← All changes | WpInit/Router.php +41 -13 10.10.2 → 11.1.0 View file →

		@@ -1,8 +1,10 @@
1	1	<?php
2	2
3	3	namespace AcyMailing\WpInit;
4	4
	5	+defined('ABSPATH') || die('Restricted Access');
	6	+
5	7	use AcyMailing\Classes\PluginClass;
6	8
7	9	class Router
8	10	{
		@@ -7,13 +9,16 @@
7	9	class Router
8	10	{
9	11	public function __construct()
10	12	{
	13	+ // Back router
11	14	add_action('wp_ajax_acymailing_router', [$this, 'router']);
	15	+ // Front router
12	16	if (!acym_isAdmin()) {
13	17	add_action('wp_loaded', [$this, 'frontRouter']);
14	18	}
15	19
	20	+ // Make sure we can redirect / download / modify headers if needed after some checks
16	21	$pages = [
17	22	'automation',
18	23	'bounces',
19	24	'campaigns',
		@@ -51,10 +56,12 @@
51	56	'users',
52	57	];
53	58	foreach ($pages as $page) {
54	59	if (in_array($page, $headerPages)) {
	60	+ // Ensure we can set headers in the plugin
55	61	add_action('load-acymailing_page_acymailing_'.$page, [$this, 'waitHeaders']);
56	62	}
	63	+ // Disable WP emojis in AcyMailing only
57	64	add_action('admin_print_scripts-acymailing_page_acymailing_'.$page, [$this, 'disableJsBreakingPages']);
58	65	add_action('admin_print_styles-acymailing_page_acymailing_'.$page, [$this, 'removeCssBreakingPages']);
59	66	}
60	67	add_action('admin_print_scripts-toplevel_page_acymailing_dashboard', [$this, 'disableJsBreakingPages']);
		@@ -64,14 +71,18 @@
64	71	}
65	72
66	73	public function protectAcyMailingPages()
67	74	{
	75	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Make sure we're on an AcyMailing page.
68	76	$page = isset($_REQUEST['page']) ? sanitize_text_field(wp_unslash($_REQUEST['page'])) : '';
69		- if (empty($page) || strpos($page, 'acymailing_') === false) return;
	77	+ if (empty($page) || strpos($page, 'acymailing_') === false) {
	78	+ return;
	79	+ }
70	80
71	81	wp_dequeue_script('responsive-lightbox-admin-select2');
72	82	wp_dequeue_style('responsive-lightbox-admin-select2');
73	83
	84	+ // Remove theme loading select2 from Supreme module pro for divi
74	85	wp_dequeue_script('dsm-select-two');
75	86	wp_dequeue_style('dsm-select-two');
76	87	}
77	88
		@@ -81,20 +92,27 @@
81	92	}
82	93
83	94	public function disableJsBreakingPages()
84	95	{
	96	+ // Show normal emojis on AcyMailing pages
85	97	remove_action('admin_print_scripts', 'print_emoji_detection_script');
86	98
	99	+ // Slideshow ck breaks the editor
87	100	remove_action('wp_enqueue_media', '\\Slideshowck\\Tinymce\\register_scripts_styles');
88	101
	102	+ // Skaut Google Drive gallery breaks the editor
89	103	remove_action('wp_enqueue_media', '\\Sgdg\\Admin\\TinyMCE\\register_scripts_styles');
90	104
	105	+ // Remove theme loading select2 which breaks select2 in vueJS
91	106	wp_dequeue_script('select2.js');
92	107
	108	+ // The "Checkout Field Manager for WooCommerce" plugin breaks the js on every pages
93	109	wp_dequeue_script('checkout_fields_js');
94	110
	111	+ // Fixed editor incompatibility
95	112	wp_dequeue_script('wp-optimize-minify-admin-purge');
96	113
	114	+ // Remove Happy Elementor Addons select2 which breaks our select2
97	115	wp_dequeue_script('happy-elementor-addons-select2');
98	116	wp_dequeue_script('select2');
99	117	}
100	118
		@@ -104,11 +122,13 @@
104	122	wp_dequeue_style('WP REST API Controller');
105	123	wp_dequeue_style('wpml-select-2');
106	124	wp_dequeue_style('swcfpc_admin_css');
107	125
	126	+ // Remove Happy Elementor Addons select2 which breaks our select2
108	127	wp_dequeue_style('happy-elementor-addons-select2');
109	128	wp_dequeue_style('select2');
110	129
	130	+ // Messes with the tooltips, the schedule date in emails for example
111	131	wp_dequeue_style('qlwapp-admin-menu');
112	132	}
113	133
114	134	public function frontRouter()
		@@ -120,13 +140,18 @@
120	140	}
121	141
122	142	public function router(bool $front = false): void
123	143	{
124		- displayFreeTrialMessage();
	144	+ acym_displayFreeTrialMessage();
125	145
126	146
127	147	if (!$front) {
128	148	auth_redirect();
	149	+
	150	+ // The router only enforces auth_redirect() and the 'dashboard' controller is exempt from call()'s ACL, so mirror Menu.php's back-office access gate (wp_access groups) to keep arbitrary logged-in users out.
	151	+ if (!acym_hasBackofficeAccess()) {
	152	+ wp_die(esc_html(acym_translation('ACYM_ACCESS_DENIED')), '', ['response' => 403]);
	153	+ }
129	154	}
130	155
131	156	if (file_exists(ACYM_FOLDER.'update.php')) {
132	157	$acyActivation = new Activation();
		@@ -131,9 +156,9 @@
131	156	if (file_exists(ACYM_FOLDER.'update.php')) {
132	157	$acyActivation = new Activation();
133	158	if (is_multisite()) {
134	159	$currentBlog = get_current_blog_id();
135		- $sites = function_exists('get_sites') ? get_sites() : wp_get_sites();
	160	+ $sites = get_sites();
136	161
137	162	foreach ($sites as $site) {
138	163	if (is_object($site)) {
139	164	$site = get_object_vars($site);
		@@ -147,17 +172,18 @@
147	172	} else {
148	173	$acyActivation->updateAcym();
149	174	}
150	175
151		- unlink(ACYM_FOLDER.'update.php');
	176	+ acym_deleteFile(ACYM_FOLDER.'update.php');
152	177	}
153	178
154	179	$config = acym_config(true);
155	180
	181	+ // Get controller. If not found, take it from the page
156	182	$ctrl = acym_getVar('cmd', 'ctrl', '');
157	183	$task = acym_getVar('cmd', 'task', '');
158	184
159		- if (!$front && acym_isAdmin() && file_exists(ACYM_NEW_FEATURES_SPLASHSCREEN_JSON) && is_writable(ACYM_NEW_FEATURES_SPLASHSCREEN_JSON)) {
	185	+ if (!$front && acym_isAdmin() && file_exists(ACYM_NEW_FEATURES_SPLASHSCREEN_JSON) && acym_isWritable(ACYM_NEW_FEATURES_SPLASHSCREEN_JSON)) {
160	186	$ctrl = 'dashboard';
161	187	$task = 'features';
162	188	acym_setVar('ctrl', $ctrl);
163	189	acym_setVar('task', $task);
		@@ -173,10 +199,11 @@
173	199	if (empty($ctrl)) {
174	200	$ctrl = str_replace(ACYM_COMPONENT.'_', '', acym_getVar('cmd', 'page', ''));
175	201
176	202	if (empty($ctrl)) {
177		- echo acym_translation('ACYM_PAGE_NOT_FOUND');
	203	+ echo esc_html(acym_translation('ACYM_PAGE_NOT_FOUND'));
178	204
	205	+ // For Google search console in the frontend to prevent from doing 404 errors
179	206	$noCache = acym_getVar('int', 'nocache', 0);
180	207	if (!empty($noCache)) {
181	208	acym_redirect(acym_rootURI());
182	209	}
		@@ -191,9 +218,9 @@
191	218	$subNamespace = $front ? 'Front' : '';
192	219	$controllerNamespace = 'AcyMailing\\'.$subNamespace.'Controllers\\'.ucfirst($ctrl).'Controller';
193	220
194	221	if (!class_exists($controllerNamespace)) {
195		- echo acym_translation('ACYM_PAGE_NOT_FOUND').': '.$ctrl;
	222	+ echo esc_html(acym_translation('ACYM_PAGE_NOT_FOUND').': '.$ctrl);
196	223
197	224	return;
198	225	}
199	226
		@@ -199,18 +226,17 @@
199	226
200	227	if (!$front && acym_isAdmin() && $task != 'edit' && !(defined('DOING_AJAX') && DOING_AJAX)) {
201	228	$pluginClass = new PluginClass();
202	229	$installedPlugins = $pluginClass->getAll('title');
203		- $newPlugins = json_decode(ACYM_AVAILABLE_PLUGINS);
204		- foreach ($newPlugins as $onePlugin) {
205		- if (empty($installedPlugins[$onePlugin->name])) continue;
206		- if ($installedPlugins[$onePlugin->name]->type !== 'ADDON') continue;
	230	+ foreach (ACYM_AVAILABLE_PLUGINS as $onePlugin) {
	231	+ if (empty($installedPlugins[$onePlugin['name']])) continue;
	232	+ if ($installedPlugins[$onePlugin['name']]->type !== 'ADDON') continue;
207	233
208	234	acym_enqueueMessage(
209	235	acym_translationSprintf(
210	236	'ACYM_NEW_PLUGIN_FORMAT',
211		- $onePlugin->name,
212		- '<a target="_blank" style="color: #00a5ff;" href="'.$onePlugin->downloadlink.'">'.acym_translation('ACYM_CLICK_HERE').'</a>'
	237	+ $onePlugin['name'],
	238	+ '<a target="_blank" style="color: #00a5ff;" href="'.$onePlugin['downloadlink'].'">'.acym_translation('ACYM_CLICK_HERE').'</a>'
213	239	),
214	240	'error'
215	241	);
216	242	}
		@@ -260,8 +286,9 @@
260	286	if (is_wp_error($user) || !$user) {
261	287	acym_redirect($cleanedUrl);
262	288	}
263	289
	290	+ // Never allow autologin for administrator accounts
264	291	if ($user->has_cap('manage_options')) {
265	292	acym_redirect($cleanedUrl);
266	293	}
267	294
		@@ -273,8 +300,9 @@
273	300	}
274	301
275	302	private function deactivateHookAdminFooter()
276	303	{
	304	+ //Remove hook function which break AcyMailing pages
277	305	remove_action('admin_footer', 'Freemius::_enrich_ajax_url');
278	306	remove_action('admin_footer', 'Freemius::_open_support_forum_in_new_page');
279	307	}
280	308	}