PluginProbe
Autoptimize / 3.1.4
Autoptimize v3.1.4
2.2.2 2.3.0 2.3.1 2.3.2 2.3.3 2.3.4 2.4.0 2.4.1 2.4.2 2.4.3 2.4.4 2.5.0 2.5.1 2.6.0 2.6.1 2.6.2 2.7.0 2.7.1 2.7.2 2.7.3 2.7.4 2.7.5 2.7.6 2.7.7 2.7.8 All 107 releases
← All changes | classes/autoptimizeCriticalCSSSettingsAjax.php +236 -39 2.7.33.1.4 View file →
@@ -7,16 +7,10 @@
7 7 exit;
8 8 }
9 9
10 10 class autoptimizeCriticalCSSSettingsAjax {
11 - public function __construct()
12 - {
13 - // fetch all options at once and populate them individually explicitely as globals.
14 - $all_options = autoptimizeCriticalCSSBase::fetch_options();
15 - foreach ( $all_options as $_option => $_value ) {
16 - global ${$_option};
17 - ${$_option} = $_value;
18 - }
11 + public function __construct() {
12 + $this->criticalcss = autoptimize()->criticalcss();
19 13 $this->run();
20 14 }
21 15
22 16 public function run() {
@@ -26,8 +20,10 @@
26 20 add_action( 'wp_ajax_rm_critcss', array( $this, 'critcss_rm_callback' ) );
27 21 add_action( 'wp_ajax_rm_critcss_all', array( $this, 'critcss_rm_all_callback' ) );
28 22 add_action( 'wp_ajax_ao_ccss_export', array( $this, 'ao_ccss_export_callback' ) );
29 23 add_action( 'wp_ajax_ao_ccss_import', array( $this, 'ao_ccss_import_callback' ) );
24 + add_action( 'wp_ajax_ao_ccss_queuerunner', array( $this, 'ao_ccss_queuerunner_callback' ) );
25 + add_action( 'wp_ajax_ao_ccss_saverules', array( $this, 'ao_ccss_saverules_callback' ) );
30 26 }
31 27
32 28 public function critcss_fetch_callback() {
33 29 // Ajax handler to obtain a critical CSS file from the filesystem.
@@ -85,19 +81,21 @@
85 81 // Set critical CSS content.
86 82 $critcsscontents = stripslashes( $_POST['critcsscontents'] );
87 83
88 84 // If there is content and it's valid, write the file.
89 - if ( $critcsscontents && autoptimizeCriticalCSSCore::ao_ccss_check_contents( $critcsscontents ) ) {
85 + if ( $critcsscontents && $this->criticalcss->check_contents( $critcsscontents ) ) {
90 86 // Set file path and status.
91 87 $critcssfile = AO_CCSS_DIR . strip_tags( $_POST['critcssfile'] );
92 88 $status = file_put_contents( $critcssfile, $critcsscontents, LOCK_EX );
93 89 // Or set as error.
94 90 } else {
95 - $error = true;
91 + $error = true;
92 + $critcssfile = 'CCSS content not acceptable.';
96 93 }
97 94 // Or just set an error.
98 95 } else {
99 - $error = true;
96 + $error = true;
97 + $critcssfile = 'Not allowed or problem with CCSS filename.';
100 98 }
101 99
102 100 // Prepare response.
103 101 if ( ! $status || $error ) {
@@ -107,9 +105,9 @@
107 105 $response['code'] = '200';
108 106 if ( $critcssfile ) {
109 107 $response['string'] = 'File ' . $critcssfile . ' saved.';
110 108 } else {
111 - $response['string'] = 'Empty content do not need to be saved.';
109 + $response['string'] = 'Empty content does not need to be saved.';
112 110 }
113 111 }
114 112
115 113 // Dispatch respose.
@@ -118,9 +116,8 @@
118 116 // Close ajax request.
119 117 wp_die();
120 118 }
121 119
122 -
123 120 public function critcss_rm_callback() {
124 121 // Ajax handler to delete a critical CSS from the filesystem
125 122 // Check referer.
126 123 check_ajax_referer( 'rm_critcss_nonce', 'critcss_rm_nonce' );
@@ -212,18 +209,67 @@
212 209 wp_die();
213 210 }
214 211
215 212 // Init array, get options and prepare the raw object.
216 - $settings = array();
217 - $settings['rules'] = get_option( 'autoptimize_ccss_rules' );
218 - $settings['additional'] = get_option( 'autoptimize_ccss_additional' );
219 - $settings['viewport'] = get_option( 'autoptimize_ccss_viewport' );
220 - $settings['finclude'] = get_option( 'autoptimize_ccss_finclude' );
221 - $settings['rlimit'] = get_option( 'autoptimize_ccss_rlimit' );
222 - $settings['noptimize'] = get_option( 'autoptimize_ccss_noptimize' );
223 - $settings['debug'] = get_option( 'autoptimize_ccss_debug' );
224 - $settings['key'] = get_option( 'autoptimize_ccss_key' );
213 + $settings = array();
225 214
215 + // CCSS settings.
216 + $settings['ccss']['rules'] = get_option( 'autoptimize_ccss_rules' );
217 + $settings['ccss']['additional'] = get_option( 'autoptimize_ccss_additional' );
218 + $settings['ccss']['viewport'] = get_option( 'autoptimize_ccss_viewport' );
219 + $settings['ccss']['finclude'] = get_option( 'autoptimize_ccss_finclude' );
220 + $settings['ccss']['rtimelimit'] = get_option( 'autoptimize_ccss_rtimelimit' );
221 + $settings['ccss']['noptimize'] = get_option( 'autoptimize_ccss_noptimize' );
222 + $settings['ccss']['debug'] = get_option( 'autoptimize_ccss_debug' );
223 + $settings['ccss']['key'] = get_option( 'autoptimize_ccss_key' );
224 + $settings['ccss']['deferjquery'] = get_option( 'autoptimize_ccss_deferjquery' );
225 + $settings['ccss']['domain'] = get_option( 'autoptimize_ccss_domain' );
226 + $settings['ccss']['forcepath'] = get_option( 'autoptimize_ccss_forcepath' );
227 + $settings['ccss']['loggedin'] = get_option( 'autoptimize_ccss_loggedin' );
228 + $settings['ccss']['rlimit'] = get_option( 'autoptimize_ccss_rlimit' );
229 + $settings['ccss']['unloadccss'] = get_option( 'autoptimize_ccss_unloadccss' );
230 +
231 + // JS settings.
232 + $settings['js']['root'] = get_option( 'autoptimize_js' );
233 + $settings['js']['aggregate'] = get_option( 'autoptimize_js_aggregate' );
234 + $settings['js']['defer_not_aggregate'] = get_option( 'autoptimize_js_defer_not_aggregate' );
235 + $settings['js']['defer_inline'] = get_option( 'autoptimize_js_defer_inline' );
236 + $settings['js']['exclude'] = get_option( 'autoptimize_js_exclude' );
237 + $settings['js']['forcehead'] = get_option( 'autoptimize_js_forcehead' );
238 + $settings['js']['justhead'] = get_option( 'autoptimize_js_justhead' );
239 + $settings['js']['trycatch'] = get_option( 'autoptimize_js_trycatch' );
240 + $settings['js']['include_inline'] = get_option( 'autoptimize_js_include_inline' );
241 +
242 + // CSS settings.
243 + $settings['css']['root'] = get_option( 'autoptimize_css' );
244 + $settings['css']['aggregate'] = get_option( 'autoptimize_css_aggregate' );
245 + $settings['css']['datauris'] = get_option( 'autoptimize_css_datauris' );
246 + $settings['css']['justhead'] = get_option( 'autoptimize_css_justhead' );
247 + $settings['css']['defer'] = get_option( 'autoptimize_css_defer' );
248 + $settings['css']['defer_inline'] = get_option( 'autoptimize_css_defer_inline' );
249 + $settings['css']['inline'] = get_option( 'autoptimize_css_inline' );
250 + $settings['css']['exclude'] = get_option( 'autoptimize_css_exclude' );
251 + $settings['css']['include_inline'] = get_option( 'autoptimize_css_include_inline' );
252 +
253 + // Others.
254 + $settings['other']['autoptimize_imgopt_settings'] = get_option( 'autoptimize_imgopt_settings' );
255 + $settings['other']['autoptimize_extra_settings'] = get_option( 'autoptimize_extra_settings' );
256 + $settings['other']['autoptimize_cache_fallback'] = get_option( 'autoptimize_cache_fallback' );
257 + $settings['other']['autoptimize_cache_nogzip'] = get_option( 'autoptimize_cache_nogzip' );
258 + $settings['other']['autoptimize_cdn_url'] = get_option( 'autoptimize_cdn_url' );
259 + $settings['other']['autoptimize_enable_meta_ao_settings'] = get_option( 'autoptimize_enable_meta_ao_settings' );
260 + $settings['other']['autoptimize_enable_site_config'] = get_option( 'autoptimize_enable_site_config' );
261 + $settings['other']['autoptimize_html'] = get_option( 'autoptimize_html' );
262 + $settings['other']['autoptimize_html_keepcomments'] = get_option( 'autoptimize_html_keepcomments' );
263 + $settings['other']['autoptimize_minify_excluded'] = get_option( 'autoptimize_minify_excluded' );
264 + $settings['other']['autoptimize_optimize_checkout'] = get_option( 'autoptimize_optimize_checkout' );
265 + $settings['other']['autoptimize_optimize_logged'] = get_option( 'autoptimize_optimize_logged' );
266 +
267 + if ( defined( 'AO_PRO_VERSION' ) ) {
268 + $settings['pro']['boosters'] = get_option( 'autoptimize_pro_boosters' );
269 + $settings['pro']['pagecache'] = get_option( 'autoptimize_pro_pagecache' );
270 + }
271 +
226 272 // Initialize error flag.
227 273 $error = true;
228 274
229 275 // Check user permissions.
@@ -235,9 +281,9 @@
235 281 $error = false;
236 282 }
237 283
238 284 // Prepare archive.
239 - $zipfile = AO_CCSS_DIR . date( 'Ymd-H\hi' ) . '_ao_ccss_settings.zip';
285 + $zipfile = AO_CCSS_DIR . str_replace( array( '.', '/' ), '_', parse_url( AUTOPTIMIZE_WP_SITE_URL, PHP_URL_HOST ) ) . '_' . date( 'Ymd-H\hi' ) . '_ao_ccss_settings.zip'; // @codingStandardsIgnoreLine
240 286 $file = pathinfo( $zipfile, PATHINFO_BASENAME );
241 287 $zip = new ZipArchive();
242 288 $ret = $zip->open( $zipfile, ZipArchive::CREATE );
243 289 if ( true !== $ret ) {
@@ -254,8 +300,13 @@
254 300 $zip->addGlob( AO_CCSS_DIR . '*.css', 0, $options );
255 301 $zip->close();
256 302 }
257 303
304 + // settings.json has been added to zipfile, so can be removed now.
305 + if ( file_exists( $exportfile ) ) {
306 + unlink( $exportfile );
307 + }
308 +
258 309 // Prepare response.
259 310 if ( ! $status || $error ) {
260 311 $response['code'] = '500';
261 312 $response['msg'] = 'Error saving file ' . $file . ', code: ' . $ret;
@@ -280,24 +331,38 @@
280 331 // Initialize error flag.
281 332 $error = false;
282 333
283 334 // Process an uploaded file with no errors.
284 - if ( ! $_FILES['file']['error'] ) {
285 - // Save file to the cache directory.
286 - $zipfile = AO_CCSS_DIR . $_FILES['file']['name'];
335 + if ( current_user_can( 'manage_options' ) && ! $_FILES['file']['error'] && $_FILES['file']['size'] < 500001 && strpos( $_FILES['file']['name'], '.zip' ) === strlen( $_FILES['file']['name'] ) - 4 ) {
336 + // create tmp dir with hard guess name in AO_CCSS_DIR.
337 + $_secret_dir = wp_hash( uniqid( md5( AUTOPTIMIZE_CACHE_URL ), true ) );
338 + $_import_tmp_dir = trailingslashit( AO_CCSS_DIR . $_secret_dir );
339 + mkdir( $_import_tmp_dir, 0774, true );
340 +
341 + // Save file to that tmp directory but give it our own name to prevent directory traversal risks when using original name.
342 + $zipfile = $_import_tmp_dir . uniqid( 'import_settings-', true ) . '.zip';
287 343 move_uploaded_file( $_FILES['file']['tmp_name'], $zipfile );
288 344
289 - // Extract archive.
345 + // Extract archive in the tmp directory.
290 346 $zip = new ZipArchive;
291 347 if ( $zip->open( $zipfile ) === true ) {
292 - $zip->extractTo( AO_CCSS_DIR );
348 + // loop through all files in the zipfile.
349 + for ( $i = 0; $i < $zip->numFiles; $i++ ) { // @codingStandardsIgnoreLine
350 + // but only extract known good files.
351 + if ( preg_match( '/^settings\.json$|^\.\/ccss_[a-z0-9]{32}\.css$/', $zip->getNameIndex( $i ) ) > 0 ) {
352 + $zip->extractTo( AO_CCSS_DIR, $zip->getNameIndex( $i ) );
353 + }
354 + }
293 355 $zip->close();
294 356 } else {
295 - $error = 'extracting';
357 + $error = 'could not extract';
296 358 }
297 359
360 + // and remove temp. dir with all contents (the import-zipfile).
361 + $this->rrmdir( $_import_tmp_dir );
362 +
298 363 if ( ! $error ) {
299 - // Archive extraction ok, continue settings importing
364 + // Archive extraction ok, continue importing settings from AO_CCSS_DIR.
300 365 // Settings file.
301 366 $importfile = AO_CCSS_DIR . 'settings.json';
302 367
303 368 if ( file_exists( $importfile ) ) {
@@ -303,22 +368,66 @@
303 368 if ( file_exists( $importfile ) ) {
304 369 // Get settings and turn them into an object.
305 370 $settings = json_decode( file_get_contents( $importfile ), true );
306 371
307 - // Update options.
308 - update_option( 'autoptimize_ccss_rules', $settings['rules'] );
309 - update_option( 'autoptimize_ccss_additional', $settings['additional'] );
310 - update_option( 'autoptimize_ccss_viewport', $settings['viewport'] );
311 - update_option( 'autoptimize_ccss_finclude', $settings['finclude'] );
312 - update_option( 'autoptimize_ccss_rlimit', $settings['rlimit'] );
313 - update_option( 'autoptimize_ccss_noptimize', $settings['noptimize'] );
314 - update_option( 'autoptimize_ccss_debug', $settings['debug'] );
315 - update_option( 'autoptimize_ccss_key', $settings['key'] );
372 + // Update options from settings, but only for known options.
373 + // CCSS.
374 + foreach ( array( 'rules', 'additional', 'viewport', 'finclude', 'rtimelimit', 'noptimize', 'debug', 'key', 'deferjquery', 'domain', 'forcepath', 'loggedin', 'rlimit', 'unloadccss' ) as $ccss_setting ) {
375 + if ( false === array_key_exists( 'ccss', $settings ) || false === array_key_exists( $ccss_setting, $settings['ccss'] ) ) {
376 + continue;
377 + } else {
378 + update_option( 'autoptimize_ccss_' . $ccss_setting, $settings['ccss'][ $ccss_setting ] );
379 + }
380 + }
381 +
382 + // JS.
383 + foreach ( array( 'root', 'aggregate', 'defer_not_aggregate', 'defer_inline', 'exclude', 'forcehead', 'trycatch', 'include_inline' ) as $js_setting ) {
384 + if ( false === array_key_exists( 'js', $settings ) || false === array_key_exists( $js_setting, $settings['js'] ) ) {
385 + continue;
386 + } else if ( 'root' === $js_setting ) {
387 + update_option( 'autoptimize_js', $settings['js']['root'] );
388 + } else {
389 + update_option( 'autoptimize_js_' . $js_setting, $settings['js'][ $js_setting ] );
390 + }
391 + }
392 +
393 + // CSS.
394 + foreach ( array( 'root', 'aggregate', 'datauris', 'justhead', 'defer', 'defer_inline', 'inline', 'exclude', 'include_inline' ) as $css_setting ) {
395 + if ( false === array_key_exists( 'css', $settings ) || false === array_key_exists( $css_setting, $settings['css'] ) ) {
396 + continue;
397 + } else if ( 'root' === $css_setting ) {
398 + update_option( 'autoptimize_css', $settings['css']['root'] );
399 + } else {
400 + update_option( 'autoptimize_css_' . $css_setting, $settings['css'][ $css_setting ] );
401 + }
402 + }
403 +
404 + // Other.
405 + foreach ( array( 'autoptimize_imgopt_settings', 'autoptimize_extra_settings', 'autoptimize_cache_fallback', 'autoptimize_cache_nogzip', 'autoptimize_cdn_url', 'autoptimize_enable_meta_ao_settings', 'autoptimize_enable_site_config', 'autoptimize_html', 'autoptimize_html_keepcomments', 'autoptimize_minify_excluded', 'autoptimize_optimize_checkout', 'autoptimize_optimize_logged' ) as $other_setting ) {
406 + if ( false === array_key_exists( 'other', $settings ) || false === array_key_exists( $other_setting, $settings['other'] ) ) {
407 + continue;
408 + } else {
409 + update_option( $other_setting, $settings['other'][ $other_setting ] );
410 + }
411 + }
412 +
413 + // AO Pro.
414 + if ( defined( 'AO_PRO_VERSION' ) && array_key_exists( 'pro', $settings ) ) {
415 + update_option( 'autoptimize_pro_boosters', $settings['pro']['boosters'] );
416 + update_option( 'autoptimize_pro_pagecache', $settings['pro']['pagecache'] );
417 + }
418 +
419 + // settings.json has been imported, so can be removed now.
420 + if ( file_exists( $importfile ) ) {
421 + unlink( $importfile );
422 + }
316 423 } else {
317 424 // Settings file doesn't exist, update error flag.
318 425 $error = 'settings file does not exist';
319 426 }
320 427 }
428 + } else {
429 + $error = 'file could not be saved';
321 430 }
322 431
323 432 // Prepare response.
324 433 if ( $error ) {
@@ -335,8 +444,84 @@
335 444 // Close ajax request.
336 445 wp_die();
337 446 }
338 447
448 + public function ao_ccss_queuerunner_callback() {
449 + check_ajax_referer( 'ao_ccss_queuerunner_nonce', 'ao_ccss_queuerunner_nonce' );
450 +
451 + // Process an uploaded file with no errors.
452 + if ( current_user_can( 'manage_options' ) ) {
453 + if ( ! file_exists( AO_CCSS_LOCK ) ) {
454 + $ccss_cron = new autoptimizeCriticalCSSCron();
455 + $ccss_cron->ao_ccss_queue_control();
456 + $response['code'] = '200';
457 + $response['msg'] = 'Queue processing done';
458 + } else {
459 + $response['code'] = '302';
460 + $response['msg'] = 'Lock file found';
461 + }
462 + } else {
463 + $response['code'] = '500';
464 + $response['msg'] = 'Not allowed';
465 + }
466 +
467 + // Dispatch respose.
468 + echo json_encode( $response );
469 +
470 + // Close ajax request.
471 + wp_die();
472 + }
473 +
474 + public function ao_ccss_saverules_callback() {
475 + check_ajax_referer( 'ao_ccss_saverules_nonce', 'ao_ccss_saverules_nonce' );
476 +
477 + // save rules over AJAX, too many users forget to press "save changes".
478 + if ( current_user_can( 'manage_options' ) ) {
479 + if ( array_key_exists( 'critcssrules', $_POST ) ) {
480 + $rules = stripslashes( $_POST['critcssrules'] ); // ugly, but seems correct as per https://developer.wordpress.org/reference/functions/stripslashes_deep/#comment-1045 .
481 + if ( ! empty( $rules ) ) {
482 + $_unsafe_rules_array = json_decode( wp_strip_all_tags( $rules ), true );
483 + if ( ! empty( $_unsafe_rules_array ) && is_array( $_unsafe_rules_array ) ) {
484 + $_safe_rules_array = array();
485 + if ( array_key_exists( 'paths', $_unsafe_rules_array ) ) {
486 + $_safe_rules_array['paths'] = $_unsafe_rules_array['paths'];
487 + }
488 + if ( array_key_exists( 'types', $_unsafe_rules_array ) ) {
489 + $_safe_rules_array['types'] = $_unsafe_rules_array['types'];
490 + }
491 + $_safe_rules = json_encode( $_safe_rules_array, JSON_FORCE_OBJECT );
492 + if ( ! empty( $_safe_rules ) ) {
493 + update_option( 'autoptimize_ccss_rules', $_safe_rules );
494 + $response['code'] = '200';
495 + $response['msg'] = 'Rules saved';
496 + } else {
497 + $_error = 'Could not auto-save rules (safe rules empty)';
498 + }
499 + } else {
500 + $_error = 'Could not auto-save rules (rules could not be json_decoded)';
501 + }
502 + } else {
503 + $_error = 'Could not auto-save rules (rules empty)';
504 + }
505 + } else {
506 + $_error = 'Could not auto-save rules (rules not in $_POST)';
507 + }
508 + } else {
509 + $_error = 'Not allowed';
510 + }
511 +
512 + if ( ! isset( $response ) && $_error ) {
513 + $response['code'] = '500';
514 + $response['msg'] = $_error;
515 + }
516 +
517 + // Dispatch respose.
518 + echo json_encode( $response );
519 +
520 + // Close ajax request.
521 + wp_die();
522 + }
523 +
339 524 public function critcss_check_filename( $filename ) {
340 525 // Try to avoid directory traversal when reading/writing/deleting critical CSS files.
341 526 if ( strpos( $filename, 'ccss_' ) !== 0 ) {
342 527 return false;
@@ -347,6 +532,18 @@
347 532 return false;
348 533 } else {
349 534 return true;
350 535 }
536 + }
537 +
538 + public function rrmdir( $path ) {
539 + // recursively remove a directory as found on
540 + // https://andy-carter.com/blog/recursively-remove-a-directory-in-php.
541 + $files = glob( $path . '/*' );
542 + foreach ( $files as $file ) {
543 + is_dir( $file ) ? $this->rrmdir( $file ) : unlink( $file );
544 + }
545 + rmdir( $path );
546 +
547 + return;
351 548 }
352 549 }