- Restricts router access to explicitly defined endpoint actions

lib/Router/Endpoints/Queue.php

@@ -8,6 +8,7 @@ if(!defined('ABSPATH')) exit;
 class Queue {
   const ENDPOINT = 'queue';
   const ACTION_RUN = 'run';
+  public $allowed_actions = array(self::ACTION_RUN);
 
   function run($data) {
     $queue = new Daemon($data);

lib/Router/Endpoints/Subscription.php

@@ -7,6 +7,14 @@ if(!defined('ABSPATH')) exit;
 
 class Subscription {
   const ENDPOINT = 'subscription';
+  const ACTION_CONFIRM = 'confirm';
+  const ACTION_MANAGE = 'manage';
+  const ACTION_UNSUBSCRIBE = 'unsubscribe';
+  public $allowed_actions = array(
+    self::ACTION_CONFIRM,
+    self::ACTION_MANAGE,
+    self::ACTION_UNSUBSCRIBE
+  );
 
   function confirm($data) {
     $subscription = new UserSubscription\Pages('confirm', $data);

lib/Router/Endpoints/Track.php

@@ -14,6 +14,10 @@ class Track {
   const ENDPOINT = 'track';
   const ACTION_CLICK = 'click';
   const ACTION_OPEN = 'open';
+  public $allowed_actions = array(
+    self::ACTION_CLICK,
+    self::ACTION_OPEN
+  );
 
   function click($data) {
     $click_event = new Clicks();

lib/Router/Endpoints/ViewInBrowser.php

@@ -11,6 +11,7 @@ if(!defined('ABSPATH')) exit;
 class ViewInBrowser {
   const ENDPOINT = 'view_in_browser';
   const ACTION_VIEW = 'view';
+  public $allowed_actions = array(self::ACTION_VIEW);
 
   function view($data) {
     $data = $this->_processBrowserPreviewData($data);

lib/Router/Front.php

@@ -31,7 +31,7 @@ class Front {
 
     if(!$this->api_request) return;
     if(!$this->endpoint || !class_exists($class)) {
-      self::terminateRequest(self::RESPONSE_ERROR, __('Invalid Router endpoint.'));
+      self::terminateRequest(self::RESPONSE_ERROR, __('Invalid router endpoint.'));
     }
     $this->callEndpoint(
       $class,
@@ -41,10 +41,10 @@ class Front {
   }
 
   function callEndpoint($endpoint, $action, $data) {
-    if(!method_exists($endpoint, $action)) {
-      self::terminateRequest(self::RESPONSE_ERROR, __('Invalid Router action.'));
-    }
     $endpoint = new $endpoint();
+    if(!method_exists($endpoint, $action) || !in_array($action, $endpoint->allowed_actions)) {
+      self::terminateRequest(self::RESPONSE_ERROR, __('Invalid router action.'));
+    }
     call_user_func(
       array(
         $endpoint,