Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

GH-179 : Implement nonce verification for Ajax calls #285

Merged
merged 10 commits into from
Feb 26, 2024
Merged

GH-179 : Implement nonce verification for Ajax calls #285

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
c383f14
Implement nonce verification for Ajax calls
SohamPatel46 Feb 21, 2024
731d08d
Add missing comma for multiline array
SohamPatel46 Feb 21, 2024
686c118
Add prefixs and remove package-lock json file
SohamPatel46 Feb 22, 2024
27f8296
Build js file using Grunt Uglify
SohamPatel46 Feb 22, 2024
5addcd9
Rename nonce and remove extra escaping
SohamPatel46 Feb 22, 2024
5470b7f
Build transcoder admin js file
SohamPatel46 Feb 22, 2024
34a4e74
Rename ajax parameters
SohamPatel46 Feb 22, 2024
aab36a3
Build transcoder admin js file
SohamPatel46 Feb 22, 2024
2bdb263
Revert block editor build file
SohamPatel46 Feb 22, 2024
6bfb1cc
Remove unused ajax actions
SohamPatel46 Feb 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions admin/js/rt-transcoder-admin.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,8 @@
if ( confirm( rt_transcoder_script.disable_encoding ) ) {

var data = {
action: 'rt_disable_transcoding'
action: 'rt_disable_transcoding',
rt_transcoder_nonce: rt_transcoder_script.security_nonce_for_disabling_encoding
};

if ( $( this ).next( 'img' ).length === 0 ) {
Expand Down Expand Up @@ -84,7 +85,8 @@
if ( confirm( rt_transcoder_script.enable_encoding ) ) {

var data = {
action: 'rt_enable_transcoding'
action: 'rt_enable_transcoding',
rt_transcoder_nonce: rt_transcoder_script.security_nonce_for_enabling_encoding
};

if ( $( this ).next( 'img' ).length === 0 ) {
Expand Down
2 changes: 1 addition & 1 deletion admin/js/rt-transcoder-admin.min.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

14 changes: 8 additions & 6 deletions admin/rt-transcoder-admin.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,12 +196,14 @@ public function enqueue_scripts_styles() {
wp_register_script( 'rt-transcoder-main', RT_TRANSCODER_URL . 'admin/js/rt-transcoder-admin' . $suffix . '.js', array( 'jquery' ), RT_TRANSCODER_VERSION, true );

$localize_script_data = array(
'admin_url' => esc_url( admin_url() ),
'loader_image' => esc_url( admin_url( 'images/loading.gif' ) ),
'disable_encoding' => esc_html__( 'Are you sure you want to disable the transcoding service?', 'transcoder' ),
'enable_encoding' => esc_html__( 'Are you sure you want to enable the transcoding service?', 'transcoder' ),
'something_went_wrong' => esc_html__( 'Something went wrong. Please ', 'transcoder' ) . '<a href onclick="location.reload();">' . esc_html__( 'refresh', 'transcoder' ) . '</a>' . esc_html__( ' page.', 'transcoder' ),
'error_empty_key' => esc_html__( 'Please enter the license key.', 'transcoder' ),
'admin_url' => esc_url( admin_url() ),
'loader_image' => esc_url( admin_url( 'images/loading.gif' ) ),
'disable_encoding' => esc_html__( 'Are you sure you want to disable the transcoding service?', 'transcoder' ),
'enable_encoding' => esc_html__( 'Are you sure you want to enable the transcoding service?', 'transcoder' ),
'something_went_wrong' => esc_html__( 'Something went wrong. Please ', 'transcoder' ) . '<a href onclick="location.reload();">' . esc_html__( 'refresh', 'transcoder' ) . '</a>' . esc_html__( ' page.', 'transcoder' ),
'error_empty_key' => esc_html__( 'Please enter the license key.', 'transcoder' ),
'security_nonce_for_enabling_encoding' => wp_create_nonce( 'rt_enable_transcoding' ),
'security_nonce_for_disabling_encoding' => wp_create_nonce( 'rt_disable_transcoding' ),
);

wp_localize_script( 'rt-transcoder-main', 'rt_transcoder_script', $localize_script_data );
Expand Down
31 changes: 2 additions & 29 deletions admin/rt-transcoder-handler.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,8 +180,6 @@ public function __construct( $no_init = false ) {
}

add_action( 'init', array( $this, 'handle_callback' ), 20 );
add_action( 'wp_ajax_rt_hide_transcoding_notice', array( $this, 'hide_transcoding_notice' ), 1 );
add_action( 'wp_ajax_rt_enter_api_key', array( $this, 'enter_api_key' ), 1 );
add_action( 'wp_ajax_rt_disable_transcoding', array( $this, 'disable_transcoding' ), 1 );
add_action( 'wp_ajax_rt_enable_transcoding', array( $this, 'enable_transcoding' ), 1 );
add_action( 'add_attachment', array( $this, 'after_upload_pdf' ) );
Expand Down Expand Up @@ -1263,39 +1261,13 @@ public function handle_callback() {
do_action( 'rtt_handle_callback_finished', $attachment_id, $job_id );
}

/**
* Hide notices.
*
* @since 1.0.0
*/
public function hide_transcoding_notice() {
update_site_option( 'rt-transcoding-service-notice', true );
update_site_option( 'rt-transcoding-expansion-notice', true );
echo true;
die();
}

/**
* Check whether key is entered or not.
*
* @since 1.0
*/
public function enter_api_key() {
$apikey = transcoder_filter_input( INPUT_GET, 'apikey', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
if ( ! empty( $apikey ) ) {
echo wp_json_encode( array( 'apikey' => $apikey ) );
} else {
echo wp_json_encode( array( 'error' => esc_html__( 'Please enter the license key.', 'transcoder' ) ) );
}
die();
}

/**
* Disable transcoding.
*
* @since 1.0.0
*/
public function disable_transcoding() {
check_ajax_referer( 'rt_disable_transcoding', 'rt_transcoder_nonce', true );
update_site_option( 'rt-transcoding-api-key', '' );
esc_html_e( 'Transcoding disabled successfully.', 'transcoder' );
die();
Expand All @@ -1307,6 +1279,7 @@ public function disable_transcoding() {
* @since 1.0.0
*/
public function enable_transcoding() {
check_ajax_referer( 'rt_enable_transcoding', 'rt_transcoder_nonce', true );
update_site_option( 'rt-transcoding-api-key', $this->stored_api_key );
esc_html_e( 'Transcoding enabled successfully.', 'transcoder' );
die();
Expand Down
Loading