| @@ -108,9 +108,9 @@ | ||
| 108 | 108 | |
| 109 | 109 | /** |
| 110 | 110 | * The main bbPress admin loader |
| 111 | 111 | * |
| 112 | - * @since 2.0.0 bbPress (r2515) | |
| 112 | + * @since 2.0.0 bbPress (r3071) | |
| 113 | 113 | */ |
| 114 | 114 | public function __construct() { |
| 115 | 115 | $this->setup_globals(); |
| 116 | 116 | $this->includes(); |
| @@ -119,9 +119,9 @@ | ||
| 119 | 119 | |
| 120 | 120 | /** |
| 121 | 121 | * Admin globals |
| 122 | 122 | * |
| 123 | - * @since 2.0.0 bbPress (r2646) | |
| 123 | + * @since 2.0.0 bbPress (r3338) | |
| 124 | 124 | * |
| 125 | 125 | * @access private |
| 126 | 126 | */ |
| 127 | 127 | private function setup_globals() { |
| @@ -140,9 +140,9 @@ | ||
| 140 | 140 | |
| 141 | 141 | /** |
| 142 | 142 | * Include required files |
| 143 | 143 | * |
| 144 | - * @since 2.0.0 bbPress (r2646) | |
| 144 | + * @since 2.0.0 bbPress (r3338) | |
| 145 | 145 | * |
| 146 | 146 | * @access private |
| 147 | 147 | */ |
| 148 | 148 | private function includes() { |
| @@ -168,9 +168,9 @@ | ||
| 168 | 168 | |
| 169 | 169 | /** |
| 170 | 170 | * Setup the admin hooks, actions and filters |
| 171 | 171 | * |
| 172 | - * @since 2.0.0 bbPress (r2646) | |
| 172 | + * @since 2.0.0 bbPress (r3338) | |
| 173 | 173 | * |
| 174 | 174 | * @access private |
| 175 | 175 | */ |
| 176 | 176 | private function setup_actions() { |
| @@ -232,9 +232,9 @@ | ||
| 232 | 232 | |
| 233 | 233 | /** |
| 234 | 234 | * Setup general admin area notices. |
| 235 | 235 | * |
| 236 | - * @since 2.6.0 bbPress (r6701) | |
| 236 | + * @since 2.6.0 bbPress (r6705) | |
| 237 | 237 | */ |
| 238 | 238 | public function setup_notices() { |
| 239 | 239 | |
| 240 | 240 | // Avoid malformed notices variable |
| @@ -274,9 +274,9 @@ | ||
| 274 | 274 | |
| 275 | 275 | /** |
| 276 | 276 | * Handle hiding of general admin area notices. |
| 277 | 277 | * |
| 278 | - * @since 2.6.0 bbPress (r6701) | |
| 278 | + * @since 2.6.0 bbPress (r6705) | |
| 279 | 279 | */ |
| 280 | 280 | public function hide_notices() { |
| 281 | 281 | |
| 282 | 282 | // Hiding a notice? |
| @@ -425,9 +425,9 @@ | ||
| 425 | 425 | |
| 426 | 426 | /** |
| 427 | 427 | * Maybe append the pending upgrade count to the "Tools" menu. |
| 428 | 428 | * |
| 429 | - * @since 2.6.0 bbPress (r6896) | |
| 429 | + * @since 2.6.0 bbPress (r6897) | |
| 430 | 430 | * |
| 431 | 431 | * @global menu $menu |
| 432 | 432 | */ |
| 433 | 433 | public function add_upgrade_count() { |
| @@ -466,13 +466,14 @@ | ||
| 466 | 466 | |
| 467 | 467 | // Loop through tools and check |
| 468 | 468 | if ( ! empty( $tools ) ) { |
| 469 | 469 | foreach ( $tools as $tool ) { |
| 470 | + $name = wp_kses_post( $tool['name'] ); | |
| 470 | 471 | |
| 471 | 472 | // Try to add the admin page |
| 472 | 473 | $page = add_management_page( |
| 473 | - $tool['name'], | |
| 474 | - $tool['name'], | |
| 474 | + $name, | |
| 475 | + $name, | |
| 475 | 476 | $tool['cap'], |
| 476 | 477 | $tool['page'], |
| 477 | 478 | $tool['func'] |
| 478 | 479 | ); |
| @@ -550,9 +551,9 @@ | ||
| 550 | 551 | |
| 551 | 552 | /** |
| 552 | 553 | * Add the network admin menus |
| 553 | 554 | * |
| 554 | - * @since 2.1.0 bbPress (r3689) | |
| 555 | + * @since 2.1.0 bbPress (r3731) | |
| 555 | 556 | */ |
| 556 | 557 | public function network_admin_menus() { |
| 557 | 558 | |
| 558 | 559 | // Bail if plugin is not network activated |
| @@ -633,9 +634,9 @@ | ||
| 633 | 634 | |
| 634 | 635 | /** |
| 635 | 636 | * Maps settings capabilities |
| 636 | 637 | * |
| 637 | - * @since 2.2.0 bbPress (r4242) | |
| 638 | + * @since 2.2.0 bbPress (r4244) | |
| 638 | 639 | * |
| 639 | 640 | * @param array $caps Capabilities for meta capability |
| 640 | 641 | * @param string $cap Capability name |
| 641 | 642 | * @param int $user_id User id |
| @@ -672,8 +673,15 @@ | ||
| 672 | 673 | case 'bbp_settings_per_rss_page' : // Settings - Per RSS page |
| 673 | 674 | $caps = array( bbp_admin()->minimum_capability ); |
| 674 | 675 | break; |
| 675 | 676 | |
| 677 | + // On multisite, use a grantable capability for network user imports. | |
| 678 | + case 'bbp_tools_import_users' : | |
| 679 | + $caps = is_multisite() | |
| 680 | + ? array( $cap ) | |
| 681 | + : array( bbp_setup_admin()->minimum_capability ); | |
| 682 | + break; | |
| 683 | + | |
| 676 | 684 | // Extend - BuddyPress |
| 677 | 685 | case 'bbp_settings_buddypress' : |
| 678 | 686 | if ( ( is_plugin_active( 'buddypress/bp-loader.php' ) && defined( 'BP_VERSION' ) && bp_is_root_blog() ) && is_super_admin() ) { |
| 679 | 687 | $caps = array( bbp_admin()->minimum_capability ); |
| @@ -700,9 +708,9 @@ | ||
| 700 | 708 | |
| 701 | 709 | /** |
| 702 | 710 | * Register the importers |
| 703 | 711 | * |
| 704 | - * @since 2.0.0 bbPress (r2737) | |
| 712 | + * @since 2.0.0 bbPress (r3194) | |
| 705 | 713 | */ |
| 706 | 714 | public function register_importers() { |
| 707 | 715 | |
| 708 | 716 | // Leave if we're not in the import section |
| @@ -734,9 +742,9 @@ | ||
| 734 | 742 | |
| 735 | 743 | /** |
| 736 | 744 | * Add Settings link to plugins area |
| 737 | 745 | * |
| 738 | - * @since 2.0.0 bbPress (r2737) | |
| 746 | + * @since 2.2.0 bbPress (r4159) | |
| 739 | 747 | * |
| 740 | 748 | * @param array $links Links array in which we would prepend our link |
| 741 | 749 | * @param string $file Current plugin basename |
| 742 | 750 | * @return array Processed links |
| @@ -767,9 +775,9 @@ | ||
| 767 | 775 | |
| 768 | 776 | /** |
| 769 | 777 | * Enqueue any admin scripts we might need |
| 770 | 778 | * |
| 771 | - * @since 2.2.0 bbPress (r4260) | |
| 779 | + * @since 2.2.0 bbPress (r4261) | |
| 772 | 780 | */ |
| 773 | 781 | public function enqueue_scripts() { |
| 774 | 782 | |
| 775 | 783 | // Get the current screen |
| @@ -807,9 +815,9 @@ | ||
| 807 | 815 | |
| 808 | 816 | /** |
| 809 | 817 | * Enqueue any admin scripts we might need |
| 810 | 818 | * |
| 811 | - * @since 2.6.0 bbPress (r5224) | |
| 819 | + * @since 2.6.0 bbPress (r5225) | |
| 812 | 820 | */ |
| 813 | 821 | public function enqueue_styles() { |
| 814 | 822 | wp_enqueue_style( 'bbp-admin-css' ); |
| 815 | 823 | } |
| @@ -837,9 +845,9 @@ | ||
| 837 | 845 | * |
| 838 | 846 | * Because wp-content can exist outside of the WordPress root, there is no |
| 839 | 847 | * way to be certain what the relative path of admin images is. |
| 840 | 848 | * |
| 841 | - * @since 2.6.0 bbPress (r2521) | |
| 849 | + * @since 2.6.0 bbPress (r6913) | |
| 842 | 850 | */ |
| 843 | 851 | public function register_admin_styles() { |
| 844 | 852 | |
| 845 | 853 | // RTL and/or minified |
| @@ -890,9 +898,9 @@ | ||
| 890 | 898 | * Because wp-content can exist outside of the WordPress root there is no |
| 891 | 899 | * way to be certain what the relative path of the admin images is. |
| 892 | 900 | * We are including the two most common configurations here, just in case. |
| 893 | 901 | * |
| 894 | - * @since 2.6.0 bbPress (r2521) | |
| 902 | + * @since 2.6.0 bbPress (r6913) | |
| 895 | 903 | */ |
| 896 | 904 | public function register_admin_scripts() { |
| 897 | 905 | |
| 898 | 906 | // Minified |
| @@ -973,9 +981,9 @@ | ||
| 973 | 981 | |
| 974 | 982 | // If we found some topics, loop through and display them |
| 975 | 983 | if ( ! empty( $topics ) ) { |
| 976 | 984 | foreach ( (array) $topics as $post ) { |
| 977 | - printf( esc_html__( '%1$s - %2$s', 'bbpress' ), bbp_get_topic_id( $post->ID ), bbp_get_topic_title( $post->ID ) . "\n" ); | |
| 985 | + printf( esc_html__( '%1$s - %2$s', 'bbpress' ), bbp_get_topic_id( $post->ID ), esc_html( bbp_get_topic_title( $post->ID ) ) . "\n" ); | |
| 978 | 986 | } |
| 979 | 987 | } |
| 980 | 988 | die(); |
| 981 | 989 | } |
| @@ -982,9 +990,9 @@ | ||
| 982 | 990 | |
| 983 | 991 | /** |
| 984 | 992 | * Ajax action for facilitating the topic and reply author auto-suggest |
| 985 | 993 | * |
| 986 | - * @since 2.4.0 bbPress (r5014) | |
| 994 | + * @since 2.4.0 bbPress (r5015) | |
| 987 | 995 | */ |
| 988 | 996 | public function suggest_user() { |
| 989 | 997 | |
| 990 | 998 | // Do some very basic request checking |
| @@ -1053,9 +1061,9 @@ | ||
| 1053 | 1061 | |
| 1054 | 1062 | // If we found some users, loop through and output them to the AJAX |
| 1055 | 1063 | if ( ! empty( $users_query->results ) ) { |
| 1056 | 1064 | foreach ( (array) $users_query->results as $user ) { |
| 1057 | - printf( esc_html__( '%1$s - %2$s', 'bbpress' ), bbp_get_user_id( $user->ID ), bbp_get_user_nicename( $user->ID, array( 'force' => $user->user_nicename ) ) . "\n" ); | |
| 1065 | + printf( esc_html__( '%1$s - %2$s', 'bbpress' ), bbp_get_user_id( $user->ID ), esc_html( bbp_get_user_nicename( $user->ID, array( 'force' => $user->user_nicename ) ) ) . "\n" ); | |
| 1058 | 1066 | } |
| 1059 | 1067 | } |
| 1060 | 1068 | die(); |
| 1061 | 1069 | } |
| @@ -1302,9 +1310,9 @@ | ||
| 1302 | 1310 | |
| 1303 | 1311 | /** |
| 1304 | 1312 | * Update all bbPress forums across all sites |
| 1305 | 1313 | * |
| 1306 | - * @since 2.1.0 bbPress (r3689) | |
| 1314 | + * @since 2.1.0 bbPress (r3731) | |
| 1307 | 1315 | */ |
| 1308 | 1316 | public static function update_screen() { |
| 1309 | 1317 | |
| 1310 | 1318 | // Get action |
| @@ -1318,8 +1326,9 @@ | ||
| 1318 | 1326 | |
| 1319 | 1327 | // Taking action |
| 1320 | 1328 | switch ( $action ) { |
| 1321 | 1329 | case 'bbp-update' : |
| 1330 | + check_admin_referer( 'bbp-update' ); | |
| 1322 | 1331 | |
| 1323 | 1332 | // Run the full updater |
| 1324 | 1333 | bbp_version_updater(); ?> |
| 1325 | 1334 | |
| @@ -1333,9 +1342,9 @@ | ||
| 1333 | 1342 | case 'show' : |
| 1334 | 1343 | default : ?> |
| 1335 | 1344 | |
| 1336 | 1345 | <p><?php esc_html_e( 'You can update your forum through this page. Hit the link below to update.', 'bbpress' ); ?></p> |
| 1337 | - <p><a class="button" href="index.php?page=bbp-update&action=bbp-update"><?php esc_html_e( 'Update Forum', 'bbpress' ); ?></a></p> | |
| 1346 | + <p><a class="button" href="<?php echo esc_url( wp_nonce_url( 'index.php?page=bbp-update&action=bbp-update', 'bbp-update' ) ); ?>"><?php esc_html_e( 'Update Forum', 'bbpress' ); ?></a></p> | |
| 1338 | 1347 | |
| 1339 | 1348 | <?php break; |
| 1340 | 1349 | |
| 1341 | 1350 | } ?> |
| @@ -1345,9 +1354,9 @@ | ||
| 1345 | 1354 | |
| 1346 | 1355 | /** |
| 1347 | 1356 | * Update all bbPress forums across all sites |
| 1348 | 1357 | * |
| 1349 | - * @since 2.1.0 bbPress (r3689) | |
| 1358 | + * @since 2.1.0 bbPress (r3731) | |
| 1350 | 1359 | */ |
| 1351 | 1360 | public static function network_update_screen() { |
| 1352 | 1361 | $bbp_db = bbp_db(); |
| 1353 | 1362 | |
| @@ -1362,8 +1371,9 @@ | ||
| 1362 | 1371 | |
| 1363 | 1372 | // Taking action |
| 1364 | 1373 | switch ( $action ) { |
| 1365 | 1374 | case 'bbpress-update' : |
| 1375 | + check_admin_referer( 'bbpress-update' ); | |
| 1366 | 1376 | |
| 1367 | 1377 | // Site counter |
| 1368 | 1378 | $n = isset( $_GET['n'] ) ? intval( $_GET['n'] ) : 0; |
| 1369 | 1379 | |
| @@ -1433,14 +1443,14 @@ | ||
| 1433 | 1443 | </ul> |
| 1434 | 1444 | |
| 1435 | 1445 | <p> |
| 1436 | 1446 | <?php esc_html_e( 'If your browser doesn’t start loading the next page automatically, click this link:', 'bbpress' ); ?> |
| 1437 | - <a class="button" href="update-core.php?page=bbpress-update&action=bbpress-update&n=<?php echo ( $n + 5 ); ?>"><?php esc_html_e( 'Next Forums', 'bbpress' ); ?></a> | |
| 1447 | + <a class="button" href="<?php echo esc_url( wp_nonce_url( 'update-core.php?page=bbpress-update&action=bbpress-update&n=' . ( $n + 5 ), 'bbpress-update' ) ); ?>"><?php esc_html_e( 'Next Forums', 'bbpress' ); ?></a> | |
| 1438 | 1448 | </p> |
| 1439 | 1449 | <script type='text/javascript'> |
| 1440 | 1450 | <!-- |
| 1441 | 1451 | function nextpage() { |
| 1442 | - location.href = 'update-core.php?page=bbpress-update&action=bbpress-update&n=<?php echo ( $n + 5 ) ?>'; | |
| 1452 | + location.href = '<?php echo esc_js( add_query_arg( '_wpnonce', wp_create_nonce( 'bbpress-update' ), 'update-core.php?page=bbpress-update&action=bbpress-update&n=' . ( $n + 5 ) ) ); ?>'; | |
| 1443 | 1453 | } |
| 1444 | 1454 | setTimeout( 'nextpage()', 250 ); |
| 1445 | 1455 | //--> |
| 1446 | 1456 | </script><?php |
| @@ -1452,9 +1462,9 @@ | ||
| 1452 | 1462 | case 'show' : |
| 1453 | 1463 | default : ?> |
| 1454 | 1464 | |
| 1455 | 1465 | <p><?php esc_html_e( 'You can update all the forums on your network through this page. It works by calling the update script of each site automatically. Hit the link below to update.', 'bbpress' ); ?></p> |
| 1456 | - <p><a class="button" href="update-core.php?page=bbpress-update&action=bbpress-update"><?php esc_html_e( 'Update Forums', 'bbpress' ); ?></a></p> | |
| 1466 | + <p><a class="button" href="<?php echo esc_url( wp_nonce_url( 'update-core.php?page=bbpress-update&action=bbpress-update', 'bbpress-update' ) ); ?>"><?php esc_html_e( 'Update Forums', 'bbpress' ); ?></a></p> | |
| 1457 | 1467 | |
| 1458 | 1468 | <?php break; |
| 1459 | 1469 | |
| 1460 | 1470 | } ?> |
