← All changes | Inc/Admin/Frames/Init.php +11 -31 4.2.21 → 4.1.3 View file →

		@@ -1,10 +1,8 @@
1	1	<?php
2	2
3		-namespace PXLBSAdminify\Inc\Admin\Frames;
	3	+namespace WPAdminify\Inc\Admin\Frames;
4	4
5		-use PXLBSAdminify\Inc\Utils;
6		-
7	5	// no direct access allowed
8	6	if (!defined('ABSPATH')) {
9	7	exit;
10	8	}
		@@ -32,24 +30,17 @@
32	30
33	31	public function __construct()
34	32	{
35	33
36		- if ( ! Utils::is_admin_page_request() ) {
37		- return;
38		- }
39		-
40	34	if ( ! $this->is_allowed() ) {
41		- if ( Utils::is_iframe() ) {
42		- $http_host = isset($_SERVER['HTTP_HOST']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'])) : '';
43		- $request_uri = isset($_SERVER['REQUEST_URI']) ? esc_url_raw(wp_unslash($_SERVER['REQUEST_URI'])) : '';
44		- $scheme = empty($_SERVER['HTTPS']) ? 'http' : 'https';
45		- $actual_link = $scheme . '://' . $http_host . $request_uri;
	35	+ if ( is_iframe() ) {
	36	+ $actual_link = (empty($_SERVER['HTTPS']) ? 'http' : 'https') . "://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
46	37	Frames::custom_plugin_change_reload($actual_link);
47	38	}
48	39	return;
49	40	}
50	41
51		- if ( Utils::is_iframe() ) {
	42	+ if ( is_iframe() ) {
52	43	$this->frame = new Frames();
53	44	} else {
54	45	$this->admin = new Admin();
55	46	}
		@@ -62,9 +53,9 @@
62	53	*
63	54	* @return string Normalized path (e.g., /wp-admin/edit.php)
64	55	*/
65	56	private function get_normalized_admin_path() {
66		- $php_self = isset($_SERVER['PHP_SELF']) ? sanitize_text_field(wp_unslash($_SERVER['PHP_SELF'])) : '';
	57	+ $php_self = $_SERVER['PHP_SELF'] ?? '';
67	58
68	59	// Method 1: Use WordPress native function to get subdirectory path
69	60	// site_url() returns full URL including subdirectory
70	61	// e.g., https://example.com/blog or https://example.com
		@@ -102,10 +93,9 @@
102	93	}
103	94
104	95	// Fallback: ends-with check for edge cases
105	96	// e.g., /wp-admin/customize.php should match even if normalization fails
106		- $php_self = isset($_SERVER['PHP_SELF']) ? sanitize_text_field(wp_unslash($_SERVER['PHP_SELF'])) : '';
107		- if ( $this->url_ends_with( $php_self, $blocked_url ) ) {
	97	+ if ( $this->url_ends_with( $_SERVER['PHP_SELF'] ?? '', $blocked_url ) ) {
108	98	return true;
109	99	}
110	100
111	101	return false;
		@@ -139,9 +129,9 @@
139	129	'site_url' => site_url(),
140	130	'home_url' => home_url(),
141	131	'admin_url' => admin_url(),
142	132	'subdirectory' => wp_parse_url( site_url(), PHP_URL_PATH ) ?: '/',
143		- 'php_self' => isset($_SERVER['PHP_SELF']) ? sanitize_text_field(wp_unslash($_SERVER['PHP_SELF'])) : '',
	133	+ 'php_self' => $_SERVER['PHP_SELF'] ?? '',
144	134	'normalized_path' => $this->get_normalized_admin_path(),
145	135	];
146	136	}
147	137
		@@ -194,10 +184,9 @@
194	184	function check_query_params($query_params) {
195	185	// Pattern 1: Both keys and their values should check in $_GET
196	186	if (array_keys($query_params) === $query_params) {
197	187	foreach ($query_params as $key => $value) {
198		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
199		- if (!isset($_GET[$key]) || sanitize_text_field(wp_unslash($_GET[$key])) != $value) {
	188	+ if (!isset($_GET[$key]) || $_GET[$key] != $value) {
200	189	return false; // Key doesn't exist or the value doesn't match
201	190	}
202	191	}
203	192	return true; // All keys and values match
		@@ -207,12 +196,10 @@
207	196	if (array_values($query_params) === $query_params) {
208	197	foreach ($query_params as $param) {
209	198	if ( substr($param, -1) === '!' ) {
210	199	$param = substr($param, 0, -1);
211		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
212	200	if ( isset($_GET[$param]) ) return false; // The key exists in $_GET
213	201	} else {
214		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
215	202	if ( ! isset($_GET[$param]) ) return false; // The key doesn't exist in $_GET
216	203	}
217	204
218	205	}
		@@ -224,18 +211,15 @@
224	211	if (is_numeric($key)) {
225	212	// For numeric keys, we're checking only existence (Pattern 1 behavior)
226	213	if ( substr($value, -1) === '!' ) {
227	214	$value = substr($value, 0, -1);
228		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
229	215	if ( isset($_GET[$value]) ) return false; // The key exists in $_GET
230	216	} else {
231		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
232	217	if ( ! isset($_GET[$value]) ) return false; // The key doesn't exist in $_GET
233	218	}
234	219	} else {
235	220	// For associative keys, we check for both key and value (Pattern 2 behavior)
236		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
237		- if (!isset($_GET[$key]) || sanitize_text_field(wp_unslash($_GET[$key])) != $value) {
	221	+ if (!isset($_GET[$key]) || $_GET[$key] != $value) {
238	222	return false; // Key doesn't exist or value doesn't match
239	223	}
240	224	}
241	225	}
		@@ -243,16 +227,12 @@
243	227	return true; // All conditions are met
244	228	}
245	229
246	230	function check_post_type($post_types) {
247		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
248	231	if ( isset( $_GET['post_type'] ) ) {
249		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
250		- return in_array( sanitize_text_field( wp_unslash( $_GET['post_type'] ) ), $post_types );
251		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
	232	+ return in_array( $_GET['post_type'], $post_types );
252	233	} else if ( isset( $_GET['post'] ) ) {
253		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only check, no state change.
254		- return in_array( get_post_type( absint( wp_unslash( $_GET['post'] ) ) ), $post_types );
	234	+ return in_array( get_post_type( $_GET['post'] ), $post_types );
255	235	}
256	236	return in_array( 'post', $post_types );
257	237	}
258	238