| @@ -41,218 +41,15 @@ | ||
| 41 | 41 | $this->plugins_list = $this->plugins_list(); |
| 42 | 42 | |
| 43 | 43 | $this->includes(); |
| 44 | 44 | |
| 45 | - // Show Addons menu only on network admin for multisite, or on regular admin for single site | |
| 46 | - if ( is_multisite() ) { | |
| 47 | - add_action('network_admin_menu', array($this, 'admin_menu'), 1000); | |
| 48 | - } else { | |
| 49 | - add_action('admin_menu', array($this, 'admin_menu'), 1000); | |
| 50 | - } | |
| 45 | + add_action('admin_menu', array($this, 'admin_menu'), $this->menu_order, 1000); | |
| 46 | + // add_action('network_admin_menu', array($this, 'admin_menu'), $this->menu_order); | |
| 51 | 47 | add_action('wp_ajax_jltwp_adminify_addons_upgrade_plugin', array($this, 'jltwp_adminify_addons_upgrade_plugin')); |
| 52 | 48 | add_action('wp_ajax_jltwp_adminify_addons_activate_plugin', array($this, 'jltwp_adminify_addons_activate_plugin')); |
| 53 | - // Notify the site admin when a renamed legacy addon is detected | |
| 54 | - // alongside its replacement. Per WordPress.org plugin guidelines, | |
| 55 | - // we must not deactivate or activate plugins automatically; the | |
| 56 | - // user has to perform the swap themselves from the Plugins screen. | |
| 57 | - add_action('admin_notices', array($this, 'maybe_renamed_addon_notice')); | |
| 58 | - add_action( 'rest_api_init', array( $this , 'jltwp_adminify_addons_rest_routes') ); | |
| 59 | 49 | } |
| 60 | 50 | |
| 61 | - public function jltwp_adminify_addons_rest_routes() { | |
| 62 | - register_rest_route('adminify/v1', '/get-addons-list', array( | |
| 63 | - 'methods' => 'GET', | |
| 64 | - 'callback' => [$this, 'jltwp_adminify_get_addons_plugins_list'], | |
| 65 | - 'permission_callback' => [$this, 'adminify_is_admin_user'], | |
| 66 | - )); | |
| 67 | - | |
| 68 | - register_rest_route('adminify/v1', '/install-addons', array( | |
| 69 | - 'methods' => 'POST', | |
| 70 | - 'callback' => [$this, 'jltwp_adminify_install_addons'], | |
| 71 | - 'permission_callback' => [$this, 'adminify_verify_nonce_and_permissions'], | |
| 72 | - )); | |
| 73 | - } | |
| 74 | - | |
| 75 | - public function adminify_is_admin_user() { | |
| 76 | - if ( is_multisite() && ! is_super_admin() ) { | |
| 77 | - return new \WP_Error('rest_forbidden', __('You are not allowed to access this resource.', 'adminify'), array('status' => 403)); | |
| 78 | - } | |
| 79 | - if ( ! current_user_can('manage_options') ) { | |
| 80 | - return new \WP_Error('rest_forbidden', __('You are not allowed to access this resource.', 'adminify'), array('status' => 403)); | |
| 81 | - } | |
| 82 | - return true; | |
| 83 | - } | |
| 84 | - | |
| 85 | - public function adminify_verify_nonce_and_permissions() { | |
| 86 | - // The install-addons endpoint may both install AND activate | |
| 87 | - // addons depending on each addon's current status, so the | |
| 88 | - // caller must hold BOTH capabilities. On multisite this also | |
| 89 | - // requires super admin. | |
| 90 | - if ( is_multisite() && ! is_super_admin() ) { | |
| 91 | - return new \WP_Error('rest_forbidden', __('Super admin required.', 'adminify'), array('status' => 403)); | |
| 92 | - } | |
| 93 | - if ( ! current_user_can('install_plugins') ) { | |
| 94 | - return new \WP_Error('rest_forbidden', __('You are not allowed to install plugins.', 'adminify'), array('status' => 403)); | |
| 95 | - } | |
| 96 | - if ( ! current_user_can('activate_plugins') ) { | |
| 97 | - return new \WP_Error('rest_forbidden', __('You are not allowed to activate plugins.', 'adminify'), array('status' => 403)); | |
| 98 | - } | |
| 99 | - | |
| 100 | - // Nonce check from header. Sanitize and unslash before verifying. | |
| 101 | - $nonce = isset($_SERVER['HTTP_X_WP_NONCE']) | |
| 102 | - ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_WP_NONCE'] ) ) | |
| 103 | - : ''; | |
| 104 | - if ( ! wp_verify_nonce( $nonce, 'wp_rest' ) ) { | |
| 105 | - return new \WP_Error('rest_cookie_invalid_nonce', __('Invalid nonce.', 'adminify'), array('status' => 403)); | |
| 106 | - } | |
| 107 | - | |
| 108 | - return true; | |
| 109 | - } | |
| 110 | - | |
| 111 | - | |
| 112 | - public function jltwp_adminify_get_addons_plugins_list() { | |
| 113 | - $plugins = $this->plugins_list; | |
| 114 | - unset($plugins['master-addons']); | |
| 115 | - $all_plugins = get_plugins(); | |
| 116 | - $active_plugins = get_option('active_plugins'); | |
| 117 | - foreach( $plugins as $slug => $plugin){ | |
| 118 | - foreach ($all_plugins as $plugin_file => $plugin_data) { | |
| 119 | - if (strpos($plugin_file, $slug) !== false) { | |
| 120 | - $plugins[$slug]["status"] = 'installed'; | |
| 121 | - | |
| 122 | - if (in_array($plugin_file, $active_plugins)) { | |
| 123 | - $plugins[$slug]["status"] = 'activated'; | |
| 124 | - } | |
| 125 | - break; | |
| 126 | - } | |
| 127 | - } | |
| 128 | - if( !isset($plugins[$slug]["status"])) $plugins[$slug]["status"] = 'not-installed'; | |
| 129 | - | |
| 130 | - } | |
| 131 | - | |
| 132 | - return rest_ensure_response($plugins); | |
| 133 | - | |
| 134 | - } | |
| 135 | - | |
| 136 | - | |
| 137 | - public function jltwp_adminify_install_addons( $request ) { | |
| 138 | - $addons = $request->get_param('addons'); | |
| 139 | - if ( empty($addons) || ! is_array($addons) ) { | |
| 140 | - return new \WP_Error('no_addons', __('No addons were selected.', 'adminify'), array('status' => 400)); | |
| 141 | - } | |
| 142 | - | |
| 143 | - $plugins_list = $this->jltwp_adminify_get_addons_plugins_list()->data; | |
| 144 | - foreach( $addons as $key => $plugin ) { | |
| 145 | - $plugin = sanitize_key( $plugin ); | |
| 146 | - if ( ! isset( $plugins_list[ $plugin ] ) ) { | |
| 147 | - continue; | |
| 148 | - } | |
| 149 | - if ( $plugins_list[ $plugin ]['status'] === 'activated' ) { | |
| 150 | - continue; | |
| 151 | - } | |
| 152 | - if ( $plugins_list[ $plugin ]['status'] === 'installed' ) { | |
| 153 | - $this->jltwp_adminify_activate_plugin_by_slug( $plugin ); | |
| 154 | - continue; | |
| 155 | - } | |
| 156 | - $params = [ | |
| 157 | - 'request_type' => 'rest', | |
| 158 | - 'plugin' => $plugins_list[ $plugin ]['download_link'], | |
| 159 | - ]; | |
| 160 | - | |
| 161 | - $this->jltwp_adminify_addons_upgrade_plugin( $params ); | |
| 162 | - } | |
| 163 | - | |
| 164 | - return rest_ensure_response(['message' => __('Addons processed.', 'adminify'), 'addons' => $addons]); | |
| 165 | - } | |
| 166 | - | |
| 167 | - function jltwp_adminify_activate_plugin_by_slug($slug) { | |
| 168 | - // Activation requires the activate_plugins capability in | |
| 169 | - // addition to whatever capability gated the calling endpoint. | |
| 170 | - // On multisite, activation must be performed by a super admin. | |
| 171 | - if ( is_multisite() && ! is_super_admin() ) { | |
| 172 | - return new \WP_Error( 'rest_forbidden', __( 'Super admin required to activate plugins.', 'adminify' ), array( 'status' => 403 ) ); | |
| 173 | - } | |
| 174 | - if ( ! current_user_can( 'activate_plugins' ) ) { | |
| 175 | - return new \WP_Error( 'rest_forbidden', __( 'You are not allowed to activate plugins.', 'adminify' ), array( 'status' => 403 ) ); | |
| 176 | - } | |
| 177 | - | |
| 178 | - // Reject any slug containing path separators / traversal so | |
| 179 | - // $slug cannot escape WP_PLUGIN_DIR. | |
| 180 | - if ( ! is_string( $slug ) || $slug === '' || strpbrk( $slug, "/\\" ) !== false || strpos( $slug, '..' ) !== false ) { | |
| 181 | - return new \WP_Error( 'invalid_slug', __( 'Invalid plugin slug.', 'adminify' ), array( 'status' => 400 ) ); | |
| 182 | - } | |
| 183 | - | |
| 184 | - // Slug must be present in the trusted addons list. | |
| 185 | - if ( ! array_key_exists( $slug, (array) $this->plugins_list ) ) { | |
| 186 | - return new \WP_Error( 'invalid_slug', __( 'Invalid plugin slug.', 'adminify' ), array( 'status' => 400 ) ); | |
| 187 | - } | |
| 188 | - | |
| 189 | - $plugin_path = WP_PLUGIN_DIR . '/' . $slug; | |
| 190 | - | |
| 191 | - if ( ! is_dir( $plugin_path ) ) { | |
| 192 | - return; | |
| 193 | - } | |
| 194 | - | |
| 195 | - $installed_plugins = get_plugins( '/' . $slug ); | |
| 196 | - if ( empty( $installed_plugins ) ) { | |
| 197 | - return; | |
| 198 | - } | |
| 199 | - | |
| 200 | - $plugin_relative_path = $slug . '/' . key( $installed_plugins ); | |
| 201 | - | |
| 202 | - if ( is_plugin_active( $plugin_relative_path ) ) { | |
| 203 | - return; | |
| 204 | - } | |
| 205 | - | |
| 206 | - activate_plugin( $plugin_relative_path ); | |
| 207 | - } | |
| 208 | - | |
| 209 | 51 | /** |
| 210 | - * Map of legacy addon slugs that have been renamed to a new slug. | |
| 211 | - * | |
| 212 | - * @return array<string,string> | |
| 213 | - */ | |
| 214 | - protected function renamed_addons_map() { | |
| 215 | - return [ | |
| 216 | - 'sidebar-generator/adminify-sidebar-generator.php' => 'adminify-sidebar-generator/adminify-sidebar-generator.php', | |
| 217 | - ]; | |
| 218 | - } | |
| 219 | - | |
| 220 | - /** | |
| 221 | - * Show a non-blocking admin notice if a legacy (renamed) addon is | |
| 222 | - * still installed. We never deactivate or activate plugins on the | |
| 223 | - * user's behalf; the notice points them to the Plugins screen so | |
| 224 | - * they can perform the swap themselves. | |
| 225 | - */ | |
| 226 | - public function maybe_renamed_addon_notice() { | |
| 227 | - if ( ! current_user_can('activate_plugins') ) { | |
| 228 | - return; | |
| 229 | - } | |
| 230 | - | |
| 231 | - $messages = []; | |
| 232 | - | |
| 233 | - foreach ($this->renamed_addons_map() as $old_plugin => $new_plugin) { | |
| 234 | - $old_exists = file_exists(WP_PLUGIN_DIR . '/' . $old_plugin); | |
| 235 | - if ( ! $old_exists ) { | |
| 236 | - continue; | |
| 237 | - } | |
| 238 | - | |
| 239 | - $messages[] = sprintf( | |
| 240 | - /* translators: 1: old plugin slug, 2: new plugin slug */ | |
| 241 | - esc_html__('"%1$s" has been renamed to "%2$s". Please deactivate and remove the old version, then install the new one from the Adminify Addons screen.', 'adminify'), | |
| 242 | - esc_html(dirname($old_plugin)), | |
| 243 | - esc_html(dirname($new_plugin)) | |
| 244 | - ); | |
| 245 | - } | |
| 246 | - | |
| 247 | - if ( empty($messages) ) { | |
| 248 | - return; | |
| 249 | - } | |
| 250 | - | |
| 251 | - echo '<div class="notice notice-warning"><p><strong>' . esc_html__('Adminify', 'adminify') . ':</strong> ' . esc_html(implode('<br>', $messages)) . '</p></div>'; | |
| 252 | - } | |
| 253 | - | |
| 254 | - /** | |
| 255 | 52 | * Includes |
| 256 | 53 | * |
| 257 | 54 | * @author Jewel Theme <support@jeweltheme.com> |
| 258 | 55 | */ |
| @@ -257,18 +54,17 @@ | ||
| 257 | 54 | * @author Jewel Theme <support@jeweltheme.com> |
| 258 | 55 | */ |
| 259 | 56 | public function includes() |
| 260 | 57 | { |
| 261 | - // wp-load.php must never be required from within a plugin: the | |
| 262 | - // plugin already runs inside WordPress. The wp-admin includes | |
| 263 | - // below are required for plugin install/upgrade APIs used by | |
| 264 | - // this class and are loaded with require_once immediately | |
| 265 | - // before the functions from each file are called. | |
| 266 | - require_once ABSPATH . 'wp-admin/includes/plugin-install.php'; | |
| 267 | - require_once ABSPATH . 'wp-admin/includes/file.php'; | |
| 268 | - require_once ABSPATH . 'wp-admin/includes/misc.php'; | |
| 269 | - require_once ABSPATH . 'wp-admin/includes/plugin.php'; | |
| 270 | - require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php'; | |
| 58 | + // if (!function_exists('install_plugin_install_status')) { | |
| 59 | + // require_once ABSPATH . 'wp-admin/includes/plugin-install.php'; | |
| 60 | + require_once(ABSPATH . '/wp-load.php'); | |
| 61 | + require_once(ABSPATH . 'wp-admin/includes/plugin-install.php'); | |
| 62 | + require_once(ABSPATH . 'wp-admin/includes/file.php'); | |
| 63 | + require_once(ABSPATH . 'wp-admin/includes/misc.php'); | |
| 64 | + require_once(ABSPATH . 'wp-admin/includes/plugin.php'); | |
| 65 | + require_once(ABSPATH . 'wp-admin/includes/class-wp-upgrader.php'); | |
| 66 | + // } | |
| 271 | 67 | } |
| 272 | 68 | |
| 273 | 69 | /** |
| 274 | 70 | * Menu Items |
| @@ -327,13 +123,12 @@ | ||
| 327 | 123 | if ( $this->is_eligible_for_coupon() ) { |
| 328 | 124 | // Get the coupon |
| 329 | 125 | $coupon = $this->maybe_create_and_get_coupon(); |
| 330 | 126 | if (!empty($coupon) && !empty($coupon['code'])) { |
| 331 | - echo '<h3>' . sprintf( | |
| 332 | - /* translators: %s: Coupon code */ | |
| 333 | - esc_html__('Coupon Code: <strong style="color: red">%s</strong> Redeem this coupon code to get free access to all our premium addons (Except Admin Bar Editor, RoleMaster Suite and Master Addons). Learn how to <a href="https://wpadminify.com/redeem-addons-using-coupon-code/" target="_blank">redeem coupon code?</a>', 'adminify'), | |
| 127 | + echo sprintf( | |
| 128 | + __('<h3>Coupon Code: <strong style="color: red">%s</strong> Redeem this coupon code to get free access to all our premium addons (Except Admin Bar Editor, RoleMaster Suite and Master Addons). Learn how to <a href="https://wpadminify.com/redeem-addons-using-coupon-code/" target="_blank">redeem coupon code?</a></h3> ', 'adminify'), | |
| 334 | 129 | esc_attr($coupon['code']) |
| 335 | - ) . '</h3> '; | |
| 130 | + ); | |
| 336 | 131 | } |
| 337 | 132 | } |
| 338 | 133 | |
| 339 | 134 | echo '<style> |
| @@ -350,17 +145,16 @@ | ||
| 350 | 145 | |
| 351 | 146 | $is_eligible = get_option('wp_adminify_addon__is_eligible_for_coupon', null); |
| 352 | 147 | |
| 353 | 148 | if ( $is_eligible !== null ) return wp_validate_boolean($is_eligible); |
| 149 | + | |
| 354 | 150 | $args = [ |
| 355 | - 'license' => base64_encode(json_encode(jltwp_adminify()->_get_license())), | |
| 151 | + 'license' => jltwp_adminify()->_get_license(), | |
| 356 | 152 | 'action' => 'check_eligibility' |
| 357 | 153 | ]; |
| 358 | 154 | |
| 359 | - $request_uri = add_query_arg($args, $this->server_url); | |
| 155 | + $response = wp_remote_get(add_query_arg($args, $this->server_url)); | |
| 360 | 156 | |
| 361 | - $response = wp_remote_get($request_uri); | |
| 362 | - | |
| 363 | 157 | if (!is_wp_error($response) && $response['response']['code'] === 200) { |
| 364 | 158 | $file_contents = wp_remote_retrieve_body($response); |
| 365 | 159 | $is_eligible = json_decode($file_contents, true); |
| 366 | 160 | update_option('wp_adminify_addon__is_eligible_for_coupon', wp_validate_boolean($is_eligible)); |
| @@ -369,19 +163,11 @@ | ||
| 369 | 163 | |
| 370 | 164 | return false; |
| 371 | 165 | } |
| 372 | 166 | |
| 373 | - public function maybe_delete_corrupted_coupon(){ | |
| 374 | - $coupon_delete_check = get_option('wp_adminify_addon__coupon_is_deleted', false); | |
| 375 | - if($coupon_delete_check != true){ | |
| 376 | - delete_option('wp_adminify_addon__coupon'); | |
| 377 | - update_option('wp_adminify_addon__coupon_is_deleted', true); | |
| 378 | - } | |
| 379 | - } | |
| 380 | - | |
| 381 | 167 | public function maybe_create_and_get_coupon() |
| 382 | 168 | { |
| 383 | - $this->maybe_delete_corrupted_coupon(); | |
| 169 | + | |
| 384 | 170 | $coupon = get_option('wp_adminify_addon__coupon'); |
| 385 | 171 | |
| 386 | 172 | if (!empty($coupon)) return $coupon; |
| 387 | 173 | |
| @@ -386,9 +172,9 @@ | ||
| 386 | 172 | if (!empty($coupon)) return $coupon; |
| 387 | 173 | |
| 388 | 174 | // communicate hit hserver get coupon |
| 389 | 175 | $args = [ |
| 390 | - 'license' => base64_encode(json_encode(jltwp_adminify()->_get_license())), | |
| 176 | + 'license' => jltwp_adminify()->_get_license(), | |
| 391 | 177 | 'action' => 'get_coupon' |
| 392 | 178 | ]; |
| 393 | 179 | |
| 394 | 180 | $response = wp_remote_get(add_query_arg($args, $this->server_url)); |
| @@ -397,11 +183,11 @@ | ||
| 397 | 183 | |
| 398 | 184 | $file_contents = wp_remote_retrieve_body($response); |
| 399 | 185 | $response_data = json_decode($file_contents, true); |
| 400 | 186 | |
| 401 | - if (!empty($response_data) && is_array($response_data) && !empty($response_data['id']) && !empty($response_data['code']) ) { | |
| 187 | + if (!empty($response_data)) { | |
| 402 | 188 | $coupon = [ |
| 403 | - 'id' => $response_data['id'], | |
| 189 | + 'id' => $response_data['id'], | |
| 404 | 190 | 'code' => $response_data['code'] |
| 405 | 191 | ]; |
| 406 | 192 | update_option('wp_adminify_addon__coupon', $coupon); |
| 407 | 193 | } |
| @@ -419,9 +205,9 @@ | ||
| 419 | 205 | ?> |
| 420 | 206 | <div class='wp-adminify-addons-header'> |
| 421 | 207 | <div class='wp-adminify-addons-title'> |
| 422 | 208 | <h2> |
| 423 | - <?php echo esc_html__('Add Ons for Adminify', 'adminify'); ?> | |
| 209 | + <?php echo esc_html__('Add Ons for WP Adminify', 'adminify'); ?> | |
| 424 | 210 | </h2> |
| 425 | 211 | <?php $this->jltwp_adminify_addons_check(); ?> |
| 426 | 212 | </div> |
| 427 | 213 | <div class='wp-adminify-addons-menu'> |
| @@ -592,9 +378,9 @@ | ||
| 592 | 378 | <?php |
| 593 | 379 | } elseif (current_user_can('activate_plugin', $install_status['file'])) { |
| 594 | 380 | ?> |
| 595 | 381 | <button class="button activate-now" data-plugin-file="<?php echo esc_attr($install_status['file']); ?>"> |
| 596 | - <?php echo esc_html__('Activate Now', 'adminify'); ?> | |
| 382 | + <?php echo esc_html__('Activate', 'adminify'); ?> | |
| 597 | 383 | </button> |
| 598 | 384 | <?php |
| 599 | 385 | } else { |
| 600 | 386 | ?> |
| @@ -631,12 +417,11 @@ | ||
| 631 | 417 | if (!wp_verify_nonce($nonce, 'jltwp_adminify_addons_nonce')) { |
| 632 | 418 | wp_send_json_error(array('mess' => __('Nonce is invalid', 'adminify'))); |
| 633 | 419 | } |
| 634 | 420 | |
| 635 | - // Security check - only administrators can activate plugins | |
| 636 | - if (!current_user_can('activate_plugins')) { | |
| 637 | - wp_send_json_error(array('mess' => __('You do not have permission to perform this action.', 'adminify'))); | |
| 638 | - } | |
| 421 | + // if ((is_multisite() && !is_network_admin()) || !current_user_can('install_plugins')) { | |
| 422 | + // wp_send_json_error(array('mess' => __('Invalid access', 'adminify'))); | |
| 423 | + // } | |
| 639 | 424 | |
| 640 | 425 | $plugin = sanitize_text_field(wp_unslash($_POST['plugin'])); |
| 641 | 426 | $plugin_links = array_values(wp_list_pluck($this->plugins_list, 'slug')); |
| 642 | 427 | |
| @@ -702,11 +487,11 @@ | ||
| 702 | 487 | * Upgrade Plugins required Libraries |
| 703 | 488 | * |
| 704 | 489 | * @author Jewel Theme <support@jeweltheme.com> |
| 705 | 490 | */ |
| 706 | - public function jltwp_adminify_addons_upgrade_plugin( $params = null ) | |
| 491 | + public function jltwp_adminify_addons_upgrade_plugin() | |
| 707 | 492 | { |
| 708 | - if ($params == null && empty($_POST['plugin'])) { | |
| 493 | + if (empty($_POST['plugin'])) { | |
| 709 | 494 | return; |
| 710 | 495 | } |
| 711 | 496 | |
| 712 | 497 | try { |
| @@ -714,73 +499,48 @@ | ||
| 714 | 499 | require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php'; |
| 715 | 500 | require_once ABSPATH . 'wp-admin/includes/class-wp-ajax-upgrader-skin.php'; |
| 716 | 501 | require_once ABSPATH . 'wp-admin/includes/class-plugin-upgrader.php'; |
| 717 | 502 | |
| 718 | - if($params == null){ | |
| 719 | - $nonce = isset($_POST['nonce']) ? sanitize_text_field(wp_unslash($_POST['nonce'])) : ''; | |
| 503 | + $nonce = isset($_POST['nonce']) ? sanitize_text_field(wp_unslash($_POST['nonce'])) : ''; | |
| 720 | 504 | |
| 721 | - if (!wp_verify_nonce($nonce, 'jltwp_adminify_addons_nonce')) { | |
| 722 | - wp_send_json_error(array('mess' => __('Nonce is invalid', 'adminify'))); | |
| 723 | - } | |
| 724 | - $plugin = sanitize_text_field(wp_unslash($_POST['plugin'])); | |
| 725 | - }else{ | |
| 726 | - $plugin = $params['plugin']; | |
| 505 | + if (!wp_verify_nonce($nonce, 'jltwp_adminify_addons_nonce')) { | |
| 506 | + wp_send_json_error(array('mess' => __('Nonce is invalid', 'adminify'))); | |
| 727 | 507 | } |
| 728 | 508 | |
| 729 | - // Security check - only administrators can install plugins | |
| 730 | - if (!current_user_can('install_plugins')) { | |
| 731 | - wp_send_json_error(array('mess' => __('You do not have permission to perform this action.', 'adminify'))); | |
| 732 | - } | |
| 509 | + // if ((is_multisite() && !is_network_admin()) || !current_user_can('install_plugins')) { | |
| 510 | + // wp_send_json_error(array('mess' => __('Invalid access', 'adminify'))); | |
| 511 | + // } | |
| 733 | 512 | |
| 513 | + $plugin = sanitize_text_field(wp_unslash($_POST['plugin'])); | |
| 514 | + | |
| 734 | 515 | $plugin_slug = $this->get_the_plugin_slug( $plugin ); |
| 735 | 516 | |
| 736 | - if ( ! array_key_exists( $plugin_slug, $this->plugins_list ) ) { | |
| 517 | + if ( ! array_key_exists( $plugin_slug, $this->plugins_list) ) { | |
| 737 | 518 | wp_send_json_error(array('mess' => __('Invalid plugin', 'adminify'))); |
| 738 | 519 | } |
| 739 | 520 | |
| 740 | - // Replace the user-supplied $plugin value with values derived | |
| 741 | - // from our trusted internal addons list, so that arbitrary | |
| 742 | - // input never reaches Plugin_Upgrader::install()/upgrade() or | |
| 743 | - // activate_plugin(). | |
| 744 | - $trusted_install_source = isset($this->plugins_list[$plugin_slug]['download_link']) | |
| 745 | - ? $this->plugins_list[$plugin_slug]['download_link'] | |
| 746 | - : ''; | |
| 747 | - | |
| 748 | - if($params == null){ | |
| 749 | - $type = isset($_POST['type']) ? sanitize_text_field(wp_unslash($_POST['type'])) : 'install'; | |
| 750 | - }else{ | |
| 751 | - $type = 'install'; | |
| 752 | - } | |
| 521 | + $type = isset($_POST['type']) ? sanitize_text_field(wp_unslash($_POST['type'])) : 'install'; | |
| 753 | 522 | $skin = new \WP_Ajax_Upgrader_Skin(); |
| 754 | 523 | $upgrader = new \Plugin_Upgrader($skin); |
| 755 | 524 | |
| 756 | 525 | if ('install' === $type) { |
| 757 | 526 | |
| 758 | - if ( empty( $trusted_install_source ) ) { | |
| 759 | - wp_send_json_error(array('mess' => __('Invalid plugin', 'adminify'))); | |
| 527 | + $result = $upgrader->install($plugin); | |
| 528 | + | |
| 529 | + if (empty($result) || empty($upgrader->result)) { | |
| 530 | + wp_send_json_error( | |
| 531 | + array( | |
| 532 | + 'mess' => 'Something is wrong', | |
| 533 | + ) | |
| 534 | + ); | |
| 760 | 535 | } |
| 761 | 536 | |
| 762 | - $result = $upgrader->install( $trusted_install_source ); | |
| 763 | - if ($params == null){ | |
| 764 | - if (empty($result) || empty($upgrader->result)) { | |
| 765 | - wp_send_json_error( | |
| 766 | - array( | |
| 767 | - 'mess' => 'Something is wrong', | |
| 768 | - ) | |
| 769 | - ); | |
| 770 | - } | |
| 771 | - | |
| 772 | - if (is_wp_error($result)) { | |
| 773 | - wp_send_json_error( | |
| 774 | - array( | |
| 775 | - 'mess' => $result->get_error_message(), | |
| 776 | - ) | |
| 777 | - ); | |
| 778 | - } | |
| 779 | - }else{ | |
| 780 | - if(empty($result) || empty($upgrader->result)){ | |
| 781 | - return; | |
| 782 | - } | |
| 537 | + if (is_wp_error($result)) { | |
| 538 | + wp_send_json_error( | |
| 539 | + array( | |
| 540 | + 'mess' => $result->get_error_message(), | |
| 541 | + ) | |
| 542 | + ); | |
| 783 | 543 | } |
| 784 | 544 | |
| 785 | 545 | $plugins = get_plugins('/' . $upgrader->result['destination_name']); |
| 786 | 546 | $plugin_data = end($plugins); |
| @@ -791,91 +551,69 @@ | ||
| 791 | 551 | |
| 792 | 552 | $install_status = \install_plugin_install_status($plugin_data); |
| 793 | 553 | |
| 794 | 554 | $active_plugin = activate_plugin($install_status['file']); |
| 795 | - | |
| 796 | - if ($params == null){ | |
| 797 | - if (is_wp_error($active_plugin)) { | |
| 798 | - wp_send_json_error( | |
| 799 | - array( | |
| 800 | - 'mess' => $active_plugin->get_error_message(), | |
| 801 | - ) | |
| 802 | - ); | |
| 803 | - } else { | |
| 804 | - wp_send_json_success( | |
| 805 | - array( | |
| 806 | - 'mess' => __('Install success', 'adminify'), | |
| 807 | - ) | |
| 808 | - ); | |
| 809 | - } | |
| 810 | - } | |
| 811 | - } else { | |
| 812 | - if ($params == null){ | |
| 555 | + | |
| 556 | + if (is_wp_error($active_plugin)) { | |
| 813 | 557 | wp_send_json_error( |
| 814 | 558 | array( |
| 815 | - 'mess' => 'Error', | |
| 559 | + 'mess' => $active_plugin->get_error_message(), | |
| 816 | 560 | ) |
| 817 | 561 | ); |
| 562 | + } else { | |
| 563 | + wp_send_json_success( | |
| 564 | + array( | |
| 565 | + 'mess' => __('Install success', 'adminify'), | |
| 566 | + ) | |
| 567 | + ); | |
| 568 | + } | |
| 569 | + } else { | |
| 818 | 570 | |
| 819 | - } | |
| 571 | + wp_send_json_error( | |
| 572 | + array( | |
| 573 | + 'mess' => 'Error', | |
| 574 | + ) | |
| 575 | + ); | |
| 820 | 576 | } |
| 821 | 577 | } else { |
| 822 | 578 | |
| 823 | - // Resolve the trusted plugin file path from the validated | |
| 824 | - // slug instead of trusting the raw $_POST value, so that | |
| 825 | - // is_plugin_active(), Plugin_Upgrader::upgrade() and | |
| 826 | - // activate_plugin() never receive attacker-supplied paths. | |
| 827 | - $installed_plugins = get_plugins( '/' . $plugin_slug ); | |
| 828 | - if ( empty( $installed_plugins ) ) { | |
| 829 | - wp_send_json_error(array('mess' => __('Plugin not installed.', 'adminify'))); | |
| 830 | - } | |
| 831 | - $trusted_plugin_file = $plugin_slug . '/' . key( $installed_plugins ); | |
| 579 | + $is_active = is_plugin_active($plugin); | |
| 580 | + $result = $upgrader->upgrade($plugin); | |
| 832 | 581 | |
| 833 | - $is_active = is_plugin_active( $trusted_plugin_file ); | |
| 834 | - $result = $upgrader->upgrade( $trusted_plugin_file ); | |
| 835 | - | |
| 836 | - if ($params == null){ | |
| 837 | - if ( empty($result) || is_wp_error($result) ) { | |
| 838 | - wp_send_json_error( | |
| 839 | - array( | |
| 840 | - 'mess' => is_wp_error($result) ? $result->get_error_message() : __('Couldn\'t upgrade', 'adminify') | |
| 841 | - ) | |
| 842 | - ); | |
| 843 | - } | |
| 582 | + if ( empty($result) || is_wp_error($result) ) { | |
| 583 | + wp_send_json_error( | |
| 584 | + array( | |
| 585 | + 'mess' => is_wp_error($result) ? $result->get_error_message() : __('Couldn\'t upgrade', 'adminify') | |
| 586 | + ) | |
| 587 | + ); | |
| 844 | 588 | } |
| 845 | 589 | |
| 846 | - $active_status = activate_plugin( $trusted_plugin_file ); | |
| 590 | + $active_status = activate_plugin($plugin); | |
| 847 | 591 | |
| 848 | - if ($params == null){ | |
| 849 | - if ( empty($active_status) || is_wp_error($active_status) ) { | |
| 850 | - wp_send_json_error( | |
| 851 | - array( | |
| 852 | - 'mess' => is_wp_error($result) ? $result->get_error_message() : __('Activation Failed', 'adminify') | |
| 853 | - ) | |
| 854 | - ); | |
| 855 | - } | |
| 856 | - | |
| 857 | - wp_send_json_success( | |
| 592 | + if ( empty($active_status) || is_wp_error($active_status) ) { | |
| 593 | + wp_send_json_error( | |
| 858 | 594 | array( |
| 859 | - 'mess' => __('Update success', 'adminify'), | |
| 860 | - 'active' => true, | |
| 595 | + 'mess' => is_wp_error($result) ? $result->get_error_message() : __('Activation Failed', 'adminify') | |
| 861 | 596 | ) |
| 862 | 597 | ); |
| 863 | 598 | } |
| 864 | - } | |
| 865 | - | |
| 866 | - } catch (\Exception $ex) { | |
| 867 | - if ($params == null){ | |
| 868 | - wp_send_json_error( | |
| 599 | + | |
| 600 | + wp_send_json_success( | |
| 869 | 601 | array( |
| 870 | - 'mess' => __('Error exception.', 'adminify'), | |
| 871 | - array( | |
| 872 | - 'error' => $ex, | |
| 873 | - ), | |
| 602 | + 'mess' => __('Update success', 'adminify'), | |
| 603 | + 'active' => true, | |
| 874 | 604 | ) |
| 875 | 605 | ); |
| 876 | 606 | } |
| 607 | + } catch (\Exception $ex) { | |
| 608 | + wp_send_json_error( | |
| 609 | + array( | |
| 610 | + 'mess' => __('Error exception.', 'adminify'), | |
| 611 | + array( | |
| 612 | + 'error' => $ex, | |
| 613 | + ), | |
| 614 | + ) | |
| 615 | + ); | |
| 877 | 616 | } |
| 878 | 617 | } |
| 879 | - | |
| 880 | 618 | } |
| 881 | 619 | } |
