WordPress.org
Get WordPress

Plugin Directory

Changeset 3756495


Ignore:
Timestamp:
10/20/2026 10:55:47 AM (3 hours ago)
Author:
enituretechnology
Message:

2.5.25 - 2026-10-20

  • Update: Added REST API endpoints to export store settings data for the Eniture support chatbot.
  • Fix: Improved plugin security.

Ticket# 47714250004, 47577391118

Location:
ltl-freight-quotes-unishippers-edition
Files:
2 added
34 edited
1 copied

Legend:

Unmodified
Added
Removed

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/fdo/en-coupon-api.php

    r3722849 r3756495  
    88        {
    99            add_action('wp_ajax_en_unishippers_ltl_fdo_connection_status_refresh', [$this, 'en_unishippers_ltl_fdo_connection_status_refresh']);
    10             add_action('wp_ajax_nopriv_en_unishippers_ltl_fdo_connection_status_refresh', [$this, 'en_unishippers_ltl_fdo_connection_status_refresh']);
    1110
    1211            add_action('wp_ajax_en_unishippers_ltl_va_connection_status_refresh', [$this, 'en_unishippers_ltl_va_connection_status_refresh']);
    13             add_action('wp_ajax_nopriv_en_unishippers_ltl_va_connection_status_refresh', [$this, 'en_unishippers_ltl_va_connection_status_refresh']);
    1412
    15             add_action('wp_ajax_nopriv_unishippers_fd', [$this, 'unishippers_fd_api']);
    1613            add_action('wp_ajax_unishippers_fd', [$this, 'unishippers_fd_api']);
    1714            add_action('rest_api_init', [$this, 'en_rest_api_init_status_unishippers']);
    … …  
    2320        function en_unishippers_ltl_fdo_connection_status_refresh()
    2421        {
    25             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_freight_nonce')) {
     22            $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     23            if (!current_user_can('manage_options') || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
    2624                echo json_encode([]);
    2725                return;
    … …  
    3634        function en_unishippers_ltl_va_connection_status_refresh()
    3735        {
    38             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_freight_nonce')) {
     36            $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     37            if (!current_user_can('manage_options') || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
    3938                echo json_encode([]);
    4039                return;
    … …  
    5049        function unishippers_fd_api()
    5150        {
    52             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_freight_nonce')) {
     51            $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     52            if (!current_user_can('manage_options') || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
    5353                echo json_encode([]);
    5454                return;
    … …  
    5656
    5757            $store_name = eniture_unishippers_freight_get_domain();
    58             $company_id = sanitize_text_field( wp_unslash( $_POST['company_id']));
     58            $company_id = isset($_POST['company_id']) ? sanitize_text_field(wp_unslash($_POST['company_id'])) : '';
     59            $disconnect = isset($_POST['disconnect']) ? sanitize_text_field(wp_unslash($_POST['disconnect'])) : '';
    5960            $data = [
    6061                'plateform'  => 'wp',
    … …  
    6465            ];
    6566            if (is_array($data) && count($data) > 0) {
    66                 if($_POST['disconnect'] != 'disconnect') {
     67                if($disconnect != 'disconnect') {
    6768                    $url =  'https://freightdesk.online/validate-company';
    6869                }else {
    … …  
    7980                $response = wp_remote_retrieve_body($response);
    8081            }
    81             if($_POST['disconnect'] == 'disconnect') {
     82            if($disconnect == 'disconnect') {
    8283                $result = json_decode($response);
    8384                if ($result->status == 'SUCCESS') {
    … …  
    9798                'callback' => [$this, 'en_unishippers_fdo_data_status'],
    9899                'permission_callback' => '__return_true'
    99             ));
    100             // plan update
    101             register_rest_route(EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE, '/v1', array(
    102                 'methods' => 'GET',
    103                 'callback' => [$this, 'en_plan_update'],
    104                 'permission_callback' => 'en_unishippers_verify_plan_update_request'
    105100            ));
    106101        }
    … …  
    130125        function fdo_va_update_status_authenticate($request) {
    131126            if ( !empty( $_SERVER['HTTP_CONSUMER_KEY'] ) && !empty( $_SERVER['HTTP_CONSUMER_SECRET'] ) ) {
    132                 $consumer_key    = sanitize_text_field( wp_unslash( $_SERVER['HTTP_CONSUMER_KEY'] ) );
     127                $consumer_key = wc_api_hash( sanitize_text_field( $_SERVER['HTTP_CONSUMER_KEY'] ) );
    133128                $consumer_secret = sanitize_text_field( wp_unslash( $_SERVER['HTTP_CONSUMER_SECRET'] ) );
    134129            }else{
    … …  
    164159        }
    165160
    166         function en_plan_update()
    167         {
    168             $carrier = isset($_GET['carrier']) ? sanitize_text_field(wp_unslash($_GET['carrier'])) : '';
    169             if ($carrier !== '' && $carrier !== EN_UNISHIPPERS_CARRIER_ID) {
    170                 return rest_ensure_response(['success' => false]);
    171             }
    172 
    173             $plan = isset($_GET['pakg_group']) ? sanitize_text_field($_GET['pakg_group']) : '';
    174 
    175             if (in_array($plan, array('0', '1', '2', '3'))) {
    176                 if (isset($_GET['pakg_price']) && $_GET['pakg_price'] == '0') {
    177                     $plan = '0';
    178                 }
    179 
    180                 update_option('unishippers_freight_packages_quotes_package' , "$plan");
    181                
    182                 $plan_type = isset($_GET['plan_type']) ? sanitize_text_field($_GET['plan_type']) : '';
    183                 update_option('unishippers_freight_store_type' , "$plan_type");
    184                
    185                 $expire_days = isset($_GET['pakg_duration']) ? sanitize_text_field($_GET['pakg_duration']) : '';
    186                 update_option('unishippers_freight_package_expire_days' , "$expire_days");
    187 
    188                 $expiry_date = isset($_GET['expiry_date']) ? sanitize_text_field($_GET['expiry_date']) : '';
    189                 update_option('unishippers_freight_package_expire_date' , "$expiry_date");
    190                
    191                 eniture_check_unishippers_freight_plan_on_product_detail();
    192             }
    193 
    194             return rest_ensure_response( ['success' => true] );
    195         }
    196161    }
    197162}
    198 
    199 /**
    200  * Verifies that a plan update request was signed by the Eniture licensing server with this
    201  * store's license key. The signature covers the query string exactly as sent, up to but not
    202  * including the trailing sig parameter, so sig must always be appended last. When a store
    203  * uses plain permalinks WordPress prepends its own rest_route parameter, which the licensing
    204  * server did not sign and which is therefore dropped before the comparison.
    205  *
    206  * @return bool|WP_Error
    207  */
    208 function en_unishippers_verify_plan_update_request()
    209 {
    210     $license_key = get_option('wc_settings_unishippers_freight_licence_key');
    211     $signature = isset($_GET['sig']) ? sanitize_text_field(wp_unslash($_GET['sig'])) : '';
    212     $query = isset($_SERVER['QUERY_STRING']) ? wp_unslash($_SERVER['QUERY_STRING']) : '';
    213     $position = strrpos($query, '&sig=');
    214 
    215     if (empty($license_key) || empty($signature) || $position === false) {
    216         return new WP_Error('rest_forbidden', __('Invalid request.', 'ltl-freight-quotes-unishippers-edition'), array('status' => 403));
    217     }
    218 
    219     $signed = substr($query, 0, $position);
    220 
    221     if (strpos($signed, 'rest_route=') === 0) {
    222         $separator = strpos($signed, '&');
    223         $signed = ($separator === false) ? '' : substr($signed, $separator + 1);
    224     }
    225 
    226     if (!hash_equals(hash_hmac('sha256', $signed, $license_key), $signature)) {
    227         return new WP_Error('rest_forbidden', __('Invalid request.', 'ltl-freight-quotes-unishippers-edition'), array('status' => 403));
    228     }
    229 
    230     return true;
    231 }
    232 

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/js/eniture-calculate-shipping-admin.js

    r3495563 r3756495  
    1010            url: ajaxurl,
    1111            data: {
    12                 action: 'eniture_calculate_shipping_rates_admin',
     12                action: 'eniture_unishippers_ltl_calculate_shipping_rates_admin',
     13                wp_nonce: en_unishippers_ltl_order_rates_script.nonce,
    1314                products: $('#order_line_items .item').toArray().map(function(item) {
    1415                    return $(item).find('input.order_item_id').val();

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/ltl-freight-quotes-unishippers-edition.php

    r3722849 r3756495  
    66  Author: Eniture Technology
    77  Author URI: http://eniture.com/
    8   Version: 2.5.24
     8  Version: 2.5.25
    99  Text Domain: ltl-freight-quotes-unishippers-edition
    1010  License: GPLv2 or later
    … …  
    2121
    2222define('UNISHIPPERS_MAIN_FILE', __FILE__);
    23 define('EN_UNISHIPPERS_CARRIER_ID', '63');
    24 define('EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE', 'en_update_plan_carrier_' . EN_UNISHIPPERS_CARRIER_ID);
    2523
    2624add_action('before_woocommerce_init', function () {
    … …  
    148146        if(is_admin() && (!empty( $_GET['page']) && 'wc-orders' == $_GET['page'] ) && (!empty( $_GET['action']) && 'new' == $_GET['action'] ))
    149147        {
    150             if (!wp_script_is('eniture_calculate_shipping_admin', 'enqueued')) {
    151                 wp_enqueue_script('eniture_calculate_shipping_admin', plugin_dir_url(__FILE__) . 'js/eniture-calculate-shipping-admin.js', array(), '1.0.0' );
     148            if (!wp_script_is('eniture_unishippers_ltl_calculate_shipping_admin', 'enqueued')) {
     149                wp_enqueue_script('eniture_unishippers_ltl_calculate_shipping_admin', plugin_dir_url(__FILE__) . 'js/eniture-calculate-shipping-admin.js', array(), '1.0.1' );
     150                wp_localize_script('eniture_unishippers_ltl_calculate_shipping_admin', 'en_unishippers_ltl_order_rates_script', array(
     151                    'nonce' => wp_create_nonce('unishippers_freight_nonce'),
     152                ));
    152153            }
    153154        }
    … …  
    207208
    208209        // Shipping rules script and styles
    209         wp_enqueue_script('en_unishippers_ltl_sr_script', plugin_dir_url(__FILE__) . '/shipping-rules/assets/js/shipping_rules.js', array(), '1.0.3');
    210         wp_localize_script('en_unishippers_ltl_sr_script', 'sr_script', array(
     210        wp_enqueue_script('en_unishippers_ltl_sr_script', plugin_dir_url(__FILE__) . '/shipping-rules/assets/js/shipping_rules.js', array(), '1.0.4');
     211        wp_localize_script('en_unishippers_ltl_sr_script', 'en_unishippers_ltl_sr_script_data', array(
    211212            'pluginsUrl' => plugins_url(),
    212213            'nonce' => wp_create_nonce('unishippers_sr_freight_nonce'),
    … …  
    282283require_once('shipping-rules/shipping-rules-save.php');
    283284require_once 'support/support-code-request.php';
     285require_once('unishippers-app-data.php');
    284286
    285287/**
    … …  
    321323        $plugin_info = get_plugins();
    322324        $plugin_version = (isset($plugin_info[$index]['Version'])) ? $plugin_info[$index]['Version'] : '';
    323         $update_now = get_option('en_unishippers_freight_update_now');
    324 
    325         if ($update_now != $plugin_version) {
    326             if (!function_exists('eniture_unishippers_freight_activate_hit_to_update_plan')) {
    327                 require_once(__DIR__ . '/update-plan.php');
    328             }
    329 
    330             eniture_unishippers_freight_activate_hit_to_update_plan();
    331             eniture_create_unishippers_ltl_wh_db();
    332             eniture_create_carriers_db_unishippers();
    333             eniture_unishippers_ltl_freihgt_installation_carrier();
    334 
    335             update_option('en_unishippers_freight_update_now', $plugin_version);
    336         }
     325
     326        if (!function_exists('en_unishippers_run_update_routine')) {
     327            require_once(__DIR__ . '/update-plan.php');
     328        }
     329
     330        en_unishippers_run_update_routine($plugin_version);
    337331    }
    338332
    … …  
    354348        wp_enqueue_script('jquery');
    355349        wp_enqueue_script('en_unishippers_freight_frontend_checkout_script', plugin_dir_url(__FILE__) . 'front/js/en-unishippers-ltl-checkout.js', array(), '1.0.0');
    356         wp_localize_script('en_unishippers_freight_frontend_checkout_script', 'frontend_script', array(
     350        wp_localize_script('en_unishippers_freight_frontend_checkout_script', 'en_unishippers_ltl_frontend_script', array(
    357351            'pluginsUrl' => plugins_url(),
    358352        ));

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/order/rates/order-rates.php

    r3251023 r3756495  
    1515        public function __construct()
    1616        {
    17             add_action('wp_ajax_eniture_calculate_shipping_rates_admin', [$this, 'eniture_calculate_shipping_rates_admin']);
     17            add_action('wp_ajax_eniture_unishippers_ltl_calculate_shipping_rates_admin', [$this, 'eniture_calculate_shipping_rates_admin']);
    1818            add_filter('en_order_accessories', [$this, 'en_order_accessories']);
    1919        }
    … …  
    2828        public function eniture_calculate_shipping_rates_admin()
    2929        {
    30             $products = isset($_POST['products']) ? (array) sanitize_text_field( wp_unslash( $_POST['products'] )) : array();
     30            $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     31            if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce')) || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
     32                wp_send_json_error(array('message' => 'Unauthorized Access'), 403);
     33            }
     34
     35            $products = isset($_POST['products']) ? array_map('absint', (array) $_POST['products']) : array();
    3136            $orderItems = array_map(function($productId) {
    3237                return new WC_Order_Item_Product((int) $productId);

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/readme.txt

    r3722849 r3756495  
    44Requires at least: 6.4
    55Tested up to: 7.1
    6 Stable tag: 2.5.24
     6Stable tag: 2.5.25
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    167167== Changelog ==
    168168
     169= 2.5.25 - 2026-10-20 =
     170* Update: Added REST API endpoints to export store settings data for the Eniture support chatbot.
     171* Fix: Improved plugin security.
     172
    169173= 2.5.24 - 2026-10-01 =
    170174* Fix: Secured the subscription plan update endpoint so it only accepts verified requests.

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/shipping-rules/assets/js/shipping_rules.js

    r3722849 r3756495  
    345345                const postData = {
    346346                        action: 'en_unishippers_ltl_save_shipping_rule',
    347                         wp_nonce: sr_script.nonce,
     347                        wp_nonce: en_unishippers_ltl_sr_script_data.nonce,
    348348                        rule_id: jQuery('#edit_sr_form_id').val(),
    349349                        name: jQuery('#en_sr_rule_name').val(),
    … …  
    473473                                action: 'en_unishippers_ltl_edit_shipping_rule',
    474474                                edit_id: rule_id,
    475                                 wp_nonce: sr_script.nonce,
     475                                wp_nonce: en_unishippers_ltl_sr_script_data.nonce,
    476476                        };
    477477
    … …  
    485485                                        jQuery(elem).css(
    486486                                                'background',
    487                                                 `rgba(255, 255, 255, 1) url("${sr_script.pluginsUrl}/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/processing.gif") no-repeat scroll 50% 50%`
     487                                                `rgba(255, 255, 255, 1) url("${en_unishippers_ltl_sr_script_data.pluginsUrl}/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/processing.gif") no-repeat scroll 50% 50%`
    488488                                        );
    489489                                },
    … …  
    640640                                action: 'en_unishippers_ltl_delete_shipping_rule',
    641641                                delete_id: id,
    642                                 wp_nonce: sr_script.nonce,
     642                                wp_nonce: en_unishippers_ltl_sr_script_data.nonce,
    643643                        };
    644644
    … …  
    652652                                        jQuery(elem).css(
    653653                                                'background',
    654                                                 `rgba(255, 255, 255, 1) url("${sr_script.pluginsUrl}/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/processing.gif") no-repeat scroll 50% 50%`
     654                                                `rgba(255, 255, 255, 1) url("${en_unishippers_ltl_sr_script_data.pluginsUrl}/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/processing.gif") no-repeat scroll 50% 50%`
    655655                                        );
    656656                                },
    … …  
    685685                        rule_id,
    686686                        is_active: Number(!Number(is_active)),
    687                         wp_nonce: sr_script.nonce,
     687                        wp_nonce: en_unishippers_ltl_sr_script_data.nonce,
    688688                };
    689689
    … …  
    697697                                jQuery(elem).css(
    698698                                        'background',
    699                                         `rgba(255, 255, 255, 1) url("${sr_script.pluginsUrl}/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/processing.gif") no-repeat scroll 50% 50%`
     699                                        `rgba(255, 255, 255, 1) url("${en_unishippers_ltl_sr_script_data.pluginsUrl}/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/processing.gif") no-repeat scroll 50% 50%`
    700700                                );
    701701                        },
    … …  
    720720
    721721        // #region: Get Row Markup
     722        // The rule name/type are admin-supplied strings -- escape them before building markup from them.
     723        const escapeHtml = (value) => jQuery('<div>').text(value ?? '').html();
     724
    722725        function enUnishippersLtlGetRowMarkup(rule) {
     726                const escapeHtml = (value) => jQuery('<div>').text(value ?? '').html();
    723727                const rowMarkup = `
    724                                 <td class="en_wd_warehouse_list_data">${rule?.name}</td>
    725                                 <td class="en_wd_warehouse_list_data">${rule?.type}</td>
     728                                <td class="en_wd_warehouse_list_data">${escapeHtml(rule?.name)}</td>
     729                                <td class="en_wd_warehouse_list_data">${escapeHtml(rule?.type)}</td>
    726730                                <td class="en_wd_warehouse_list_data"><a href="#" class='en_unishippers_ltl_sr_status_link' data-id='${
    727731                                        rule?.id
    … …  
    731735                                        <a href="#" class="en_unishippers_ltl_sr_edit_link" data-id="${rule?.id}">
    732736                                                <img src="${
    733                                                         sr_script.pluginsUrl
     737                                                        en_unishippers_ltl_sr_script_data.pluginsUrl
    734738                                                }/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/edit.png" title="Edit">
    735739                                        </a>
    … …  
    737741                                        <a href="#" class="en_unishippers_ltl_sr_delete_link" data-id="${rule?.id}">
    738742                                                <img src="${
    739                                                         sr_script.pluginsUrl
     743                                                        en_unishippers_ltl_sr_script_data.pluginsUrl
    740744                                                }/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/delete.png" title="Delete">
    741745                                        </a>

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/shipping-rules/shipping-rules-save.php

    r3722849 r3756495  
    2525            $this->is_country_filter_applied = false;
    2626
    27             add_action('wp_ajax_nopriv_en_unishippers_ltl_save_shipping_rule', array($this, 'en_unishippers_ltl_save_shipping_rule_ajax'));
    2827            add_action('wp_ajax_en_unishippers_ltl_save_shipping_rule', array($this, 'en_unishippers_ltl_save_shipping_rule_ajax'));
    2928
    30             add_action('wp_ajax_nopriv_en_unishippers_ltl_edit_shipping_rule', array($this, 'en_unishippers_ltl_edit_shipping_rule_ajax'));
    3129            add_action('wp_ajax_en_unishippers_ltl_edit_shipping_rule', array($this, 'en_unishippers_ltl_edit_shipping_rule_ajax'));
    3230
    33             add_action('wp_ajax_nopriv_en_unishippers_ltl_delete_shipping_rule', array($this, 'en_unishippers_ltl_delete_shipping_rule_ajax'));
    3431            add_action('wp_ajax_en_unishippers_ltl_delete_shipping_rule', array($this, 'en_unishippers_ltl_delete_shipping_rule_ajax'));
    3532
    36             add_action('wp_ajax_nopriv_en_unishippers_ltl_update_shipping_rule_status', array($this, 'en_unishippers_ltl_update_shipping_rule_status_ajax'));
    3733            add_action('wp_ajax_en_unishippers_ltl_update_shipping_rule_status', array($this, 'en_unishippers_ltl_update_shipping_rule_status_ajax'));
     34        }
     35
     36        /**
     37         * Shared gate for all four shipping-rule handlers: an appropriately capable user plus a valid
     38         * nonce. Sends a 403 and halts rather than returning, so no caller can proceed unauthorized.
     39         */
     40        private function en_unishippers_ltl_authorize_request()
     41        {
     42            $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     43            if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce')) || !wp_verify_nonce($nonce, 'unishippers_sr_freight_nonce')) {
     44                wp_send_json(array('error' => true, 'message' => 'Unauthorized Access.'), 403);
     45            }
     46        }
     47
     48        /** Recursively sanitizes a submitted value, preserving the settings array's shape. */
     49        private function en_unishippers_ltl_sanitize($value)
     50        {
     51            if (is_array($value)) {
     52                return array_map(array($this, 'en_unishippers_ltl_sanitize'), $value);
     53            }
     54
     55            return sanitize_text_field(wp_unslash($value));
    3856        }
    3957
    … …  
    4563        function en_unishippers_ltl_save_shipping_rule_ajax()
    4664        {
    47             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_sr_freight_nonce')) {
    48                 echo json_encode([]);
    49                 exit;
    50             }
     65            $this->en_unishippers_ltl_authorize_request();
    5166
    5267            global $wpdb;
    … …  
    5469            $insert_qry = $update_qry = '';
    5570            $error = false;
    56             $data = eniture_uni_ltl_sanitize_request_data($_POST);
    57             $get_shipping_rule_id = (isset($data['rule_id']) && intval($data['rule_id'])) ? intval($data['rule_id']) : "";
     71            // Whitelist the columns actually written instead of handing the request array to $wpdb.
     72            $data = array(
     73                'name' => isset($_POST['name']) ? $this->en_unishippers_ltl_sanitize($_POST['name']) : '',
     74                'type' => isset($_POST['type']) ? $this->en_unishippers_ltl_sanitize($_POST['type']) : '',
     75                'is_active' => !empty($_POST['is_active']) ? 1 : 0,
     76                'settings' => (isset($_POST['settings']) && is_array($_POST['settings'])) ? $this->en_unishippers_ltl_sanitize($_POST['settings']) : array(),
     77            );
     78            $get_shipping_rule_id = isset($_POST['rule_id']) ? absint($_POST['rule_id']) : 0;
    5879            $last_id = $get_shipping_rule_id;
    5980            $get_shipping_rule = $wpdb->get_results(
    … …  
    6384                )
    6485            );
    65            
    66             unset($data['action']);
    67             unset($data['rule_id']);
    68             unset($data['wp_nonce']);
    6986
    7087            if (!empty($get_shipping_rule_id)) {
    71                 $data['settings'] = json_encode($data['settings']);
     88                $data['settings'] = wp_json_encode($data['settings']);
    7289                $update_qry = $wpdb->update(
    7390                    $wpdb->prefix . 'eniture_unishippers_ltl_shipping_rules', $data, array('id' => $get_shipping_rule_id)
    … …  
    7996                    $error = true;
    8097                } else {
    81                     $data['settings'] = json_encode($data['settings']);
     98                    $data['settings'] = wp_json_encode($data['settings']);
    8299                    $insert_qry = $wpdb->insert($wpdb->prefix . 'eniture_unishippers_ltl_shipping_rules', $data);
    83100                    $last_id = $wpdb->insert_id;
    … …  
    98115        function en_unishippers_ltl_edit_shipping_rule_ajax()
    99116        {
    100             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_sr_freight_nonce')) {
    101                 echo json_encode([]);
    102                 exit;
    103             }
     117            $this->en_unishippers_ltl_authorize_request();
    104118
    105119            global $wpdb;
    106             $get_shipping_rule_id = (isset($_POST['edit_id']) && intval($_POST['edit_id'])) ? intval(sanitize_text_field( wp_unslash($_POST['edit_id']))) : "";
     120            $get_shipping_rule_id = isset($_POST['edit_id']) ? absint($_POST['edit_id']) : 0;
    107121            $shipping_rules_list = $wpdb->get_results(
    108                 $wpdb->prepare("SELECT * FROM " . $wpdb->prefix . "eniture_unishippers_ltl_shipping_rules WHERE id = %d", [$get_shipping_rule_id])
     122                $wpdb->prepare("SELECT * FROM {$wpdb->prefix}eniture_unishippers_ltl_shipping_rules WHERE id = %d", $get_shipping_rule_id)
    109123            );
    110124            $product_tags_markup = !empty($shipping_rules_list) ? $this->en_unishippers_ltl_get_product_tags_markup($shipping_rules_list) : '';
    … …  
    128142        function en_unishippers_ltl_delete_shipping_rule_ajax()
    129143        {
    130             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_sr_freight_nonce')) {
    131                 echo json_encode([]);
    132                 exit;
    133             }
     144            $this->en_unishippers_ltl_authorize_request();
    134145
    135146            global $wpdb;
    136             $get_shipping_rule_id = (isset($_POST['delete_id']) && intval($_POST['delete_id'])) ? intval(sanitize_text_field( wp_unslash($_POST['delete_id']))) : "";
     147            $get_shipping_rule_id = isset($_POST['delete_id']) ? absint($_POST['delete_id']) : 0;
    137148            $qry = $wpdb->delete($wpdb->prefix . 'eniture_unishippers_ltl_shipping_rules', array('id' => $get_shipping_rule_id));
    138149
    … …  
    148159        function en_unishippers_ltl_update_shipping_rule_status_ajax()
    149160        {
    150             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_sr_freight_nonce')) {
    151                 echo json_encode([]);
    152                 exit;
    153             }
     161            $this->en_unishippers_ltl_authorize_request();
    154162
    155163            global $wpdb;
    156             $get_shipping_rule_id = (isset($_POST['rule_id']) && intval($_POST['rule_id'])) ? intval(sanitize_text_field( wp_unslash($_POST['rule_id']))) : "";
    157             $is_active = isset($_POST['is_active']) ? sanitize_text_field( wp_unslash($_POST['is_active'] )) : "";
     164            $get_shipping_rule_id = isset($_POST['rule_id']) ? absint($_POST['rule_id']) : 0;
     165            $is_active = !empty($_POST['is_active']) ? 1 : 0;
    158166            $data = ['is_active' => $is_active];
    159167            $update_qry = $wpdb->update(

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/shipping-rules/shipping-rules-template.php

    r3722849 r3756495  
    5151                    ?>
    5252                      <tr id="sr_row_<?php echo (isset($rule->id)) ? esc_attr($rule->id) : ''; ?>" class="en_uni_ltl_sr_row">
    53                         <td class="en_wd_warehouse_list_data"><?php echo esc_attr( $rule->name ); ?></td>
    54                         <td class="en_wd_warehouse_list_data"><?php echo esc_attr( $rule->type ); ?></td>
     53                        <td class="en_wd_warehouse_list_data"><?php echo esc_html( $rule->name ); ?></td>
     54                        <td class="en_wd_warehouse_list_data"><?php echo esc_html( $rule->type ); ?></td>
    5555                        <td class="en_wd_warehouse_list_data">
    56                           <a href="#" class="en_unishippers_ltl_sr_status_link" data-id="<?php echo (isset($rule->id)) ? esc_attr($rule->id) : ''; ?>" data-status="<?php echo esc_attr( $rule->is_active ); ?>"><?php echo esc_attr( $rule->is_active ) ? 'Yes' : 'No'; ?></a>
     56                          <a href="#" class="en_unishippers_ltl_sr_status_link" data-id="<?php echo (isset($rule->id)) ? esc_attr($rule->id) : ''; ?>" data-status="<?php echo esc_attr( $rule->is_active ); ?>"><?php echo $rule->is_active ? 'Yes' : 'No'; ?></a>
    5757                        </td>
    5858                        <td class="en_wd_warehouse_list_data">

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/support/support-code-request.php

    r3663340 r3756495  
    1919function en_unishippers_freight_generate_support_code()
    2020{
    21     if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce')) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['wp_nonce'])), 'unishippers_freight_nonce')) {
     21    $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     22    if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce')) || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
    2223        echo wp_json_encode(array('success' => false, 'message' => 'Unauthorized Access.'));
    2324        exit;

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/unishippers-ltl-tab-class.php

    r3722849 r3756495  
    600600                            'name' => __('Show WooCommerce Shipping Options ', 'ltl-freight-quotes-unishippers-edition'),
    601601                            'type' => 'select',
    602                             'default' => '3',
     602                            'default' => 'yes',
    603603                            'desc' => __('Enabled options on WooCommerce Shipping page are included in quote results.', 'ltl-freight-quotes-unishippers-edition'),
    604604                            'id' => 'wc_settings_unishippers_freight_allow_other_plugins',

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/unishippers-ltl-test-connecion.php

    r3251023 r3756495  
    1818    function eniture_unishippers_freight_submit()
    1919    {
    20         if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_freight_nonce')) {
     20        $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     21        if (!current_user_can('manage_options') || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
    2122            echo json_encode([]);
    2223            exit;
    … …  
    7879    }
    7980
    80     add_action('wp_ajax_nopriv_unishippers_ltl_validate_keys', 'eniture_unishippers_freight_submit');
    8181    add_action('wp_ajax_unishippers_ltl_validate_keys', 'eniture_unishippers_freight_submit');
    8282}

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/update-plan.php

    r3722849 r3756495  
    88}
    99
    10 add_action('wp_ajax_en_unishippers_freight_activate_hit_to_update_plan', 'eniture_unishippers_freight_activate_hit_to_update_plan');
    11 add_action('wp_ajax_nopriv_en_unishippers_freight_activate_hit_to_update_plan', 'eniture_unishippers_freight_activate_hit_to_update_plan');
     10add_action('wp_ajax_en_unishippers_freight_activate_hit_to_update_plan', 'en_unishippers_ajax_update_plan');
     11
     12/**
     13 * Nonce- and capability-gated entry point for the "Click here to refresh the plan" link. The worker
     14 * function itself is also reached from the activation hook and the update routine, so access is
     15 * gated here at the call site rather than inside the worker.
     16 */
     17if (!function_exists('en_unishippers_ajax_update_plan')) {
     18
     19    function en_unishippers_ajax_update_plan()
     20    {
     21        $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     22        if (!current_user_can('manage_options') || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
     23            wp_send_json_error(array('message' => 'Unauthorized Access'), 403);
     24        }
     25
     26        eniture_unishippers_freight_activate_hit_to_update_plan();
     27        wp_send_json_success(eniture_unishippers_freight_plan_name());
     28    }
     29
     30}
     31
     32/**
     33 * The automatic plan refresh must never run on an anonymous storefront/checkout/cron request -- it is
     34 * a blocking remote call. Defer it to the next admin/AJAX/WP-CLI request instead.
     35 */
     36if (!function_exists('en_unishippers_can_refresh_plan_now')) {
     37
     38    function en_unishippers_can_refresh_plan_now()
     39    {
     40        return is_admin() || wp_doing_ajax() || (defined('WP_CLI') && WP_CLI);
     41    }
     42
     43}
     44
     45/**
     46 * Runs the one-time-per-version upgrade steps. Local steps always run; the remote plan refresh only
     47 * runs in a safe context and is otherwise flagged to run on a later request.
     48 */
     49if (!function_exists('en_unishippers_run_update_routine')) {
     50
     51    function en_unishippers_run_update_routine($plugin_version)
     52    {
     53        if (get_option('en_unishippers_freight_update_now') != $plugin_version) {
     54            update_option('en_unishippers_freight_update_now', $plugin_version);
     55
     56            eniture_create_unishippers_ltl_wh_db();
     57            eniture_create_carriers_db_unishippers();
     58            eniture_unishippers_ltl_freihgt_installation_carrier();
     59
     60            if (en_unishippers_can_refresh_plan_now()) {
     61                delete_option('en_unishippers_plan_refresh_pending');
     62                eniture_unishippers_freight_activate_hit_to_update_plan();
     63            } else {
     64                update_option('en_unishippers_plan_refresh_pending', '1');
     65            }
     66            return;
     67        }
     68
     69        if (get_option('en_unishippers_plan_refresh_pending') && en_unishippers_can_refresh_plan_now()) {
     70            delete_option('en_unishippers_plan_refresh_pending');
     71            eniture_unishippers_freight_activate_hit_to_update_plan();
     72        }
     73    }
     74
     75}
    1276
    1377/**
    … …  
    1882    function eniture_unishippers_freight_activate_hit_to_update_plan($network_wide = null)
    1983    {
    20         if (!current_user_can('manage_options')) {
    21             echo wp_json_encode([]);
    22             return;
    23         }
    24 
    2584        if ( is_multisite() && $network_wide ) {
    2685
    … …  
    3796                    'carrier' => '63',
    3897                    'store_url' => $domain,
    39                     'webhook_url' => $domain . '/wp-json/' . EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE . '/v1',
     98                    'webhook_url' => '',
    4099                    'plugin_version' => $plugin_version,
    41100                );
    … …  
    85144                'carrier' => '63',
    86145                'store_url' => $domain,
    87                 'webhook_url' => $domain . '/wp-json/' . EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE . '/v1',
     146                'webhook_url' => '',
    88147                'plugin_version' => $plugin_version,
    89148            );
    … …  
    164223    }
    165224
    166 }
    167 
    168 add_action('admin_init', 'en_unishippers_maybe_register_plan_webhook');
    169 
    170 /**
    171  * Re-registers this store's plan update callback URL with the licensing server after the route
    172  * changed from the shared, unsigned plan-update/update-plan route to this edition's own
    173  * namespaced, signed REST route, so installs upgrading from an earlier version keep receiving
    174  * plan updates. Retries at most once an hour until the licensing server accepts it.
    175  */
    176 function en_unishippers_maybe_register_plan_webhook()
    177 {
    178     if (get_option('en_unishippers_plan_webhook_registered') === EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE) {
    179         return;
    180     }
    181 
    182     if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce'))) {
    183         return;
    184     }
    185 
    186     $license_key = get_option('wc_settings_unishippers_freight_licence_key');
    187     if (empty($license_key) || get_transient('en_unishippers_plan_webhook_retry')) {
    188         return;
    189     }
    190 
    191     set_transient('en_unishippers_plan_webhook_retry', 1, HOUR_IN_SECONDS);
    192 
    193     $domain = eniture_unishippers_freight_get_domain();
    194     $index = 'ltl-freight-quotes-unishippers-edition/unishippers-freight-quotes-unishippers-edition.php';
    195     $plugin_info = function_exists('get_plugins') ? get_plugins() : array();
    196 
    197     $post_data = array(
    198         'platform' => 'wordpress',
    199         'carrier' => EN_UNISHIPPERS_CARRIER_ID,
    200         'store_url' => $domain,
    201         'webhook_url' => $domain . '/wp-json/' . EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE . '/v1',
    202         'plugin_version' => isset($plugin_info[$index]['Version']) ? $plugin_info[$index]['Version'] : '',
    203         'license_key' => $license_key,
    204     );
    205 
    206     $response = wp_remote_get(
    207         UNISHIPPERS_FREIGHT_DOMAIN_HITTING_URL . '/web-hooks/subscription-plans/create-plugin-webhook.php?',
    208         array(
    209             'timeout' => 30,
    210             'body' => $post_data,
    211         )
    212     );
    213 
    214     if (!is_wp_error($response) && wp_remote_retrieve_response_code($response) == 200) {
    215         update_option('en_unishippers_plan_webhook_registered', EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE);
    216         delete_transient('en_unishippers_plan_webhook_retry');
    217     }
    218225}
    219226

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/warehouse-dropship/wild-delivery.php

    r3701755 r3756495  
    1414    function en_unishippers_ltl_wd_admin_script_style() {
    1515        wp_enqueue_script('en_unishippers_ltl_wd_tagging', plugin_dir_url(__FILE__) . '/wild/assets/js/tagging.js', array(), '1.0.0');
    16         wp_localize_script('en_unishippers_ltl_wd_tagging', 'script', array(
     16        wp_localize_script('en_unishippers_ltl_wd_tagging', 'en_unishippers_ltl_wd_tagging_script', array(
    1717            'pluginsUrl' => plugins_url(),
    1818        ));
    1919
    2020        wp_enqueue_script('en_unishippers_ltl_wd_script', plugin_dir_url(__FILE__) . '/wild/assets/js/warehouse_section.js', array(), '1.0.7');
    21         wp_localize_script('en_unishippers_ltl_wd_script', 'wh_script', array(
     21        wp_localize_script('en_unishippers_ltl_wd_script', 'en_unishippers_ltl_wh_script', array(
    2222            'pluginsUrl' => plugins_url(),
    2323            'nonce' => wp_create_nonce('en_uni_ltl_woo_wd_nonce'),

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/warehouse-dropship/wild/assets/js/warehouse_section.js

    r3457766 r3756495  
    452452            'enable_liftgate_pickup': jQuery('#en_wh_liftgate_pickup').is(':checked'),
    453453            'tab': tab,
    454             'wp_nonce': wh_script.nonce
     454            'wp_nonce': en_unishippers_ltl_wh_script.nonce
    455455        };
    456456
    … …  
    489489                    jQuery('.dropship_created').css('display', 'none');
    490490                    window.location.href = jQuery('.close').attr('href');
    491                     jQuery('tr[id=row_' + WarehpuseDataId + ']').html('<td class="en_wd_warehouse_list_data en_uni_ltl_bulk_delete_col"><input type="checkbox" class="en_uni_ltl_delete_warehouse_item" value="' + WarehpuseDataId + '" onclick="return en_uni_ltl_toggle_select_all_locations(`en_uni_ltl_delete_warehouse_item`, `en_uni_ltl_bulk_delete_warehouses`);"></td> <td class="en_wd_warehouse_list_data">' + data.origin_city + '</td><td class="en_wd_warehouse_list_data">' + data.origin_state + '</td><td class="en_wd_warehouse_list_data">' + data.origin_zip + '</td><td class="en_wd_warehouse_list_data">' + data.origin_country + '</td><td class="en_wd_warehouse_list_data"><a href="javascript(0)" title="Edit" onclick="return en_uni_ltl_wd_edit_warehouse(' + WarehpuseDataId + ')"><img src="' + wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/edit.png"></a><a href="javascript(0)" title="Delete" onclick="return en_uni_ltl_wd_delete_current_warehouse(' + WarehpuseDataId + ');"><img src="' + wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/delete.png"></a></td>');
     491                    jQuery('tr[id=row_' + WarehpuseDataId + ']').html('<td class="en_wd_warehouse_list_data en_uni_ltl_bulk_delete_col"><input type="checkbox" class="en_uni_ltl_delete_warehouse_item" value="' + WarehpuseDataId + '" onclick="return en_uni_ltl_toggle_select_all_locations(`en_uni_ltl_delete_warehouse_item`, `en_uni_ltl_bulk_delete_warehouses`);"></td> <td class="en_wd_warehouse_list_data">' + data.origin_city + '</td><td class="en_wd_warehouse_list_data">' + data.origin_state + '</td><td class="en_wd_warehouse_list_data">' + data.origin_zip + '</td><td class="en_wd_warehouse_list_data">' + data.origin_country + '</td><td class="en_wd_warehouse_list_data"><a href="javascript(0)" title="Edit" onclick="return en_uni_ltl_wd_edit_warehouse(' + WarehpuseDataId + ')"><img src="' + en_unishippers_ltl_wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/edit.png"></a><a href="javascript(0)" title="Delete" onclick="return en_uni_ltl_wd_delete_current_warehouse(' + WarehpuseDataId + ');"><img src="' + en_unishippers_ltl_wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/delete.png"></a></td>');
    492492                }
    493493                else {
    … …  
    518518            'delete_id': e,
    519519            'tab': tab,
    520             'wp_nonce': wh_script.nonce
     520            'wp_nonce': en_unishippers_ltl_wh_script.nonce
    521521        };
    522522        jQuery.ajax({
    … …  
    555555            'action': 'en_uni_ltl_wd_edit_warehouse',
    556556            'edit_id': e,
    557             'wp_nonce': wh_script.nonce,
     557            'wp_nonce': en_unishippers_ltl_wh_script.nonce,
    558558        };
    559559        jQuery.ajax({
    … …  
    664664            'location': jQuery('#en_wd_dropship_location').val(),
    665665            'tab': tab,
    666             'wp_nonce': wh_script.nonce
     666            'wp_nonce': en_unishippers_ltl_wh_script.nonce
    667667        };
    668668
    … …  
    703703                    jQuery('.warehouse_created').css('display', 'none');
    704704                    window.location.href = jQuery('.close').attr('href');
    705                     jQuery('tr[id=row_' + WarehpuseDataId + ']').html('<td class="en_wd_dropship_list_data en_uni_ltl_bulk_delete_col"><input type="checkbox" class="en_uni_ltl_delete_dropship_item" value="' + WarehpuseDataId + '" onclick="return en_uni_ltl_toggle_select_all_locations(`en_uni_ltl_delete_dropship_item`, `en_uni_ltl_bulk_delete_dropships`);"></td> <td class="en_wd_dropship_list_data">' + data.nickname + '</td><td class="en_wd_dropship_list_data">' + data.origin_city + '</td><td class="en_wd_dropship_list_data">' + data.origin_state + '</td><td class="en_wd_dropship_list_data">' + data.origin_zip + '</td><td class="en_wd_dropship_list_data">' + data.origin_country + '</td><td class="en_wd_dropship_list_data"><a href="javascript(0)" title="Edit" onclick="return en_uni_ltl_wd_edit_dropship(' + WarehpuseDataId + ')"><img src="' + wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/edit.png"></a><a href="javascript(0)" title="Delete" onclick="return en_wd_delete_current_dropship(' + WarehpuseDataId + ');"><img src="' + wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/delete.png"></a></td>');
     705                    jQuery('tr[id=row_' + WarehpuseDataId + ']').html('<td class="en_wd_dropship_list_data en_uni_ltl_bulk_delete_col"><input type="checkbox" class="en_uni_ltl_delete_dropship_item" value="' + WarehpuseDataId + '" onclick="return en_uni_ltl_toggle_select_all_locations(`en_uni_ltl_delete_dropship_item`, `en_uni_ltl_bulk_delete_dropships`);"></td> <td class="en_wd_dropship_list_data">' + data.nickname + '</td><td class="en_wd_dropship_list_data">' + data.origin_city + '</td><td class="en_wd_dropship_list_data">' + data.origin_state + '</td><td class="en_wd_dropship_list_data">' + data.origin_zip + '</td><td class="en_wd_dropship_list_data">' + data.origin_country + '</td><td class="en_wd_dropship_list_data"><a href="javascript(0)" title="Edit" onclick="return en_uni_ltl_wd_edit_dropship(' + WarehpuseDataId + ')"><img src="' + en_unishippers_ltl_wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/edit.png"></a><a href="javascript(0)" title="Delete" onclick="return en_wd_delete_current_dropship(' + WarehpuseDataId + ');"><img src="' + en_unishippers_ltl_wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/delete.png"></a></td>');
    706706                }
    707707                else {
    … …  
    730730            'action': 'en_uni_ltl_wd_edit_dropship',
    731731            'dropship_edit_id': e,
    732             'wp_nonce': wh_script.nonce
     732            'wp_nonce': en_unishippers_ltl_wh_script.nonce
    733733        };
    734734        jQuery.ajax({
    … …  
    816816            'dropship_delete_id': e,
    817817            'tab': tab,
    818             'wp_nonce': wh_script.nonce
     818            'wp_nonce': en_unishippers_ltl_wh_script.nonce
    819819        };
    820820        jQuery.ajax({
    … …  
    877877            'location_ids': location_ids,
    878878            'location_type': location_type,
    879             'wp_nonce': wh_script.nonce
     879            'wp_nonce': en_unishippers_ltl_wh_script.nonce
    880880        }
    881881        const delete_locs_btn = `.en_uni_ltl_bulk_delete_${location_type}`,

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/warehouse-dropship/wild/dropship/dropship_template.php

    r3369534 r3756495  
    6767
    6868        var postForm = {
    69             'action': 'en_wd_get_address',
     69            'action': 'eniture_unishippers_ltl_wd_get_address',
    7070            'origin_zip': jQuery('#en_wd_dropship_zip').val(),
     71            'wp_nonce': en_unishippers_ltl_wh_script.nonce,
    7172        };
    7273

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/warehouse-dropship/wild/includes/wild-delivery-save.php

    r3722849 r3756495  
    2222        public function __construct()
    2323        {
    24             add_action('wp_ajax_nopriv_en_wd_get_address', array($this, 'get_address_api_ajax'));
    25             add_action('wp_ajax_en_wd_get_address', array($this, 'get_address_api_ajax'));
     24            add_action('wp_ajax_eniture_unishippers_ltl_wd_get_address', array($this, 'get_address_api_ajax'));
    2625
    2726            // Warehouse
    28             add_action('wp_ajax_nopriv_en_uni_ltl_wd_save_warehouse', array($this, 'save_warehouse_ajax'));
    2927            add_action('wp_ajax_en_uni_ltl_wd_save_warehouse', array($this, 'save_warehouse_ajax'));
    3028           
    31             add_action('wp_ajax_nopriv_en_uni_ltl_wd_edit_warehouse', array($this, 'edit_warehouse_ajax'));
    3229            add_action('wp_ajax_en_uni_ltl_wd_edit_warehouse', array($this, 'edit_warehouse_ajax'));
    3330           
    34             add_action('wp_ajax_nopriv_en_uni_ltl_wd_delete_warehouse', array($this, 'delete_warehouse_ajax'));
    3531            add_action('wp_ajax_en_uni_ltl_wd_delete_warehouse', array($this, 'delete_warehouse_ajax'));
    3632
    3733            // Dropship
    38             add_action('wp_ajax_nopriv_en_uni_ltl_wd_save_dropship', array($this, 'save_dropship_ajax'));
    3934            add_action('wp_ajax_en_uni_ltl_wd_save_dropship', array($this, 'save_dropship_ajax'));
    4035
    41             add_action('wp_ajax_nopriv_en_uni_ltl_wd_edit_dropship', array($this, 'edit_dropship_ajax'));
    4236            add_action('wp_ajax_en_uni_ltl_wd_edit_dropship', array($this, 'edit_dropship_ajax'));
    4337       
    44             add_action('wp_ajax_nopriv_en_uni_ltl_wd_delete_dropship', array($this, 'delete_dropship_ajax'));
    4538            add_action('wp_ajax_en_uni_ltl_wd_delete_dropship', array($this, 'delete_dropship_ajax'));
    4639
    47             add_action('wp_ajax_nopriv_en_uni_ltl_wd_bulk_delete_locations', array($this, 'delete_bulk_locations_ajax'));
    4840            add_action('wp_ajax_en_uni_ltl_wd_bulk_delete_locations', array($this, 'delete_bulk_locations_ajax'));
    4941        }
    … …  
    5446        function get_address_api_ajax()
    5547        {
     48            $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     49            if (!current_user_can('manage_options') || !wp_verify_nonce($nonce, 'en_uni_ltl_woo_wd_nonce')) {
     50                echo wp_json_encode(array('message' => 'Unauthorized Access'));
     51                exit;
     52            }
     53
    5654            if (isset($_POST['origin_zip'])) {
    5755                $map_address = (isset($_POST['origin_zip'])) ? sanitize_text_field($_POST['origin_zip']) : "";
    … …  
    197195        function save_warehouse_ajax()
    198196        {
    199             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     197            if (!current_user_can('manage_options') || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    200198                echo json_encode([]);
    201199                return;
    … …  
    289287        function edit_warehouse_ajax()
    290288        {
    291             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     289            if (!current_user_can('manage_options') || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    292290                echo wp_json_encode([]);
    293291                return;
    … …  
    314312        function delete_warehouse_ajax()
    315313        {
    316             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     314            if (!current_user_can('manage_options') || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    317315                echo wp_json_encode([]);
    318316                return;
    … …  
    334332        function save_dropship_ajax()
    335333        {
    336             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     334            if (!current_user_can('manage_options') || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    337335                echo wp_json_encode([]);
    338336                return;
    … …  
    426424        function edit_dropship_ajax()
    427425        {
    428             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     426            if (!current_user_can('manage_options') || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    429427                echo wp_json_encode([]);
    430428                return;
    … …  
    451449        function delete_dropship_ajax()
    452450        {
    453             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     451            if (!current_user_can('manage_options') || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    454452                echo wp_json_encode([]);
    455453                return;
    … …  
    491489        function delete_bulk_locations_ajax()
    492490        {
    493             if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce')) || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     491            if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce')) || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    494492                echo wp_json_encode([]);
    495493                return;
    496494            }
    497495
    498             $location_ids = isset($_POST['location_ids']) ? $_POST['location_ids'] : array();
    499             $loc_type = isset($_POST['location_type']) ? $_POST['location_type'] : '';
     496            $location_ids = isset($_POST['location_ids']) ? array_map('absint', (array) $_POST['location_ids']) : array();
     497            $loc_type = isset($_POST['location_type']) ? sanitize_text_field(wp_unslash($_POST['location_type'])) : '';
    500498            if (empty($location_ids)) {
    501499                echo wp_json_encode(['error' => true, 'message' => "Please select at least one {$loc_type} to delete."]);
    … …  
    511509                    $ser = maybe_serialize($get_dropship_id);
    512510                    $get_dropship_val = array_map('intval', $get_dropship_array);
    513                     $get_post_id = $wpdb->get_results("SELECT group_concat(post_id) as post_ids_list FROM `" . $wpdb->prefix . "postmeta` WHERE `meta_key` = '_dropship_location' AND (`meta_value` LIKE '%" . $ser . "%' OR `meta_value` = '" . $dropship_id . "')");
     511                    $get_post_id = $wpdb->get_results(
     512                        $wpdb->prepare(
     513                            "SELECT group_concat(post_id) as post_ids_list FROM {$wpdb->prefix}postmeta WHERE meta_key = '_dropship_location' AND (meta_value LIKE %s OR meta_value = %s)",
     514                            '%' . $wpdb->esc_like($ser) . '%',
     515                            $dropship_id
     516                        )
     517                    );
    514518                    $post_id = reset($get_post_id)->post_ids_list;
    515519
    516                     if (isset($post_id)) {
    517                         $wpdb->query("UPDATE `" . $wpdb->prefix . "postmeta` SET `meta_value` = '' WHERE `meta_key` IN('_enable_dropship','_dropship_location')  AND `post_id` IN ($post_id)");
     520                    if (!empty($post_id)) {
     521                        $wpdb->query(
     522                            $wpdb->prepare(
     523                                "UPDATE `{$wpdb->prefix}postmeta` SET `meta_value` = '' WHERE `meta_key` IN('_enable_dropship','_dropship_location') AND `post_id` IN (%s)",
     524                                implode(',', array_map('intval', explode(',', $post_id)))
     525                            )
     526                        );
    518527                    }
    519528                }
    520529
    521                 $wpdb->delete($wpdb->prefix . "warehouse", array('id' => intval($location_id), 'location' => $loc_type));
     530                $wpdb->delete($wpdb->prefix . "warehouse", array('id' => absint($location_id), 'location' => $loc_type));
    522531            }
    523532

  • ltl-freight-quotes-unishippers-edition/tags/2.5.25/warehouse-dropship/wild/warehouse/warehouse_template.php

    r3369534 r3756495  
    6363
    6464        var postForm = {
    65             'action': 'en_wd_get_address',
     65            'action': 'eniture_unishippers_ltl_wd_get_address',
    6666            'origin_zip': jQuery('#en_wd_origin_zip').val(),
     67            'wp_nonce': en_unishippers_ltl_wh_script.nonce,
    6768        };
    6869

  • ltl-freight-quotes-unishippers-edition/trunk/fdo/en-coupon-api.php

    r3722849 r3756495  
    88        {
    99            add_action('wp_ajax_en_unishippers_ltl_fdo_connection_status_refresh', [$this, 'en_unishippers_ltl_fdo_connection_status_refresh']);
    10             add_action('wp_ajax_nopriv_en_unishippers_ltl_fdo_connection_status_refresh', [$this, 'en_unishippers_ltl_fdo_connection_status_refresh']);
    1110
    1211            add_action('wp_ajax_en_unishippers_ltl_va_connection_status_refresh', [$this, 'en_unishippers_ltl_va_connection_status_refresh']);
    13             add_action('wp_ajax_nopriv_en_unishippers_ltl_va_connection_status_refresh', [$this, 'en_unishippers_ltl_va_connection_status_refresh']);
    1412
    15             add_action('wp_ajax_nopriv_unishippers_fd', [$this, 'unishippers_fd_api']);
    1613            add_action('wp_ajax_unishippers_fd', [$this, 'unishippers_fd_api']);
    1714            add_action('rest_api_init', [$this, 'en_rest_api_init_status_unishippers']);
    … …  
    2320        function en_unishippers_ltl_fdo_connection_status_refresh()
    2421        {
    25             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_freight_nonce')) {
     22            $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     23            if (!current_user_can('manage_options') || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
    2624                echo json_encode([]);
    2725                return;
    … …  
    3634        function en_unishippers_ltl_va_connection_status_refresh()
    3735        {
    38             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_freight_nonce')) {
     36            $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     37            if (!current_user_can('manage_options') || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
    3938                echo json_encode([]);
    4039                return;
    … …  
    5049        function unishippers_fd_api()
    5150        {
    52             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_freight_nonce')) {
     51            $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     52            if (!current_user_can('manage_options') || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
    5353                echo json_encode([]);
    5454                return;
    … …  
    5656
    5757            $store_name = eniture_unishippers_freight_get_domain();
    58             $company_id = sanitize_text_field( wp_unslash( $_POST['company_id']));
     58            $company_id = isset($_POST['company_id']) ? sanitize_text_field(wp_unslash($_POST['company_id'])) : '';
     59            $disconnect = isset($_POST['disconnect']) ? sanitize_text_field(wp_unslash($_POST['disconnect'])) : '';
    5960            $data = [
    6061                'plateform'  => 'wp',
    … …  
    6465            ];
    6566            if (is_array($data) && count($data) > 0) {
    66                 if($_POST['disconnect'] != 'disconnect') {
     67                if($disconnect != 'disconnect') {
    6768                    $url =  'https://freightdesk.online/validate-company';
    6869                }else {
    … …  
    7980                $response = wp_remote_retrieve_body($response);
    8081            }
    81             if($_POST['disconnect'] == 'disconnect') {
     82            if($disconnect == 'disconnect') {
    8283                $result = json_decode($response);
    8384                if ($result->status == 'SUCCESS') {
    … …  
    9798                'callback' => [$this, 'en_unishippers_fdo_data_status'],
    9899                'permission_callback' => '__return_true'
    99             ));
    100             // plan update
    101             register_rest_route(EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE, '/v1', array(
    102                 'methods' => 'GET',
    103                 'callback' => [$this, 'en_plan_update'],
    104                 'permission_callback' => 'en_unishippers_verify_plan_update_request'
    105100            ));
    106101        }
    … …  
    130125        function fdo_va_update_status_authenticate($request) {
    131126            if ( !empty( $_SERVER['HTTP_CONSUMER_KEY'] ) && !empty( $_SERVER['HTTP_CONSUMER_SECRET'] ) ) {
    132                 $consumer_key    = sanitize_text_field( wp_unslash( $_SERVER['HTTP_CONSUMER_KEY'] ) );
     127                $consumer_key = wc_api_hash( sanitize_text_field( $_SERVER['HTTP_CONSUMER_KEY'] ) );
    133128                $consumer_secret = sanitize_text_field( wp_unslash( $_SERVER['HTTP_CONSUMER_SECRET'] ) );
    134129            }else{
    … …  
    164159        }
    165160
    166         function en_plan_update()
    167         {
    168             $carrier = isset($_GET['carrier']) ? sanitize_text_field(wp_unslash($_GET['carrier'])) : '';
    169             if ($carrier !== '' && $carrier !== EN_UNISHIPPERS_CARRIER_ID) {
    170                 return rest_ensure_response(['success' => false]);
    171             }
    172 
    173             $plan = isset($_GET['pakg_group']) ? sanitize_text_field($_GET['pakg_group']) : '';
    174 
    175             if (in_array($plan, array('0', '1', '2', '3'))) {
    176                 if (isset($_GET['pakg_price']) && $_GET['pakg_price'] == '0') {
    177                     $plan = '0';
    178                 }
    179 
    180                 update_option('unishippers_freight_packages_quotes_package' , "$plan");
    181                
    182                 $plan_type = isset($_GET['plan_type']) ? sanitize_text_field($_GET['plan_type']) : '';
    183                 update_option('unishippers_freight_store_type' , "$plan_type");
    184                
    185                 $expire_days = isset($_GET['pakg_duration']) ? sanitize_text_field($_GET['pakg_duration']) : '';
    186                 update_option('unishippers_freight_package_expire_days' , "$expire_days");
    187 
    188                 $expiry_date = isset($_GET['expiry_date']) ? sanitize_text_field($_GET['expiry_date']) : '';
    189                 update_option('unishippers_freight_package_expire_date' , "$expiry_date");
    190                
    191                 eniture_check_unishippers_freight_plan_on_product_detail();
    192             }
    193 
    194             return rest_ensure_response( ['success' => true] );
    195         }
    196161    }
    197162}
    198 
    199 /**
    200  * Verifies that a plan update request was signed by the Eniture licensing server with this
    201  * store's license key. The signature covers the query string exactly as sent, up to but not
    202  * including the trailing sig parameter, so sig must always be appended last. When a store
    203  * uses plain permalinks WordPress prepends its own rest_route parameter, which the licensing
    204  * server did not sign and which is therefore dropped before the comparison.
    205  *
    206  * @return bool|WP_Error
    207  */
    208 function en_unishippers_verify_plan_update_request()
    209 {
    210     $license_key = get_option('wc_settings_unishippers_freight_licence_key');
    211     $signature = isset($_GET['sig']) ? sanitize_text_field(wp_unslash($_GET['sig'])) : '';
    212     $query = isset($_SERVER['QUERY_STRING']) ? wp_unslash($_SERVER['QUERY_STRING']) : '';
    213     $position = strrpos($query, '&sig=');
    214 
    215     if (empty($license_key) || empty($signature) || $position === false) {
    216         return new WP_Error('rest_forbidden', __('Invalid request.', 'ltl-freight-quotes-unishippers-edition'), array('status' => 403));
    217     }
    218 
    219     $signed = substr($query, 0, $position);
    220 
    221     if (strpos($signed, 'rest_route=') === 0) {
    222         $separator = strpos($signed, '&');
    223         $signed = ($separator === false) ? '' : substr($signed, $separator + 1);
    224     }
    225 
    226     if (!hash_equals(hash_hmac('sha256', $signed, $license_key), $signature)) {
    227         return new WP_Error('rest_forbidden', __('Invalid request.', 'ltl-freight-quotes-unishippers-edition'), array('status' => 403));
    228     }
    229 
    230     return true;
    231 }
    232 

  • ltl-freight-quotes-unishippers-edition/trunk/js/eniture-calculate-shipping-admin.js

    r3495563 r3756495  
    1010            url: ajaxurl,
    1111            data: {
    12                 action: 'eniture_calculate_shipping_rates_admin',
     12                action: 'eniture_unishippers_ltl_calculate_shipping_rates_admin',
     13                wp_nonce: en_unishippers_ltl_order_rates_script.nonce,
    1314                products: $('#order_line_items .item').toArray().map(function(item) {
    1415                    return $(item).find('input.order_item_id').val();

  • ltl-freight-quotes-unishippers-edition/trunk/ltl-freight-quotes-unishippers-edition.php

    r3722849 r3756495  
    66  Author: Eniture Technology
    77  Author URI: http://eniture.com/
    8   Version: 2.5.24
     8  Version: 2.5.25
    99  Text Domain: ltl-freight-quotes-unishippers-edition
    1010  License: GPLv2 or later
    … …  
    2121
    2222define('UNISHIPPERS_MAIN_FILE', __FILE__);
    23 define('EN_UNISHIPPERS_CARRIER_ID', '63');
    24 define('EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE', 'en_update_plan_carrier_' . EN_UNISHIPPERS_CARRIER_ID);
    2523
    2624add_action('before_woocommerce_init', function () {
    … …  
    148146        if(is_admin() && (!empty( $_GET['page']) && 'wc-orders' == $_GET['page'] ) && (!empty( $_GET['action']) && 'new' == $_GET['action'] ))
    149147        {
    150             if (!wp_script_is('eniture_calculate_shipping_admin', 'enqueued')) {
    151                 wp_enqueue_script('eniture_calculate_shipping_admin', plugin_dir_url(__FILE__) . 'js/eniture-calculate-shipping-admin.js', array(), '1.0.0' );
     148            if (!wp_script_is('eniture_unishippers_ltl_calculate_shipping_admin', 'enqueued')) {
     149                wp_enqueue_script('eniture_unishippers_ltl_calculate_shipping_admin', plugin_dir_url(__FILE__) . 'js/eniture-calculate-shipping-admin.js', array(), '1.0.1' );
     150                wp_localize_script('eniture_unishippers_ltl_calculate_shipping_admin', 'en_unishippers_ltl_order_rates_script', array(
     151                    'nonce' => wp_create_nonce('unishippers_freight_nonce'),
     152                ));
    152153            }
    153154        }
    … …  
    207208
    208209        // Shipping rules script and styles
    209         wp_enqueue_script('en_unishippers_ltl_sr_script', plugin_dir_url(__FILE__) . '/shipping-rules/assets/js/shipping_rules.js', array(), '1.0.3');
    210         wp_localize_script('en_unishippers_ltl_sr_script', 'sr_script', array(
     210        wp_enqueue_script('en_unishippers_ltl_sr_script', plugin_dir_url(__FILE__) . '/shipping-rules/assets/js/shipping_rules.js', array(), '1.0.4');
     211        wp_localize_script('en_unishippers_ltl_sr_script', 'en_unishippers_ltl_sr_script_data', array(
    211212            'pluginsUrl' => plugins_url(),
    212213            'nonce' => wp_create_nonce('unishippers_sr_freight_nonce'),
    … …  
    282283require_once('shipping-rules/shipping-rules-save.php');
    283284require_once 'support/support-code-request.php';
     285require_once('unishippers-app-data.php');
    284286
    285287/**
    … …  
    321323        $plugin_info = get_plugins();
    322324        $plugin_version = (isset($plugin_info[$index]['Version'])) ? $plugin_info[$index]['Version'] : '';
    323         $update_now = get_option('en_unishippers_freight_update_now');
    324 
    325         if ($update_now != $plugin_version) {
    326             if (!function_exists('eniture_unishippers_freight_activate_hit_to_update_plan')) {
    327                 require_once(__DIR__ . '/update-plan.php');
    328             }
    329 
    330             eniture_unishippers_freight_activate_hit_to_update_plan();
    331             eniture_create_unishippers_ltl_wh_db();
    332             eniture_create_carriers_db_unishippers();
    333             eniture_unishippers_ltl_freihgt_installation_carrier();
    334 
    335             update_option('en_unishippers_freight_update_now', $plugin_version);
    336         }
     325
     326        if (!function_exists('en_unishippers_run_update_routine')) {
     327            require_once(__DIR__ . '/update-plan.php');
     328        }
     329
     330        en_unishippers_run_update_routine($plugin_version);
    337331    }
    338332
    … …  
    354348        wp_enqueue_script('jquery');
    355349        wp_enqueue_script('en_unishippers_freight_frontend_checkout_script', plugin_dir_url(__FILE__) . 'front/js/en-unishippers-ltl-checkout.js', array(), '1.0.0');
    356         wp_localize_script('en_unishippers_freight_frontend_checkout_script', 'frontend_script', array(
     350        wp_localize_script('en_unishippers_freight_frontend_checkout_script', 'en_unishippers_ltl_frontend_script', array(
    357351            'pluginsUrl' => plugins_url(),
    358352        ));

  • ltl-freight-quotes-unishippers-edition/trunk/order/rates/order-rates.php

    r3251023 r3756495  
    1515        public function __construct()
    1616        {
    17             add_action('wp_ajax_eniture_calculate_shipping_rates_admin', [$this, 'eniture_calculate_shipping_rates_admin']);
     17            add_action('wp_ajax_eniture_unishippers_ltl_calculate_shipping_rates_admin', [$this, 'eniture_calculate_shipping_rates_admin']);
    1818            add_filter('en_order_accessories', [$this, 'en_order_accessories']);
    1919        }
    … …  
    2828        public function eniture_calculate_shipping_rates_admin()
    2929        {
    30             $products = isset($_POST['products']) ? (array) sanitize_text_field( wp_unslash( $_POST['products'] )) : array();
     30            $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     31            if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce')) || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
     32                wp_send_json_error(array('message' => 'Unauthorized Access'), 403);
     33            }
     34
     35            $products = isset($_POST['products']) ? array_map('absint', (array) $_POST['products']) : array();
    3136            $orderItems = array_map(function($productId) {
    3237                return new WC_Order_Item_Product((int) $productId);

  • ltl-freight-quotes-unishippers-edition/trunk/readme.txt

    r3722849 r3756495  
    44Requires at least: 6.4
    55Tested up to: 7.1
    6 Stable tag: 2.5.24
     6Stable tag: 2.5.25
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    167167== Changelog ==
    168168
     169= 2.5.25 - 2026-10-20 =
     170* Update: Added REST API endpoints to export store settings data for the Eniture support chatbot.
     171* Fix: Improved plugin security.
     172
    169173= 2.5.24 - 2026-10-01 =
    170174* Fix: Secured the subscription plan update endpoint so it only accepts verified requests.

  • ltl-freight-quotes-unishippers-edition/trunk/shipping-rules/assets/js/shipping_rules.js

    r3722849 r3756495  
    345345                const postData = {
    346346                        action: 'en_unishippers_ltl_save_shipping_rule',
    347                         wp_nonce: sr_script.nonce,
     347                        wp_nonce: en_unishippers_ltl_sr_script_data.nonce,
    348348                        rule_id: jQuery('#edit_sr_form_id').val(),
    349349                        name: jQuery('#en_sr_rule_name').val(),
    … …  
    473473                                action: 'en_unishippers_ltl_edit_shipping_rule',
    474474                                edit_id: rule_id,
    475                                 wp_nonce: sr_script.nonce,
     475                                wp_nonce: en_unishippers_ltl_sr_script_data.nonce,
    476476                        };
    477477
    … …  
    485485                                        jQuery(elem).css(
    486486                                                'background',
    487                                                 `rgba(255, 255, 255, 1) url("${sr_script.pluginsUrl}/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/processing.gif") no-repeat scroll 50% 50%`
     487                                                `rgba(255, 255, 255, 1) url("${en_unishippers_ltl_sr_script_data.pluginsUrl}/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/processing.gif") no-repeat scroll 50% 50%`
    488488                                        );
    489489                                },
    … …  
    640640                                action: 'en_unishippers_ltl_delete_shipping_rule',
    641641                                delete_id: id,
    642                                 wp_nonce: sr_script.nonce,
     642                                wp_nonce: en_unishippers_ltl_sr_script_data.nonce,
    643643                        };
    644644
    … …  
    652652                                        jQuery(elem).css(
    653653                                                'background',
    654                                                 `rgba(255, 255, 255, 1) url("${sr_script.pluginsUrl}/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/processing.gif") no-repeat scroll 50% 50%`
     654                                                `rgba(255, 255, 255, 1) url("${en_unishippers_ltl_sr_script_data.pluginsUrl}/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/processing.gif") no-repeat scroll 50% 50%`
    655655                                        );
    656656                                },
    … …  
    685685                        rule_id,
    686686                        is_active: Number(!Number(is_active)),
    687                         wp_nonce: sr_script.nonce,
     687                        wp_nonce: en_unishippers_ltl_sr_script_data.nonce,
    688688                };
    689689
    … …  
    697697                                jQuery(elem).css(
    698698                                        'background',
    699                                         `rgba(255, 255, 255, 1) url("${sr_script.pluginsUrl}/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/processing.gif") no-repeat scroll 50% 50%`
     699                                        `rgba(255, 255, 255, 1) url("${en_unishippers_ltl_sr_script_data.pluginsUrl}/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/processing.gif") no-repeat scroll 50% 50%`
    700700                                );
    701701                        },
    … …  
    720720
    721721        // #region: Get Row Markup
     722        // The rule name/type are admin-supplied strings -- escape them before building markup from them.
     723        const escapeHtml = (value) => jQuery('<div>').text(value ?? '').html();
     724
    722725        function enUnishippersLtlGetRowMarkup(rule) {
     726                const escapeHtml = (value) => jQuery('<div>').text(value ?? '').html();
    723727                const rowMarkup = `
    724                                 <td class="en_wd_warehouse_list_data">${rule?.name}</td>
    725                                 <td class="en_wd_warehouse_list_data">${rule?.type}</td>
     728                                <td class="en_wd_warehouse_list_data">${escapeHtml(rule?.name)}</td>
     729                                <td class="en_wd_warehouse_list_data">${escapeHtml(rule?.type)}</td>
    726730                                <td class="en_wd_warehouse_list_data"><a href="#" class='en_unishippers_ltl_sr_status_link' data-id='${
    727731                                        rule?.id
    … …  
    731735                                        <a href="#" class="en_unishippers_ltl_sr_edit_link" data-id="${rule?.id}">
    732736                                                <img src="${
    733                                                         sr_script.pluginsUrl
     737                                                        en_unishippers_ltl_sr_script_data.pluginsUrl
    734738                                                }/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/edit.png" title="Edit">
    735739                                        </a>
    … …  
    737741                                        <a href="#" class="en_unishippers_ltl_sr_delete_link" data-id="${rule?.id}">
    738742                                                <img src="${
    739                                                         sr_script.pluginsUrl
     743                                                        en_unishippers_ltl_sr_script_data.pluginsUrl
    740744                                                }/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/delete.png" title="Delete">
    741745                                        </a>

  • ltl-freight-quotes-unishippers-edition/trunk/shipping-rules/shipping-rules-save.php

    r3722849 r3756495  
    2525            $this->is_country_filter_applied = false;
    2626
    27             add_action('wp_ajax_nopriv_en_unishippers_ltl_save_shipping_rule', array($this, 'en_unishippers_ltl_save_shipping_rule_ajax'));
    2827            add_action('wp_ajax_en_unishippers_ltl_save_shipping_rule', array($this, 'en_unishippers_ltl_save_shipping_rule_ajax'));
    2928
    30             add_action('wp_ajax_nopriv_en_unishippers_ltl_edit_shipping_rule', array($this, 'en_unishippers_ltl_edit_shipping_rule_ajax'));
    3129            add_action('wp_ajax_en_unishippers_ltl_edit_shipping_rule', array($this, 'en_unishippers_ltl_edit_shipping_rule_ajax'));
    3230
    33             add_action('wp_ajax_nopriv_en_unishippers_ltl_delete_shipping_rule', array($this, 'en_unishippers_ltl_delete_shipping_rule_ajax'));
    3431            add_action('wp_ajax_en_unishippers_ltl_delete_shipping_rule', array($this, 'en_unishippers_ltl_delete_shipping_rule_ajax'));
    3532
    36             add_action('wp_ajax_nopriv_en_unishippers_ltl_update_shipping_rule_status', array($this, 'en_unishippers_ltl_update_shipping_rule_status_ajax'));
    3733            add_action('wp_ajax_en_unishippers_ltl_update_shipping_rule_status', array($this, 'en_unishippers_ltl_update_shipping_rule_status_ajax'));
     34        }
     35
     36        /**
     37         * Shared gate for all four shipping-rule handlers: an appropriately capable user plus a valid
     38         * nonce. Sends a 403 and halts rather than returning, so no caller can proceed unauthorized.
     39         */
     40        private function en_unishippers_ltl_authorize_request()
     41        {
     42            $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     43            if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce')) || !wp_verify_nonce($nonce, 'unishippers_sr_freight_nonce')) {
     44                wp_send_json(array('error' => true, 'message' => 'Unauthorized Access.'), 403);
     45            }
     46        }
     47
     48        /** Recursively sanitizes a submitted value, preserving the settings array's shape. */
     49        private function en_unishippers_ltl_sanitize($value)
     50        {
     51            if (is_array($value)) {
     52                return array_map(array($this, 'en_unishippers_ltl_sanitize'), $value);
     53            }
     54
     55            return sanitize_text_field(wp_unslash($value));
    3856        }
    3957
    … …  
    4563        function en_unishippers_ltl_save_shipping_rule_ajax()
    4664        {
    47             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_sr_freight_nonce')) {
    48                 echo json_encode([]);
    49                 exit;
    50             }
     65            $this->en_unishippers_ltl_authorize_request();
    5166
    5267            global $wpdb;
    … …  
    5469            $insert_qry = $update_qry = '';
    5570            $error = false;
    56             $data = eniture_uni_ltl_sanitize_request_data($_POST);
    57             $get_shipping_rule_id = (isset($data['rule_id']) && intval($data['rule_id'])) ? intval($data['rule_id']) : "";
     71            // Whitelist the columns actually written instead of handing the request array to $wpdb.
     72            $data = array(
     73                'name' => isset($_POST['name']) ? $this->en_unishippers_ltl_sanitize($_POST['name']) : '',
     74                'type' => isset($_POST['type']) ? $this->en_unishippers_ltl_sanitize($_POST['type']) : '',
     75                'is_active' => !empty($_POST['is_active']) ? 1 : 0,
     76                'settings' => (isset($_POST['settings']) && is_array($_POST['settings'])) ? $this->en_unishippers_ltl_sanitize($_POST['settings']) : array(),
     77            );
     78            $get_shipping_rule_id = isset($_POST['rule_id']) ? absint($_POST['rule_id']) : 0;
    5879            $last_id = $get_shipping_rule_id;
    5980            $get_shipping_rule = $wpdb->get_results(
    … …  
    6384                )
    6485            );
    65            
    66             unset($data['action']);
    67             unset($data['rule_id']);
    68             unset($data['wp_nonce']);
    6986
    7087            if (!empty($get_shipping_rule_id)) {
    71                 $data['settings'] = json_encode($data['settings']);
     88                $data['settings'] = wp_json_encode($data['settings']);
    7289                $update_qry = $wpdb->update(
    7390                    $wpdb->prefix . 'eniture_unishippers_ltl_shipping_rules', $data, array('id' => $get_shipping_rule_id)
    … …  
    7996                    $error = true;
    8097                } else {
    81                     $data['settings'] = json_encode($data['settings']);
     98                    $data['settings'] = wp_json_encode($data['settings']);
    8299                    $insert_qry = $wpdb->insert($wpdb->prefix . 'eniture_unishippers_ltl_shipping_rules', $data);
    83100                    $last_id = $wpdb->insert_id;
    … …  
    98115        function en_unishippers_ltl_edit_shipping_rule_ajax()
    99116        {
    100             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_sr_freight_nonce')) {
    101                 echo json_encode([]);
    102                 exit;
    103             }
     117            $this->en_unishippers_ltl_authorize_request();
    104118
    105119            global $wpdb;
    106             $get_shipping_rule_id = (isset($_POST['edit_id']) && intval($_POST['edit_id'])) ? intval(sanitize_text_field( wp_unslash($_POST['edit_id']))) : "";
     120            $get_shipping_rule_id = isset($_POST['edit_id']) ? absint($_POST['edit_id']) : 0;
    107121            $shipping_rules_list = $wpdb->get_results(
    108                 $wpdb->prepare("SELECT * FROM " . $wpdb->prefix . "eniture_unishippers_ltl_shipping_rules WHERE id = %d", [$get_shipping_rule_id])
     122                $wpdb->prepare("SELECT * FROM {$wpdb->prefix}eniture_unishippers_ltl_shipping_rules WHERE id = %d", $get_shipping_rule_id)
    109123            );
    110124            $product_tags_markup = !empty($shipping_rules_list) ? $this->en_unishippers_ltl_get_product_tags_markup($shipping_rules_list) : '';
    … …  
    128142        function en_unishippers_ltl_delete_shipping_rule_ajax()
    129143        {
    130             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_sr_freight_nonce')) {
    131                 echo json_encode([]);
    132                 exit;
    133             }
     144            $this->en_unishippers_ltl_authorize_request();
    134145
    135146            global $wpdb;
    136             $get_shipping_rule_id = (isset($_POST['delete_id']) && intval($_POST['delete_id'])) ? intval(sanitize_text_field( wp_unslash($_POST['delete_id']))) : "";
     147            $get_shipping_rule_id = isset($_POST['delete_id']) ? absint($_POST['delete_id']) : 0;
    137148            $qry = $wpdb->delete($wpdb->prefix . 'eniture_unishippers_ltl_shipping_rules', array('id' => $get_shipping_rule_id));
    138149
    … …  
    148159        function en_unishippers_ltl_update_shipping_rule_status_ajax()
    149160        {
    150             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_sr_freight_nonce')) {
    151                 echo json_encode([]);
    152                 exit;
    153             }
     161            $this->en_unishippers_ltl_authorize_request();
    154162
    155163            global $wpdb;
    156             $get_shipping_rule_id = (isset($_POST['rule_id']) && intval($_POST['rule_id'])) ? intval(sanitize_text_field( wp_unslash($_POST['rule_id']))) : "";
    157             $is_active = isset($_POST['is_active']) ? sanitize_text_field( wp_unslash($_POST['is_active'] )) : "";
     164            $get_shipping_rule_id = isset($_POST['rule_id']) ? absint($_POST['rule_id']) : 0;
     165            $is_active = !empty($_POST['is_active']) ? 1 : 0;
    158166            $data = ['is_active' => $is_active];
    159167            $update_qry = $wpdb->update(

  • ltl-freight-quotes-unishippers-edition/trunk/shipping-rules/shipping-rules-template.php

    r3722849 r3756495  
    5151                    ?>
    5252                      <tr id="sr_row_<?php echo (isset($rule->id)) ? esc_attr($rule->id) : ''; ?>" class="en_uni_ltl_sr_row">
    53                         <td class="en_wd_warehouse_list_data"><?php echo esc_attr( $rule->name ); ?></td>
    54                         <td class="en_wd_warehouse_list_data"><?php echo esc_attr( $rule->type ); ?></td>
     53                        <td class="en_wd_warehouse_list_data"><?php echo esc_html( $rule->name ); ?></td>
     54                        <td class="en_wd_warehouse_list_data"><?php echo esc_html( $rule->type ); ?></td>
    5555                        <td class="en_wd_warehouse_list_data">
    56                           <a href="#" class="en_unishippers_ltl_sr_status_link" data-id="<?php echo (isset($rule->id)) ? esc_attr($rule->id) : ''; ?>" data-status="<?php echo esc_attr( $rule->is_active ); ?>"><?php echo esc_attr( $rule->is_active ) ? 'Yes' : 'No'; ?></a>
     56                          <a href="#" class="en_unishippers_ltl_sr_status_link" data-id="<?php echo (isset($rule->id)) ? esc_attr($rule->id) : ''; ?>" data-status="<?php echo esc_attr( $rule->is_active ); ?>"><?php echo $rule->is_active ? 'Yes' : 'No'; ?></a>
    5757                        </td>
    5858                        <td class="en_wd_warehouse_list_data">

  • ltl-freight-quotes-unishippers-edition/trunk/support/support-code-request.php

    r3663340 r3756495  
    1919function en_unishippers_freight_generate_support_code()
    2020{
    21     if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce')) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['wp_nonce'])), 'unishippers_freight_nonce')) {
     21    $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     22    if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce')) || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
    2223        echo wp_json_encode(array('success' => false, 'message' => 'Unauthorized Access.'));
    2324        exit;

  • ltl-freight-quotes-unishippers-edition/trunk/unishippers-ltl-tab-class.php

    r3722849 r3756495  
    600600                            'name' => __('Show WooCommerce Shipping Options ', 'ltl-freight-quotes-unishippers-edition'),
    601601                            'type' => 'select',
    602                             'default' => '3',
     602                            'default' => 'yes',
    603603                            'desc' => __('Enabled options on WooCommerce Shipping page are included in quote results.', 'ltl-freight-quotes-unishippers-edition'),
    604604                            'id' => 'wc_settings_unishippers_freight_allow_other_plugins',

  • ltl-freight-quotes-unishippers-edition/trunk/unishippers-ltl-test-connecion.php

    r3251023 r3756495  
    1818    function eniture_unishippers_freight_submit()
    1919    {
    20         if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'unishippers_freight_nonce')) {
     20        $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     21        if (!current_user_can('manage_options') || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
    2122            echo json_encode([]);
    2223            exit;
    … …  
    7879    }
    7980
    80     add_action('wp_ajax_nopriv_unishippers_ltl_validate_keys', 'eniture_unishippers_freight_submit');
    8181    add_action('wp_ajax_unishippers_ltl_validate_keys', 'eniture_unishippers_freight_submit');
    8282}

  • ltl-freight-quotes-unishippers-edition/trunk/update-plan.php

    r3722849 r3756495  
    88}
    99
    10 add_action('wp_ajax_en_unishippers_freight_activate_hit_to_update_plan', 'eniture_unishippers_freight_activate_hit_to_update_plan');
    11 add_action('wp_ajax_nopriv_en_unishippers_freight_activate_hit_to_update_plan', 'eniture_unishippers_freight_activate_hit_to_update_plan');
     10add_action('wp_ajax_en_unishippers_freight_activate_hit_to_update_plan', 'en_unishippers_ajax_update_plan');
     11
     12/**
     13 * Nonce- and capability-gated entry point for the "Click here to refresh the plan" link. The worker
     14 * function itself is also reached from the activation hook and the update routine, so access is
     15 * gated here at the call site rather than inside the worker.
     16 */
     17if (!function_exists('en_unishippers_ajax_update_plan')) {
     18
     19    function en_unishippers_ajax_update_plan()
     20    {
     21        $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     22        if (!current_user_can('manage_options') || !wp_verify_nonce($nonce, 'unishippers_freight_nonce')) {
     23            wp_send_json_error(array('message' => 'Unauthorized Access'), 403);
     24        }
     25
     26        eniture_unishippers_freight_activate_hit_to_update_plan();
     27        wp_send_json_success(eniture_unishippers_freight_plan_name());
     28    }
     29
     30}
     31
     32/**
     33 * The automatic plan refresh must never run on an anonymous storefront/checkout/cron request -- it is
     34 * a blocking remote call. Defer it to the next admin/AJAX/WP-CLI request instead.
     35 */
     36if (!function_exists('en_unishippers_can_refresh_plan_now')) {
     37
     38    function en_unishippers_can_refresh_plan_now()
     39    {
     40        return is_admin() || wp_doing_ajax() || (defined('WP_CLI') && WP_CLI);
     41    }
     42
     43}
     44
     45/**
     46 * Runs the one-time-per-version upgrade steps. Local steps always run; the remote plan refresh only
     47 * runs in a safe context and is otherwise flagged to run on a later request.
     48 */
     49if (!function_exists('en_unishippers_run_update_routine')) {
     50
     51    function en_unishippers_run_update_routine($plugin_version)
     52    {
     53        if (get_option('en_unishippers_freight_update_now') != $plugin_version) {
     54            update_option('en_unishippers_freight_update_now', $plugin_version);
     55
     56            eniture_create_unishippers_ltl_wh_db();
     57            eniture_create_carriers_db_unishippers();
     58            eniture_unishippers_ltl_freihgt_installation_carrier();
     59
     60            if (en_unishippers_can_refresh_plan_now()) {
     61                delete_option('en_unishippers_plan_refresh_pending');
     62                eniture_unishippers_freight_activate_hit_to_update_plan();
     63            } else {
     64                update_option('en_unishippers_plan_refresh_pending', '1');
     65            }
     66            return;
     67        }
     68
     69        if (get_option('en_unishippers_plan_refresh_pending') && en_unishippers_can_refresh_plan_now()) {
     70            delete_option('en_unishippers_plan_refresh_pending');
     71            eniture_unishippers_freight_activate_hit_to_update_plan();
     72        }
     73    }
     74
     75}
    1276
    1377/**
    … …  
    1882    function eniture_unishippers_freight_activate_hit_to_update_plan($network_wide = null)
    1983    {
    20         if (!current_user_can('manage_options')) {
    21             echo wp_json_encode([]);
    22             return;
    23         }
    24 
    2584        if ( is_multisite() && $network_wide ) {
    2685
    … …  
    3796                    'carrier' => '63',
    3897                    'store_url' => $domain,
    39                     'webhook_url' => $domain . '/wp-json/' . EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE . '/v1',
     98                    'webhook_url' => '',
    4099                    'plugin_version' => $plugin_version,
    41100                );
    … …  
    85144                'carrier' => '63',
    86145                'store_url' => $domain,
    87                 'webhook_url' => $domain . '/wp-json/' . EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE . '/v1',
     146                'webhook_url' => '',
    88147                'plugin_version' => $plugin_version,
    89148            );
    … …  
    164223    }
    165224
    166 }
    167 
    168 add_action('admin_init', 'en_unishippers_maybe_register_plan_webhook');
    169 
    170 /**
    171  * Re-registers this store's plan update callback URL with the licensing server after the route
    172  * changed from the shared, unsigned plan-update/update-plan route to this edition's own
    173  * namespaced, signed REST route, so installs upgrading from an earlier version keep receiving
    174  * plan updates. Retries at most once an hour until the licensing server accepts it.
    175  */
    176 function en_unishippers_maybe_register_plan_webhook()
    177 {
    178     if (get_option('en_unishippers_plan_webhook_registered') === EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE) {
    179         return;
    180     }
    181 
    182     if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce'))) {
    183         return;
    184     }
    185 
    186     $license_key = get_option('wc_settings_unishippers_freight_licence_key');
    187     if (empty($license_key) || get_transient('en_unishippers_plan_webhook_retry')) {
    188         return;
    189     }
    190 
    191     set_transient('en_unishippers_plan_webhook_retry', 1, HOUR_IN_SECONDS);
    192 
    193     $domain = eniture_unishippers_freight_get_domain();
    194     $index = 'ltl-freight-quotes-unishippers-edition/unishippers-freight-quotes-unishippers-edition.php';
    195     $plugin_info = function_exists('get_plugins') ? get_plugins() : array();
    196 
    197     $post_data = array(
    198         'platform' => 'wordpress',
    199         'carrier' => EN_UNISHIPPERS_CARRIER_ID,
    200         'store_url' => $domain,
    201         'webhook_url' => $domain . '/wp-json/' . EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE . '/v1',
    202         'plugin_version' => isset($plugin_info[$index]['Version']) ? $plugin_info[$index]['Version'] : '',
    203         'license_key' => $license_key,
    204     );
    205 
    206     $response = wp_remote_get(
    207         UNISHIPPERS_FREIGHT_DOMAIN_HITTING_URL . '/web-hooks/subscription-plans/create-plugin-webhook.php?',
    208         array(
    209             'timeout' => 30,
    210             'body' => $post_data,
    211         )
    212     );
    213 
    214     if (!is_wp_error($response) && wp_remote_retrieve_response_code($response) == 200) {
    215         update_option('en_unishippers_plan_webhook_registered', EN_UNISHIPPERS_PLAN_UPDATE_NAMESPACE);
    216         delete_transient('en_unishippers_plan_webhook_retry');
    217     }
    218225}
    219226

  • ltl-freight-quotes-unishippers-edition/trunk/warehouse-dropship/wild-delivery.php

    r3701755 r3756495  
    1414    function en_unishippers_ltl_wd_admin_script_style() {
    1515        wp_enqueue_script('en_unishippers_ltl_wd_tagging', plugin_dir_url(__FILE__) . '/wild/assets/js/tagging.js', array(), '1.0.0');
    16         wp_localize_script('en_unishippers_ltl_wd_tagging', 'script', array(
     16        wp_localize_script('en_unishippers_ltl_wd_tagging', 'en_unishippers_ltl_wd_tagging_script', array(
    1717            'pluginsUrl' => plugins_url(),
    1818        ));
    1919
    2020        wp_enqueue_script('en_unishippers_ltl_wd_script', plugin_dir_url(__FILE__) . '/wild/assets/js/warehouse_section.js', array(), '1.0.7');
    21         wp_localize_script('en_unishippers_ltl_wd_script', 'wh_script', array(
     21        wp_localize_script('en_unishippers_ltl_wd_script', 'en_unishippers_ltl_wh_script', array(
    2222            'pluginsUrl' => plugins_url(),
    2323            'nonce' => wp_create_nonce('en_uni_ltl_woo_wd_nonce'),

  • ltl-freight-quotes-unishippers-edition/trunk/warehouse-dropship/wild/assets/js/warehouse_section.js

    r3457766 r3756495  
    452452            'enable_liftgate_pickup': jQuery('#en_wh_liftgate_pickup').is(':checked'),
    453453            'tab': tab,
    454             'wp_nonce': wh_script.nonce
     454            'wp_nonce': en_unishippers_ltl_wh_script.nonce
    455455        };
    456456
    … …  
    489489                    jQuery('.dropship_created').css('display', 'none');
    490490                    window.location.href = jQuery('.close').attr('href');
    491                     jQuery('tr[id=row_' + WarehpuseDataId + ']').html('<td class="en_wd_warehouse_list_data en_uni_ltl_bulk_delete_col"><input type="checkbox" class="en_uni_ltl_delete_warehouse_item" value="' + WarehpuseDataId + '" onclick="return en_uni_ltl_toggle_select_all_locations(`en_uni_ltl_delete_warehouse_item`, `en_uni_ltl_bulk_delete_warehouses`);"></td> <td class="en_wd_warehouse_list_data">' + data.origin_city + '</td><td class="en_wd_warehouse_list_data">' + data.origin_state + '</td><td class="en_wd_warehouse_list_data">' + data.origin_zip + '</td><td class="en_wd_warehouse_list_data">' + data.origin_country + '</td><td class="en_wd_warehouse_list_data"><a href="javascript(0)" title="Edit" onclick="return en_uni_ltl_wd_edit_warehouse(' + WarehpuseDataId + ')"><img src="' + wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/edit.png"></a><a href="javascript(0)" title="Delete" onclick="return en_uni_ltl_wd_delete_current_warehouse(' + WarehpuseDataId + ');"><img src="' + wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/delete.png"></a></td>');
     491                    jQuery('tr[id=row_' + WarehpuseDataId + ']').html('<td class="en_wd_warehouse_list_data en_uni_ltl_bulk_delete_col"><input type="checkbox" class="en_uni_ltl_delete_warehouse_item" value="' + WarehpuseDataId + '" onclick="return en_uni_ltl_toggle_select_all_locations(`en_uni_ltl_delete_warehouse_item`, `en_uni_ltl_bulk_delete_warehouses`);"></td> <td class="en_wd_warehouse_list_data">' + data.origin_city + '</td><td class="en_wd_warehouse_list_data">' + data.origin_state + '</td><td class="en_wd_warehouse_list_data">' + data.origin_zip + '</td><td class="en_wd_warehouse_list_data">' + data.origin_country + '</td><td class="en_wd_warehouse_list_data"><a href="javascript(0)" title="Edit" onclick="return en_uni_ltl_wd_edit_warehouse(' + WarehpuseDataId + ')"><img src="' + en_unishippers_ltl_wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/edit.png"></a><a href="javascript(0)" title="Delete" onclick="return en_uni_ltl_wd_delete_current_warehouse(' + WarehpuseDataId + ');"><img src="' + en_unishippers_ltl_wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/delete.png"></a></td>');
    492492                }
    493493                else {
    … …  
    518518            'delete_id': e,
    519519            'tab': tab,
    520             'wp_nonce': wh_script.nonce
     520            'wp_nonce': en_unishippers_ltl_wh_script.nonce
    521521        };
    522522        jQuery.ajax({
    … …  
    555555            'action': 'en_uni_ltl_wd_edit_warehouse',
    556556            'edit_id': e,
    557             'wp_nonce': wh_script.nonce,
     557            'wp_nonce': en_unishippers_ltl_wh_script.nonce,
    558558        };
    559559        jQuery.ajax({
    … …  
    664664            'location': jQuery('#en_wd_dropship_location').val(),
    665665            'tab': tab,
    666             'wp_nonce': wh_script.nonce
     666            'wp_nonce': en_unishippers_ltl_wh_script.nonce
    667667        };
    668668
    … …  
    703703                    jQuery('.warehouse_created').css('display', 'none');
    704704                    window.location.href = jQuery('.close').attr('href');
    705                     jQuery('tr[id=row_' + WarehpuseDataId + ']').html('<td class="en_wd_dropship_list_data en_uni_ltl_bulk_delete_col"><input type="checkbox" class="en_uni_ltl_delete_dropship_item" value="' + WarehpuseDataId + '" onclick="return en_uni_ltl_toggle_select_all_locations(`en_uni_ltl_delete_dropship_item`, `en_uni_ltl_bulk_delete_dropships`);"></td> <td class="en_wd_dropship_list_data">' + data.nickname + '</td><td class="en_wd_dropship_list_data">' + data.origin_city + '</td><td class="en_wd_dropship_list_data">' + data.origin_state + '</td><td class="en_wd_dropship_list_data">' + data.origin_zip + '</td><td class="en_wd_dropship_list_data">' + data.origin_country + '</td><td class="en_wd_dropship_list_data"><a href="javascript(0)" title="Edit" onclick="return en_uni_ltl_wd_edit_dropship(' + WarehpuseDataId + ')"><img src="' + wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/edit.png"></a><a href="javascript(0)" title="Delete" onclick="return en_wd_delete_current_dropship(' + WarehpuseDataId + ');"><img src="' + wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/delete.png"></a></td>');
     705                    jQuery('tr[id=row_' + WarehpuseDataId + ']').html('<td class="en_wd_dropship_list_data en_uni_ltl_bulk_delete_col"><input type="checkbox" class="en_uni_ltl_delete_dropship_item" value="' + WarehpuseDataId + '" onclick="return en_uni_ltl_toggle_select_all_locations(`en_uni_ltl_delete_dropship_item`, `en_uni_ltl_bulk_delete_dropships`);"></td> <td class="en_wd_dropship_list_data">' + data.nickname + '</td><td class="en_wd_dropship_list_data">' + data.origin_city + '</td><td class="en_wd_dropship_list_data">' + data.origin_state + '</td><td class="en_wd_dropship_list_data">' + data.origin_zip + '</td><td class="en_wd_dropship_list_data">' + data.origin_country + '</td><td class="en_wd_dropship_list_data"><a href="javascript(0)" title="Edit" onclick="return en_uni_ltl_wd_edit_dropship(' + WarehpuseDataId + ')"><img src="' + en_unishippers_ltl_wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/edit.png"></a><a href="javascript(0)" title="Delete" onclick="return en_wd_delete_current_dropship(' + WarehpuseDataId + ');"><img src="' + en_unishippers_ltl_wh_script.pluginsUrl + '/ltl-freight-quotes-unishippers-edition/warehouse-dropship/wild/assets/images/delete.png"></a></td>');
    706706                }
    707707                else {
    … …  
    730730            'action': 'en_uni_ltl_wd_edit_dropship',
    731731            'dropship_edit_id': e,
    732             'wp_nonce': wh_script.nonce
     732            'wp_nonce': en_unishippers_ltl_wh_script.nonce
    733733        };
    734734        jQuery.ajax({
    … …  
    816816            'dropship_delete_id': e,
    817817            'tab': tab,
    818             'wp_nonce': wh_script.nonce
     818            'wp_nonce': en_unishippers_ltl_wh_script.nonce
    819819        };
    820820        jQuery.ajax({
    … …  
    877877            'location_ids': location_ids,
    878878            'location_type': location_type,
    879             'wp_nonce': wh_script.nonce
     879            'wp_nonce': en_unishippers_ltl_wh_script.nonce
    880880        }
    881881        const delete_locs_btn = `.en_uni_ltl_bulk_delete_${location_type}`,

  • ltl-freight-quotes-unishippers-edition/trunk/warehouse-dropship/wild/dropship/dropship_template.php

    r3369534 r3756495  
    6767
    6868        var postForm = {
    69             'action': 'en_wd_get_address',
     69            'action': 'eniture_unishippers_ltl_wd_get_address',
    7070            'origin_zip': jQuery('#en_wd_dropship_zip').val(),
     71            'wp_nonce': en_unishippers_ltl_wh_script.nonce,
    7172        };
    7273

  • ltl-freight-quotes-unishippers-edition/trunk/warehouse-dropship/wild/includes/wild-delivery-save.php

    r3722849 r3756495  
    2222        public function __construct()
    2323        {
    24             add_action('wp_ajax_nopriv_en_wd_get_address', array($this, 'get_address_api_ajax'));
    25             add_action('wp_ajax_en_wd_get_address', array($this, 'get_address_api_ajax'));
     24            add_action('wp_ajax_eniture_unishippers_ltl_wd_get_address', array($this, 'get_address_api_ajax'));
    2625
    2726            // Warehouse
    28             add_action('wp_ajax_nopriv_en_uni_ltl_wd_save_warehouse', array($this, 'save_warehouse_ajax'));
    2927            add_action('wp_ajax_en_uni_ltl_wd_save_warehouse', array($this, 'save_warehouse_ajax'));
    3028           
    31             add_action('wp_ajax_nopriv_en_uni_ltl_wd_edit_warehouse', array($this, 'edit_warehouse_ajax'));
    3229            add_action('wp_ajax_en_uni_ltl_wd_edit_warehouse', array($this, 'edit_warehouse_ajax'));
    3330           
    34             add_action('wp_ajax_nopriv_en_uni_ltl_wd_delete_warehouse', array($this, 'delete_warehouse_ajax'));
    3531            add_action('wp_ajax_en_uni_ltl_wd_delete_warehouse', array($this, 'delete_warehouse_ajax'));
    3632
    3733            // Dropship
    38             add_action('wp_ajax_nopriv_en_uni_ltl_wd_save_dropship', array($this, 'save_dropship_ajax'));
    3934            add_action('wp_ajax_en_uni_ltl_wd_save_dropship', array($this, 'save_dropship_ajax'));
    4035
    41             add_action('wp_ajax_nopriv_en_uni_ltl_wd_edit_dropship', array($this, 'edit_dropship_ajax'));
    4236            add_action('wp_ajax_en_uni_ltl_wd_edit_dropship', array($this, 'edit_dropship_ajax'));
    4337       
    44             add_action('wp_ajax_nopriv_en_uni_ltl_wd_delete_dropship', array($this, 'delete_dropship_ajax'));
    4538            add_action('wp_ajax_en_uni_ltl_wd_delete_dropship', array($this, 'delete_dropship_ajax'));
    4639
    47             add_action('wp_ajax_nopriv_en_uni_ltl_wd_bulk_delete_locations', array($this, 'delete_bulk_locations_ajax'));
    4840            add_action('wp_ajax_en_uni_ltl_wd_bulk_delete_locations', array($this, 'delete_bulk_locations_ajax'));
    4941        }
    … …  
    5446        function get_address_api_ajax()
    5547        {
     48            $nonce = isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '';
     49            if (!current_user_can('manage_options') || !wp_verify_nonce($nonce, 'en_uni_ltl_woo_wd_nonce')) {
     50                echo wp_json_encode(array('message' => 'Unauthorized Access'));
     51                exit;
     52            }
     53
    5654            if (isset($_POST['origin_zip'])) {
    5755                $map_address = (isset($_POST['origin_zip'])) ? sanitize_text_field($_POST['origin_zip']) : "";
    … …  
    197195        function save_warehouse_ajax()
    198196        {
    199             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     197            if (!current_user_can('manage_options') || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    200198                echo json_encode([]);
    201199                return;
    … …  
    289287        function edit_warehouse_ajax()
    290288        {
    291             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     289            if (!current_user_can('manage_options') || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    292290                echo wp_json_encode([]);
    293291                return;
    … …  
    314312        function delete_warehouse_ajax()
    315313        {
    316             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     314            if (!current_user_can('manage_options') || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    317315                echo wp_json_encode([]);
    318316                return;
    … …  
    334332        function save_dropship_ajax()
    335333        {
    336             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     334            if (!current_user_can('manage_options') || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    337335                echo wp_json_encode([]);
    338336                return;
    … …  
    426424        function edit_dropship_ajax()
    427425        {
    428             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     426            if (!current_user_can('manage_options') || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    429427                echo wp_json_encode([]);
    430428                return;
    … …  
    451449        function delete_dropship_ajax()
    452450        {
    453             if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     451            if (!current_user_can('manage_options') || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    454452                echo wp_json_encode([]);
    455453                return;
    … …  
    491489        function delete_bulk_locations_ajax()
    492490        {
    493             if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce')) || !wp_verify_nonce($_POST['wp_nonce'], 'en_uni_ltl_woo_wd_nonce')) {
     491            if (!(current_user_can('manage_options') || current_user_can('manage_woocommerce')) || !wp_verify_nonce(isset($_POST['wp_nonce']) ? sanitize_text_field(wp_unslash($_POST['wp_nonce'])) : '', 'en_uni_ltl_woo_wd_nonce')) {
    494492                echo wp_json_encode([]);
    495493                return;
    496494            }
    497495
    498             $location_ids = isset($_POST['location_ids']) ? $_POST['location_ids'] : array();
    499             $loc_type = isset($_POST['location_type']) ? $_POST['location_type'] : '';
     496            $location_ids = isset($_POST['location_ids']) ? array_map('absint', (array) $_POST['location_ids']) : array();
     497            $loc_type = isset($_POST['location_type']) ? sanitize_text_field(wp_unslash($_POST['location_type'])) : '';
    500498            if (empty($location_ids)) {
    501499                echo wp_json_encode(['error' => true, 'message' => "Please select at least one {$loc_type} to delete."]);
    … …  
    511509                    $ser = maybe_serialize($get_dropship_id);
    512510                    $get_dropship_val = array_map('intval', $get_dropship_array);
    513                     $get_post_id = $wpdb->get_results("SELECT group_concat(post_id) as post_ids_list FROM `" . $wpdb->prefix . "postmeta` WHERE `meta_key` = '_dropship_location' AND (`meta_value` LIKE '%" . $ser . "%' OR `meta_value` = '" . $dropship_id . "')");
     511                    $get_post_id = $wpdb->get_results(
     512                        $wpdb->prepare(
     513                            "SELECT group_concat(post_id) as post_ids_list FROM {$wpdb->prefix}postmeta WHERE meta_key = '_dropship_location' AND (meta_value LIKE %s OR meta_value = %s)",
     514                            '%' . $wpdb->esc_like($ser) . '%',
     515                            $dropship_id
     516                        )
     517                    );
    514518                    $post_id = reset($get_post_id)->post_ids_list;
    515519
    516                     if (isset($post_id)) {
    517                         $wpdb->query("UPDATE `" . $wpdb->prefix . "postmeta` SET `meta_value` = '' WHERE `meta_key` IN('_enable_dropship','_dropship_location')  AND `post_id` IN ($post_id)");
     520                    if (!empty($post_id)) {
     521                        $wpdb->query(
     522                            $wpdb->prepare(
     523                                "UPDATE `{$wpdb->prefix}postmeta` SET `meta_value` = '' WHERE `meta_key` IN('_enable_dropship','_dropship_location') AND `post_id` IN (%s)",
     524                                implode(',', array_map('intval', explode(',', $post_id)))
     525                            )
     526                        );
    518527                    }
    519528                }
    520529
    521                 $wpdb->delete($wpdb->prefix . "warehouse", array('id' => intval($location_id), 'location' => $loc_type));
     530                $wpdb->delete($wpdb->prefix . "warehouse", array('id' => absint($location_id), 'location' => $loc_type));
    522531            }
    523532

  • ltl-freight-quotes-unishippers-edition/trunk/warehouse-dropship/wild/warehouse/warehouse_template.php

    r3369534 r3756495  
    6363
    6464        var postForm = {
    65             'action': 'en_wd_get_address',
     65            'action': 'eniture_unishippers_ltl_wd_get_address',
    6666            'origin_zip': jQuery('#en_wd_origin_zip').val(),
     67            'wp_nonce': en_unishippers_ltl_wh_script.nonce,
    6768        };
    6869
Note: See TracChangeset for help on using the changeset viewer.