Security Concern: Direct Add-to-Cart GET Requests Vulnerability

1. I’m going to need third-party confirmation before I add this to my site. Last time I tried something like this it disabled all the add-to-cart buttons, and locked me out of the site for an hour.
2. WooCommerce’ Hand Picked products block doesn’t use AJAX. I had to add the following code to my site to compensate for this issue.
3. I hate nested IF statements. Doesn’t anyone know how to use PHP’s Switch/Case Statement?

add_action( 'wp_enqueue_scripts', 'hand_picked_block_ajax');

function hand_picked_block_ajax() {
// Only load this on the homepage to keep the site fast
if ( is_front_page() ) {
// Force the core WooCommerce AJAX scripts to load
    wp_enqueue_script( 'wc-add-to-cart' );
       wp_enqueue_script( 'wc-cart-fragments' ); // This fixes the "0 items" issue

    // The custom JS logic
    $custom_js = "
        jQuery(document).on('click', '.wc-block-handpicked-products .add_to_cart_button', function(e) {
            e.preventDefault();
            var \$button = jQuery(this);
            var product_id = \$button.data('product_id');

            if (!product_id) return;

            \$button.addClass('loading');

            jQuery.ajax({
                type: 'POST',
                url: wc_add_to_cart_params.ajax_url,
                data: {
                    action: 'woocommerce_ajax_add_to_cart',
                    product_id: product_id
                },
                success: function(response) {
                    if (response.error && response.product_url) {
                        window.location = response.product_url;
                        return;
                    }
                    // Trigger the fragment refresh so the mini-cart updates
                    jQuery(document.body).trigger('added_to_cart', [response.fragments, response.cart_hash, \$button]);
                    \$button.removeClass('loading').addClass('added');
                }
            });
        });
    ";

    // Attach this script to the 'wc-add-to-cart' handle
    wp_add_inline_script( 'wc-add-to-cart', $custom_js );
}}

Hi @shahzeenfarooq

Given the scope of this forum, that’s perfectly understandable. But this is a serious security concern that affects ALL Woocommerce users. These bots are attacking every website they can find. We’d all appreciate it if Automatic would add cart security like this to Woocommerce core functionality.

Hi @lovingbro

As difficult as it may be for Automatic to handle these issues at the application level. Think about how difficult it is for us ecommerce merchants. Remember, a lot of us are one-man operations.

I’m a technical writer turned voice actor. I write, voice, and produce my audio recordings. I design my own cover art, I maintain my website and promote my products.In my list of skills, writing non-fiction is #1, coding is probably #10. I’m an amateur.

I spent 3 months trying to find the code to block these bots. (three months NOT developing new products) And so far, I’m only 80% successful. My hosting service tech support was totally useless. I couldn’t find an answer on reddit or stackoverflow. And the AIs I asked for help made a ton of mistakes. People who have even less coding experience than me will go straight to an AI, ask for the code, and add it to their site, not realizing they could be adding additional problems.

We need a better solution.

• This reply was modified 1 week, 3 days ago by mesmer7.