Security issues

2 files changed, 11 insertions, 1 deletions

diff --git a/Postman/Postman-Send-Test-Email/PostmanSendTestEmailController.php b/Postman/Postman-Send-Test-Email/PostmanSendTestEmailController.php
index b569c98..1a207c8 100644
--- a/Postman/Postman-Send-Test-Email/PostmanSendTestEmailController.php
+++ b/Postman/Postman-Send-Test-Email/PostmanSendTestEmailController.php
@@ -1,4 +1,8 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+    exit; // Exit if accessed directly
+}
+
 class PostmanSendTestEmailController {
 	const EMAIL_TEST_SLUG = 'postman/email_test';
 	const RECIPIENT_EMAIL_FIELD_NAME = 'postman_recipient_email';
@@ -127,6 +131,8 @@ class PostmanSendTestEmailController {
 
 		printf( '<form id="postman_test_email_wizard" method="post" action="%s">', PostmanUtils::getSettingsPageUrl() );
 
+		wp_nonce_field('post-smtp', 'security' );
+
 		// Step 1
 		printf( '<h5>%s</h5>', __( 'Specify the Recipient', 'post-smtp' ) );
 		print '<fieldset>';
@@ -199,6 +205,9 @@ class PostmanSendTestEmailAjaxController extends PostmanAbstractAjaxHandler {
 	 * This Ajax sends a test email
 	 */
 	function sendTestEmailViaAjax() {
+
+	    check_admin_referer('post-smtp', 'security');
+
 		// get the email address of the recipient from the HTTP Request
 		$email = $this->getRequestParameter( 'email' );
 
diff --git a/Postman/Postman-Send-Test-Email/postman_send_test_email.js b/Postman/Postman-Send-Test-Email/postman_send_test_email.js
index c3e9f07..ab69d1f 100644
--- a/Postman/Postman-Send-Test-Email/postman_send_test_email.js
+++ b/Postman/Postman-Send-Test-Email/postman_send_test_email.js
@@ -107,7 +107,8 @@ function postHandleStepChange(event, currentIndex, priorIndex, myself) {
 		jQuery('li').addClass('disabled');
 		var data = {
 			'action' : 'postman_send_test_email',
-			'email' : jQuery(postman_email_test.recipient).val()
+			'email' : jQuery(postman_email_test.recipient).val(),
+			'security' : jQuery('#security').val()
 		};
 		jQuery('#postman_test_message_status').html(postman_email_test.sending);
 		jQuery('#postman_test_message_status').css('color', 'blue');