Skip to content

Commit 727492e

Browse files
AlexP11223AlexP11223
committed
Fix nonce ignoring
1 parent fc9ca6f commit 727492e

File tree

10 files changed

+30
-22
lines changed

10 files changed

+30
-22
lines changed

‎modules/ppcp-axo/src/Gateway/AxoGateway.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -264,17 +264,16 @@ public function process_payment( $order_id ) {
264264
);
265265
}
266266

267-
// phpcs:ignore WordPress.Security.NonceVerification.Missing
268-
$axo_nonce = wc_clean( wp_unslash( $_POST['axo_nonce'] ?? '' ) );
269-
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
267+
// phpcs:disable WordPress.Security.NonceVerification
268+
269+
$axo_nonce = wc_clean( wp_unslash( $_POST['axo_nonce'] ?? '' ) );
270270
$token_param = wc_clean( wp_unslash( $_GET['token'] ?? '' ) );
271271

272272
if ( empty( $axo_nonce ) && ! empty( $token_param ) ) {
273273
return $this->process_3ds_return( $wc_order, $token_param );
274274
}
275275

276276
try {
277-
// phpcs:ignore WordPress.Security.NonceVerification.Missing
278277
$fastlane_member = wc_clean( wp_unslash( $_POST['fastlane_member'] ?? '' ) );
279278
if ( $fastlane_member ) {
280279
$payment_method_title = __( 'Debit & Credit Cards (via Fastlane by PayPal)', 'woocommerce-paypal-payments' );
@@ -341,6 +340,7 @@ public function process_payment( $order_id ) {
341340
'result' => 'success',
342341
'redirect' => $this->get_return_url( $wc_order ),
343342
);
343+
// phpcs:enable WordPress.Security.NonceVerification
344344
}
345345

346346
/**

‎modules/ppcp-button/src/Endpoint/CartScriptParamsEndpoint.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,8 @@ public function handle_request(): bool {
7676
wc_maybe_define_constant( 'WOOCOMMERCE_CART', true );
7777
}
7878

79-
$include_shipping = (bool) wc_clean( wp_unslash( $_GET['shipping'] ?? '' ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
79+
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
80+
$include_shipping = (bool) wc_clean( wp_unslash( $_GET['shipping'] ?? '' ) );
8081

8182
$script_data = $this->smart_button->script_data();
8283
if ( ! $script_data ) {

‎modules/ppcp-button/src/Helper/ContextTrait.php‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -301,8 +301,9 @@ private function is_add_payment_method_page(): bool {
301301
* @return bool
302302
*/
303303
private function is_subscription_change_payment_method_page(): bool {
304-
if ( isset( $_GET['change_payment_method'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
305-
return wcs_is_subscription( wc_clean( wp_unslash( $_GET['change_payment_method'] ) ) ); // phpcs:ignore WordPress.Security.NonceVerification
304+
// phpcs:disable WordPress.Security.NonceVerification
305+
if ( isset( $_GET['change_payment_method'] ) ) {
306+
return wcs_is_subscription( wc_clean( wp_unslash( $_GET['change_payment_method'] ) ) );
306307
}
307308

308309
return false;
@@ -325,12 +326,14 @@ protected function is_block_editor(): bool {
325326
* @return bool
326327
*/
327328
protected function is_wc_settings_payments_tab(): bool {
328-
if ( ! is_admin() || isset( $_GET['section'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
329+
// phpcs:disable WordPress.Security.NonceVerification
330+
if ( ! is_admin() || isset( $_GET['section'] ) ) {
329331
return false;
330332
}
331333

332-
$page = wc_clean( wp_unslash( $_GET['page'] ?? '' ) ); // phpcs:ignore WordPress.Security.NonceVerification
333-
$tab = wc_clean( wp_unslash( $_GET['tab'] ?? '' ) ); // phpcs:ignore WordPress.Security.NonceVerification
334+
$page = wc_clean( wp_unslash( $_GET['page'] ?? '' ) );
335+
$tab = wc_clean( wp_unslash( $_GET['tab'] ?? '' ) );
336+
// phpcs:enable WordPress.Security.NonceVerification
334337

335338
return $page === 'wc-settings' && $tab === 'checkout';
336339
}

‎modules/ppcp-compat/src/AdminContextTrait.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@ trait AdminContextTrait {
2020
* @return bool
2121
*/
2222
private function is_paypal_order_edit_page(): bool {
23-
$post_id = wc_clean( wp_unslash( $_GET['id'] ?? $_GET['post'] ?? '' ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
23+
// phpcs:ignore WordPress.Security.NonceVerification
24+
$post_id = wc_clean( wp_unslash( $_GET['id'] ?? $_GET['post'] ?? '' ) );
2425
if ( ! $post_id ) {
2526
return false;
2627
}

‎modules/ppcp-compat/src/PPEC/SubscriptionsHandler.php‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,8 @@ private function should_mock_ppec_gateway() {
150150
return true;
151151
}
152152

153+
// phpcs:disable WordPress.Security.NonceVerification
154+
153155
// Checks that require Subscriptions.
154156
if ( class_exists( \WC_Subscriptions::class ) ) {
155157
// My Account > Subscriptions > (Subscription).
@@ -160,15 +162,15 @@ private function should_mock_ppec_gateway() {
160162
}
161163

162164
// Changing payment method?
163-
if ( is_wc_endpoint_url( 'order-pay' ) && isset( $_GET['change_payment_method'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
165+
if ( is_wc_endpoint_url( 'order-pay' ) && isset( $_GET['change_payment_method'] ) ) {
164166
$subscription = wcs_get_subscription( absint( get_query_var( 'order-pay' ) ) );
165167

166168
return ( $subscription && PPECHelper::PPEC_GATEWAY_ID === $subscription->get_payment_method() );
167169
}
168170

169171
// Early renew (via modal).
170-
if ( isset( $_GET['process_early_renewal'], $_GET['subscription_id'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
171-
$subscription = wcs_get_subscription( absint( $_GET['subscription_id'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
172+
if ( isset( $_GET['process_early_renewal'], $_GET['subscription_id'] ) ) {
173+
$subscription = wcs_get_subscription( absint( $_GET['subscription_id'] ) );
172174

173175
return ( $subscription && PPECHelper::PPEC_GATEWAY_ID === $subscription->get_payment_method() );
174176
}
@@ -185,7 +187,6 @@ private function should_mock_ppec_gateway() {
185187
}
186188

187189
// Are we editing an order or subscription tied to PPEC?
188-
// phpcs:ignore WordPress.Security.NonceVerification
189190
$order_id = wc_clean( wp_unslash( $_GET['id'] ?? $_GET['post'] ?? $_POST['post_ID'] ?? '' ) );
190191
if ( $order_id ) {
191192
$order = wc_get_order( $order_id );
@@ -199,9 +200,7 @@ private function should_mock_ppec_gateway() {
199200
* @psalm-suppress UndefinedClass
200201
*/
201202
$post_type_or_page = class_exists( OrderUtil::class ) && OrderUtil::custom_orders_table_usage_is_enabled()
202-
// phpcs:ignore WordPress.Security.NonceVerification
203203
? wc_clean( wp_unslash( $_GET['page'] ?? '' ) )
204-
// phpcs:ignore WordPress.Security.NonceVerification
205204
: wc_clean( wp_unslash( $_GET['post_type'] ?? $_POST['post_type'] ?? '' ) );
206205
if ( $post_type_or_page === 'shop_subscription' || $post_type_or_page === 'wc-orders--shop_subscription' ) {
207206
return true;

‎modules/ppcp-order-tracking/src/TrackingAvailabilityTrait.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,8 @@ trait TrackingAvailabilityTrait {
2424
* @return bool
2525
*/
2626
protected function is_tracking_enabled( Bearer $bearer ): bool {
27-
$post_id = (int) wc_clean( wp_unslash( $_GET['id'] ?? $_GET['post'] ?? '' ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
27+
// phpcs:ignore WordPress.Security.NonceVerification
28+
$post_id = (int) wc_clean( wp_unslash( $_GET['id'] ?? $_GET['post'] ?? '' ) );
2829
if ( ! $post_id ) {
2930
return false;
3031
}

‎modules/ppcp-paypal-subscriptions/src/PayPalSubscriptionsModule.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,7 @@ function( $product_id ) use ( $c ) {
167167
return;
168168
}
169169

170+
// phpcs:ignore WordPress.Security.NonceVerification
170171
$nonce = wc_clean( wp_unslash( $_POST['_wcsnonce'] ?? '' ) );
171172
if (
172173
$subscriptions_mode !== 'subscriptions_api'
@@ -250,6 +251,7 @@ static function ( $passed_validation, $product_id ) use ( $c ) {
250251
* @psalm-suppress MissingClosureParamType
251252
*/
252253
function( $variation_id ) use ( $c ) {
254+
// phpcs:ignore WordPress.Security.NonceVerification
253255
$wcsnonce_save_variations = wc_clean( wp_unslash( $_POST['_wcsnonce_save_variations'] ?? '' ) );
254256

255257
if (

‎modules/ppcp-save-payment-methods/src/SavePaymentMethodsModule.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -285,7 +285,8 @@ function () use ( $c ) {
285285
? apply_filters( 'woocommerce_paypal_payments_three_d_secure_contingency', $settings->get( '3d_secure_contingency' ) )
286286
: '';
287287

288-
$change_payment_method = wc_clean( wp_unslash( $_GET['change_payment_method'] ?? '' ) ); // phpcs:ignore WordPress.Security.NonceVerification
288+
// phpcs:ignore WordPress.Security.NonceVerification
289+
$change_payment_method = wc_clean( wp_unslash( $_GET['change_payment_method'] ?? '' ) );
289290

290291
wp_localize_script(
291292
'ppcp-add-payment-method',

‎modules/ppcp-vaulting/src/VaultingModule.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,7 @@ function() use ( $container ) {
207207
return;
208208
}
209209

210+
// phpcs:ignore WordPress.Security.NonceVerification
210211
$wpnonce = wc_clean( wp_unslash( $_REQUEST['_wpnonce'] ?? '' ) );
211212
$token_id_string = (string) $token_id;
212213
$action = 'delete-payment-method-' . $token_id_string;

‎modules/ppcp-wc-gateway/src/Gateway/PayUponInvoice/PayUponInvoiceGateway.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -247,9 +247,8 @@ public function init_form_fields() {
247247
*/
248248
public function process_payment( $order_id ) {
249249
$wc_order = wc_get_order( $order_id );
250-
// phpcs:disable WordPress.Security.NonceVerification.Missing
250+
// phpcs:disable WordPress.Security.NonceVerification
251251
$birth_date = wc_clean( wp_unslash( $_POST['billing_birth_date'] ?? '' ) );
252-
// phpcs:disable WordPress.Security.NonceVerification.Recommended
253252
$pay_for_order = wc_clean( wp_unslash( $_GET['pay_for_order'] ?? '' ) );
254253
if ( 'true' === $pay_for_order ) {
255254
if ( ! $this->checkout_helper->validate_birth_date( $birth_date ) ) {
@@ -261,7 +260,7 @@ public function process_payment( $order_id ) {
261260
}
262261

263262
$phone_number = wc_clean( wp_unslash( $_POST['billing_phone'] ?? '' ) );
264-
// phpcs:enable WordPress.Security.NonceVerification.Missing
263+
// phpcs:enable WordPress.Security.NonceVerification
265264
if ( $phone_number ) {
266265
$wc_order->set_billing_phone( $phone_number );
267266
$wc_order->save();

0 commit comments

Comments
 (0)