Changeset 1820

Timestamp:

08/10/2015 08:16:43 PM (10 years ago)

Author:

iandunn

Message:

WordCamp Payments: Move nonce verification for Mark as Incomplete metabox.

It was introduced in r1816 and placed in save_payment() along with the other nonce checks, but that was incorrect, because the action for this metabox actually occurs in update_request_status().

A side-effect of that mistake was that requests would not be saved if the metabox was not being displayed, because the nonce only exists when the box is displayed. Since the box is only displayed for users with manage_network, the saving process was broken for all normal admins.

File:

• sites/trunk/wordcamp.org/public_html/wp-content/plugins/wordcamp-payments/classes/payment-request.php (modified) (3 diffs)

sites/trunk/wordcamp.org/public_html/wp-content/plugins/wordcamp-payments/classes/payment-request.php

@@ -637 +637 @@
     public function update_request_status( $post_data, $post_data_raw ) {
         if ( $this->post_edit_is_actionable( $post_data ) ) {
-
-            if ( isset( $_POST['wcp_mark_incomplete_checkbox'] ) && 'on' == $_POST['wcp_mark_incomplete_checkbox'] && ! empty( $_POST['wcp_mark_incomplete_notes'] ) ) {
+            if ( $this->should_mark_request_incomplete() ) {
                 $post_data['post_status'] = 'incomplete';
                 $this->notify_requester_request_incomplete( $post_data_raw['ID'], $post_data, $post_data_raw );
@@ -655 +654 @@
 
     /**
+     * Determine if the user wants to mark a payment request as incomplete, and if that is valid
+     *
+     * @return bool
+     */
+    protected function should_mark_request_incomplete() {
+        $mark_incomplete = false;
+
+        if ( isset( $_POST['wcp_mark_incomplete_checkbox'] ) && 'on' == $_POST['wcp_mark_incomplete_checkbox'] && ! empty( $_POST['wcp_mark_incomplete_notes'] ) ) {
+            if ( isset( $_POST['mark_incomplete_nonce'] ) && wp_verify_nonce( $_POST['mark_incomplete_nonce'], 'mark_incomplete' ) ) {
+                if ( current_user_can( 'manage_network' ) ) {
+                    $mark_incomplete = true;
+                }
+            }
+        }
+
+        return $mark_incomplete;
+    }
+
+    /**
      * Notify the payment requester that it has been marked as paid.
      *
@@ -730 +748 @@
 
         // Verify nonces
-        $nonces = array( 'status_nonce', 'mark_incomplete_nonce', 'general_info_nonce', 'payment_details_nonce', 'vendor_details_nonce' );    // todo add prefix to all of these
+        $nonces = array( 'status_nonce', 'general_info_nonce', 'payment_details_nonce', 'vendor_details_nonce' );    // todo add prefix to all of these
 
         foreach ( $nonces as $nonce ) {