Changeset 2947741

Timestamp:

08/04/2023 01:15:47 PM (3 years ago)

Author:

addatwork

Message:

Added CSRF for reset option

Location:

poeditor/trunk

Files:

• poeditor.php (modified) (2 diffs)
• readme.txt (modified) (1 diff)
• views/changeApiKey.php (modified) (1 diff)
• views/index.php (modified) (5 diffs)
• views/index_nokey.php (modified) (1 diff)

poeditor/trunk/poeditor.php

@@ -4 +4 @@
     Plugin URI: https://poeditor.com/
     Description: This plugin will let you manage your POEditor translations directly from Wordpress via the POEditor API.
-    Version: 0.9.7
+    Version: 0.9.8
     Author: POEditor
     Author URI: https://poeditor.com/
@@ -619 +619 @@
          * This method deletes all data that has been written by the plugin from the database
          */
-        function clean() {
-            delete_option('poeditor_apikey');
-            delete_option('poeditor_assingments');
-            delete_option('poeditor_projects');
-            delete_option('poeditor_languages');
-            delete_option('poeditor_files');
-
-            $this->_setFlashMessage(__('The plugin has been reset successfully', 'poeditor'), 'updated');
-            wp_redirect(POEDITOR_PATH);
-        }
+        function clean() {
+            if (!wp_verify_nonce( $_POST['_wpnonce'], 'reset_nonce' )) {
+                return $this->CSRFErrorPage();
+            }
+
+            delete_option('poeditor_apikey');
+            delete_option('poeditor_assingments');
+            delete_option('poeditor_projects');
+            delete_option('poeditor_languages');
+            delete_option('poeditor_files');
+
+            $this->_setFlashMessage(__('The plugin has been reset successfully', 'poeditor'), 'updated');
+            wp_redirect(POEDITOR_PATH);
+        }
 
         //method for hooks

poeditor/trunk/readme.txt

@@ -5 +5 @@
 Requires at least: 3.5
 Tested up to: 6.2
-Stable tag: 0.9.7
+Stable tag: 0.9.8
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html

poeditor/trunk/views/changeApiKey.php

@@ -9 +9 @@
 
         <form action="<?php echo POEDITOR_PATH;?>&amp;do=setApiKey" method="post">
-            <?= wp_nonce_field('setApiKey_nonce'); ?>
+            <?php wp_nonce_field('setApiKey_nonce'); ?>
 
             <p>

poeditor/trunk/views/index.php

@@ -7 +7 @@
     <div id="poeditorTopLinks">
         <a class="button-secondary" href="<?php echo POEDITOR_PATH;?>&amp;do=changeApiKey"><?php esc_html_e( 'Change API Key', 'poeditor' ); ?></a>
+
         <a class="button-secondary poeditorReset" href="#reset" title="<?php esc_attr_e( 'Disconnect plugin from linked POEditor account', 'poeditor' ); ?>"><?php esc_html_e( 'Reset plugin', 'poeditor' ); ?></a>
     </div>
@@ -121 +122 @@
                             <a href="#addLanguage" class="addLanguageButton button-secondary" rel="<?php echo esc_attr($project['id']);?>">+ <?php echo $project_new_language ;?></a>
                             <form action="<?php echo POEDITOR_PATH;?>&amp;do=addLanguage" class="addLanguage" id="<?php echo esc_attr('addLanguage_' . $project['id']);?>" method="post">
-                                <?= wp_nonce_field('addLang_nonce'); ?>
+                                <?php wp_nonce_field('addLang_nonce'); ?>
 
                                 <select name="language">
@@ -163 +164 @@
                     <a href="#addProject" class="addProjectButton button-secondary">+ <?php esc_html_e('Create project', 'poeditor'); ?></a>
                     <form action="<?php echo POEDITOR_PATH;?>&amp;do=addProject" class="addProject" method="post">
-                        <?= wp_nonce_field('createProj_nonce'); ?>
+                        <?php wp_nonce_field('createProj_nonce'); ?>
 
                         <input type="text" name="project" id="projectNameInput">
@@ -200 +201 @@
 
         <form action="<?php echo POEDITOR_PATH;?>&amp;do=addProject" class="addProject" method="post">
-            <?= wp_nonce_field('createProj_nonce'); ?>
+            <?php wp_nonce_field('createProj_nonce'); ?>
 
             <input type="text" name="project" id="projectNameInput">
@@ -448 +449 @@
     </p>
 
-    <div id="resetConfirm">
-        <h4>
-            <?php esc_html_e('Are you sure you want to reset the plugin?', 'poeditor'); ?>
-        </h4>
-        <p>
-            <?php $text_content = printf(__('This will delete all your local file assignments and it will detach your Wordpress installation from you account on %s', 'poeditor'),'POEditor.com'); ?>
-            <?php echo esc_html($text_content) ?>
-        </p>
-        <a href="#cancel" class="button button-primary" id="poeditorCancelReset"><?php esc_html_e('Cancel', 'poeditor'); ?></a>
-        <a href="<?php echo POEDITOR_PATH;?>&amp;do=clean" class="button button-primary" id="poeditorProceedWithReset"><?php esc_html_e('Reset', 'poeditor'); ?></a>
-    </div>
+    <form action="<?php echo POEDITOR_PATH;?>&amp;do=clean" method="post">
+        <?php wp_nonce_field('reset_nonce'); ?>
+
+        <div id="resetConfirm">
+            <h4>
+                <?php esc_html_e('Are you sure you want to reset the plugin?', 'poeditor'); ?>
+            </h4>
+            <p>
+                <?php $text_content = printf(__('This will delete all your local file assignments and it will detach your Wordpress installation from you account on %s', 'poeditor'),'POEditor.com'); ?>
+                <?php echo esc_html($text_content) ?>
+            </p>
+            <a href="#cancel" class="button button-primary" id="poeditorCancelReset"><?php esc_html_e('Cancel', 'poeditor'); ?></a>
+
+            <button type="submit" class="button button-primary" id="poeditorProceedWithReset"><?php esc_html_e('Reset', 'poeditor'); ?></button>
+        </div>
+    </form>
 </div>
 <script src="<?php echo plugins_url( '_resources/js/jquery.base64.min.js' , __FILE__ );?>"></script>

poeditor/trunk/views/index_nokey.php

@@ -18 +18 @@
 
         <form action="<?php echo POEDITOR_PATH;?>&amp;do=setApiKey" method="post">
-            <?= wp_nonce_field('setApiKey_nonce'); ?>
+            <?php wp_nonce_field('setApiKey_nonce'); ?>
 
             <p>