← All changes | Inc/Admin/Frames/Init.php +2 -219 4.2.5 → 4.0 View file →

		@@ -1,10 +1,8 @@
1	1	<?php
2	2
3		-namespace PXLBSAdminify\Inc\Admin\Frames;
	3	+namespace WPAdminify\Inc\Admin\Frames;
4	4
5		-use PXLBSAdminify\Inc\Utils;
6		-
7	5	// no direct access allowed
8	6	if (!defined('ABSPATH')) {
9	7	exit;
10	8	}
		@@ -31,227 +29,12 @@
31	29	}
32	30
33	31	public function __construct()
34	32	{
35		-
36		- if ( ! $this->is_allowed() ) {
37		- if ( Utils::is_iframe() ) {
38		- $http_host = isset($_SERVER['HTTP_HOST']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'])) : '';
39		- $request_uri = isset($_SERVER['REQUEST_URI']) ? esc_url_raw(wp_unslash($_SERVER['REQUEST_URI'])) : '';
40		- $scheme = empty($_SERVER['HTTPS']) ? 'http' : 'https';
41		- $actual_link = $scheme . '://' . $http_host . $request_uri;
42		- Frames::custom_plugin_change_reload($actual_link);
43		- }
44		- return;
45		- }
46		-
47		- if ( Utils::is_iframe() ) {
	33	+ if (is_iframe()) {
48	34	$this->frame = new Frames();
49	35	} else {
50	36	$this->admin = new Admin();
51	37	}
52		-
53	38	}
54		-
55		- /**
56		- * Get the relative admin path without subdirectory prefix
57		- * Handles root, subdirectory, subdomain, and multisite installations
58		- *
59		- * @return string Normalized path (e.g., /wp-admin/edit.php)
60		- */
61		- private function get_normalized_admin_path() {
62		- $php_self = isset($_SERVER['PHP_SELF']) ? sanitize_text_field(wp_unslash($_SERVER['PHP_SELF'])) : '';
63		-
64		- // Method 1: Use WordPress native function to get subdirectory path
65		- // site_url() returns full URL including subdirectory
66		- // e.g., https://example.com/blog or https://example.com
67		- $site_url_path = wp_parse_url( site_url(), PHP_URL_PATH );
68		-
69		- // Remove subdirectory prefix if exists
70		- if ( ! empty( $site_url_path ) && $site_url_path !== '/' ) {
71		- // Ensure path starts with subdirectory
72		- if ( strpos( $php_self, $site_url_path ) === 0 ) {
73		- $php_self = substr( $php_self, strlen( $site_url_path ) );
74		- }
75		- }
76		-
77		- // Ensure path starts with /
78		- if ( empty( $php_self ) || $php_self[0] !== '/' ) {
79		- $php_self = '/' . $php_self;
80		- }
81		-
82		- return $php_self;
83		- }
84		-
85		- /**
86		- * Check if current path matches the blocked URL pattern
87		- * Supports exact match and ends-with matching for subdirectory compatibility
88		- *
89		- * @param string $blocked_url The URL pattern to check against
90		- * @return bool True if current path matches the blocked URL
91		- */
92		- private function matches_blocked_url( $blocked_url ) {
93		- $current_path = $this->get_normalized_admin_path();
94		-
95		- // Exact match (normalized)
96		- if ( $current_path === $blocked_url ) {
97		- return true;
98		- }
99		-
100		- // Fallback: ends-with check for edge cases
101		- // e.g., /wp-admin/customize.php should match even if normalization fails
102		- $php_self = isset($_SERVER['PHP_SELF']) ? sanitize_text_field(wp_unslash($_SERVER['PHP_SELF'])) : '';
103		- if ( $this->url_ends_with( $php_self, $blocked_url ) ) {
104		- return true;
105		- }
106		-
107		- return false;
108		- }
109		-
110		- /**
111		- * Check if a URL ends with a specific path
112		- * Useful for subdirectory WordPress installs
113		- *
114		- * @param string $url Full URL or path to check
115		- * @param string $ending The ending pattern to match
116		- * @return bool
117		- */
118		- private function url_ends_with( $url, $ending ) {
119		- $ending_length = strlen( $ending );
120		- if ( $ending_length === 0 ) {
121		- return true;
122		- }
123		- return substr( $url, -$ending_length ) === $ending;
124		- }
125		-
126		- /**
127		- * Get WordPress installation context for debugging
128		- *
129		- * @return array Installation details
130		- */
131		- public function get_install_context() {
132		- return [
133		- 'is_multisite' => is_multisite(),
134		- 'is_subdomain' => defined( 'SUBDOMAIN_INSTALL' ) && SUBDOMAIN_INSTALL,
135		- 'site_url' => site_url(),
136		- 'home_url' => home_url(),
137		- 'admin_url' => admin_url(),
138		- 'subdirectory' => wp_parse_url( site_url(), PHP_URL_PATH ) ?: '/',
139		- 'php_self' => isset($_SERVER['PHP_SELF']) ? sanitize_text_field(wp_unslash($_SERVER['PHP_SELF'])) : '',
140		- 'normalized_path' => $this->get_normalized_admin_path(),
141		- ];
142		- }
143		-
144		- public function is_allowed() {
145		-
146		- $not_allowed_urls = Admin::get_not_allowed_urls();
147		-
148		- foreach ( $not_allowed_urls as $url_object ) {
149		- if ( is_string( $url_object ) ) {
150		-
151		- $is_allowed = true; // Scoped Default allowed
152		- // Use normalized path matching for subdirectory compatibility
153		- if ( $this->matches_blocked_url( $url_object ) ) {
154		- $is_allowed = false; // not allowed
155		- }
156		-
157		- } else {
158		-
159		- $is_allowed = false; // Scoped Default not allowed
160		-
161		- // Use normalized path matching for subdirectory compatibility
162		- if ( $url_object['url'] !== '*' && ! $this->matches_blocked_url( $url_object['url'] ) ) {
163		- $is_allowed = true; // allowed
164		- }
165		-
166		- if ( ! $is_allowed && array_key_exists( 'query_params', $url_object ) ) {
167		- if ( ! $this->check_query_params( $url_object['query_params'] ) ) {
168		- $is_allowed = true; // allowed
169		- }
170		- }
171		-
172		- if ( ! $is_allowed && array_key_exists( 'post_type', $url_object ) ) {
173		- if ( ! $this->check_post_type( $url_object['post_type'] ) ) {
174		- $is_allowed = true; // allowed
175		- }
176		- }
177		-
178		- }
179		-
180		- if ( ! $is_allowed ) {
181		- return $is_allowed;
182		- }
183		-
184		- }
185		-
186		- return true;
187		-
188		- }
189		-
190		- function check_query_params($query_params) {
191		- // Pattern 1: Both keys and their values should check in $_GET
192		- if (array_keys($query_params) === $query_params) {
193		- foreach ($query_params as $key => $value) {
194		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
195		- if (!isset($_GET[$key]) || sanitize_text_field(wp_unslash($_GET[$key])) != $value) {
196		- return false; // Key doesn't exist or the value doesn't match
197		- }
198		- }
199		- return true; // All keys and values match
200		- }
201		-
202		- // Pattern 2: Check for only keys in $_GET, no need to check their values
203		- if (array_values($query_params) === $query_params) {
204		- foreach ($query_params as $param) {
205		- if ( substr($param, -1) === '!' ) {
206		- $param = substr($param, 0, -1);
207		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
208		- if ( isset($_GET[$param]) ) return false; // The key exists in $_GET
209		- } else {
210		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
211		- if ( ! isset($_GET[$param]) ) return false; // The key doesn't exist in $_GET
212		- }
213		-
214		- }
215		- return true; // All keys exist
216		- }
217		-
218		- // Pattern 3: A mix of key existence and key-value matching
219		- foreach ($query_params as $key => $value) {
220		- if (is_numeric($key)) {
221		- // For numeric keys, we're checking only existence (Pattern 1 behavior)
222		- if ( substr($value, -1) === '!' ) {
223		- $value = substr($value, 0, -1);
224		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
225		- if ( isset($_GET[$value]) ) return false; // The key exists in $_GET
226		- } else {
227		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
228		- if ( ! isset($_GET[$value]) ) return false; // The key doesn't exist in $_GET
229		- }
230		- } else {
231		- // For associative keys, we check for both key and value (Pattern 2 behavior)
232		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
233		- if (!isset($_GET[$key]) || sanitize_text_field(wp_unslash($_GET[$key])) != $value) {
234		- return false; // Key doesn't exist or value doesn't match
235		- }
236		- }
237		- }
238		-
239		- return true; // All conditions are met
240		- }
241		-
242		- function check_post_type($post_types) {
243		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
244		- if ( isset( $_GET['post_type'] ) ) {
245		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
246		- return in_array( sanitize_text_field( wp_unslash( $_GET['post_type'] ) ), $post_types );
247		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
248		- } else if ( isset( $_GET['post'] ) ) {
249		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
250		- return in_array( get_post_type( absint( wp_unslash( $_GET['post'] ) ) ), $post_types );
251		- }
252		- return in_array( 'post', $post_types );
253		- }
254		-
255	39	}
256		-
257	40	}