| @@ -97,18 +97,21 @@ | ||
| 97 | 97 | * @retun void |
| 98 | 98 | * @since 1.0.2 |
| 99 | 99 | */ |
| 100 | 100 | public function write_block_css() { |
| 101 | - if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'betterdocs_style_handler_nonce' ) || ! current_user_can( 'manage_options' ) ) { | |
| 101 | + $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : ''; | |
| 102 | + if ( ! wp_verify_nonce( $nonce, 'betterdocs_style_handler_nonce' ) || ! current_user_can( 'manage_options' ) ) { | |
| 102 | 103 | echo 'Invalid request'; |
| 103 | 104 | wp_die(); |
| 104 | 105 | } |
| 105 | 106 | |
| 106 | - $block_styles = (array) json_decode( stripslashes( $_POST['data'] ) ); | |
| 107 | + $raw_data = isset( $_POST['data'] ) ? wp_unslash( $_POST['data'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- decoded JSON; values are sanitized in build_css(). | |
| 108 | + $block_styles = (array) json_decode( $raw_data ); | |
| 107 | 109 | |
| 108 | - if ( isset( $_POST['editorType'] ) && $_POST['editorType'] === 'edit-site' ) { | |
| 110 | + $editor_type = isset( $_POST['editorType'] ) ? sanitize_key( wp_unslash( $_POST['editorType'] ) ) : ''; | |
| 111 | + if ( 'edit-site' === $editor_type ) { | |
| 109 | 112 | $upload_dir = wp_upload_dir()['basedir'] . '/betterdocs-style/'; |
| 110 | - $editSiteCssPath = $upload_dir . 'betterdocs-style-' . $_POST['editorType'] . '.min.css'; | |
| 113 | + $editSiteCssPath = $upload_dir . 'betterdocs-style-' . $editor_type . '.min.css'; | |
| 111 | 114 | if ( file_exists( $editSiteCssPath ) ) { |
| 112 | 115 | $existingCss = file_get_contents( $editSiteCssPath ); |
| 113 | 116 | $pattern = '~\/\*(.*?)\*\/~'; |
| 114 | 117 | preg_match_all( $pattern, $existingCss, $result, PREG_PATTERN_ORDER ); |
| @@ -134,9 +137,9 @@ | ||
| 134 | 137 | |
| 135 | 138 | if ( ! empty( $css = $this->build_css( $finalCSSArray ) ) ) { |
| 136 | 139 | $upload_dir = wp_upload_dir()['basedir'] . '/betterdocs-style/'; |
| 137 | 140 | if ( ! file_exists( $upload_dir ) ) { |
| 138 | - mkdir( $upload_dir ); | |
| 141 | + wp_mkdir_p( $upload_dir ); | |
| 139 | 142 | } |
| 140 | 143 | |
| 141 | 144 | file_put_contents( $editSiteCssPath, $css ); |
| 142 | 145 | } |
| @@ -142,9 +145,9 @@ | ||
| 142 | 145 | } |
| 143 | 146 | } elseif ( ! empty( $css = $this->build_css( $block_styles ) ) ) { |
| 144 | 147 | $upload_dir = wp_upload_dir()['basedir'] . '/betterdocs-style/'; |
| 145 | 148 | if ( ! file_exists( $upload_dir ) ) { |
| 146 | - mkdir( $upload_dir ); | |
| 149 | + wp_mkdir_p( $upload_dir ); | |
| 147 | 150 | } |
| 148 | 151 | |
| 149 | 152 | file_put_contents( $editSiteCssPath, $css ); |
| 150 | 153 | } |
| @@ -150,11 +153,12 @@ | ||
| 150 | 153 | } |
| 151 | 154 | } elseif ( ! empty( $css = $this->build_css( $block_styles ) ) ) { |
| 152 | 155 | $upload_dir = wp_upload_dir()['basedir'] . '/betterdocs-style/'; |
| 153 | 156 | if ( ! file_exists( $upload_dir ) ) { |
| 154 | - mkdir( $upload_dir ); | |
| 157 | + wp_mkdir_p( $upload_dir ); | |
| 155 | 158 | } |
| 156 | - file_put_contents( $upload_dir . 'betterdocs-style-' . abs( $_POST['id'] ) . '.min.css', $css ); | |
| 159 | + $post_id = isset( $_POST['id'] ) ? absint( wp_unslash( $_POST['id'] ) ) : 0; | |
| 160 | + file_put_contents( $upload_dir . 'betterdocs-style-' . $post_id . '.min.css', $css ); | |
| 157 | 161 | } |
| 158 | 162 | |
| 159 | 163 | wp_send_json_success( 'done' ); |
| 160 | 164 | } |
