diff --git a/omnisend/includes/Internal/class-connection.php b/omnisend/includes/Internal/class-connection.php index 3ca2b4e..0a8298f 100644 --- a/omnisend/includes/Internal/class-connection.php +++ b/omnisend/includes/Internal/class-connection.php @@ -82,7 +82,6 @@ private static function get_account_data( $api_key ): array { return is_array( $arr ) ? $arr : array(); } - public static function show_connected_store_view(): bool { return Options::is_store_connected(); } @@ -90,8 +89,10 @@ public static function show_connected_store_view(): bool { public static function show_connection_view(): bool { $connected = Options::is_store_connected(); - // phpcs:disable WordPress.Security.NonceVerification if ( ! $connected && ! empty( $_GET['action'] ) && 'show_connection_form' == $_GET['action'] ) { + if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ?? '' ) ), 'show_connection_form' ) ) { + die( 'nonce verification failed: ' . __FILE__ . ':' . __LINE__ ); + } return true; } diff --git a/omnisend/view/landing-page.html b/omnisend/view/landing-page.html index b3db788..60e059c 100644 --- a/omnisend/view/landing-page.html +++ b/omnisend/view/landing-page.html @@ -1,4 +1,7 @@ - +