WordPress.org
Get WordPress

Plugin Directory

Changeset 3372940


Ignore:
Timestamp:
10/04/2025 07:08:54 PM (4 months ago)
Author:
elementinvader
Message:

v1.4.0

Location:
elementinvader-addons-for-elementor
Files:
230 added
6 edited

Legend:

Unmodified
Added
Removed

  • elementinvader-addons-for-elementor/trunk/README.txt

    r3370940 r3372940  
    66Requires PHP: 5.6
    77Tested up to: 6.8
    8 Stable tag: 1.3.9
     8Stable tag: 1.4.0
    99License: GPLv2 or later
    1010License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    8989== Changelog ==
    9090
     91= 1.3.10 =
     92* Form Poc Protect with Token
     93
    9194= 1.3.9 =
    9295* Encrypt contact data from shortcode

  • elementinvader-addons-for-elementor/trunk/elementinvader-addons-for-elementor.php

    r3370940 r3372940  
    55 * Description: Ready to use Elementor Addon Elements like Menu, Forms, Maps, Newsletter with many styling options
    66 * Plugin URI:  https://elementinvader.com
    7  * Version:     1.3.9
     7 * Version:     1.4.0
    88 * Author:      ElementInvader
    99 * Author URI:  https://elementinvader.com

  • elementinvader-addons-for-elementor/trunk/helpers/plugin_helpers.php

    r3370940 r3372940  
    371371    return $decrypted !== false ? $decrypted : false;
    372372}
     373
     374function eli_generate_form_token() {
     375    $token = wp_generate_password(32, false, false);
     376
     377    $context = eli_get_request_context();
     378    set_transient('eli_form_token_' . $token, $context, 30 * MINUTE_IN_SECONDS);
     379
     380    return $token;
     381}
     382
     383function eli_verify_form_token($token) {
     384    $context = eli_get_request_context();
     385    $stored  = get_transient('eli_form_token_' . $token);
     386
     387    if ($stored && hash_equals($stored, $context)) {
     388        delete_transient('eli_form_token_' . $token); // одноразовый
     389        return true;
     390    }
     391    return false;
     392}
     393
     394function eli_get_request_context() {
     395    $ip    = $_SERVER['REMOTE_ADDR'] ?? '';
     396    $agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
     397
     398    return hash('sha256', $ip . '|' . $agent);
     399}

  • elementinvader-addons-for-elementor/trunk/modules/forms/ajax-handler.php

    r3370940 r3372940  
    277277                $this->output( $ajax_output );
    278278            }
     279
     280            if (empty($_POST['eli_token']) || !eli_verify_form_token($_POST['eli_token'])) {
     281                $ajax_output['code'] = self::INVALID_FORM;
     282                $ajax_output['message'] = $this->generate_alert( esc_html__( 'Security check failed. Please reload the page and try again.(Token)', 'elementinvader-addons-for-elementor' ), 'elementinvader_addons_for_elementor_alert-danger' );
     283                $this->output( $ajax_output );
     284            }
     285
    279286           
    280287            $post = sanitize_post($_POST);
    … …  
    290297            $form_data = array();
    291298            if(isset($post['shortcode']) && !empty($post['shortcode'])){
     299               
     300                $allowed_fields = [
     301                    'mail_data_to_email',
     302                    'mail_data_from_email',
     303                    'mail_data_from_name',
     304                    'Email',
     305                    'email',
     306                    'custom_class',
     307                    'disable_mail_send',
     308                    'mail_data_subject',
     309                    'recaptcha_site_key',
     310                    'recaptcha_secret_key',
     311                    'section_send_action_mailchimp_api_key',
     312                    'section_send_action_mailchimp_list_id',
     313                    'send_action_type',
     314                ];
     315                $_POST = array_intersect_key($_POST, array_flip($allowed_fields));
     316
    292317                $form_data = array('settings' => $_POST);
    293318
    … …  
    297322                    }
    298323                }
     324
     325               
    299326            } else {
    300327                $get_settings   = new ThzelGetElementSettings($post['eli_page_id'],$post['eli_id'],$post['eli_type']);
    … …  
    378405
    379406                    if($key=='element_id') continue;
    380                     if(in_array($key, array('eli_id', 'eli_type','ID','filter','action','send_action_type', 'g-recaptcha-response'))) continue;
     407                    if(in_array($key, array('eli_id', 'eli_type','ID','filter','action','send_action_type', 'g-recaptcha-response','eli_nonce','eli_token','_wp_http_referer','mail_data_to_email',
     408                    'mail_data_from_email',
     409                    'mail_data_from_name','shortcode'))) continue;
    381410
    382411                    if($key  == 'eli_page_id'){
    … …  
    479508                        if(empty($value)) continue;
    480509
    481                         if(in_array($key, array('eli_id', 'eli_type','ID','filter','action', 'send_action_type', 'g-recaptcha-response'))) continue;
     510                        if(in_array($key, array('eli_id', 'eli_type','ID','filter','action', 'send_action_type', 'g-recaptcha-response','eli_nonce','eli_token','_wp_http_referer','mail_data_to_email',
     511                        'mail_data_from_email',
     512                        'mail_data_from_name','shortcode'))) continue;
    482513
    483514                        if($key  == 'eli_page_id'){

  • elementinvader-addons-for-elementor/trunk/shortcodes/views/shortcode-newsletter.php

    r3370940 r3372940  
    55            <input type="hidden" name="element_id" value="1">
    66            <input type="hidden" name="shortcode" value="1">
     7            <input type="hidden" name="eli_token" value="<?php echo esc_attr(eli_generate_form_token()); ?>">
    78            <?php
    89            // Add a nonce field for AJAX security

  • elementinvader-addons-for-elementor/trunk/views/form/widget_layout.php

    r3370940 r3372940  
    99        <form class="elementinvader_addons_for_elementor_f" <?php if(isset($settings['disable_scroll_to_form']) && $settings['disable_scroll_to_form'] == 'yes'):?> scroll-disabled="disabled"<?php endif;?>>
    1010            <input type="hidden" name="element_id" value="<?php echo esc_attr($this->get_id_int());?>"/>
     11            <input type="hidden" name="eli_token" value="<?php echo esc_attr(eli_generate_form_token()); ?>">
    1112           
    1213            <?php
Note: See TracChangeset for help on using the changeset viewer.