← All changes
|
Libs/adminify-framework/classes/admin-options.class.php
+16
-22
4.2.26
→
4.0
View file →
| @@ -203,21 +203,20 @@ | ||
| 203 | 203 | |
| 204 | 204 | // set options |
| 205 | 205 | public function set_options( $ajax = false ) { |
| 206 | 206 | |
| 207 | - // The payload is only read here; the nonce + capability are verified below (see the wp_verify_nonce | |
| 208 | - // guard) before any value is used, and every field is sanitized individually inside that block. | |
| 209 | - // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- nonce/capability verified below; each field sanitized per-field afterwards. | |
| 210 | - $response = ( $ajax && ! empty( $_POST['data'] ) ) ? json_decode( trim( wp_unslash( $_POST['data'] ) ), true ) : $_POST; | |
| 207 | + // XSS ok. | |
| 208 | + // No worries, This "POST" requests is sanitizing in the below foreach. see #L337 - #L341 | |
| 209 | + $response = ( $ajax && ! empty( $_POST['data'] ) ) ? json_decode( wp_unslash( trim( $_POST['data'] ) ), true ) : $_POST; | |
| 211 | 210 | |
| 212 | 211 | // Set variables. |
| 213 | 212 | $data = array(); |
| 214 | 213 | $noncekey = 'adminify_options_nonce'. $this->unique; |
| 215 | - $nonce = ( ! empty( $response[$noncekey] ) ) ? sanitize_text_field( wp_unslash( $response[$noncekey] ) ) : ''; | |
| 214 | + $nonce = ( ! empty( $response[$noncekey] ) ) ? $response[$noncekey] : ''; | |
| 216 | 215 | $options = ( ! empty( $response[$this->unique] ) ) ? $response[$this->unique] : array(); |
| 217 | 216 | $transient = ( ! empty( $response['adminify_transient'] ) ) ? $response['adminify_transient'] : array(); |
| 218 | 217 | |
| 219 | - if ( wp_verify_nonce( $nonce, 'adminify_options_nonce' ) && current_user_can( $this->args['menu_capability'] ) ) { | |
| 218 | + if ( wp_verify_nonce( $nonce, 'adminify_options_nonce' ) ) { | |
| 220 | 219 | |
| 221 | 220 | $importing = false; |
| 222 | 221 | $section_id = ( ! empty( $transient['section'] ) ) ? $transient['section'] : ''; |
| 223 | 222 | |
| @@ -243,11 +242,11 @@ | ||
| 243 | 242 | $this->notice = esc_html__( 'Default settings restored.', 'adminify' ); |
| 244 | 243 | |
| 245 | 244 | } else if ( ! empty( $transient['reset_section'] ) && ! empty( $section_id ) ) { |
| 246 | 245 | |
| 247 | - if ( ! empty( $this->pre_sections[$section_id-2]['fields'] ) ) { | |
| 246 | + if ( ! empty( $this->pre_sections[$section_id-1]['fields'] ) ) { | |
| 248 | 247 | |
| 249 | - foreach ( $this->pre_sections[$section_id-2]['fields'] as $field ) { | |
| 248 | + foreach ( $this->pre_sections[$section_id-1]['fields'] as $field ) { | |
| 250 | 249 | if ( ! empty( $field['id'] ) ) { |
| 251 | 250 | $data[$field['id']] = $this->get_default( $field ); |
| 252 | 251 | } |
| 253 | 252 | } |
| @@ -291,14 +290,9 @@ | ||
| 291 | 290 | $data[$field_id] = call_user_func( $field['sanitize'], $field_value ); |
| 292 | 291 | |
| 293 | 292 | } else { |
| 294 | 293 | |
| 295 | - // A sanitize callback was declared but is not callable; never store raw input. | |
| 296 | - if ( is_array( $field_value ) ) { | |
| 297 | - $data[$field_id] = wp_kses_post_deep( $field_value ); | |
| 298 | - } else { | |
| 299 | - $data[$field_id] = wp_kses_post( $field_value ); | |
| 300 | - } | |
| 294 | + $data[$field_id] = $field_value; | |
| 301 | 295 | |
| 302 | 296 | } |
| 303 | 297 | |
| 304 | 298 | // Validate "post" request of field. |
| @@ -506,9 +500,9 @@ | ||
| 506 | 500 | echo '<div class="adminify-header'. esc_attr( $sticky_class ) .'">'; |
| 507 | 501 | echo '<div class="adminify-header-inner">'; |
| 508 | 502 | |
| 509 | 503 | echo '<div class="adminify-header-left">'; |
| 510 | - echo '<h1>'. wp_kses_post( $this->args['framework_title'] ) .'</h1>'; | |
| 504 | + echo '<h1>'. $this->args['framework_title'] .'</h1>'; | |
| 511 | 505 | echo '</div>'; |
| 512 | 506 | |
| 513 | 507 | echo '<div class="adminify-header-right">'; |
| 514 | 508 | |
| @@ -514,9 +508,9 @@ | ||
| 514 | 508 | |
| 515 | 509 | $notice_class = ( ! empty( $this->notice ) ) ? 'adminify-form-show' : ''; |
| 516 | 510 | $notice_text = ( ! empty( $this->notice ) ) ? $this->notice : ''; |
| 517 | 511 | |
| 518 | - echo '<div class="adminify-form-result adminify-form-success '. esc_attr( $notice_class ) .'">'. wp_kses_post( $notice_text ) .'</div>'; | |
| 512 | + echo '<div class="adminify-form-result adminify-form-success '. esc_attr( $notice_class ) .'">'. $notice_text .'</div>'; | |
| 519 | 513 | |
| 520 | 514 | echo ( $this->args['show_form_warning'] ) ? '<div class="adminify-form-result adminify-form-warning">'. esc_html__( 'You have unsaved changes, save your changes!', 'adminify' ) .'</div>' : ''; |
| 521 | 515 | |
| 522 | 516 | echo ( $has_nav && $this->args['show_all_options'] ) ? '<div class="adminify-expand-all" title="'. esc_html__( 'show all settings', 'adminify' ) .'"><i class="fas fa-outdent"></i></div>' : ''; |
| @@ -552,9 +546,9 @@ | ||
| 552 | 546 | if ( ! empty( $tab['subs'] ) ) { |
| 553 | 547 | |
| 554 | 548 | echo '<li class="adminify-tab-item">'; |
| 555 | 549 | |
| 556 | - echo '<a href="#tab='. esc_attr( $tab_id ) .'" data-tab-id="'. esc_attr( $tab_id ) .'" class="adminify-arrow">'. wp_kses_post( $tab_icon ) . esc_html( $tab['title'] ) . wp_kses_post( $tab_error ) .'</a>'; | |
| 550 | + echo '<a href="#tab='. esc_attr( $tab_id ) .'" data-tab-id="'. esc_attr( $tab_id ) .'" class="adminify-arrow">'. $tab_icon . $tab['title'] . $tab_error .'</a>'; | |
| 557 | 551 | |
| 558 | 552 | echo '<ul>'; |
| 559 | 553 | |
| 560 | 554 | foreach ( $tab['subs'] as $sub ) { |
| @@ -562,9 +556,9 @@ | ||
| 562 | 556 | $sub_id = $tab_id .'/'. sanitize_title( $sub['title'] ); |
| 563 | 557 | $sub_error = $this->error_check( $sub ); |
| 564 | 558 | $sub_icon = ( ! empty( $sub['icon'] ) ) ? '<i class="adminify-tab-icon '. esc_attr( $sub['icon'] ) .'"></i>' : ''; |
| 565 | 559 | |
| 566 | - echo '<li><a href="#tab='. esc_attr( $sub_id ) .'" data-tab-id="'. esc_attr( $sub_id ) .'">'. wp_kses_post( $sub_icon ) . esc_html( $sub['title'] ) . wp_kses_post( $sub_error ) .'</a></li>'; | |
| 560 | + echo '<li><a href="#tab='. esc_attr( $sub_id ) .'" data-tab-id="'. esc_attr( $sub_id ) .'">'. $sub_icon . $sub['title'] . $sub_error .'</a></li>'; | |
| 567 | 561 | |
| 568 | 562 | } |
| 569 | 563 | |
| 570 | 564 | echo '</ul>'; |
| @@ -572,9 +566,9 @@ | ||
| 572 | 566 | echo '</li>'; |
| 573 | 567 | |
| 574 | 568 | } else { |
| 575 | 569 | |
| 576 | - echo '<li class="adminify-tab-item"><a href="#tab='. esc_attr( $tab_id ) .'" data-tab-id="'. esc_attr( $tab_id ) .'">'. wp_kses_post( $tab_icon ) . esc_html( $tab['title'] ) . wp_kses_post( $tab_error ) .'</a></li>'; | |
| 570 | + echo '<li class="adminify-tab-item"><a href="#tab='. esc_attr( $tab_id ) .'" data-tab-id="'. esc_attr( $tab_id ) .'">'. $tab_icon . $tab['title'] . $tab_error .'</a></li>'; | |
| 577 | 571 | |
| 578 | 572 | } |
| 579 | 573 | |
| 580 | 574 | } |
| @@ -601,9 +595,9 @@ | ||
| 601 | 595 | $section_slug = ( ! empty( $section['title'] ) ) ? sanitize_title( $section_title ) : ''; |
| 602 | 596 | |
| 603 | 597 | echo '<div class="adminify-section hidden'. esc_attr( $section_onload . $section_class ) .'" data-section-id="'. esc_attr( $section_parent . $section_slug ) .'">'; |
| 604 | 598 | |
| 605 | - echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. wp_kses_post( $section['description'] ) .'</div>' : ''; | |
| 599 | + echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. $section['description'] .'</div>' : ''; | |
| 606 | 600 | |
| 607 | 601 | if ( ! empty( $section['fields'] ) ) { |
| 608 | 602 | |
| 609 | 603 | foreach ( $section['fields'] as $field ) { |
| @@ -653,9 +647,9 @@ | ||
| 653 | 647 | echo ( $this->args['show_reset_section'] ) ? '<input type="submit" name="adminify_transient[reset_section]" class="button button-secondary adminify-reset-section adminify-confirm" value="'. esc_html__( 'Reset Section', 'adminify' ) .'" data-confirm="'. esc_html__( 'Are you sure to reset this section options?', 'adminify' ) .'">' : ''; |
| 654 | 648 | echo ( $this->args['show_reset_all'] ) ? '<input type="submit" name="adminify_transient[reset]" class="button adminify-warning-primary adminify-reset-all adminify-confirm" value="'. ( ( $this->args['show_reset_section'] ) ? esc_html__( 'Reset All', 'adminify' ) : esc_html__( 'Reset', 'adminify' ) ) .'" data-confirm="'. esc_html__( 'Are you sure you want to reset all settings to default values?', 'adminify' ) .'">' : ''; |
| 655 | 649 | echo '</div>'; |
| 656 | 650 | |
| 657 | - echo ( ! empty( $this->args['footer_text'] ) ) ? '<div class="adminify-copyright">'. wp_kses_post( $this->args['footer_text'] ) .'</div>' : ''; | |
| 651 | + echo ( ! empty( $this->args['footer_text'] ) ) ? '<div class="adminify-copyright">'. $this->args['footer_text'] .'</div>' : ''; | |
| 658 | 652 | |
| 659 | 653 | echo '<div class="clear"></div>'; |
| 660 | 654 | echo '</div>'; |
| 661 | 655 | |
| @@ -666,9 +660,9 @@ | ||
| 666 | 660 | echo '</div>'; |
| 667 | 661 | |
| 668 | 662 | echo '<div class="clear"></div>'; |
| 669 | 663 | |
| 670 | - echo ( ! empty( $this->args['footer_after'] ) ) ? wp_kses_post( $this->args['footer_after'] ) : ''; | |
| 664 | + echo ( ! empty( $this->args['footer_after'] ) ) ? $this->args['footer_after'] : ''; | |
| 671 | 665 | |
| 672 | 666 | echo '</div>'; |
| 673 | 667 | |
| 674 | 668 | do_action( 'adminify_options_after' ); |