From e9e3cc0334626e2b3bdccc6a84fcb49dba318ec8 Mon Sep 17 00:00:00 2001
From: Matthew Haines-Young <matthew@matth.eu>
Date: Wed, 8 Feb 2017 21:56:30 +0000
Subject: [PATCH] Cache data and check nonce at appropriate times.

---
 inc/class-builder-post-meta.php | 53 +++++++++++++++------------------
 1 file changed, 24 insertions(+), 29 deletions(-)

diff --git a/inc/class-builder-post-meta.php b/inc/class-builder-post-meta.php
index 05b04e4..0da6fbe 100644
--- a/inc/class-builder-post-meta.php
+++ b/inc/class-builder-post-meta.php
@@ -4,9 +4,10 @@
 
 class Builder_Post_Meta extends Builder {
 
-	public $id     = null;
-	public $plugin = null;
-	public $args   = array();
+	public $id;
+	public $plugin;
+	public $args = array();
+	public $data;
 
 	public function init() {
 
@@ -75,18 +76,25 @@ public function output( $post ) {
 	}
 
 	public function save_post( $post_id ) {
-
-		$data = $this->get_post_data();
-
-		if ( $data ) {
+		if (
+			isset( $_POST[ $this->id . '-nonce' ] ) && // Input var okay.
+			wp_verify_nonce( sanitize_text_field( $_POST[ $this->id . '-nonce' ] ), $this->id ) // Input var okay.
+		) {
+			$data = $this->get_post_data();
 			$this->save_data( $post_id, $data );
 		}
-
 	}
 
 	public function wp_insert_post_data( $post_data, $postarr ) {
 		global $wpdb;
 
+		if (
+			! isset( $_POST[ $this->id . '-nonce' ] ) || // Input var okay.
+			! wp_verify_nonce( sanitize_text_field( $_POST[ $this->id . '-nonce' ] ), $this->id ) // Input var okay.
+		) {
+			return $post_data;
+		}
+
 		$data = $this->get_post_data();
 
 		if ( $data && ! empty( $postarr['ID'] ) ) {
@@ -290,33 +298,20 @@ public function get_supported_post_types() {
 	protected function get_post_data() {
 
 		if ( ! $this->is_allowed_for_screen() ) {
-			return false;
+			return null;
 		}
 
-		$nonce = null;
-		$data  = null;
-
-		if ( isset( $_POST[ $this->id . '-nonce' ] ) ) {
-			$nonce = sanitize_text_field( $_POST[ $this->id . '-nonce' ] ); // Input var okay.
+		if ( $this->data ) {
+			return $this->data;
 		}
 
-		if ( isset( $_POST[ $this->id . '-data' ] ) ) {
-			$json = $_POST[ $this->id . '-data' ]; // Input var okay.
-			$data = json_decode( $json, true );
-
-			/**
-			 * Data is sometimes already slashed, see https://core.trac.wordpress.org/ticket/35408
-			 */
-			if ( json_last_error() ) {
-				$data = json_decode( stripslashes( $json ), true );
-			}
-
-			if ( ! json_last_error() && $nonce && wp_verify_nonce( $nonce, $this->id ) ) {
-				return $data;
-			}
+		if ( ! isset( $_POST[ $this->id . '-data' ] ) ) {  // Input var okay
+			return null;
 		}
 
-		return false;
+		$this->data = json_decode( stripslashes( $_POST[ $this->id . '-data' ] ), true ); // Input var okay.
+		return $this->data;
+
 	}
 
 }