PluginProbe
Adminify – White Label, Admin Menu Editor, Login Customizer / 4.1.3
Adminify – White Label, Admin Menu Editor, Login Customizer v4.1.3
4.3.1 4.3.0 4.2.26 4.2.25 4.2.24 4.2.23 4.2.22 4.2.21 4.2.20 4.2.19 4.2.18 4.2.17 4.2.16 4.2.15 4.2.14 4.2.13 4.2.12 4.2.11 4.2.10 4.2.9 4.2.8 4.2.7 4.2.6 4.2.5 4.1.17 All 164 releases
← All changes | Libs/adminify-framework/classes/admin-options.class.php +14 -20 4.2.21 → 4.1.3 View file →
@@ -203,21 +203,20 @@
203 203
204 204 // set options
205 205 public function set_options( $ajax = false ) {
206 206
207 - // The payload is only read here; the nonce + capability are verified below (see the wp_verify_nonce
208 - // guard) before any value is used, and every field is sanitized individually inside that block.
209 - // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- nonce/capability verified below; each field sanitized per-field afterwards.
210 - $response = ( $ajax && ! empty( $_POST['data'] ) ) ? json_decode( trim( wp_unslash( $_POST['data'] ) ), true ) : $_POST;
207 + // XSS ok.
208 + // No worries, This "POST" requests is sanitizing in the below foreach. see #L337 - #L341
209 + $response = ( $ajax && ! empty( $_POST['data'] ) ) ? json_decode( wp_unslash( trim( $_POST['data'] ) ), true ) : $_POST;
211 210
212 211 // Set variables.
213 212 $data = array();
214 213 $noncekey = 'adminify_options_nonce'. $this->unique;
215 - $nonce = ( ! empty( $response[$noncekey] ) ) ? sanitize_text_field( wp_unslash( $response[$noncekey] ) ) : '';
214 + $nonce = ( ! empty( $response[$noncekey] ) ) ? $response[$noncekey] : '';
216 215 $options = ( ! empty( $response[$this->unique] ) ) ? $response[$this->unique] : array();
217 216 $transient = ( ! empty( $response['adminify_transient'] ) ) ? $response['adminify_transient'] : array();
218 217
219 - if ( wp_verify_nonce( $nonce, 'adminify_options_nonce' ) && current_user_can( $this->args['menu_capability'] ) ) {
218 + if ( wp_verify_nonce( $nonce, 'adminify_options_nonce' ) ) {
220 219
221 220 $importing = false;
222 221 $section_id = ( ! empty( $transient['section'] ) ) ? $transient['section'] : '';
223 222
@@ -291,14 +290,9 @@
291 290 $data[$field_id] = call_user_func( $field['sanitize'], $field_value );
292 291
293 292 } else {
294 293
295 - // A sanitize callback was declared but is not callable; never store raw input.
296 - if ( is_array( $field_value ) ) {
297 - $data[$field_id] = wp_kses_post_deep( $field_value );
298 - } else {
299 - $data[$field_id] = wp_kses_post( $field_value );
300 - }
294 + $data[$field_id] = $field_value;
301 295
302 296 }
303 297
304 298 // Validate "post" request of field.
@@ -506,9 +500,9 @@
506 500 echo '<div class="adminify-header'. esc_attr( $sticky_class ) .'">';
507 501 echo '<div class="adminify-header-inner">';
508 502
509 503 echo '<div class="adminify-header-left">';
510 - echo '<h1>'. wp_kses_post( $this->args['framework_title'] ) .'</h1>';
504 + echo '<h1>'. $this->args['framework_title'] .'</h1>';
511 505 echo '</div>';
512 506
513 507 echo '<div class="adminify-header-right">';
514 508
@@ -514,9 +508,9 @@
514 508
515 509 $notice_class = ( ! empty( $this->notice ) ) ? 'adminify-form-show' : '';
516 510 $notice_text = ( ! empty( $this->notice ) ) ? $this->notice : '';
517 511
518 - echo '<div class="adminify-form-result adminify-form-success '. esc_attr( $notice_class ) .'">'. wp_kses_post( $notice_text ) .'</div>';
512 + echo '<div class="adminify-form-result adminify-form-success '. esc_attr( $notice_class ) .'">'. $notice_text .'</div>';
519 513
520 514 echo ( $this->args['show_form_warning'] ) ? '<div class="adminify-form-result adminify-form-warning">'. esc_html__( 'You have unsaved changes, save your changes!', 'adminify' ) .'</div>' : '';
521 515
522 516 echo ( $has_nav && $this->args['show_all_options'] ) ? '<div class="adminify-expand-all" title="'. esc_html__( 'show all settings', 'adminify' ) .'"><i class="fas fa-outdent"></i></div>' : '';
@@ -552,9 +546,9 @@
552 546 if ( ! empty( $tab['subs'] ) ) {
553 547
554 548 echo '<li class="adminify-tab-item">';
555 549
556 - echo '<a href="#tab='. esc_attr( $tab_id ) .'" data-tab-id="'. esc_attr( $tab_id ) .'" class="adminify-arrow">'. wp_kses_post( $tab_icon ) . esc_html( $tab['title'] ) . wp_kses_post( $tab_error ) .'</a>';
550 + echo '<a href="#tab='. esc_attr( $tab_id ) .'" data-tab-id="'. esc_attr( $tab_id ) .'" class="adminify-arrow">'. $tab_icon . $tab['title'] . $tab_error .'</a>';
557 551
558 552 echo '<ul>';
559 553
560 554 foreach ( $tab['subs'] as $sub ) {
@@ -562,9 +556,9 @@
562 556 $sub_id = $tab_id .'/'. sanitize_title( $sub['title'] );
563 557 $sub_error = $this->error_check( $sub );
564 558 $sub_icon = ( ! empty( $sub['icon'] ) ) ? '<i class="adminify-tab-icon '. esc_attr( $sub['icon'] ) .'"></i>' : '';
565 559
566 - echo '<li><a href="#tab='. esc_attr( $sub_id ) .'" data-tab-id="'. esc_attr( $sub_id ) .'">'. wp_kses_post( $sub_icon ) . esc_html( $sub['title'] ) . wp_kses_post( $sub_error ) .'</a></li>';
560 + echo '<li><a href="#tab='. esc_attr( $sub_id ) .'" data-tab-id="'. esc_attr( $sub_id ) .'">'. $sub_icon . $sub['title'] . $sub_error .'</a></li>';
567 561
568 562 }
569 563
570 564 echo '</ul>';
@@ -572,9 +566,9 @@
572 566 echo '</li>';
573 567
574 568 } else {
575 569
576 - echo '<li class="adminify-tab-item"><a href="#tab='. esc_attr( $tab_id ) .'" data-tab-id="'. esc_attr( $tab_id ) .'">'. wp_kses_post( $tab_icon ) . esc_html( $tab['title'] ) . wp_kses_post( $tab_error ) .'</a></li>';
570 + echo '<li class="adminify-tab-item"><a href="#tab='. esc_attr( $tab_id ) .'" data-tab-id="'. esc_attr( $tab_id ) .'">'. $tab_icon . $tab['title'] . $tab_error .'</a></li>';
577 571
578 572 }
579 573
580 574 }
@@ -601,9 +595,9 @@
601 595 $section_slug = ( ! empty( $section['title'] ) ) ? sanitize_title( $section_title ) : '';
602 596
603 597 echo '<div class="adminify-section hidden'. esc_attr( $section_onload . $section_class ) .'" data-section-id="'. esc_attr( $section_parent . $section_slug ) .'">';
604 598
605 - echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. wp_kses_post( $section['description'] ) .'</div>' : '';
599 + echo ( ! empty( $section['description'] ) ) ? '<div class="adminify-field adminify-section-description">'. $section['description'] .'</div>' : '';
606 600
607 601 if ( ! empty( $section['fields'] ) ) {
608 602
609 603 foreach ( $section['fields'] as $field ) {
@@ -653,9 +647,9 @@
653 647 echo ( $this->args['show_reset_section'] ) ? '<input type="submit" name="adminify_transient[reset_section]" class="button button-secondary adminify-reset-section adminify-confirm" value="'. esc_html__( 'Reset Section', 'adminify' ) .'" data-confirm="'. esc_html__( 'Are you sure to reset this section options?', 'adminify' ) .'">' : '';
654 648 echo ( $this->args['show_reset_all'] ) ? '<input type="submit" name="adminify_transient[reset]" class="button adminify-warning-primary adminify-reset-all adminify-confirm" value="'. ( ( $this->args['show_reset_section'] ) ? esc_html__( 'Reset All', 'adminify' ) : esc_html__( 'Reset', 'adminify' ) ) .'" data-confirm="'. esc_html__( 'Are you sure you want to reset all settings to default values?', 'adminify' ) .'">' : '';
655 649 echo '</div>';
656 650
657 - echo ( ! empty( $this->args['footer_text'] ) ) ? '<div class="adminify-copyright">'. wp_kses_post( $this->args['footer_text'] ) .'</div>' : '';
651 + echo ( ! empty( $this->args['footer_text'] ) ) ? '<div class="adminify-copyright">'. $this->args['footer_text'] .'</div>' : '';
658 652
659 653 echo '<div class="clear"></div>';
660 654 echo '</div>';
661 655
@@ -666,9 +660,9 @@
666 660 echo '</div>';
667 661
668 662 echo '<div class="clear"></div>';
669 663
670 - echo ( ! empty( $this->args['footer_after'] ) ) ? wp_kses_post( $this->args['footer_after'] ) : '';
664 + echo ( ! empty( $this->args['footer_after'] ) ) ? $this->args['footer_after'] : '';
671 665
672 666 echo '</div>';
673 667
674 668 do_action( 'adminify_options_after' );