← All changes
|
Libs/adminify-framework/classes/taxonomy-options.class.php
+5
-15
4.3.2
→
4.0.5.4
View file →
| @@ -33,9 +33,9 @@ | ||
| 33 | 33 | $this->unique = $key; |
| 34 | 34 | $this->args = apply_filters( "adminify_{$this->unique}_args", wp_parse_args( $params['args'], $this->args ), $this ); |
| 35 | 35 | $this->sections = apply_filters( "adminify_{$this->unique}_sections", $params['sections'], $this ); |
| 36 | 36 | $this->taxonomies = ( is_array( $this->args['taxonomy'] ) ) ? $this->args['taxonomy'] : array_filter( (array) $this->args['taxonomy'] ); |
| 37 | - $this->taxonomy = ( ! empty( $_REQUEST[ 'taxonomy' ] ) ) ? sanitize_text_field( wp_unslash( $_REQUEST[ 'taxonomy' ] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change. | |
| 37 | + $this->taxonomy = ( ! empty( $_REQUEST[ 'taxonomy' ] ) ) ? sanitize_text_field( wp_unslash( $_REQUEST[ 'taxonomy' ] ) ) : ''; | |
| 38 | 38 | $this->pre_fields = $this->pre_fields( $this->sections ); |
| 39 | 39 | |
| 40 | 40 | if ( ! empty( $this->taxonomies ) && in_array( $this->taxonomy, $this->taxonomies ) ) { |
| 41 | 41 | add_action( 'admin_init', array( $this, 'add_taxonomy_options' ) ); |
| @@ -123,10 +123,10 @@ | ||
| 123 | 123 | |
| 124 | 124 | $section_icon = ( ! empty( $section['icon'] ) ) ? '<i class="adminify-section-icon '. esc_attr( $section['icon'] ) .'"></i>' : ''; |
| 125 | 125 | $section_title = ( ! empty( $section['title'] ) ) ? $section['title'] : ''; |
| 126 | 126 | |
| 127 | - echo ( $section_title || $section_icon ) ? '<div class="adminify-section-title"><h3>'. wp_kses_post( $section_icon ) . esc_html( $section_title ) .'</h3></div>' : ''; | |
| 128 | - echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. wp_kses_post( $section['description'] ) .'</div>' : ''; | |
| 127 | + echo ( $section_title || $section_icon ) ? '<div class="adminify-section-title"><h3>'. $section_icon . $section_title .'</h3></div>' : ''; | |
| 128 | + echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. $section['description'] .'</div>' : ''; | |
| 129 | 129 | |
| 130 | 130 | if ( ! empty( $section['fields'] ) ) { |
| 131 | 131 | foreach ( $section['fields'] as $field ) { |
| 132 | 132 | |
| @@ -163,16 +163,11 @@ | ||
| 163 | 163 | if ( ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) || ! wp_verify_nonce( $nonce, 'adminify_taxonomy_nonce' ) ) { |
| 164 | 164 | return $term_id; |
| 165 | 165 | } |
| 166 | 166 | |
| 167 | - // Authorization: a valid nonce proves intent, not permission. | |
| 168 | - if ( ! current_user_can( 'edit_term', $term_id ) ) { | |
| 169 | - return $term_id; | |
| 170 | - } | |
| 171 | - | |
| 172 | 167 | // XSS ok. |
| 173 | 168 | // No worries, This "POST" requests is sanitizing in the below foreach. |
| 174 | - $request = ( ! empty( $_POST[ $this->unique ] ) ) ? wp_unslash( $_POST[ $this->unique ] ) : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- each field is sanitized individually by the framework's per-field sanitize handlers. | |
| 169 | + $request = ( ! empty( $_POST[ $this->unique ] ) ) ? $_POST[ $this->unique ] : array(); | |
| 175 | 170 | |
| 176 | 171 | if ( ! empty( $request ) ) { |
| 177 | 172 | |
| 178 | 173 | foreach ( $this->sections as $section ) { |
| @@ -200,14 +195,9 @@ | ||
| 200 | 195 | $data[$field_id] = call_user_func( $field['sanitize'], $field_value ); |
| 201 | 196 | |
| 202 | 197 | } else { |
| 203 | 198 | |
| 204 | - // A sanitize callback was declared but is not callable; never store raw input. | |
| 205 | - if ( is_array( $field_value ) ) { | |
| 206 | - $data[$field_id] = wp_kses_post_deep( $field_value ); | |
| 207 | - } else { | |
| 208 | - $data[$field_id] = wp_kses_post( $field_value ); | |
| 209 | - } | |
| 199 | + $data[$field_id] = $field_value; | |
| 210 | 200 | |
| 211 | 201 | } |
| 212 | 202 | |
| 213 | 203 | // Validate "post" request of field. |