From df2c8294964bd85b7da37af346ecda64135646fa Mon Sep 17 00:00:00 2001 From: mashiro Date: Fri, 15 Nov 2019 00:11:02 +0800 Subject: [PATCH] add nonce check for api --- functions.php | 2 +- header.php | 4 ++-- inc/api.php | 16 ++++++++++++++-- js/sakura-app.js | 2 +- style.css | 2 +- 5 files changed, 19 insertions(+), 7 deletions(-) diff --git a/functions.php b/functions.php index 2076dea..d6bd51d 100644 --- a/functions.php +++ b/functions.php @@ -7,7 +7,7 @@ * @package Sakura */ -define( 'SAKURA_VERSION', '3.3.0' ); +define( 'SAKURA_VERSION', '3.3.1' ); define( 'BUILD_VERSION', '3' ); define( 'JSDELIVR_VERSION', '3.6.7' ); diff --git a/header.php b/header.php index 7d6118d..8f05888 100644 --- a/header.php +++ b/header.php @@ -77,9 +77,9 @@ window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)} -> +> Plz rename the theme folder name as Sakura!
请将主题文件夹名改为 Sakura！'; ?> - 主题需要 PHP 的 curl 支持！请在 `php.ini` 里开启或者联系你的主机商。
The theme requires PHP\'s curl support! Please turn on in `php.ini` or contact your hosting provider.' ?>; + 主题需要 PHP 的 curl 支持！请在 `php.ini` 里开启或者联系你的主机商。
The theme requires PHP\'s curl support! Please turn on in `php.ini` or contact your hosting provider.'; ?>
get_file_params(); - + if ( !check_ajax_referer('wp_rest', '_wpnonce', false) ) { + $output = array( + 'status' => 403, + 'success' => false, + 'message' => 'Unauthorized client.', + 'link' => "https://view.moezx.cc/images/2019/11/14/step04.md.png", + 'proxy' => akina_option('cmt_image_proxy') . "https://view.moezx.cc/images/2019/11/14/step04.md.png", + ); + $result = new WP_REST_Response($output, 403); + $result->set_headers(array('Content-Type' => 'application/json')); + return $result; + } + switch (akina_option("img_upload_api")) { case 'imgur': $image = file_get_contents($_FILES["cmt_img_file"]["tmp_name"]); diff --git a/js/sakura-app.js b/js/sakura-app.js index b0bbe4a..db66148 100644 --- a/js/sakura-app.js +++ b/js/sakura-app.js @@ -182,7 +182,7 @@ function attach_image() { var formData = new FormData(); formData.append('cmt_img_file', f); $.ajax({ - url: '/wp-json/sakura/v1/image/upload', + url: '/wp-json/sakura/v1/image/upload/?_wpnonce='+$('body').attr('nonce-data'), type: 'POST', processData: false, contentType: false, diff --git a/style.css b/style.css index 680b6e7..b10bb5e 100644 --- a/style.css +++ b/style.css @@ -5,7 +5,7 @@ Theme URI: https://2heng.xin/theme-sakura/ Author: Mashiro, Louie, Fuzzz Author URI: http://2heng.xin Description: A branch of theme Akina -Version: 3.3.0 +Version: 3.3.1 License: GNU General Public License v2 or later License URI: http://www.gnu.org/licenses/gpl-2.0.html Text Domain: sakura