Skip to content

Commit 014bbc3

Browse files
mustafauysalmustafauysal
committed
Harden admin nonce handling and Cloudflare API failures
1 parent 2128365 commit 014bbc3

8 files changed

Lines changed: 31 additions & 12 deletions

File tree

‎includes/admin/dashboard.php‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -617,7 +617,8 @@ function purge_all_admin_bar_menu( $wp_admin_bar ) {
617617
*/
618618
function purge_all_cache_action() {
619619

620-
if ( ! wp_verify_nonce( $_GET['_wpnonce'], 'powered_cache_purge_all_cache' ) ) { // phpcs:ignore
620+
$nonce = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
621+
if ( ! wp_verify_nonce( $nonce, 'powered_cache_purge_all_cache' ) ) {
621622
wp_nonce_ays( '' );
622623
}
623624

@@ -687,7 +688,8 @@ function purge_all_cache( $settings = array() ) {
687688
* @since 1.1
688689
*/
689690
function download_rewrite_config() {
690-
if ( ! wp_verify_nonce( $_GET['_wpnonce'], 'powered_cache_download_rewrite' ) ) { // phpcs:ignore
691+
$nonce = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
692+
if ( ! wp_verify_nonce( $nonce, 'powered_cache_download_rewrite' ) ) {
691693
wp_nonce_ays( '' );
692694
}
693695

@@ -940,7 +942,8 @@ function check_alloptions() {
940942
* @since 1.0
941943
*/
942944
function deactivate_plugin() {
943-
if ( ! wp_verify_nonce( $_GET['_wpnonce'], 'deactivate_plugin' ) ) { // phpcs:ignore
945+
$nonce = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
946+
if ( ! wp_verify_nonce( $nonce, 'deactivate_plugin' ) ) {
944947
wp_nonce_ays( '' );
945948
}
946949

‎includes/admin/notices.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -440,7 +440,8 @@ function maybe_display_purge_cache_plugin_notice() {
440440
* @since 3.2
441441
*/
442442
function dismiss_notice() {
443-
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'powered_cache_dismiss_notice' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated
443+
$nonce = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
444+
if ( ! wp_verify_nonce( $nonce, 'powered_cache_dismiss_notice' ) ) {
444445
wp_nonce_ays( '' );
445446
}
446447

‎includes/classes/AdvancedCache.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,8 @@ public function admin_bar_menu( $wp_admin_bar ) {
139139
* @since 2.0
140140
*/
141141
public function purge_page_cache_network_wide() {
142-
if ( ! wp_verify_nonce( $_GET['_wpnonce'], 'powered_cache_purge_page_cache_network' ) ) { // phpcs:ignore
142+
$nonce = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
143+
if ( ! wp_verify_nonce( $nonce, 'powered_cache_purge_page_cache_network' ) ) {
143144
wp_nonce_ays( '' );
144145
}
145146

@@ -758,4 +759,3 @@ public function purge_on_term_change( $term_id, $tt_id, $taxonomy ) {
758759
}
759760

760761
}
761-

‎includes/classes/Extensions/Cloudflare/API.php‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -138,10 +138,21 @@ private function remote_request( $url, $type = 'GET', $data = array() ) {
138138
}
139139

140140
$response = wp_remote_request( $url, $args );
141+
if ( is_wp_error( $response ) ) {
142+
\PoweredCache\Utils\log( sprintf( 'Cloudflare API Error: %s', $response->get_error_message() ) );
141143

142-
\PoweredCache\Utils\log( sprintf( 'Cloudflare API Response: %s', print_r( wp_remote_retrieve_body( $response ), true ) ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r
144+
return [];
145+
}
146+
147+
$response_body = wp_remote_retrieve_body( $response );
148+
\PoweredCache\Utils\log( sprintf( 'Cloudflare API Response: %s', print_r( $response_body, true ) ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r
149+
150+
$decoded_response = json_decode( $response_body, true );
151+
if ( ! is_array( $decoded_response ) ) {
152+
return [];
153+
}
143154

144-
return json_decode( wp_remote_retrieve_body( $response ), true );
155+
return $decoded_response;
145156
}
146157

147158
/**

‎includes/classes/Extensions/Cloudflare/Cloudflare.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,8 @@ public function delete_cloudflare_cache_on_flush() {
121121
* Delete CF cache when it triggered from admin menu
122122
*/
123123
public function delete_cloudflare_cache() {
124-
if ( ! wp_verify_nonce( $_GET['_wpnonce'], 'powered_cache_purge_cf_cache' ) ) { // phpcs:ignore
124+
$nonce = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
125+
if ( ! wp_verify_nonce( $nonce, 'powered_cache_purge_cf_cache' ) ) {
125126
wp_nonce_ays( '' );
126127
}
127128

‎includes/classes/ObjectCache.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,8 @@ public function admin_bar_menu( $wp_admin_bar ) {
9090
* @since 1.0
9191
*/
9292
public function purge_object_cache() {
93-
if ( ! wp_verify_nonce( $_GET['_wpnonce'], 'powered_cache_purge_object_cache' ) ) { // phpcs:ignore
93+
$nonce = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
94+
if ( ! wp_verify_nonce( $nonce, 'powered_cache_purge_object_cache' ) ) {
9495
wp_nonce_ays( '' );
9596
}
9697

‎includes/classes/Preloader.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,8 @@ private function get_preloader() {
131131
* Add preloading items to queue
132132
*/
133133
public function start_preload() {
134-
if ( ! wp_verify_nonce( $_GET['_wpnonce'], 'powered_cache_preload_cache' ) ) { // phpcs:ignore
134+
$nonce = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
135+
if ( ! wp_verify_nonce( $nonce, 'powered_cache_preload_cache' ) ) {
135136
wp_nonce_ays( '' );
136137
}
137138

‎includes/compat/plugins/wpml.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,8 @@ function admin_bar_preload_cache_menu( $wp_admin_bar ) {
186186
* @since 2.4
187187
*/
188188
function purge_page_cache() {
189-
if ( ! wp_verify_nonce( $_GET['_wpnonce'], 'powered_cache_purge_page_cache_for_lang' ) ) { // phpcs:ignore
189+
$nonce = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
190+
if ( ! wp_verify_nonce( $nonce, 'powered_cache_purge_page_cache_for_lang' ) ) {
190191
wp_nonce_ays( '' );
191192
}
192193

0 commit comments

Comments
 (0)