← All changes | back/Core/wordpress/security.php +99 -71 10.2.2 → 11.1.0 View file →

		@@ -1,33 +1,39 @@
1	1	<?php
2	2
	3	+defined('ABSPATH') || die('Restricted Access');
	4	+
3	5	use AcyMailing\Helpers\UpdatemeHelper;
4	6
5		-function acym_getVar($type, $name, $default = null, $source = 'REQUEST', $mask = 0)
	7	+/**
	8	+ * @param mixed $default
	9	+ *
	10	+ * @return mixed
	11	+ */
	12	+function acym_getVar(string $type, string $name, $default = null, string $source = 'REQUEST', int $mask = 0)
6	13	{
7	14	$source = strtoupper($source);
8	15
9	16	switch ($source) {
10		- case 'GET':
11		- $input = &$_GET;
12		- break;
13		- case 'POST':
14		- $input = &$_POST;
15		- break;
16	17	case 'FILES':
	18	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verification is the caller's responsibility for this generic helper.
17	19	$input = &$_FILES;
18	20	break;
19	21	case 'COOKIE':
	22	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verification is the caller's responsibility for this generic helper.
20	23	$input = &$_COOKIE;
21	24	break;
22		- case 'ENV':
23		- $input = &$_ENV;
24		- break;
25	25	case 'SERVER':
	26	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verification is the caller's responsibility for this generic helper.
26	27	$input = &$_SERVER;
27	28	break;
	29	+ case 'SESSION':
	30	+ acym_session();
	31	+ $input = &$_SESSION;
	32	+ break;
28	33	default:
29	34	$source = 'REQUEST';
	35	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is the caller's responsibility for this generic helper.
30	36	$input = &$_REQUEST;
31	37	break;
32	38	}
33	39
		@@ -40,8 +46,9 @@
40	46	if ($type === 'array') {
41	47	$result = (array)$result;
42	48	}
43	49
	50	+ // WP alters every variable in $_REQUEST... Seriously...
44	51	if (in_array($source, ['POST', 'REQUEST', 'GET', 'COOKIE'])) {
45	52	$result = acym_stripslashes($result);
46	53	}
47	54
		@@ -106,8 +113,9 @@
106	113	return $var;
107	114	}
108	115
109	116	if (!preg_match('//u', $var)) {
	117	+ // String contains invalid byte sequence, remove it
110	118	$var = htmlspecialchars_decode(htmlspecialchars($var, ENT_IGNORE, 'UTF-8'));
111	119	}
112	120
113	121	if (!($mask & ACYM_ALLOWHTML)) {
		@@ -116,64 +124,41 @@
116	124
117	125	return $var;
118	126	}
119	127
120		-function acym_setVar($name, $value = null, $hash = 'REQUEST', $overwrite = true)
	128	+function acym_setVar(string $name, $value): void
121	129	{
122		- $hash = strtoupper($hash);
	130	+ $_REQUEST[$name] = $value;
	131	+}
123	132
124		- switch ($hash) {
125		- case 'GET':
126		- $input = &$_GET;
127		- break;
128		- case 'POST':
129		- $input = &$_POST;
130		- break;
131		- case 'FILES':
132		- $input = &$_FILES;
133		- break;
134		- case 'COOKIE':
135		- $input = &$_COOKIE;
136		- break;
137		- case 'ENV':
138		- $input = &$_ENV;
139		- break;
140		- case 'SERVER':
141		- $input = &$_SERVER;
142		- break;
143		- default:
144		- $input = &$_REQUEST;
145		- break;
	133	+/**
	134	+ * Function detecting the context of a request, not related to security checks
	135	+ */
	136	+function acym_isAdmin(): bool
	137	+{
	138	+ // Outside of /wp-admin we are on the front-end, whatever the request parameters say
	139	+ if (!is_admin()) {
	140	+ return false;
146	141	}
147	142
148		- if (!isset($input[$name]) || $overwrite) {
149		- $input[$name] = $value;
150		- }
151		-}
152		-
153		-function acym_isAdmin()
154		-{
155	143	$page = acym_getVar('string', 'page', '');
156	144
157		- if (!empty($page)) {
158		- return !in_array($page, [ACYM_COMPONENT.'_front', 'front']);
159		- } else {
160		- return is_admin();
161		- }
	145	+ return !in_array($page, [ACYM_COMPONENT.'_front', 'front'], true);
162	146	}
163	147
164		-function acym_cmsLoaded()
	148	+function acym_cmsLoaded(): void
165	149	{
166	150	defined('ABSPATH') || die('Restricted access');
167	151	}
168	152
169		-function acym_isDebug()
	153	+function acym_isDebug(): bool
170	154	{
171	155	return defined('WP_DEBUG') && WP_DEBUG;
172	156	}
173	157
174		-function acym_askLog($current = true, $message = 'ACYM_NOTALLOWED', $type = 'error')
	158	+function acym_askLog(bool $current = true, string $message = 'ACYM_NOTALLOWED', string $type = 'error'): void
175	159	{
	160	+ //If the user is not logged in, we just redirect him to the login page....
176	161	$url = acym_rootURI().'wp-login.php';
177	162	if ($current) {
178	163	$url .= '&redirect_to='.base64_encode(acym_currentURL());
179	164	}
		@@ -180,9 +165,9 @@
180	165
181	166	acym_redirect($url, $message, $type);
182	167	}
183	168
184		-function acym_getDefaultConfigValues()
	169	+function acym_getDefaultConfigValues(): array
185	170	{
186	171	$allPref = [];
187	172
188	173	$allPref['from_name'] = get_option('fromname', '');
		@@ -200,65 +185,108 @@
200	185
201	186	return $allPref;
202	187	}
203	188
204		-function acym_cmsPermission()
	189	+function acym_hasAdminPermissions(): bool
205	190	{
206		- if (!current_user_can('manage_options')) return '';
	191	+ return current_user_can('manage_options');
	192	+}
207	193
	194	+/**
	195	+ * May the user reach the AcyMailing back-end at all? Same rule as the menu visibility (Menu::addMenus).
	196	+ */
	197	+function acym_hasBackofficeAccess(): bool
	198	+{
208	199	$config = acym_config();
	200	+ $allowedGroups = explode(',', $config->get('wp_access', 'administrator'));
	201	+
	202	+ $userGroups = acym_getGroupsByUser();
	203	+ foreach ($userGroups as $oneGroup) {
	204	+ if ($oneGroup == 'administrator' || in_array($oneGroup, $allowedGroups)) {
	205	+ return true;
	206	+ }
	207	+ }
	208	+
	209	+ return false;
	210	+}
	211	+
	212	+function acym_cmsPermission(): void
	213	+{
	214	+ if (!acym_hasAdminPermissions()) {
	215	+ return;
	216	+ }
	217	+
	218	+ $config = acym_config();
209	219	$roles = acym_getGroups();
210	220	$options = [];
211	221	$selected = explode(',', $config->get('wp_access', 'administrator'));
212	222
213	223	foreach ($roles as $name => $oneRole) {
214		- if ($name === 'administrator') continue;
	224	+ if ($name === 'administrator') {
	225	+ continue;
	226	+ }
215	227	$options[$name] = $oneRole->text;
216	228	}
217	229
218	230	asort($options);
219	231
220		- $option = '
221		- <div class="cell grid-x">
222		- <label class="cell large-3 medium-5 small-9">'.acym_translation('ACYM_ACCESS').' '.acym_info('ACYM_ACCESS_DESC').'</label>
	232	+ echo '<div class="cell grid-x">
	233	+ <label class="cell large-3 medium-5 small-9">'.esc_html(acym_translation('ACYM_ACCESS')).' ';
	234	+ acym_info(['textShownInTooltip' => 'ACYM_ACCESS_DESC']);
	235	+ echo '</label>
223	236	<div class="cell auto">';
224	237
225		- $option .= acym_selectMultiple(
	238	+ acym_selectMultiple(
226	239	$options,
227	240	'config[wp_access]',
228	241	$selected,
229		- ['class' => 'acym__select']
	242	+ ['class' => 'acym__select'],
	243	+ 'value',
	244	+ 'text',
	245	+ true,
230	246	);
231	247
232		- $option .= '</div>
	248	+ echo '</div>
233	249	</div>';
234		-
235		- return $option;
236	250	}
237	251
238		-function acym_checkVersion($ajax = false)
	252	+function acym_triggerCmsHook(string $action, array $args = [], bool $isAction = true)
239	253	{
240		-
241		- return false;
242		-}
243		-
244		-function acym_triggerCmsHook($action, $args = [], $isAction = true)
245		-{
246	254	array_unshift($args, $action);
247	255
248	256	return call_user_func_array($isAction ? 'do_action' : 'apply_filters', $args);
249	257	}
250	258
251		-function acym_getCmsCaptcha()
	259	+function acym_getCmsCaptcha(): array
252	260	{
253	261	return [];
254	262	}
255	263
256		-function acym_loadCaptcha(string $captchaPluginName, string $id): string
	264	+function acym_loadCaptcha(string $captchaPluginName, string $id): void
257	265	{
258		- return '';
259	266	}
260	267
261	268	function acym_checkCaptcha(string $captchaPluginName, ?string $response = null): bool
262	269	{
263	270	return true;
	271	+}
	272	+
	273	+function acym_getSiteSalt(): string
	274	+{
	275	+ return wp_salt('auth');
	276	+}
	277	+
	278	+function acym_stripTags(string $text): string
	279	+{
	280	+ return wp_strip_all_tags($text);
	281	+}
	282	+
	283	+function acym_setSession(string $name, $value, bool $remove = false): void
	284	+{
	285	+ acym_session();
	286	+
	287	+ if ($remove) {
	288	+ unset($_SESSION[$name]);
	289	+ } else {
	290	+ $_SESSION[$name] = $value;
	291	+ }
264	292	}