WordPress.org
Get WordPress

Plugin Directory

Changeset 2520787


Ignore:
Timestamp:
04/24/2021 01:24:17 PM (5 years ago)
Author:
simongomes02
Message:

new release 1.0.1 with more security to protect the parcel tracking form

Location:
parcel-tracker-ecourier
Files:
105 added
7 edited

Legend:

Unmodified
Added
Removed

  • parcel-tracker-ecourier/trunk/assets/css/frontend.css

    r2517826 r2520787  
    5555#ept-wrap .ept-tracker-input-container form {
    5656    position: relative;
     57    margin: 0;
    5758}
    5859
    … …  
    135136#ept-wrap #track-not-found img {
    136137    max-width: 200px;
    137     margin-bottom: 30px;
     138    margin: 0 auto 30px;
    138139}
    139140
    … …  
    315316
    316317#ept-wrap #package-information .track-shipment-info h3 {
    317    font-size: 18px;
     318    font-size: 18px;
    318319    color: #1B1E1A;
    319320    margin-bottom: 30px;

  • parcel-tracker-ecourier/trunk/assets/js/frontend.js

    r2517826 r2520787  
    4545
    4646        let data = $(this).serialize();
     47        data += `&nonce=${EPT._etp_nonce}&action=ept_tracking_form`;
    4748        $.post(EPT.ajaxurl, data, function (response) {
    4849            if (response.success) {

  • parcel-tracker-ecourier/trunk/includes/Ajax.php

    r2517826 r2520787  
    2929    public function handle_form_submission() {
    3030
    31         if ( isset( $_POST['ept-search-form'] ) && ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['ept-search-form'] ) ), 'ept_tracking_form' ) ) {
    32             wp_send_json_error(
    33                 array(
    34                     'message' => __( 'You are not allowed to do this', 'ecourier-tracking-code' ),
    35                 )
    36             );
    37             exit;
    38         }
     31        // Block if valid nonce field is not available and valid.
     32        check_ajax_referer( 'ept-parcel-tracker-nonce', 'nonce' );
    3933
    4034        $settings = ept_get_settings();

  • parcel-tracker-ecourier/trunk/includes/Assets.php

    r2517826 r2520787  
    8484            'EPT',
    8585            array(
    86                 'ajaxurl' => admin_url( 'admin-ajax.php' ),
    87                 'error'   => __( 'Something went wrong!', 'ecourier-parcel-tracker' ),
     86                'ajaxurl'    => admin_url( 'admin-ajax.php' ),
     87                '_etp_nonce' => wp_create_nonce( 'ept-parcel-tracker-nonce' ),
     88                'error'      => __( 'Something went wrong!', 'ecourier-parcel-tracker' ),
    8889            )
    8990        );

  • parcel-tracker-ecourier/trunk/includes/Frontend/views/form-parcel-tracker.php

    r2517826 r2520787  
    1515            <input type="text" name="tracking_code" placeholder="<?php esc_attr_e( 'Type your tracking number', 'ecourier-parcel-tracker' ); ?>" class="tracking-code form-control">
    1616
    17             <?php wp_nonce_field( 'ept-search-form' ); ?>
    18             <input type="hidden" name="action" value="ept_tracking_form">
     17<!--            <input type="hidden" name="action" value="ept_tracking_form">-->
    1918
    2019            <button type="submit" class="common-btn">

  • parcel-tracker-ecourier/trunk/parcel-tracker-ecourier.php

    r2520371 r2520787  
    88 * Text Domain: ecourier-parcel-tracker
    99 * Domain Path: /languages
    10  * Version: 1.0.0
     10 * Version: 1.0.1
    1111 * License: GPL2 or later
    1212 * License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    6767     * @var string
    6868     */
    69     const VERSION = '1.0.0';
     69    const VERSION = '1.0.1';
    7070
    7171    /*

  • parcel-tracker-ecourier/trunk/readme.txt

    r2518169 r2520787  
    66Tested up to: 5.7
    77Requires PHP: 5.6
    8 Stable tag: 1.0.0
     8Stable tag: 1.0.1
    99License: GPLv2 or later
    1010License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    6060* 1.0.0 is the latest release of Parcel Tracker eCourier plugin.
    6161
     62= 1.0.1 =
     63* Security measures added for Ajax form submission, this will block unauthorized form submissions for Parcel Tracking Form.
     64
    6265== Privacy Policy ==
    6366
Note: See TracChangeset for help on using the changeset viewer.