← All changes | includes/Dashboard.php +41 -16 2.0.43 → 2.1.7 View file →

		@@ -13,8 +13,16 @@
13	13	add_action( 'admin_menu', [$this, 'adminMenu'] );
14	14	}
15	15
16	16	public function get_popular_plugins () {
	17	+ if (!isset($_POST['_wpnonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['_wpnonce'])), 'wp_ajax')) {
	18	+ wp_send_json_error(['message' => 'Invalid nonce or request.'], 400);
	19	+ }
	20	+
	21	+ if (!current_user_can('manage_options')) {
	22	+ wp_send_json_error(['message' => 'Insufficient permissions.'], 403);
	23	+ }
	24	+
17	25	if ( !function_exists( 'plugins_api' ) ) {
18	26	require_once ABSPATH . 'wp-admin/includes/plugin-install.php';
19	27	}
20	28
		@@ -21,27 +29,31 @@
21	29	$cached_plugins = plugins_api( 'query_plugins', array(
22	30	'author' => 'bplugins',
23	31	'per_page' => 100
24	32	) );
25		-
26		- wp_send_json_success($cached_plugins->plugins);
	33	+
	34	+ wp_send_json_success($cached_plugins->plugins);
27	35	}
28	36
29	37	public function get_active_plugins() {
30		- if (!isset($_GET['nonce']) || !wp_verify_nonce(sanitize_text_field($_GET['nonce']), 'wp_ajax')) {
	38	+ if (!isset($_GET['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['nonce'])), 'wp_ajax')) {
31	39	wp_send_json_error(['message' => 'Invalid nonce or request.'], 400);
32	40	}
33		-
	41	+
	42	+ if (!current_user_can('manage_options')) {
	43	+ wp_send_json_error(['message' => 'Insufficient permissions.'], 403);
	44	+ }
	45	+
34	46	// Get the list of all installed plugins
35	47	if (!function_exists('get_plugins')) {
36	48	include_once ABSPATH . '/wp-admin/includes/plugin.php';
37	49	}
38		-
	50	+
39	51	$installed_plugins = get_plugins();
40		-
	52	+
41	53	// Return the plugin basenames as an array
42	54	$installed_plugin_slugs = array_keys($installed_plugins);
43		-
	55	+
44	56	wp_send_json_success($installed_plugin_slugs);
45	57	}
46	58	public function display_activation_notice() {
47	59	// Check if transient is set
		@@ -62,12 +74,12 @@
62	74
63	75	// Display notice with activation button
64	76	?>
65	77	<div class="notice notice-success is-dismissible advScrollbar-notice">
66		- <p><?php esc_html_e(" $cleaned_string plugin was successfully installed.", 'advanced-scrollbar'); ?></p>
	78	+ <p><?php echo esc_html( $cleaned_string . ' ' . __( 'plugin was successfully installed.', 'b-blocks' ) ); ?></p>
67	79	<p>
68	80	<a href="<?php echo esc_url($activation_url); ?>" class="button button-primary">
69		- <?php esc_html_e('Activate Plugin', 'advanced-scrollbar'); ?>
	81	+ <?php esc_html_e('Activate Plugin', 'b-blocks'); ?>
70	82	</a>
71	83	</p>
72	84	</div>
73	85	<?php
		@@ -74,14 +86,18 @@
74	86	}
75	87	}
76	88	public function activated_block() {
77	89	// Verify nonce
78		- if (!isset($_GET['nonce']) || !wp_verify_nonce(sanitize_text_field($_GET['nonce']), 'wp_ajax')) {
	90	+ if (!isset($_GET['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['nonce'])), 'wp_ajax')) {
79	91	wp_send_json_error(['message' => 'Invalid nonce or request.'], 400);
80	92	}
81	93
82		- $plugin_name = sanitize_text_field($_GET['plugin_name']) ?? false;
	94	+ if (!current_user_can('install_plugins')) {
	95	+ wp_send_json_error(['message' => 'Insufficient permissions.'], 403);
	96	+ }
83	97
	98	+ $plugin_name = sanitize_text_field($_GET['plugin_name'] ?? '');
	99	+
84	100	include_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
85	101	include_once ABSPATH . 'wp-admin/includes/plugin-install.php';
86	102
87	103	try {
		@@ -113,9 +129,9 @@
113	129	}
114	130	}
115	131
116	132	public function bBlocksDisabledBlocks(){
117		- $nonce = sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ) ?? '';
	133	+ $nonce = sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ?? '' ) );
118	134
119	135	if( !wp_verify_nonce( $nonce, 'wp_ajax' )){
120	136	wp_send_json_error( 'Invalid Request' );
121	137	}
		@@ -123,14 +139,23 @@
123	139	if (!current_user_can('manage_options')) {
124	140	wp_send_json_error( 'Unauthorized' );
125	141	}
126	142
127		- $data = json_decode( stripslashes( $_POST['data'] ), true );
	143	+ $raw = isset( $_POST['data'] ) ? wp_unslash( $_POST['data'] ) : null; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- sanitized below after json_decode
	144	+ $data = is_string( $raw ) ? json_decode( $raw, true ) : null;
128	145	$db_data = get_option( 'bBlocksDisabledBlocks', [] );
129	146
130		- if( !isset( $data ) && $db_data ){
	147	+ if ( ! isset( $data ) && $db_data ) {
131	148	wp_send_json_success( $db_data );
132	149	}
	150	+
	151	+ // Sanitize: the value is an array of block-name strings (e.g. "b-blocks/alert").
	152	+ if ( is_array( $data ) ) {
	153	+ $data = array_map( 'sanitize_text_field', $data );
	154	+ } else {
	155	+ $data = [];
	156	+ }
	157	+
133	158	update_option( 'bBlocksDisabledBlocks', $data );
134	159	wp_send_json_success( $data );
135	160
136	161
		@@ -183,9 +208,9 @@
183	208	);
184	209	}
185	210
186	211	function dashboardPage(){ ?>
187		- <div id='bBlocksDashboard' data-info=<?php echo esc_attr( wp_json_encode([
	212	+ <div id='bBlocksDashboard' data-info='<?php echo esc_attr( wp_json_encode([
188	213	'version' => B_BLOCKS_VERSION,
189	214	'nonce' => wp_create_nonce( 'wp_ajax' ),
190	215	'dirUrl' => B_BLOCKS_DIR_URL,
191	216	'isPremium' => Utils::isPro(),
		@@ -190,9 +215,9 @@
190	215	'dirUrl' => B_BLOCKS_DIR_URL,
191	216	'isPremium' => Utils::isPro(),
192	217	'hasPro' => B_BLOCKS_HAS_PRO,
193	218	'licenseActiveNonce' => wp_create_nonce("bBlocksLicenseActivation")
194		- ]) ); ?>></div>
	219	+ ]) ); ?>'></div>
195	220	<?php }
196	221	}
197	222	new BBlocksDashboard();
198	223	}