fix(form): verify nonce when changing payment method

ref #2580
impress-org · Aug 1, 2018 · 75fb458 · 75fb458
1 parent ab10978
commit 75fb458
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/assets/src/js/frontend/give-ajax.js b/assets/src/js/frontend/give-ajax.js
@@ -311,7 +311,8 @@ function give_load_gateway( form_object, payment_mode ) {
 			give_total: give_total,
 			give_form_id: give_form_id,
 			give_form_id_prefix: give_form_id_prefix,
-			give_payment_mode: payment_mode
+			give_payment_mode: payment_mode,
+			nonce: Give.form.fn.getNonce( form_object )
 		},
 		function( response ) {
 			//Success: let's output the gateway fields in the appropriate form space

diff --git a/includes/gateways/actions.php b/includes/gateways/actions.php
@@ -41,7 +41,11 @@ function give_load_ajax_gateway() {
 
 	$post_data = give_clean( $_POST ); // WPCS: input var ok, CSRF ok.
 
-	if ( isset( $post_data['give_payment_mode'] ) ) {
+	if ( ! give_verify_donation_form_nonce( $post_data['nonce'], $post_data['give_form_id'] ) ) {
+		Give_Notices::print_frontend_notice( __( 'Nonce verification has failed.', 'give' ), true, 'error' );
+		exit();
+
+	}elseif ( isset( $post_data['give_payment_mode'] ) ) {
 
 		$form_id_prefix = ! empty( $post_data['give_form_id_prefix'] ) ? $post_data['give_form_id_prefix'] : '';