← All changes
|
Libs/adminify-framework/classes/nav-menu-options.class.php
+4
-14
4.3.2
→
4.0.5.4
View file →
| @@ -112,10 +112,10 @@ | ||
| 112 | 112 | $section_title = ( ! empty( $section['title'] ) ) ? $section['title'] : ''; |
| 113 | 113 | |
| 114 | 114 | echo '<div class="adminify-fields">'; |
| 115 | 115 | |
| 116 | - echo ( $section_title || $section_icon ) ? '<div class="adminify-nav-menu-title"><h4>'. wp_kses_post( $section_icon ) . esc_html( $section_title ) .'</h4></div>' : ''; | |
| 117 | - echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. wp_kses_post( $section['description'] ) .'</div>' : ''; | |
| 116 | + echo ( $section_title || $section_icon ) ? '<div class="adminify-nav-menu-title"><h4>'. $section_icon . $section_title .'</h4></div>' : ''; | |
| 117 | + echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. $section['description'] .'</div>' : ''; | |
| 118 | 118 | |
| 119 | 119 | if ( ! empty( $section['fields'] ) ) { |
| 120 | 120 | |
| 121 | 121 | foreach ( $section['fields'] as $field ) { |
| @@ -153,16 +153,11 @@ | ||
| 153 | 153 | if ( ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) || ! wp_verify_nonce( $nonce, 'update-nav_menu' ) ) { |
| 154 | 154 | return $menu_item_db_id; |
| 155 | 155 | } |
| 156 | 156 | |
| 157 | - // Authorization: a valid nonce proves intent, not permission. | |
| 158 | - if ( ! current_user_can( 'edit_theme_options' ) ) { | |
| 159 | - return $menu_item_db_id; | |
| 160 | - } | |
| 161 | - | |
| 162 | 157 | // XSS ok. |
| 163 | 158 | // No worries, This "POST" requests is sanitizing in the below foreach. |
| 164 | - $request = ( ! empty( $_POST[ $this->unique ][ $menu_item_db_id ] ) ) ? wp_unslash( $_POST[ $this->unique ][ $menu_item_db_id ] ) : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- each field is sanitized individually by the framework's per-field sanitize handlers. | |
| 159 | + $request = ( ! empty( $_POST[ $this->unique ][ $menu_item_db_id ] ) ) ? $_POST[ $this->unique ][ $menu_item_db_id ] : array(); | |
| 165 | 160 | |
| 166 | 161 | if ( ! empty( $request ) ) { |
| 167 | 162 | |
| 168 | 163 | foreach ( $this->sections as $section ) { |
| @@ -190,14 +185,9 @@ | ||
| 190 | 185 | $data[$field_id] = call_user_func( $field['sanitize'], $field_value ); |
| 191 | 186 | |
| 192 | 187 | } else { |
| 193 | 188 | |
| 194 | - // A sanitize callback was declared but is not callable; never store raw input. | |
| 195 | - if ( is_array( $field_value ) ) { | |
| 196 | - $data[$field_id] = wp_kses_post_deep( $field_value ); | |
| 197 | - } else { | |
| 198 | - $data[$field_id] = wp_kses_post( $field_value ); | |
| 199 | - } | |
| 189 | + $data[$field_id] = $field_value; | |
| 200 | 190 | |
| 201 | 191 | } |
| 202 | 192 | |
| 203 | 193 | // Validate "post" request of field. |