c.code, c.type, c.value, c.limit, c.activated_at, c.expired_at
402-
ORDER BY %s
403-
LIMIT %d OFFSET %d
404-
",
405-
$orderby_sql,
408+
ORDER BY {$orderby_sql}
409+
LIMIT %1\$d OFFSET %2\$d",
406410
$per_page,
407411
$offset_page,
408412
), ARRAY_A);

‎public/class-coupon-public.php‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -140,15 +140,13 @@ public function oms_shortcode_func($atts = [], $content = null, $tag = '')
140140

141141
global $wpdb;
142142
$findOne = $wpdb->get_row($wpdb->prepare(
143-
"
144-
SELECT
143+
"SELECT
145144
c.ID, c.code, c.type, c.value, c.limit, c.activated_at, c.expired_at,
146145
COUNT(cu.user_id) AS number_of_uses, GROUP_CONCAT(cu.user_id SEPARATOR ',') AS used_by_id
147146
FROM {$wpdb->prefix}oms_coupons AS c
148147
LEFT JOIN {$wpdb->prefix}oms_coupons_user AS cu ON cu.oms_coupon_id = c.ID
149148
WHERE c.ID = %d AND c.active = 1
150-
GROUP BY c.ID, c.code, c.type, c.value, c.limit, c.activated_at, c.expired_at
151-
",
149+
GROUP BY c.ID, c.code, c.type, c.value, c.limit, c.activated_at, c.expired_at",
152150
$coupon_id,
153151
), OBJECT);
154152

@@ -218,13 +216,17 @@ public function options_user()
218216
public function save_coupon()
219217
{
220218
check_ajax_referer($this->plugin_prefix . $this->plugin_name . '_save_nonce');
221-
if (!$_POST['action'] || $_POST['action'] !== 'oms_coupon_save') {
219+
if (get_request_parameter('action') !== 'oms_coupon_save') {
222220
header('Status: 403 Forbidden', true, 403);
223221
wp_die();
224222
}
225223

226224
$user_id = get_current_user_id();
227-
$coupon_id = intval($_POST['id']);
225+
$coupon_id = intval(get_request_parameter('id'));
226+
if (!$coupon_id) {
227+
header('Status: 400 Bad Request', true, 400);
228+
wp_die();
229+
}
228230
$now = tz_strtodate('now');
229231

230232
global $wpdb;

‎public/partials/coupon-public-table.php‎

Lines changed: 28 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ protected function column_cb($item)
188188
protected function column_code($item)
189189
{
190190
$user_id = get_current_user_id();
191-
$page = wp_unslash($_REQUEST['page']);
191+
$page = get_request_parameter('page', 1);
192192

193193
if ($item['user_id'] == $user_id) {
194194
// Build hide row action.
@@ -287,21 +287,25 @@ protected function process_bulk_action()
287287
global $wpdb;
288288
$user_id = get_current_user_id();
289289

290-
if (isset($_GET[$this->_args['singular']])) {
291-
$coupon_params = wp_unslash($_GET[$this->_args['singular']]);
292-
$ids = is_array($coupon_params) ? implode(',', $coupon_params) : $coupon_params;
290+
if (isset($_REQUEST[$this->_args['singular']])) {
291+
$coupon_params = get_request_parameter($this->_args['singular']);
292+
$ids = is_array($coupon_params)
293+
? implode(',', array_map('intval', $coupon_params))
294+
: intval($coupon_params);
293295

294296
if ($this->current_action() === 'hide') {
295297
$wpdb->query($wpdb->prepare(
296-
"UPDATE {$wpdb->prefix}oms_coupons_user SET active = 0 WHERE oms_coupon_id IN(%s) AND user_id = %d",
298+
"UPDATE {$wpdb->prefix}oms_coupons_user SET active = 0
299+
WHERE oms_coupon_id IN(%s) AND user_id = %d",
297300
$ids,
298301
$user_id,
299302
));
300303
}
301304

302305
if ($this->current_action() === 'delete' && current_user_can('administrator')) {
303306
$wpdb->query($wpdb->prepare(
304-
"DELETE FROM {$wpdb->prefix}oms_coupons_user WHERE oms_coupon_id IN(%s)",
307+
"DELETE FROM {$wpdb->prefix}oms_coupons_user
308+
WHERE oms_coupon_id IN(%s)",
305309
$ids,
306310
));
307311
}
@@ -342,7 +346,9 @@ public function prepare_items()
342346
*/
343347
$total_items = $wpdb->get_var(
344348
"SELECT COUNT(*) FROM {$wpdb->prefix}oms_coupons_user WHERE active = 1"
345-
. current_user_can('administrator') ? '' : $wpdb->prepare(" AND user_id = %d", $user_id)
349+
. current_user_can('administrator')
350+
? ''
351+
: $wpdb->prepare(" AND user_id = %d", $user_id)
346352
);
347353

348354
/*
@@ -371,46 +377,43 @@ public function prepare_items()
371377
$this->process_bulk_action();
372378

373379
// If no sort, default to user_id.
374-
$orderby = !empty($_REQUEST['orderby']) && in_array($_REQUEST['orderby'], $sortable, true) ? $_REQUEST['orderby'] : 'user_id';
375-
$orderby = ($orderby === 'saved_at' || $orderby === 'user_id'
380+
$orderby = get_request_parameter('orderby', 'user_id');
381+
if (!in_array($orderby, array_keys($sortable), true)) {
382+
$orderby = 'user_id';
383+
}
384+
$alias = ($orderby === 'saved_at' || $orderby === 'user_id'
376385
? 'cu.'
377386
: ($orderby === 'display_name' ? 'u.' : 'c.')
378-
) . $orderby;
379-
$order = !empty($_REQUEST['order']) && 'DESC' === strtoupper($_REQUEST['order']) ? 'DESC' : 'ASC';
380-
$orderby_sql = sanitize_sql_orderby("{$orderby} {$order}");
387+
);
388+
$order = 'DESC' === strtoupper(get_request_parameter('order')) ? 'DESC' : 'ASC';
389+
$orderby_sql = $alias . sanitize_sql_orderby("{$orderby} {$order}");
381390

382391
/*
383392
* GET THE DATA!
384393
*/
385394
if (current_user_can('administrator')) {
386395
$data = $wpdb->get_results($wpdb->prepare(
387-
"
388-
SELECT
396+
"SELECT
389397
c.ID, c.code, c.type, c.value, c.expired_at, cu.saved_at, cu.user_id, u.display_name
390398
FROM {$wpdb->prefix}oms_coupons AS c
391399
LEFT JOIN {$wpdb->prefix}oms_coupons_user AS cu ON cu.oms_coupon_id = c.ID
392400
LEFT JOIN {$wpdb->prefix}users AS u ON cu.user_id = u.ID
393401
WHERE cu.active = 1
394-
ORDER BY %s
395-
LIMIT %d OFFSET %d
396-
",
397-
$orderby_sql,
402+
ORDER BY {$orderby_sql}
403+
LIMIT %1\$d OFFSET %2\$d",
398404
$per_page,
399405
$offset_page,
400406
), ARRAY_A);
401407
} else {
402408
$data = $wpdb->get_results($wpdb->prepare(
403-
"
404-
SELECT
409+
"SELECT
405410
c.ID, c.code, c.type, c.value, c.expired_at, cu.saved_at, cu.user_id
406411
FROM {$wpdb->prefix}oms_coupons AS c
407412
LEFT JOIN {$wpdb->prefix}oms_coupons_user AS cu ON cu.oms_coupon_id = c.ID
408-
WHERE cu.active = 1 AND user_id = %d
409-
ORDER BY %s
410-
LIMIT %d OFFSET %d
411-
",
413+
WHERE cu.active = 1 AND user_id = %1\$d
414+
ORDER BY {$orderby_sql}
415+
LIMIT %2\$d OFFSET %3\$d",
412416
$user_id,
413-
$orderby_sql,
414417
$per_page,
415418
$offset_page,
416419
), ARRAY_A);

0 commit comments

Comments
 (0)