← All changes | includes/addons.php +39 -15 2.9.1 → 2.13.1 View file →

		@@ -20,8 +20,10 @@
20	20	private function addons_loader() {
21	21	$Autoload = Autoload::get_instance();
22	22	$addons = apply_filters('ablocks/addons/loader_args', [
23	23	'theme-builder' => 'ThemeBuilder',
	24	+ 'cookie-consent' => 'CookieConsent',
	25	+ 'link-guard' => 'LinkGuard',
24	26	]);
25	27
26	28	foreach ( $addons as $addon_name => $addon_class_name ) {
27	29	$addon_root_path = ABLOCKS_ADDONS_DIR_PATH . $addon_name . '/';
		@@ -36,45 +38,67 @@
36	38	}
37	39
38	40	public function get_all_addons() {
39	41	check_ajax_referer( 'ablocks_nonce', 'security' );
40		- if ( ! current_user_can( 'manage_options' ) ) {
	42	+ if ( ! current_user_can( 'ablocks_manage_addons' ) ) {
41	43	wp_die();
42	44	}
43		- $academy_addons = json_decode( get_option( ABLOCKS_ADDONS_SETTINGS_NAME, '{}' ) );
44		- wp_send_json_success( $academy_addons );
	45	+ $ablocks_addons = json_decode( get_option( ABLOCKS_ADDONS_SETTINGS_NAME, '{}' ) );
	46	+ wp_send_json_success( $ablocks_addons );
45	47	}
46	48
47	49	public function saved_addon_status() {
48	50	check_ajax_referer( 'ablocks_nonce', 'security' );
49		- if ( ! current_user_can( 'manage_options' ) ) {
	51	+ // ablocks_manage_addons is only ever granted to somebody who already holds
	52	+ // install_plugins, because turning an add-on on can install one.
	53	+ if ( ! current_user_can( 'ablocks_manage_addons' ) ) {
50	54	wp_die();
51	55	}
52		-
	56	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
53	57	$addon_name = ( isset( $_POST['addon_name'] ) ? sanitize_text_field( $_POST['addon_name'] ) : '' );
	58	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
54	59	$addon_slug = ( isset( $_POST['addon_slug'] ) ? sanitize_text_field( $_POST['addon_slug'] ) : '' );
	60	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
55	61	$status = (bool) ( isset( $_POST['status'] ) ? \ABlocks\Helper::sanitize_checkbox_field( $_POST['status'] ) : false );
56	62
57	63	if ( empty( $addon_slug ) ) {
58		- wp_send_json_error( __( 'Addon Name missing', 'academy' ) );
	64	+ wp_send_json_error( __( 'Addon Name missing', 'ablocks' ) );
59	65	}
60	66
61	67	if ( $status ) {
62		- $required_plugin = ( isset( $_POST['required_plugin'] ) ? json_decode( stripslashes( $_POST['required_plugin'] ), true ) : '' );
63		- do_action( 'academy/before_active_addon', $addon_slug, $required_plugin );
64		- if ( $required_plugin && is_array( $required_plugin ) ) {
	68	+
	69	+ $required_plugin = array();
	70	+
	71	+ if ( isset( $_POST['required_plugin'] ) ) {
	72	+ $raw_json = wp_unslash( $_POST['required_plugin'] );
	73	+ $decoded = json_decode( $raw_json, true );
	74	+
	75	+ if ( is_array( $decoded ) ) {
	76	+ $required_plugin = map_deep( $decoded, 'sanitize_text_field' );
	77	+ }
	78	+ }
	79	+
	80	+ do_action( 'ablocks/before_active_addon', $addon_slug, $required_plugin );
	81	+
	82	+ if ( ! empty( $required_plugin ) ) {
65	83	foreach ( $required_plugin as $plugin ) {
66		- if ( 'Wishlist Member' === $plugin['plugin_name'] ) {
67		- $active_plugins = get_option( 'active_plugins', array() );
68		- $plugin['plugin_dir_path'] = in_array( $plugin['plugin_dir_path'], $active_plugins, true ) ? $plugin['plugin_dir_path'] : ( in_array( 'wishlist-member-x/wpm.php', $active_plugins, true ) ? 'wishlist-member-x/wpm.php' : '' );
	84	+
	85	+ if ( empty( $plugin['plugin_dir_path'] ) || empty( $plugin['plugin_name'] ) ) {
	86	+ continue;
69	87	}
70		- if ( ! Helper::is_plugin_active( sanitize_text_field( $plugin['plugin_dir_path'] ) ) ) {
71		- $error_message = sprintf( '%s Plugin is required to activate %s addon.', sanitize_text_field( $plugin['plugin_name'] ), $addon_name );
	88	+
	89	+ if ( ! Helper::is_plugin_active( $plugin['plugin_dir_path'] ) ) {
	90	+ $error_message = sprintf(
	91	+ '%s Plugin is required to activate %s addon.',
	92	+ esc_html( $plugin['plugin_name'] ),
	93	+ esc_html( $addon_name )
	94	+ );
	95	+
72	96	wp_send_json_error( $error_message );
73	97	}
74	98	}
75	99	}
76		- }
	100	+ }//end if
77	101
78	102	// Saved Data
79	103	$saved_addons = (array) json_decode( get_option( ABLOCKS_ADDONS_SETTINGS_NAME ), true );
80	104	$saved_addons[ $addon_slug ] = $status;