From fcc3b1712fe2206f5c3bbca4516ed7728457059e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johannes=20Gangs=C3=B6?=
 <13980324+jgangso@users.noreply.github.com>
Date: Mon, 4 Jul 2022 15:38:14 +0300
Subject: [PATCH] Security: Add missing nonce check to settings

Noticed the nonce is created in the form but never checked in case of update_settings.
---
 pages/template-debug.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pages/template-debug.php b/pages/template-debug.php
index ad5dbbd..b1cee7a 100644
--- a/pages/template-debug.php
+++ b/pages/template-debug.php
@@ -9,7 +9,7 @@
 	if ( $yotpo_settings->set_settings( $yotpo_settings->get_default_settings(), false, false ) ) {
 		new YRFW_Messages( 'Reset successful!', 'success', true, true );
 	}
-} elseif ( isset( $_POST['update_settings'] ) ) {
+} elseif ( isset( $_POST['update_settings'] ) && wp_verify_nonce( $_POST['yotpo_debug_settings'], 'settings' ) ) {
 	$settings_instance = YRFW_Settings_File::get_instance();
 	$settings_instance->set_settings( $_POST, true, true );
 } elseif ( isset( $_POST['reset_debug_log'] ) && wp_verify_nonce( $_POST['debug_log'], 'debug' ) ) {
@@ -53,4 +53,4 @@
 			</div> <!-- tabs -->
 		</div>
 	</div>
-</div>
\ No newline at end of file
+</div>