| 1 |
<?php |
| 2 |
|
| 3 |
defined('ABSPATH') || die('Restricted Access'); |
| 4 |
|
| 5 |
use AcyMailing\Helpers\UpdatemeHelper; |
| 6 |
|
| 7 |
/** |
| 8 |
* @param mixed $default |
| 9 |
* |
| 10 |
* @return mixed |
| 11 |
*/ |
| 12 |
function acym_getVar(string $type, string $name, $default = null, string $source = 'REQUEST', int $mask = 0) |
| 13 |
{ |
| 14 |
$source = strtoupper($source); |
| 15 |
|
| 16 |
switch ($source) { |
| 17 |
case 'FILES': |
| 18 |
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verification is the caller's responsibility for this generic helper. |
| 19 |
$input = &$_FILES; |
| 20 |
break; |
| 21 |
case 'COOKIE': |
| 22 |
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verification is the caller's responsibility for this generic helper. |
| 23 |
$input = &$_COOKIE; |
| 24 |
break; |
| 25 |
case 'SERVER': |
| 26 |
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verification is the caller's responsibility for this generic helper. |
| 27 |
$input = &$_SERVER; |
| 28 |
break; |
| 29 |
case 'SESSION': |
| 30 |
acym_session(); |
| 31 |
$input = &$_SESSION; |
| 32 |
break; |
| 33 |
default: |
| 34 |
$source = 'REQUEST'; |
| 35 |
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is the caller's responsibility for this generic helper. |
| 36 |
$input = &$_REQUEST; |
| 37 |
break; |
| 38 |
} |
| 39 |
|
| 40 |
if (!isset($input[$name])) { |
| 41 |
return $default; |
| 42 |
} |
| 43 |
|
| 44 |
$result = $input[$name]; |
| 45 |
unset($input); |
| 46 |
if ($type === 'array') { |
| 47 |
$result = (array)$result; |
| 48 |
} |
| 49 |
|
| 50 |
// WP alters every variable in $_REQUEST... Seriously... |
| 51 |
if (in_array($source, ['POST', 'REQUEST', 'GET', 'COOKIE'])) { |
| 52 |
$result = acym_stripslashes($result); |
| 53 |
} |
| 54 |
|
| 55 |
return acym_cleanVar($result, $type, $mask); |
| 56 |
} |
| 57 |
|
| 58 |
function acym_stripslashes($element) |
| 59 |
{ |
| 60 |
if (is_array($element)) { |
| 61 |
foreach ($element as &$oneCell) { |
| 62 |
$oneCell = acym_stripslashes($oneCell); |
| 63 |
} |
| 64 |
} elseif (is_string($element)) { |
| 65 |
$element = stripslashes($element); |
| 66 |
} |
| 67 |
|
| 68 |
return $element; |
| 69 |
} |
| 70 |
|
| 71 |
function acym_cleanVar($var, $type, $mask) |
| 72 |
{ |
| 73 |
if (is_array($var)) { |
| 74 |
foreach ($var as $i => $val) { |
| 75 |
$var[$i] = acym_cleanVar($val, $type, $mask); |
| 76 |
} |
| 77 |
|
| 78 |
return $var; |
| 79 |
} |
| 80 |
|
| 81 |
switch ($type) { |
| 82 |
case 'string': |
| 83 |
$var = strval($var); |
| 84 |
break; |
| 85 |
case 'int': |
| 86 |
$var = intval($var); |
| 87 |
break; |
| 88 |
case 'float': |
| 89 |
$var = floatval($var); |
| 90 |
break; |
| 91 |
case 'bool': |
| 92 |
case 'boolean': |
| 93 |
$var = boolval($var); |
| 94 |
break; |
| 95 |
case 'word': |
| 96 |
$var = preg_replace('#[^a-zA-Z_]#', '', $var); |
| 97 |
break; |
| 98 |
case 'cmd': |
| 99 |
$var = preg_replace('#[^a-zA-Z0-9_\.-]#', '', $var); |
| 100 |
$var = ltrim($var, '.'); |
| 101 |
break; |
| 102 |
default: |
| 103 |
break; |
| 104 |
} |
| 105 |
|
| 106 |
if (!is_string($var)) { |
| 107 |
return $var; |
| 108 |
} |
| 109 |
|
| 110 |
$var = trim($var); |
| 111 |
|
| 112 |
if ($mask & ACYM_ALLOWRAW) { |
| 113 |
return $var; |
| 114 |
} |
| 115 |
|
| 116 |
if (!preg_match('//u', $var)) { |
| 117 |
// String contains invalid byte sequence, remove it |
| 118 |
$var = htmlspecialchars_decode(htmlspecialchars($var, ENT_IGNORE, 'UTF-8')); |
| 119 |
} |
| 120 |
|
| 121 |
if (!($mask & ACYM_ALLOWHTML)) { |
| 122 |
$var = preg_replace('#<[a-zA-Z/]+[^>]*>#Uis', '', $var); |
| 123 |
} |
| 124 |
|
| 125 |
return $var; |
| 126 |
} |
| 127 |
|
| 128 |
function acym_setVar(string $name, $value): void |
| 129 |
{ |
| 130 |
$_REQUEST[$name] = $value; |
| 131 |
} |
| 132 |
|
| 133 |
/** |
| 134 |
* Function detecting the context of a request, not related to security checks |
| 135 |
*/ |
| 136 |
function acym_isAdmin(): bool |
| 137 |
{ |
| 138 |
// Outside of /wp-admin we are on the front-end, whatever the request parameters say |
| 139 |
if (!is_admin()) { |
| 140 |
return false; |
| 141 |
} |
| 142 |
|
| 143 |
$page = acym_getVar('string', 'page', ''); |
| 144 |
|
| 145 |
return !in_array($page, [ACYM_COMPONENT.'_front', 'front'], true); |
| 146 |
} |
| 147 |
|
| 148 |
function acym_cmsLoaded(): void |
| 149 |
{ |
| 150 |
defined('ABSPATH') || die('Restricted access'); |
| 151 |
} |
| 152 |
|
| 153 |
function acym_isDebug(): bool |
| 154 |
{ |
| 155 |
return defined('WP_DEBUG') && WP_DEBUG; |
| 156 |
} |
| 157 |
|
| 158 |
function acym_askLog(bool $current = true, string $message = 'ACYM_NOTALLOWED', string $type = 'error'): void |
| 159 |
{ |
| 160 |
//If the user is not logged in, we just redirect him to the login page.... |
| 161 |
$url = acym_rootURI().'wp-login.php'; |
| 162 |
if ($current) { |
| 163 |
$url .= '&redirect_to='.base64_encode(acym_currentURL()); |
| 164 |
} |
| 165 |
|
| 166 |
acym_redirect($url, $message, $type); |
| 167 |
} |
| 168 |
|
| 169 |
function acym_getDefaultConfigValues(): array |
| 170 |
{ |
| 171 |
$allPref = []; |
| 172 |
|
| 173 |
$allPref['from_name'] = get_option('fromname', ''); |
| 174 |
$allPref['from_email'] = get_option('admin_email', ''); |
| 175 |
$allPref['bounce_email'] = $allPref['from_email']; |
| 176 |
$allPref['sendmail_path'] = ''; |
| 177 |
$allPref['smtp_port'] = get_option('mailserver_port', ''); |
| 178 |
$allPref['smtp_secured'] = $allPref['smtp_port'] == 465 ? 'ssl' : ''; |
| 179 |
$allPref['smtp_auth'] = 1; |
| 180 |
$allPref['smtp_username'] = get_option('mailserver_login', ''); |
| 181 |
$allPref['smtp_password'] = get_option('mailserver_pass', ''); |
| 182 |
$allPref['mailer_method'] = empty($allPref['smtp_host']) ? 'phpmail' : 'smtp'; |
| 183 |
$allPref['smtp_host'] = get_option('mailserver_url', ''); |
| 184 |
$allPref['cron_savepath'] = ACYM_LOGS_FOLDER.'report{year}_{month}.log'; |
| 185 |
|
| 186 |
return $allPref; |
| 187 |
} |
| 188 |
|
| 189 |
function acym_hasAdminPermissions(): bool |
| 190 |
{ |
| 191 |
return current_user_can('manage_options'); |
| 192 |
} |
| 193 |
|
| 194 |
/** |
| 195 |
* May the user reach the AcyMailing back-end at all? Same rule as the menu visibility (Menu::addMenus). |
| 196 |
*/ |
| 197 |
function acym_hasBackofficeAccess(): bool |
| 198 |
{ |
| 199 |
$config = acym_config(); |
| 200 |
$allowedGroups = explode(',', $config->get('wp_access', 'administrator')); |
| 201 |
|
| 202 |
$userGroups = acym_getGroupsByUser(); |
| 203 |
foreach ($userGroups as $oneGroup) { |
| 204 |
if ($oneGroup == 'administrator' || in_array($oneGroup, $allowedGroups)) { |
| 205 |
return true; |
| 206 |
} |
| 207 |
} |
| 208 |
|
| 209 |
return false; |
| 210 |
} |
| 211 |
|
| 212 |
function acym_cmsPermission(): void |
| 213 |
{ |
| 214 |
if (!acym_hasAdminPermissions()) { |
| 215 |
return; |
| 216 |
} |
| 217 |
|
| 218 |
$config = acym_config(); |
| 219 |
$roles = acym_getGroups(); |
| 220 |
$options = []; |
| 221 |
$selected = explode(',', $config->get('wp_access', 'administrator')); |
| 222 |
|
| 223 |
foreach ($roles as $name => $oneRole) { |
| 224 |
if ($name === 'administrator') { |
| 225 |
continue; |
| 226 |
} |
| 227 |
$options[$name] = $oneRole->text; |
| 228 |
} |
| 229 |
|
| 230 |
asort($options); |
| 231 |
|
| 232 |
echo '<div class="cell grid-x"> |
| 233 |
<label class="cell large-3 medium-5 small-9">'.esc_html(acym_translation('ACYM_ACCESS')).' '; |
| 234 |
acym_info(['textShownInTooltip' => 'ACYM_ACCESS_DESC']); |
| 235 |
echo '</label> |
| 236 |
<div class="cell auto">'; |
| 237 |
|
| 238 |
acym_selectMultiple( |
| 239 |
$options, |
| 240 |
'config[wp_access]', |
| 241 |
$selected, |
| 242 |
['class' => 'acym__select'], |
| 243 |
'value', |
| 244 |
'text', |
| 245 |
true, |
| 246 |
); |
| 247 |
|
| 248 |
echo '</div> |
| 249 |
</div>'; |
| 250 |
} |
| 251 |
|
| 252 |
function acym_triggerCmsHook(string $action, array $args = [], bool $isAction = true) |
| 253 |
{ |
| 254 |
array_unshift($args, $action); |
| 255 |
|
| 256 |
return call_user_func_array($isAction ? 'do_action' : 'apply_filters', $args); |
| 257 |
} |
| 258 |
|
| 259 |
function acym_getCmsCaptcha(): array |
| 260 |
{ |
| 261 |
return []; |
| 262 |
} |
| 263 |
|
| 264 |
function acym_loadCaptcha(string $captchaPluginName, string $id): void |
| 265 |
{ |
| 266 |
} |
| 267 |
|
| 268 |
function acym_checkCaptcha(string $captchaPluginName, ?string $response = null): bool |
| 269 |
{ |
| 270 |
return true; |
| 271 |
} |
| 272 |
|
| 273 |
function acym_getSiteSalt(): string |
| 274 |
{ |
| 275 |
return wp_salt('auth'); |
| 276 |
} |
| 277 |
|
| 278 |
function acym_stripTags(string $text): string |
| 279 |
{ |
| 280 |
return wp_strip_all_tags($text); |
| 281 |
} |
| 282 |
|
| 283 |
function acym_setSession(string $name, $value, bool $remove = false): void |
| 284 |
{ |
| 285 |
acym_session(); |
| 286 |
|
| 287 |
if ($remove) { |
| 288 |
unset($_SESSION[$name]); |
| 289 |
} else { |
| 290 |
$_SESSION[$name] = $value; |
| 291 |
} |
| 292 |
} |
| 293 |
|
