chore: add nonce check to license form, limit autocomplete results to 25, unschedule event on plugin deactivation

Author: dannyvankooten

boxzilla.php

@@ -46,6 +46,7 @@
 
 // register activation hook
 register_activation_hook(__FILE__, [ 'Boxzilla\\Admin\\Installer', 'run' ]);
+register_deactivation_hook(__FILE__, [ 'Boxzilla\\Licensing\\Poller', 'deactivate' ]);
 
 // Bootstrap plugin at later action hook
 add_action(

src/admin/class-autocomplete.php

@@ -8,6 +8,8 @@
 
 class Autocomplete
 {
+    private const MAX_RESULTS = 20;
+
     public function init(): void
     {
         add_action('wp_ajax_boxzilla_autocomplete', [ $this, 'ajax' ], 10, 0);
@@ -22,13 +24,17 @@ public function ajax(): void
             wp_die('', '', [ 'response' => 403 ]);
         }
 
-        $q    = ( isset($_GET['q']) ) ? sanitize_text_field($_GET['q']) : '';
-        $type = ( isset($_GET['type']) && in_array($_GET['type'], [ 'page', 'post', 'category', 'post_type', 'post_tag' ], true) ) ? $_GET['type'] : 'post';
+        $q = isset($_GET['q']) ? sanitize_text_field(wp_unslash($_GET['q'])) : '';
+        $allowed_types = [ 'page', 'post', 'category', 'post_type', 'post_tag' ];
+        $type = isset($_GET['type']) ? sanitize_key(wp_unslash($_GET['type'])) : '';
+        if (! in_array($type, $allowed_types, true)) {
+            $type = 'post';
+        }
 
         // do nothing if supplied 'q' parameter is omitted or empty
         // or less than 2 characters long
         if (empty($q) || strlen($q) < 2) {
-            die();
+            wp_die();
         }
 
         switch ($type) {
@@ -51,7 +57,7 @@ public function ajax(): void
                 break;
         }
 
-        die();
+        wp_die();
     }
 
     /**
@@ -64,13 +70,15 @@ protected function list_posts($query, $post_type = 'post')
     {
         global $wpdb;
         $like = $wpdb->esc_like($query) . '%';
+        $limit = self::MAX_RESULTS;
 
         $post_slugs = $wpdb->get_col(
             $wpdb->prepare(
-                "SELECT p.post_name FROM $wpdb->posts p WHERE p.post_type = %s AND p.post_status = 'publish' AND ( p.post_title LIKE %s OR p.post_name LIKE %s ) GROUP BY p.post_name",
+                "SELECT p.post_name FROM $wpdb->posts p WHERE p.post_type = %s AND p.post_status = 'publish' AND ( p.post_title LIKE %s OR p.post_name LIKE %s ) GROUP BY p.post_name ORDER BY p.post_name ASC LIMIT %d",
                 $post_type,
                 $like,
-                $like
+                $like,
+                $limit
             )
         );
         return join(PHP_EOL, $post_slugs);
@@ -86,9 +94,15 @@ protected function list_categories($query)
         $terms = get_terms([
             'taxonomy' => 'category',
             'name__like' => $query,
+            'number'     => self::MAX_RESULTS,
             'fields'     => 'names',
             'hide_empty' => false,
         ]);
+
+        if (is_wp_error($terms)) {
+            return '';
+        }
+
         return join(PHP_EOL, $terms);
     }
 
@@ -102,9 +116,15 @@ protected function list_tags($query)
         $terms = get_terms([
             'taxonomy' => 'post_tag',
             'name__like' => $query,
+            'number'     => self::MAX_RESULTS,
             'fields'     => 'names',
             'hide_empty' => false,
         ]);
+
+        if (is_wp_error($terms)) {
+            return '';
+        }
+
         return join(PHP_EOL, $terms);
     }
 
@@ -124,6 +144,8 @@ function ($name) use ($query) {
             }
         );
 
+        $matched_post_types = array_slice($matched_post_types, 0, self::MAX_RESULTS);
+
         return join(PHP_EOL, $matched_post_types);
     }
 }

src/licensing/class-license-manager.php

@@ -108,11 +108,20 @@ protected function listen()
             return;
         }
 
-        $action      = isset($_POST['action']) ? $_POST['action'] : 'activate';
+        $nonce = isset($_POST['boxzilla_license_nonce']) ? sanitize_text_field(wp_unslash($_POST['boxzilla_license_nonce'])) : '';
+        if (! wp_verify_nonce($nonce, 'boxzilla_license_form_action')) {
+            $this->notices[] = [
+                'type'    => 'warning',
+                'message' => esc_html__('Security check failed. Please refresh the page and try again.', 'boxzilla'),
+            ];
+            return;
+        }
+
+        $action      = isset($_POST['action']) ? sanitize_text_field(wp_unslash($_POST['action'])) : 'activate';
         $key_changed = false;
 
         // did key change or was "activate" button pressed?
-        $new_license_key = sanitize_text_field($_POST['boxzilla_license_key']);
+        $new_license_key = isset($_POST['boxzilla_license_key']) ? sanitize_text_field(wp_unslash($_POST['boxzilla_license_key'])) : '';
         if ($new_license_key !== $this->license->key) {
             $this->license->key = $new_license_key;
             $key_changed        = true;

src/licensing/class-poller.php

@@ -8,6 +8,8 @@
 
 class Poller
 {
+    public const HOOK = 'boxzilla_check_license_status';
+
     /**
      * @var API
      */
@@ -35,11 +37,16 @@ public function __construct(API $api, License $license)
      */
     public function init()
     {
-        if (! wp_next_scheduled('boxzilla_check_license_status')) {
-            wp_schedule_event(time(), 'daily', 'boxzilla_check_license_status');
+        if (! wp_next_scheduled(self::HOOK)) {
+            wp_schedule_event(time(), 'daily', self::HOOK);
         }
 
-        add_action('boxzilla_check_license_status', [ $this, 'run' ]);
+        add_action(self::HOOK, [ $this, 'run' ]);
+    }
+
+    public static function deactivate()
+    {
+        wp_clear_scheduled_hook(self::HOOK);
     }
 
     /**

src/licensing/views/license-form.php

@@ -41,6 +41,7 @@
 <?php } ?>
 
 <form method="post">
+    <?php wp_nonce_field('boxzilla_license_form_action', 'boxzilla_license_nonce'); ?>
     <table class="form-table">
         <tr valign="top">
             <th><?php esc_html_e('License Key', 'boxzilla'); ?></th>