more escaping

Author: KingYes

assets/js/settings.js

@@ -92,7 +92,8 @@ jQuery( function( $ ) {
 		getData: function ( type, cb ) {
 			var payload = {
 				action: 'aal_get_properties',
-				action_category: type
+				action_category: type,
+				_nonce: window.aalSettings && window.aalSettings.nonce ? window.aalSettings.nonce : ''
 			};
 			$.getJSON( window.ajaxurl, payload, cb );
 		}

classes/class-aal-admin-ui.php

@@ -21,12 +21,13 @@ public function create_admin_menu() {
 
 	public function activity_log_page_func() {
 		$this->get_list_table()->prepare_items();
+		$page_slug = isset( $_REQUEST['page'] ) ? sanitize_key( wp_unslash( $_REQUEST['page'] ) ) : 'activity-log-page';
 		?>
 		<div class="wrap">
 			<h1 class="aal-page-title"><?php echo esc_html_x( 'Activity Log', 'Page and Menu Title', 'aryo-activity-log' ); ?></h1>
 
 			<form id="activity-filter" method="get">
-				<input type="hidden" name="page" value="<?php echo esc_attr( $_REQUEST['page'] ); ?>" />
+				<input type="hidden" name="page" value="<?php echo esc_attr( $page_slug ); ?>" />
 				<?php $this->get_list_table()->display(); ?>
 			</form>
 		</div>

classes/class-aal-api.php

@@ -75,7 +75,7 @@ protected function _get_ip_address() {
 
 		$visitor_ip_address = '';
 		if ( ! empty( $_SERVER[ $header_key ] ) ) {
-			$visitor_ip_address = $_SERVER[ $header_key ];
+			$visitor_ip_address = sanitize_text_field( wp_unslash( $_SERVER[ $header_key ] ) );
 		}
 
 		$remote_address = apply_filters( 'aal_get_ip_address', $visitor_ip_address );

classes/class-aal-settings.php

@@ -60,6 +60,13 @@ public function action_admin_menu() {
 	 */
 	public function scripts_n_styles() {
 		wp_enqueue_script( 'aal-settings', plugins_url( 'assets/js/settings.js', ACTIVITY_LOG__FILE__ ), array( 'jquery' ) );
+		wp_localize_script(
+			'aal-settings',
+			'aalSettings',
+			array(
+				'nonce' => wp_create_nonce( 'aal_get_properties' ),
+			)
+		);
 		wp_enqueue_style( 'aal-settings', plugins_url( 'assets/css/settings.css', ACTIVITY_LOG__FILE__ ) );
 	}
 
@@ -351,11 +358,13 @@ public function ajax_aal_reset_items() {
 	}
 
 	public function ajax_aal_get_properties() {
-		if ( ! current_user_can( 'manage_options' ) ) {
+		if ( ! check_ajax_referer( 'aal_get_properties', '_nonce', false ) || ! current_user_can( 'manage_options' ) ) {
 			wp_send_json_error();
 		}
 
-		$action_category = isset( $_REQUEST['action_category'] ) ? $_REQUEST['action_category'] : false;
+		$action_category = isset( $_REQUEST['action_category'] )
+			? sanitize_key( wp_unslash( $_REQUEST['action_category'] ) )
+			: '';
 
 		$options = AAL_Main::instance()->notifications->get_settings_dropdown_values( $action_category );