From ab8a02bca559143a868ba5b83a0c1f61a0a62ff6 Mon Sep 17 00:00:00 2001 From: Jason Rouet <56646501+jaz-on@users.noreply.github.com> Date: Tue, 1 Aug 2023 21:21:46 +0200 Subject: [PATCH] Add nonces to several `lws-settings` (#26) * Add extra nonces to fix security report. Resolves #23, resolves #25 * Fix preivous commit (nonces parameters were reversed) * Additional fix (nonces parameters were reversed) * Additional fix (nonces parameters were reversed) * Additional fix (nonces parameters were reversed) * Additional fix * Delete switch_metric function in function switch_simplified --- .DS_Store | Bin 8196 -> 10244 bytes admin/SystemPluginAdmin.php | 69 +++++++++++++++++++---------- admin/partials/SettingsGeneral.php | 12 ++--- 3 files changed, 52 insertions(+), 29 deletions(-) diff --git a/.DS_Store b/.DS_Store index 769a4e44c2d278f5a8bdef88a6e9da2ea45081af..46b69713380e8dd83bb430c2cbc64a7e237d9afc 100644 GIT binary patch literal 10244 zcmeHMPmdcl6n{?A?xx#qS89>qfI1QvRBc1D{U;R;={87kB^5nDwPbce5_K|8lSxyw zT9I>G)E?l1IP^@55E2(YK*c90Ck{p8$_MD7!0*|UtUZ}zdnsB8do_MD_IvhwzxSRU zdx=PF4ucAjM?}kbn64c~l~K5#pP7JJWsMHYvw18$+@UDLPgL>QmT21I! zQ?#H6EefhdMRLRt$;m-zar9Rc{;{T7oP?Sg<0LbSsq_0~^p*ZmMF~#%!d9ieExSF{dZ+NMIYw93YRMe{r{wmp?>*shrm|fb zO#A=(x#p+)du?Ovubx4aj!pEV2F3X6Lsy@Mcx%!irSp&AH+5c`%C;fl+uY*K#oU&i zlsg9Q)Oe<~f8Lbw_uASSu05OQb6J+_Wsof&k%Ywo^-#lJ{GCxPt&}ZyQ?@LWwJghD zKMmQ1{HC4XeKWOlADKO?UslG#AU}p$bO>G#s0*J*DT|+@*Yvf)>5m4zBnp4=dtqk~ zm&?D2T)uGV@Dj?(()D^tb6Ax8@ub?PUXVI%DQ*qTzPl5xcu5% z@4Wlb){U?mNp={DNOm+@)!)qFb&lTb6V`kR5KS%PXl;kpp9cBzMbHM3mTUR)> zAHU_bOF!_hmYFe4-<>=WPZp63zP*H6#Ao^OgJ+nMipmbQ;C8m<#EbM}W3kt>V^f&J z&kL=|Uj#dYt=oW-V9uPdor;6H<4cf=|0BCaj>FCYO7r~2~Io@%dRfs+bT}q%G zHBJeh>{4jQqslf@x~R4diJEg|UY3~>hrx@DQrm8iuJURwujRYDPrrs8)>x+3?)AQy zcrC@V7vb}GEKl8kfN2ojyfx}=g8kH`Af-9ywW;}$ltczHDz{CURkix?dZ7In0;5bH zaxRI}MlP|At~dl70uBL(fJ5MbAduI3czpl={`~*{9}sPw8V&)6z^gz&6l(R_CPtpz zM5HI-Q>%yPGdx_FZ>*^jL8Y$aLDh9UKKSnMZ9L3dX37Qc)r5{UMGMM*|IYw-{!iW0 Oxbwep?fic@|Njefv?pu; delta 416 zcmZn(XmOBWU|?W$DortDU;r^WfEYvza8E20o2aKKCf{4TF>Oa|<>WPGg_g zAh?;GgM~vDB+J5}$B@pD$xs4Q0Tg3ksCoQua)5vobHl+^lXC^6Ss55WtX=^bre=l7 zqJoZWXSfVIoYf}B2r9ssO@c0ynS^ZEKKfQRNUKe*5K~Q_Kh=cwS5m#*msUEG|6RL&6dw z&?=z-VXTx;-&p#aNst+691uuw0|{49=x!|h&ODi4C6EIcwxBR)m>kbDl^YbkAPz(S JgpGxNm;g~SWtac} diff --git a/admin/SystemPluginAdmin.php b/admin/SystemPluginAdmin.php index 4cb99c6..2f4927b 100644 --- a/admin/SystemPluginAdmin.php +++ b/admin/SystemPluginAdmin.php @@ -2050,10 +2050,13 @@ protected function lws_view_admin_page($name, array $args = array()) { * @since 3.0.0 */ private function switch_simplified() { - update_option('live_weather_station_advanced_mode', 0); - add_settings_error('lws_nonce_success', 200, sprintf(__('%s now runs in simplified mode.', 'live-weather-station'), LWS_PLUGIN_NAME), 'updated'); - Logger::info($this->service, null, null, null, null, null, 0, 'Weather Station now runs in simplified mode.'); - $this->switch_metric(); + if( isset($_GET['lwssettingsswitchsimplifiednonce']) && wp_verify_nonce( $_GET['lwssettingsswitchsimplifiednonce'], 'lwssettingsswitchsimplifiednonce') ) { + update_option('live_weather_station_advanced_mode', 0); + add_settings_error('lws_nonce_success', 200, sprintf(__('%s now runs in simplified mode.', 'live-weather-station'), LWS_PLUGIN_NAME), 'updated'); + Logger::info($this->service, null, null, null, null, null, 0, 'Weather Station now runs in simplified mode.'); + } else { + wp_die('NOPE'); + } } /** @@ -2062,9 +2065,13 @@ private function switch_simplified() { * @since 3.0.0 */ private function switch_extended() { - update_option('live_weather_station_advanced_mode', 1); - add_settings_error('lws_nonce_success', 200, sprintf(__('%s now runs in extended mode.', 'live-weather-station'), LWS_PLUGIN_NAME), 'updated'); - Logger::info($this->service, null, null, null, null, null, 0, 'Weather Station now runs in extended mode.'); + if( isset($_GET['lwssettingsswitchextendednonce']) && wp_verify_nonce( $_GET['lwssettingsswitchextendednonce'], 'lwssettingsswitchextendednonce') ) { + update_option('live_weather_station_advanced_mode', 1); + add_settings_error('lws_nonce_success', 200, sprintf(__('%s now runs in extended mode.', 'live-weather-station'), LWS_PLUGIN_NAME), 'updated'); + Logger::info($this->service, null, null, null, null, null, 0, 'Weather Station now runs in extended mode.'); + } else { + wp_die('NOPE'); + } } /** @@ -2073,9 +2080,13 @@ private function switch_extended() { * @since 3.0.0 */ private function switch_metric() { - self::switch_to_metric(); - add_settings_error('lws_nonce_success', 200, sprintf(__('%s now displays its data in the metric system.', 'live-weather-station'), LWS_PLUGIN_NAME), 'updated'); - Logger::info($this->service, null, null, null, null, null, 0, 'Weather Station now displays its data in the metric system.'); + if( isset($_GET['lwssettingsswitchmetricnonce']) && wp_verify_nonce( $_GET['lwssettingsswitchmetricnonce'], 'lwssettingsswitchmetricnonce') ) { + self::switch_to_metric(); + add_settings_error('lws_nonce_success', 200, sprintf(__('%s now displays its data in the metric system.', 'live-weather-station'), LWS_PLUGIN_NAME), 'updated'); + Logger::info($this->service, null, null, null, null, null, 0, 'Weather Station now displays its data in the metric system.'); + } else { + wp_die('NOPE'); + } } /** @@ -2084,9 +2095,13 @@ private function switch_metric() { * @since 3.0.0 */ private function switch_imperial() { - self::switch_to_imperial(); - add_settings_error('lws_nonce_success', 200, sprintf(__('%s now displays its data in the imperial system.', 'live-weather-station'), LWS_PLUGIN_NAME), 'updated'); - Logger::info($this->service, null, null, null, null, null, 0, 'Weather Station now displays its data in the imperial system.'); + if( isset($_GET['lwssettingsswitchimperialnonce']) && wp_verify_nonce( $_GET['lwssettingsswitchimperialnonce'], 'lwssettingsswitchimperialnonce' ) ) { + self::switch_to_imperial(); + add_settings_error('lws_nonce_success', 200, sprintf(__('%s now displays its data in the imperial system.', 'live-weather-station'), LWS_PLUGIN_NAME), 'updated'); + Logger::info($this->service, null, null, null, null, null, 0, 'Weather Station now displays its data in the imperial system.'); + } else { + wp_die('NOPE'); + } } /** @@ -2095,11 +2110,15 @@ private function switch_imperial() { * @since 3.0.0 */ private function switch_full_translation() { - update_option('live_weather_station_partial_translation', 0); - $i18n = new Intl(); - $i18n->delete_mo_files(); - add_settings_error('lws_nonce_success', 200, sprintf(__('%s no longer uses partial translations.', 'live-weather-station'), LWS_PLUGIN_NAME), 'updated'); - Logger::info($this->service, null, null, null, null, null, 0, 'Weather Station no longer uses partial translations.'); + if( isset($_GET['lwssettingsswitchfulltranslationnonce']) && wp_verify_nonce( $_GET['lwssettingsswitchfulltranslationnonce'], 'lwssettingsswitchfulltranslationnonce' ) ) { + update_option('live_weather_station_partial_translation', 0); + $i18n = new Intl(); + $i18n->delete_mo_files(); + add_settings_error('lws_nonce_success', 200, sprintf(__('%s no longer uses partial translations.', 'live-weather-station'), LWS_PLUGIN_NAME), 'updated'); + Logger::info($this->service, null, null, null, null, null, 0, 'Weather Station no longer uses partial translations.'); + } else { + wp_die('NOPE'); + } } /** @@ -2108,11 +2127,15 @@ private function switch_full_translation() { * @since 3.0.0 */ private function switch_partial_translation() { - update_option('live_weather_station_partial_translation', 1); - $i18n = new Intl(); - $i18n->cron_run(); - add_settings_error('lws_nonce_success', 200, sprintf(__('%s now uses a partial translation.', 'live-weather-station'), LWS_PLUGIN_NAME), 'updated'); - Logger::info($this->service, null, null, null, null, null, 0, 'Weather Station now uses a partial translation.'); + if( isset($_GET['lwssettingsswitchpartialtranslationnonce']) && wp_verify_nonce( $_GET['lwssettingsswitchpartialtranslationnonce'], 'lwssettingsswitchpartialtranslationnonce' ) ) { + update_option('live_weather_station_partial_translation', 1); + $i18n = new Intl(); + $i18n->cron_run(); + add_settings_error('lws_nonce_success', 200, sprintf(__('%s now uses a partial translation.', 'live-weather-station'), LWS_PLUGIN_NAME), 'updated'); + Logger::info($this->service, null, null, null, null, null, 0, 'Weather Station now uses a partial translation.'); + } else { + wp_die('NOPE'); + } } /** diff --git a/admin/partials/SettingsGeneral.php b/admin/partials/SettingsGeneral.php index 1540807..edaab5b 100644 --- a/admin/partials/SettingsGeneral.php +++ b/admin/partials/SettingsGeneral.php @@ -20,19 +20,19 @@

-

+

 

-

+

 

metric units. If that does not suit your needs, you can choose imperial units.', 'live-weather-station'), LWS_PLUGIN_NAME);?>

-

+

 

imperial units. If that does not suit your needs, you can choose metric units.', 'live-weather-station'), LWS_PLUGIN_NAME);?>

-

+

@@ -42,13 +42,13 @@

-

+

-

+