sanitize $_SERVERs

MONEI · Apr 3, 2024 · 34e16f9 · 34e16f9
1 parent 9ffecbb
commit 34e16f9
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/includes/addons/class-wc-monei-apple-pay-verification.php b/includes/addons/class-wc-monei-apple-pay-verification.php
@@ -36,7 +36,7 @@ public function apple_domain_register() {
  }
 
  try {
- $domain = isset( $_SERVER['HTTP_HOST'] ) ? $_SERVER['HTTP_HOST'] : str_replace( array( 'https://', 'https://' ), '', get_site_url() ); // @codingStandardsIgnoreLine
+ $domain = isset( $_SERVER['HTTP_HOST'] ) ? sanitize_text_field( $_SERVER['HTTP_HOST'] ) : str_replace( array( 'https://', 'https://' ), '', get_site_url() ); // @codingStandardsIgnoreLine
  WC_Monei_API::register_apple_domain( $domain );
  } catch ( OpenAPI\Client\ApiException $e ) {
  WC_Monei_Logger::log( $e, 'error' );

diff --git a/includes/class-wc-monei-ipn.php b/includes/class-wc-monei-ipn.php
@@ -27,7 +27,7 @@ public function __construct() {
  */
  public function check_ipn_request() {
 
- if ( ( 'POST' !== $_SERVER['REQUEST_METHOD'] ) ) {
+ if ( ( 'POST' !== sanitize_text_field( $_SERVER['REQUEST_METHOD'] ) ) ) {
  return;
  }
 
@@ -36,7 +36,7 @@ public function check_ipn_request() {
  $this->log_ipn_request( $headers, $raw_body );
 
  try {
- $payload = $this->verify_signature_get_payload( $raw_body, $_SERVER['HTTP_MONEI_SIGNATURE'] );
+ $payload = $this->verify_signature_get_payload( $raw_body, sanitize_text_field( $_SERVER['HTTP_MONEI_SIGNATURE'] ) );
  WC_Monei_Logger::log( $payload, 'debug' );
  $this->handle_valid_ipn( $payload );
  do_action( 'woocommerce_monei_handle_valid_ipn', $payload );