| 1 |
<?php |
| 2 |
|
| 3 |
namespace WPAdminify\Inc\Admin\Frames; |
| 4 |
|
| 5 |
// no direct access allowed |
| 6 |
if (!defined('ABSPATH')) { |
| 7 |
exit; |
| 8 |
} |
| 9 |
/** |
| 10 |
* WP Adminify |
| 11 |
* Init Class |
| 12 |
* |
| 13 |
* @author Jewel Theme <support@jeweltheme.com> |
| 14 |
*/ |
| 15 |
|
| 16 |
if (!class_exists('Init')) { |
| 17 |
class Init |
| 18 |
{ |
| 19 |
public static $instance; |
| 20 |
public $admin; |
| 21 |
public $frame; |
| 22 |
|
| 23 |
public static function instance() |
| 24 |
{ |
| 25 |
if (is_null(self::$instance)) { |
| 26 |
self::$instance = new self(); |
| 27 |
} |
| 28 |
return self::$instance; |
| 29 |
} |
| 30 |
|
| 31 |
public function __construct() |
| 32 |
{ |
| 33 |
|
| 34 |
if ( ! $this->is_allowed() ) { |
| 35 |
if ( is_iframe() ) { |
| 36 |
$actual_link = (empty($_SERVER['HTTPS']) ? 'http' : 'https') . "://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"; |
| 37 |
Frames::custom_plugin_change_reload($actual_link); |
| 38 |
} |
| 39 |
return; |
| 40 |
} |
| 41 |
|
| 42 |
if ( is_iframe() ) { |
| 43 |
$this->frame = new Frames(); |
| 44 |
} else { |
| 45 |
$this->admin = new Admin(); |
| 46 |
} |
| 47 |
|
| 48 |
} |
| 49 |
|
| 50 |
public function is_allowed() { |
| 51 |
|
| 52 |
$not_allowed_urls = Admin::get_not_allowed_urls(); |
| 53 |
|
| 54 |
foreach ( $not_allowed_urls as $url_object ) { |
| 55 |
if ( is_string( $url_object ) ) { |
| 56 |
|
| 57 |
$is_allowed = true; // Scoped Default allowed |
| 58 |
if ( $url_object === $_SERVER['PHP_SELF'] ) $is_allowed = false; // not allowed |
| 59 |
|
| 60 |
} else { |
| 61 |
|
| 62 |
$is_allowed = false; // Scoped Default not allowed |
| 63 |
|
| 64 |
if ( $url_object['url'] !== '*' && $url_object['url'] !== $_SERVER['PHP_SELF'] ) $is_allowed = true; // allowed |
| 65 |
if ( ! $is_allowed && array_key_exists( 'query_params', $url_object ) ) { |
| 66 |
if ( ! $this->check_query_params( $url_object['query_params'] ) ) $is_allowed = true; // allowed |
| 67 |
} |
| 68 |
|
| 69 |
if ( ! $is_allowed && array_key_exists( 'post_type', $url_object ) ) { |
| 70 |
if ( ! $this->check_post_type( $url_object['post_type'] ) ) $is_allowed = true; // allowed |
| 71 |
} |
| 72 |
|
| 73 |
} |
| 74 |
|
| 75 |
if ( ! $is_allowed ) return $is_allowed; |
| 76 |
|
| 77 |
} |
| 78 |
|
| 79 |
return true; |
| 80 |
|
| 81 |
} |
| 82 |
|
| 83 |
function check_query_params($query_params) { |
| 84 |
// Pattern 1: Both keys and their values should check in $_GET |
| 85 |
if (array_keys($query_params) === $query_params) { |
| 86 |
foreach ($query_params as $key => $value) { |
| 87 |
if (!isset($_GET[$key]) || $_GET[$key] != $value) { |
| 88 |
return false; // Key doesn't exist or the value doesn't match |
| 89 |
} |
| 90 |
} |
| 91 |
return true; // All keys and values match |
| 92 |
} |
| 93 |
|
| 94 |
// Pattern 2: Check for only keys in $_GET, no need to check their values |
| 95 |
if (array_values($query_params) === $query_params) { |
| 96 |
foreach ($query_params as $param) { |
| 97 |
if ( substr($param, -1) === '!' ) { |
| 98 |
$param = substr($param, 0, -1); |
| 99 |
if ( isset($_GET[$param]) ) return false; // The key exists in $_GET |
| 100 |
} else { |
| 101 |
if ( ! isset($_GET[$param]) ) return false; // The key doesn't exist in $_GET |
| 102 |
} |
| 103 |
|
| 104 |
} |
| 105 |
return true; // All keys exist |
| 106 |
} |
| 107 |
|
| 108 |
// Pattern 3: A mix of key existence and key-value matching |
| 109 |
foreach ($query_params as $key => $value) { |
| 110 |
if (is_numeric($key)) { |
| 111 |
// For numeric keys, we're checking only existence (Pattern 1 behavior) |
| 112 |
if ( substr($value, -1) === '!' ) { |
| 113 |
$value = substr($value, 0, -1); |
| 114 |
if ( isset($_GET[$value]) ) return false; // The key exists in $_GET |
| 115 |
} else { |
| 116 |
if ( ! isset($_GET[$value]) ) return false; // The key doesn't exist in $_GET |
| 117 |
} |
| 118 |
} else { |
| 119 |
// For associative keys, we check for both key and value (Pattern 2 behavior) |
| 120 |
if (!isset($_GET[$key]) || $_GET[$key] != $value) { |
| 121 |
return false; // Key doesn't exist or value doesn't match |
| 122 |
} |
| 123 |
} |
| 124 |
} |
| 125 |
|
| 126 |
return true; // All conditions are met |
| 127 |
} |
| 128 |
|
| 129 |
function check_post_type($post_types) { |
| 130 |
if ( isset( $_GET['post_type'] ) ) { |
| 131 |
return in_array( $_GET['post_type'], $post_types ); |
| 132 |
} else if ( isset( $_GET['post'] ) ) { |
| 133 |
return in_array( get_post_type( $_GET['post'] ), $post_types ); |
| 134 |
} |
| 135 |
return in_array( 'post', $post_types ); |
| 136 |
} |
| 137 |
|
| 138 |
} |
| 139 |
|
| 140 |
} |
| 141 |
|
