stklcode/wp-liveticker
1
0
Fork 0
Code Issues Releases 7 Activity

AJAX nonce verification enabled

Browse Source
This commit is contained in:
Stefan Kalscheuer 2017-12-09 16:05:09 +01:00
parent de347e1f81
commit f10e9c63e0
2 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
includes/class-wpliveticker2.php
View File

@ -248,6 +248,7 @@ class WPLiveticker2 {
'ajax_object', 'ajax_object',
array( array(
'ajax_url' => admin_url( 'admin-ajax.php' ), 'ajax_url' => admin_url( 'admin-ajax.php' ),
'nonce' => wp_create_nonce( 'wplt2_update-ticks' ),
'poll_interval' => self::$_options['poll_interval'] * 1000, 'poll_interval' => self::$_options['poll_interval'] * 1000,
) )
); );
@ -259,8 +260,8 @@ class WPLiveticker2 {
* @return void * @return void
*/ */
public static function ajax_update() { public static function ajax_update() {
// TODO: re-enable security checks. // Verify AJAX nonce.
// check_ajax_referer( 'wplt2_update-ticks' ); check_ajax_referer( 'wplt2_update-ticks' );
// Extract update requests. // Extract update requests.
if ( isset( $_POST['update'] ) && is_array( $_POST['update'] ) ) { if ( isset( $_POST['update'] ) && is_array( $_POST['update'] ) ) {
@ -284,7 +285,7 @@ class WPLiveticker2 {
), ),
'date_query' => array( 'date_query' => array(
'after' => date( 'c', $last_poll ), 'after' => date( 'c', $last_poll ),
) ),
); );
$query = new WP_Query( $query_args ); $query = new WP_Query( $query_args );

6
scripts/wp-liveticker2.js
View File

@ -12,6 +12,7 @@ WPLT2.init = function () {
}); });
// Extract AJAX settings. // Extract AJAX settings.
WPLT2.ajaxURL = ajax_object.ajax_url; WPLT2.ajaxURL = ajax_object.ajax_url;
WPLT2.nonce = ajax_object.nonce;
WPLT2.pollInterval = ajax_object.poll_interval; WPLT2.pollInterval = ajax_object.poll_interval;
// Trigger update, if necessary. // Trigger update, if necessary.
if (WPLT2.ticker.length > 0 && WPLT2.pollInterval > 0) { if (WPLT2.ticker.length > 0 && WPLT2.pollInterval > 0) {
@ -32,8 +33,9 @@ WPLT2.update = function () {
jQuery.post( jQuery.post(
WPLT2.ajaxURL, WPLT2.ajaxURL,
{ {
'action': 'wplt2_update-ticks', 'action' : 'wplt2_update-ticks',
'update': updateReq '_ajax_nonce': WPLT2.nonce,
'update' : updateReq
}, },
function (res) { function (res) {
try { try {