fix(donations): add checkout nonce verification

Automattic · Dec 19, 2024 · 3884884 · 3884884
1 parent cbe7f45
commit 3884884
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/includes/class-donations.php b/includes/class-donations.php
@@ -665,13 +665,20 @@ public static function process_donation_request() {
 			return;
 		}
 
+		// Nonce value defined in \Newpack_Blocks\Modal_Checkout.
+		if ( ! check_ajax_referer( 'newspack_checkout_nonce' ) ) {
+			wp_send_json_error( [ 'message' => __( 'Invalid nonce.', 'newspack-blocks' ) ] );
+			wp_die();
+		}
+
 		$is_modal_checkout = filter_input( INPUT_GET, 'modal_checkout', FILTER_SANITIZE_NUMBER_INT );
 
 		// Parse values from the form.
 		$donation_frequency = filter_input( INPUT_GET, 'donation_frequency', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
 		if ( ! $donation_frequency ) {
 			return;
 		}
+
 		$donation_value = filter_input( INPUT_GET, 'donation_value_' . $donation_frequency, FILTER_SANITIZE_FULL_SPECIAL_CHARS );
 		if ( ! $donation_value ) {
 			$donation_value = filter_input( INPUT_GET, 'donation_value_' . $donation_frequency . '_untiered', FILTER_SANITIZE_FULL_SPECIAL_CHARS );