WordPress.org
Get WordPress

Plugin Directory

Changeset 3728375


Ignore:
Timestamp:
10/05/2026 08:16:33 AM (3 weeks ago)
Author:
convertkit
Message:

Update to version 2.0.0 from GitHub

Location:
integrate-convertkit-wpforms
Files:
12 edited
1 copied

Legend:

Unmodified
Added
Removed

  • integrate-convertkit-wpforms/tags/2.0.0/includes/class-integrate-convertkit-wpforms.php

    r3504867 r3728375  
    107107                $reconnect_button = sprintf(
    108108                        '<a href="%s" class="%s-reconnect">%s</a>',
    109                         esc_url( $api->get_oauth_url( admin_url( 'admin.php?page=wpforms-settings&view=integrations' ) ) ),
     109                        esc_url( $api->get_oauth_url( integrate_convertkit_wpforms_get_oauth_return_url() ) ),
    110110                        esc_attr( $this->slug ),
    111111                        esc_html__( 'Reconnect', 'integrate-convertkit-wpforms' )
    … …  
    657657                        return sprintf(
    658658                                '<div class="wpforms-connection-block"><a href="%s" class="wpforms-btn wpforms-btn-md wpforms-btn-orange" data-provider="convertkit" target="_blank" rel="noopener noreferrer">%s</a></div>',
    659                                 esc_url( $api->get_oauth_url( admin_url( 'admin.php?page=wpforms-settings&view=integrations&convertkit-modal=1' ) ) ),
     659                                esc_url( $api->get_oauth_url( integrate_convertkit_wpforms_get_oauth_return_url( true ) ) ),
    660660                                esc_html__( 'Connect to Kit', 'integrate-convertkit-wpforms' )
    661661                        );
    … …  
    816816        public function maybe_get_and_store_access_token() {
    817817
     818                // phpcs:disable WordPress.Security.NonceVerification
     819
    818820                // Bail if we're not on the integration screen.
    819                 if ( ! array_key_exists( 'page', $_REQUEST ) ) { // phpcs:ignore WordPress.Security.NonceVerification
     821                if ( ! array_key_exists( 'page', $_REQUEST ) ) {
    820822                        return;
    821823                }
    822                 if ( sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) !== 'wpforms-settings' ) { // phpcs:ignore WordPress.Security.NonceVerification
     824                if ( sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) !== 'wpforms-settings' ) {
    823825                        return;
    824826                }
    825 
    826                 if ( ! array_key_exists( 'view', $_REQUEST ) ) { // phpcs:ignore WordPress.Security.NonceVerification
     827                if ( ! array_key_exists( 'view', $_REQUEST ) ) {
    827828                        return;
    828829                }
    829                 if ( $_REQUEST['view'] !== 'integrations' ) { // phpcs:ignore WordPress.Security.NonceVerification
     830                if ( sanitize_text_field( wp_unslash( $_REQUEST['view'] ) ) !== 'integrations' ) {
    830831                        return;
    831832                }
    832833
    833                 // Bail if no authorization code is included in the request.
    834                 if ( ! array_key_exists( 'code', $_REQUEST ) ) { // phpcs:ignore WordPress.Security.NonceVerification
     834                // Bail if no authorization code is included in the request, as this isn't an OAuth callback.
     835                if ( ! array_key_exists( 'code', $_REQUEST ) ) {
    835836                        return;
    836837                }
    837838
     839                // phpcs:enable
     840
     841                // Redirect to the integrations screen if the user isn't permitted to manage WPForms settings.
     842                if ( ! wpforms_current_user_can() ) {
     843                        wp_safe_redirect( $this->get_integrations_url() );
     844                        exit();
     845                }
     846
     847                // Redirect with an error if the nonce is missing or invalid.
     848                if ( ! isset( $_REQUEST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_REQUEST['nonce'] ), INTEGRATE_CONVERTKIT_WPFORMS_NONCE_ACTION_OAUTH_CONNECT ) ) {
     849                        wp_safe_redirect(
     850                                $this->get_integrations_url(
     851                                        array(
     852                                                'error_description' => __( 'The authorization request could not be verified. Please click Connect to Kit again.', 'integrate-convertkit-wpforms' ),
     853                                        )
     854                                )
     855                        );
     856                        exit();
     857                }
     858
    838859                // Sanitize token.
    839                 $authorization_code = sanitize_text_field( wp_unslash( $_REQUEST['code'] ) ); // phpcs:ignore WordPress.Security.NonceVerification
     860                $authorization_code = sanitize_text_field( wp_unslash( $_REQUEST['code'] ) );
    840861
    841862                // Exchange the authorization code and verifier for an access token.
    … …  
    933954
    934955        }
     956
    935957
    936958        /**

  • integrate-convertkit-wpforms/tags/2.0.0/includes/functions.php

    r3422915 r3728375  
    149149}
    150150
     151/**
     152 * Returns the URL Kit redirects to after the user authorizes the Plugin via OAuth,
     153 * including a nonce that is verified before the authorization code is exchanged
     154 * for an access token.
     155 *
     156 * @since   2.0.0
     157 *
     158 * @param   bool $modal  Whether the OAuth flow is served in the form builder's popup window.
     159 * @return  string          OAuth Return URL
     160 */
     161function integrate_convertkit_wpforms_get_oauth_return_url( $modal = false ) {
     162
     163        $args = array(
     164                'page'  => 'wpforms-settings',
     165                'view'  => 'integrations',
     166                'nonce' => wp_create_nonce( INTEGRATE_CONVERTKIT_WPFORMS_NONCE_ACTION_OAUTH_CONNECT ),
     167        );
     168
     169        // Close the popup window once connected, if the OAuth flow started in the form builder.
     170        if ( $modal ) {
     171                $args['convertkit-modal'] = '1';
     172        }
     173
     174        return add_query_arg( $args, admin_url( 'admin.php' ) );
     175
     176}
     177
    151178// Update Access Token when refreshed by the API class.
    152179add_action( 'convertkit_api_refresh_token', 'integrate_convertkit_wpforms_maybe_update_credentials', 10, 3 );

  • integrate-convertkit-wpforms/tags/2.0.0/integrate-convertkit-wpforms.php

    r3698141 r3728375  
    1010 * Plugin URI:  https://kit.com
    1111 * Description: Create Kit signup forms using WPForms
    12  * Version:     1.9.9
     12 * Version:     2.0.0
    1313 * Author:      Kit
    1414 * Author URI:  https://kit.com
    … …  
    2929define( 'INTEGRATE_CONVERTKIT_WPFORMS_URL', plugin_dir_url( __FILE__ ) );
    3030define( 'INTEGRATE_CONVERTKIT_WPFORMS_PATH', __DIR__ );
    31 define( 'INTEGRATE_CONVERTKIT_WPFORMS_VERSION', '1.9.9' );
     31define( 'INTEGRATE_CONVERTKIT_WPFORMS_VERSION', '2.0.0' );
    3232define( 'INTEGRATE_CONVERTKIT_WPFORMS_OAUTH_CLIENT_ID', '147qqKJeENYp5MqgL6AOShDDcLK3UQeClmcIV1ij3gI' );
    3333define( 'INTEGRATE_CONVERTKIT_WPFORMS_OAUTH_REDIRECT_URI', 'https://app.kit.com/wordpress/redirect' );
     34define( 'INTEGRATE_CONVERTKIT_WPFORMS_NONCE_ACTION_OAUTH_CONNECT', 'integrate-convertkit-wpforms-oauth-connect' );
    3435
    3536// Load shared classes, if they have not been included by another ConvertKit Plugin.

  • integrate-convertkit-wpforms/tags/2.0.0/languages/integrate-convertkit-wpforms.pot

    r3698141 r3728375  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: Kit (formerly ConvertKit) for WPForms 1.9.9\n"
     5"Project-Id-Version: Kit (formerly ConvertKit) for WPForms 2.0.0\n"
    66"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/convertkit-wpforms\n"
    77"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
    … …  
    1010"Content-Type: text/plain; charset=UTF-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "POT-Creation-Date: 2026-09-15T13:15:08+00:00\n"
     12"POT-Creation-Date: 2026-10-05T02:23:48+00:00\n"
    1313"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
    1414"X-Generator: WP-CLI 2.12.0\n"
    … …  
    254254msgstr ""
    255255
    256 #: includes/class-integrate-convertkit-wpforms.php:971
     256#: includes/class-integrate-convertkit-wpforms.php:852
     257msgid "The authorization request could not be verified. Please click Connect to Kit again."
     258msgstr ""
     259
     260#: includes/class-integrate-convertkit-wpforms.php:993
    257261msgid "The Kit WordPress Libraries is missing the `revoke_tokens` method. Please update all Kit WordPress Plugins to their latest versions, and click Disconnect again."
    258262msgstr ""
    259263
    260 #: includes/class-integrate-convertkit-wpforms.php:1016
     264#: includes/class-integrate-convertkit-wpforms.php:1038
    261265msgid "Kit: Email"
    262266msgstr ""
    263267
    264 #: includes/class-integrate-convertkit-wpforms.php:1022
     268#: includes/class-integrate-convertkit-wpforms.php:1044
    265269msgid "Kit: First Name"
    266270msgstr ""
    267271
    268 #: includes/class-integrate-convertkit-wpforms.php:1027
     272#: includes/class-integrate-convertkit-wpforms.php:1049
    269273msgid "Kit: Tag"
    270274msgstr ""
    271275
    272276#. translators: ConvertKit Custom Field label
    273 #: includes/class-integrate-convertkit-wpforms.php:1060
     277#: includes/class-integrate-convertkit-wpforms.php:1082
    274278#, php-format
    275279msgid "Kit: Custom Field: %s"
    276280msgstr ""
    277281
    278 #: includes/class-integrate-convertkit-wpforms.php:1095
     282#: includes/class-integrate-convertkit-wpforms.php:1117
    279283msgid "No Kit connections exist."
    280284msgstr ""
    281285
    282286#. translators: WPForms ConvertKit Account ID
    283 #: includes/class-integrate-convertkit-wpforms.php:1103
     287#: includes/class-integrate-convertkit-wpforms.php:1125
    284288#, php-format
    285289msgid "The Kit connection with ID %s was unregistered."

  • integrate-convertkit-wpforms/tags/2.0.0/readme.txt

    r3698141 r3728375  
    66Tested up to: 7.1
    77Requires PHP: 7.1
    8 Stable tag: 1.9.9
     8Stable tag: 2.0.0
    99License: GPLv3 or later
    1010License URI: https://www.gnu.org/licenses/gpl-3.0.html
    … …  
    4545
    4646== Changelog ==
     47
     48### 2.0.0 2026-10-05
     49* Fix: OAuth: Connect: Check user has required permissions
     50* Fix: OAuth: Connect: Use nonce to prevent CSRF
    4751
    4852### 1.9.9 2026-09-15

  • integrate-convertkit-wpforms/tags/2.0.0/views/backend/settings-integration.php

    r3186873 r3728375  
    99?>
    1010
    11 <a href="<?php echo esc_url( $api->get_oauth_url( admin_url( 'admin.php?page=wpforms-settings&view=integrations' ), get_site_url() ) ); ?>" class="wpforms-btn wpforms-btn-md wpforms-btn-orange">
     11<a href="<?php echo esc_url( $api->get_oauth_url( integrate_convertkit_wpforms_get_oauth_return_url(), get_site_url() ) ); ?>" class="wpforms-btn wpforms-btn-md wpforms-btn-orange">
    1212        <?php esc_html_e( 'Connect to Kit', 'integrate-convertkit-wpforms' ); ?>
    1313</a>

  • integrate-convertkit-wpforms/trunk/includes/class-integrate-convertkit-wpforms.php

    r3504867 r3728375  
    107107                $reconnect_button = sprintf(
    108108                        '<a href="%s" class="%s-reconnect">%s</a>',
    109                         esc_url( $api->get_oauth_url( admin_url( 'admin.php?page=wpforms-settings&view=integrations' ) ) ),
     109                        esc_url( $api->get_oauth_url( integrate_convertkit_wpforms_get_oauth_return_url() ) ),
    110110                        esc_attr( $this->slug ),
    111111                        esc_html__( 'Reconnect', 'integrate-convertkit-wpforms' )
    … …  
    657657                        return sprintf(
    658658                                '<div class="wpforms-connection-block"><a href="%s" class="wpforms-btn wpforms-btn-md wpforms-btn-orange" data-provider="convertkit" target="_blank" rel="noopener noreferrer">%s</a></div>',
    659                                 esc_url( $api->get_oauth_url( admin_url( 'admin.php?page=wpforms-settings&view=integrations&convertkit-modal=1' ) ) ),
     659                                esc_url( $api->get_oauth_url( integrate_convertkit_wpforms_get_oauth_return_url( true ) ) ),
    660660                                esc_html__( 'Connect to Kit', 'integrate-convertkit-wpforms' )
    661661                        );
    … …  
    816816        public function maybe_get_and_store_access_token() {
    817817
     818                // phpcs:disable WordPress.Security.NonceVerification
     819
    818820                // Bail if we're not on the integration screen.
    819                 if ( ! array_key_exists( 'page', $_REQUEST ) ) { // phpcs:ignore WordPress.Security.NonceVerification
     821                if ( ! array_key_exists( 'page', $_REQUEST ) ) {
    820822                        return;
    821823                }
    822                 if ( sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) !== 'wpforms-settings' ) { // phpcs:ignore WordPress.Security.NonceVerification
     824                if ( sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) !== 'wpforms-settings' ) {
    823825                        return;
    824826                }
    825 
    826                 if ( ! array_key_exists( 'view', $_REQUEST ) ) { // phpcs:ignore WordPress.Security.NonceVerification
     827                if ( ! array_key_exists( 'view', $_REQUEST ) ) {
    827828                        return;
    828829                }
    829                 if ( $_REQUEST['view'] !== 'integrations' ) { // phpcs:ignore WordPress.Security.NonceVerification
     830                if ( sanitize_text_field( wp_unslash( $_REQUEST['view'] ) ) !== 'integrations' ) {
    830831                        return;
    831832                }
    832833
    833                 // Bail if no authorization code is included in the request.
    834                 if ( ! array_key_exists( 'code', $_REQUEST ) ) { // phpcs:ignore WordPress.Security.NonceVerification
     834                // Bail if no authorization code is included in the request, as this isn't an OAuth callback.
     835                if ( ! array_key_exists( 'code', $_REQUEST ) ) {
    835836                        return;
    836837                }
    837838
     839                // phpcs:enable
     840
     841                // Redirect to the integrations screen if the user isn't permitted to manage WPForms settings.
     842                if ( ! wpforms_current_user_can() ) {
     843                        wp_safe_redirect( $this->get_integrations_url() );
     844                        exit();
     845                }
     846
     847                // Redirect with an error if the nonce is missing or invalid.
     848                if ( ! isset( $_REQUEST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_REQUEST['nonce'] ), INTEGRATE_CONVERTKIT_WPFORMS_NONCE_ACTION_OAUTH_CONNECT ) ) {
     849                        wp_safe_redirect(
     850                                $this->get_integrations_url(
     851                                        array(
     852                                                'error_description' => __( 'The authorization request could not be verified. Please click Connect to Kit again.', 'integrate-convertkit-wpforms' ),
     853                                        )
     854                                )
     855                        );
     856                        exit();
     857                }
     858
    838859                // Sanitize token.
    839                 $authorization_code = sanitize_text_field( wp_unslash( $_REQUEST['code'] ) ); // phpcs:ignore WordPress.Security.NonceVerification
     860                $authorization_code = sanitize_text_field( wp_unslash( $_REQUEST['code'] ) );
    840861
    841862                // Exchange the authorization code and verifier for an access token.
    … …  
    933954
    934955        }
     956
    935957
    936958        /**

  • integrate-convertkit-wpforms/trunk/includes/functions.php

    r3422915 r3728375  
    149149}
    150150
     151/**
     152 * Returns the URL Kit redirects to after the user authorizes the Plugin via OAuth,
     153 * including a nonce that is verified before the authorization code is exchanged
     154 * for an access token.
     155 *
     156 * @since   2.0.0
     157 *
     158 * @param   bool $modal  Whether the OAuth flow is served in the form builder's popup window.
     159 * @return  string          OAuth Return URL
     160 */
     161function integrate_convertkit_wpforms_get_oauth_return_url( $modal = false ) {
     162
     163        $args = array(
     164                'page'  => 'wpforms-settings',
     165                'view'  => 'integrations',
     166                'nonce' => wp_create_nonce( INTEGRATE_CONVERTKIT_WPFORMS_NONCE_ACTION_OAUTH_CONNECT ),
     167        );
     168
     169        // Close the popup window once connected, if the OAuth flow started in the form builder.
     170        if ( $modal ) {
     171                $args['convertkit-modal'] = '1';
     172        }
     173
     174        return add_query_arg( $args, admin_url( 'admin.php' ) );
     175
     176}
     177
    151178// Update Access Token when refreshed by the API class.
    152179add_action( 'convertkit_api_refresh_token', 'integrate_convertkit_wpforms_maybe_update_credentials', 10, 3 );

  • integrate-convertkit-wpforms/trunk/integrate-convertkit-wpforms.php

    r3698141 r3728375  
    1010 * Plugin URI:  https://kit.com
    1111 * Description: Create Kit signup forms using WPForms
    12  * Version:     1.9.9
     12 * Version:     2.0.0
    1313 * Author:      Kit
    1414 * Author URI:  https://kit.com
    … …  
    2929define( 'INTEGRATE_CONVERTKIT_WPFORMS_URL', plugin_dir_url( __FILE__ ) );
    3030define( 'INTEGRATE_CONVERTKIT_WPFORMS_PATH', __DIR__ );
    31 define( 'INTEGRATE_CONVERTKIT_WPFORMS_VERSION', '1.9.9' );
     31define( 'INTEGRATE_CONVERTKIT_WPFORMS_VERSION', '2.0.0' );
    3232define( 'INTEGRATE_CONVERTKIT_WPFORMS_OAUTH_CLIENT_ID', '147qqKJeENYp5MqgL6AOShDDcLK3UQeClmcIV1ij3gI' );
    3333define( 'INTEGRATE_CONVERTKIT_WPFORMS_OAUTH_REDIRECT_URI', 'https://app.kit.com/wordpress/redirect' );
     34define( 'INTEGRATE_CONVERTKIT_WPFORMS_NONCE_ACTION_OAUTH_CONNECT', 'integrate-convertkit-wpforms-oauth-connect' );
    3435
    3536// Load shared classes, if they have not been included by another ConvertKit Plugin.

  • integrate-convertkit-wpforms/trunk/languages/integrate-convertkit-wpforms.pot

    r3698141 r3728375  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: Kit (formerly ConvertKit) for WPForms 1.9.9\n"
     5"Project-Id-Version: Kit (formerly ConvertKit) for WPForms 2.0.0\n"
    66"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/convertkit-wpforms\n"
    77"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
    … …  
    1010"Content-Type: text/plain; charset=UTF-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "POT-Creation-Date: 2026-09-15T13:15:08+00:00\n"
     12"POT-Creation-Date: 2026-10-05T02:23:48+00:00\n"
    1313"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
    1414"X-Generator: WP-CLI 2.12.0\n"
    … …  
    254254msgstr ""
    255255
    256 #: includes/class-integrate-convertkit-wpforms.php:971
     256#: includes/class-integrate-convertkit-wpforms.php:852
     257msgid "The authorization request could not be verified. Please click Connect to Kit again."
     258msgstr ""
     259
     260#: includes/class-integrate-convertkit-wpforms.php:993
    257261msgid "The Kit WordPress Libraries is missing the `revoke_tokens` method. Please update all Kit WordPress Plugins to their latest versions, and click Disconnect again."
    258262msgstr ""
    259263
    260 #: includes/class-integrate-convertkit-wpforms.php:1016
     264#: includes/class-integrate-convertkit-wpforms.php:1038
    261265msgid "Kit: Email"
    262266msgstr ""
    263267
    264 #: includes/class-integrate-convertkit-wpforms.php:1022
     268#: includes/class-integrate-convertkit-wpforms.php:1044
    265269msgid "Kit: First Name"
    266270msgstr ""
    267271
    268 #: includes/class-integrate-convertkit-wpforms.php:1027
     272#: includes/class-integrate-convertkit-wpforms.php:1049
    269273msgid "Kit: Tag"
    270274msgstr ""
    271275
    272276#. translators: ConvertKit Custom Field label
    273 #: includes/class-integrate-convertkit-wpforms.php:1060
     277#: includes/class-integrate-convertkit-wpforms.php:1082
    274278#, php-format
    275279msgid "Kit: Custom Field: %s"
    276280msgstr ""
    277281
    278 #: includes/class-integrate-convertkit-wpforms.php:1095
     282#: includes/class-integrate-convertkit-wpforms.php:1117
    279283msgid "No Kit connections exist."
    280284msgstr ""
    281285
    282286#. translators: WPForms ConvertKit Account ID
    283 #: includes/class-integrate-convertkit-wpforms.php:1103
     287#: includes/class-integrate-convertkit-wpforms.php:1125
    284288#, php-format
    285289msgid "The Kit connection with ID %s was unregistered."

  • integrate-convertkit-wpforms/trunk/readme.txt

    r3698141 r3728375  
    66Tested up to: 7.1
    77Requires PHP: 7.1
    8 Stable tag: 1.9.9
     8Stable tag: 2.0.0
    99License: GPLv3 or later
    1010License URI: https://www.gnu.org/licenses/gpl-3.0.html
    … …  
    4545
    4646== Changelog ==
     47
     48### 2.0.0 2026-10-05
     49* Fix: OAuth: Connect: Check user has required permissions
     50* Fix: OAuth: Connect: Use nonce to prevent CSRF
    4751
    4852### 1.9.9 2026-09-15

  • integrate-convertkit-wpforms/trunk/views/backend/settings-integration.php

    r3186873 r3728375  
    99?>
    1010
    11 <a href="<?php echo esc_url( $api->get_oauth_url( admin_url( 'admin.php?page=wpforms-settings&view=integrations' ), get_site_url() ) ); ?>" class="wpforms-btn wpforms-btn-md wpforms-btn-orange">
     11<a href="<?php echo esc_url( $api->get_oauth_url( integrate_convertkit_wpforms_get_oauth_return_url(), get_site_url() ) ); ?>" class="wpforms-btn wpforms-btn-md wpforms-btn-orange">
    1212        <?php esc_html_e( 'Connect to Kit', 'integrate-convertkit-wpforms' ); ?>
    1313</a>
Note: See TracChangeset for help on using the changeset viewer.