Merge pull request #201 from paynl/feature/ajax_nonce

Fix ajax call with nonce

Author: woutse

assets/js/payorder.js

@@ -43,7 +43,8 @@ function doAjaxRequest($, amount, type)
         'terminal': terminal,
         'order_id': paynl_order.order_id,
         'returnUrl': window.location.href,
-        'type': type
+        'type': type,
+        'security': paynl_order.nonce
     };
 
     $.ajax({

includes/classes/PPMFWC/Gateways.php

@@ -1207,6 +1207,16 @@ public static function ppmfwc_retourpinReturn()
      */
     public static function ppmfwc_onPinRefund()
     {
+        $security = PPMFWC_Helper_Data::getPostTextField('security');
+        if ((empty($security) || !wp_verify_nonce($security, 'ajax_nonce')) || (!current_user_can('manage_woocommerce') && !current_user_can('manage_options'))) {
+            $returnArray = array(
+                'success' => false,
+                'message' => __('You do not have permission to perform this action.', PPMFWC_WOOCOMMERCE_TEXTDOMAIN),
+            );
+            header('Content-Type: application/json;charset=UTF-8');
+            die(json_encode($returnArray));
+        }
+                
         try {
             $amount = PPMFWC_Helper_Data::getPostTextField('amount');
             $terminal = PPMFWC_Helper_Data::getPostTextField('terminal');

woocommerce-payment-paynl.php

@@ -457,6 +457,7 @@ function ppmfwc_setup_instore_scripts(array $terminals, $texts, $additionalData)
         array(
             'texts' => $texts,
             'terminals' => $terminals,
+            'nonce' => wp_create_nonce('ajax_nonce')
         ),
         $additionalData
     );