Changeset 3728354 for retainful/trunk/App/Controllers/Webhook.php

Timestamp:

10/05/2026 08:05:53 AM (13 days ago)

Author:

retainful

Message:

v1.0.11 release

File:

• retainful/trunk/App/Controllers/Webhook.php (modified) (3 diffs)

retainful/trunk/App/Controllers/Webhook.php

@@ -15 +15 @@
 use RTFL\App\Helpers\Platform;
 use RTFL\App\Helpers\Product;
+use RTFL\App\Helpers\RateLimiter;
 use RTFL\App\Helpers\Settings;
 use RTFL\App\Helpers\Util;
@@ -516 +517 @@
                 }
 
-                // 2. Input validation
+                if ( RateLimiter::isEnabled() && ! RateLimiter::checkLimit( 'trackProductViewed' )['allowed'] ) {
+                        wp_send_json_error( [ 'message' => __( 'Rate limit exceeded', 'retainful' ) ], 429 );
+                }
+
+                // 2. Input validation. The email comes from the server-side identity (logged-in user / session),
+                // never from the request, so a visitor cannot trigger product-view events for someone else's email.
                 $product_id = absint( Input::get( 'product_id', 0 ) );
-                $email      = sanitize_email( Input::get( 'email', '' ) );
+                $email      = \RTFL\App\Controllers\Store\Common::getIdentifiedCustomerEmail();
 
                 if ( ! $product_id || ! is_email( $email ) ) {
@@ -838 +844 @@
                                 ], 403 );
                         }
+                        if ( RateLimiter::isEnabled() && ! RateLimiter::checkLimit( 'trackUserData' )['allowed'] ) {
+                                wp_send_json_error( [
+                                        'message' => __( 'Rate limit exceeded', 'retainful' )
+                                ], 429 );
+                        }
                 }
                 if ( ! function_exists( 'wc_get_webhook' ) || ! function_exists( 'as_next_scheduled_action' ) || ! function_exists( 'as_schedule_single_action' ) ) {