← All changes | freemius/includes/fs-core-functions.php +67 -10 2.6.1 → 2.6.6 View file →

		@@ -132,48 +132,103 @@
132	132	#--------------------------------------------------------------------------------
133	133	#region Request handlers.
134	134	#--------------------------------------------------------------------------------
135	135
136		- if ( ! function_exists( 'fs_request_get' ) ) {
	136	+ if ( ! function_exists( 'fs_request_get_raw' ) ) {
137	137	/**
138		- * A helper method to fetch GET/POST user input with an optional default value when the input is not set.
139		- * @author Vova Feldman (@svovaf)
	138	+ * A helper function to fetch GET/POST user input with an optional default value when the input is not set.
	139	+ * This function does not do sanitization. It is up to the caller to properly sanitize and validate the input.
140	140	*
	141	+ * The return of this function is always unslashed.
	142	+ *
	143	+ * @since 2.5.10
	144	+ *
141	145	* @param string $key
142	146	* @param mixed $def
143		- * @param string|bool $type Since 1.2.1.7 - when set to 'get' will look for the value passed via querystring, when
144		- * set to 'post' will look for the value passed via the POST request's body, otherwise,
145		- * will check if the parameter was passed in any of the two.
	147	+ * @param string|bool $type When set to 'get', it will look for the value passed via query string. When
	148	+ * set to 'post', it will look for the value passed via the POST request's body. Otherwise,
	149	+ * it will check if the parameter was passed using any of the mentioned two methods.
146	150	*
147	151	* @return mixed
148	152	*/
149		- function fs_request_get( $key, $def = false, $type = false ) {
	153	+ function fs_request_get_raw( $key, $def = false, $type = false ) {
150	154	if ( is_string( $type ) ) {
151	155	$type = strtolower( $type );
152	156	}
153	157
154	158	/**
155		- * Note to WordPress.org Reviewers:
156		- * This is a helper method to fetch GET/POST user input with an optional default value when the input is not set. The actual sanitization is done in the scope of the function's usage.
	159	+ * Note to WordPress.org reviewers:
	160	+ * This is a helper function to fetch GET/POST user input with an optional default value when the input is not set. The actual sanitization is done in the scope of the function's usage.
157	161	*/
158	162	switch ( $type ) {
159	163	case 'post':
	164	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing
160	165	$value = isset( $_POST[ $key ] ) ? $_POST[ $key ] : $def;
161	166	break;
162	167	case 'get':
	168	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
163	169	$value = isset( $_GET[ $key ] ) ? $_GET[ $key ] : $def;
164	170	break;
165	171	default:
	172	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
166	173	$value = isset( $_REQUEST[ $key ] ) ? $_REQUEST[ $key ] : $def;
167	174	break;
168	175	}
169	176
170		- return $value;
	177	+ // Don't unslash if the value itself is empty (empty string, null, empty array etc).
	178	+ return empty( $value ) ? $value : wp_unslash( $value );
171	179	}
172	180	}
173	181
	182	+ if ( ! function_exists( 'fs_sanitize_input' ) ) {
	183	+ /**
	184	+ * Sanitizes input recursively (if an array).
	185	+ *
	186	+ * @param mixed $input
	187	+ *
	188	+ * @return mixed
	189	+ * @uses sanitize_text_field()
	190	+ * @since 2.5.10
	191	+ */
	192	+ function fs_sanitize_input( $input ) {
	193	+ if ( is_array( $input ) ) {
	194	+ foreach ( $input as $key => $value ) {
	195	+ $input[ $key ] = fs_sanitize_input( $value );
	196	+ }
	197	+ } else {
	198	+ // Allow empty values to pass through as-is, like `null`, `''`, `0`, `'0'` etc.
	199	+ $input = empty( $input ) ? $input : sanitize_text_field( $input );
	200	+ }
	201	+
	202	+ return $input;
	203	+ }
	204	+ }
	205	+
	206	+ if ( ! function_exists( 'fs_request_get' ) ) {
	207	+ /**
	208	+ * A helper method to fetch GET/POST user input with an optional default value when the input is not set.
	209	+ *
	210	+ * @author Vova Feldman (@svovaf)
	211	+ *
	212	+ * @note The return value is always sanitized with sanitize_text_field().
	213	+ *
	214	+ * @param string $key
	215	+ * @param mixed $def
	216	+ * @param string|bool $type Since 1.2.1.7 - when set to 'get' will look for the value passed via querystring, when
	217	+ * set to 'post' will look for the value passed via the POST request's body, otherwise,
	218	+ * will check if the parameter was passed in any of the two.
	219	+ *
	220	+ *
	221	+ * @return mixed
	222	+ */
	223	+ function fs_request_get( $key, $def = false, $type = false ) {
	224	+ return fs_sanitize_input( fs_request_get_raw( $key, $def, $type ) );
	225	+ }
	226	+ }
	227	+
174	228	if ( ! function_exists( 'fs_request_has' ) ) {
175	229	function fs_request_has( $key ) {
	230	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
176	231	return isset( $_REQUEST[ $key ] );
177	232	}
178	233	}
179	234
		@@ -230,8 +285,9 @@
230	285	}
231	286
232	287	if ( ! function_exists( 'fs_get_action' ) ) {
233	288	function fs_get_action( $action_key = 'action' ) {
	289	+ // phpcs:disable WordPress.Security.NonceVerification.Recommended
234	290	if ( ! empty( $_REQUEST[ $action_key ] ) && is_string( $_REQUEST[ $action_key ] ) ) {
235	291	return strtolower( $_REQUEST[ $action_key ] );
236	292	}
237	293
		@@ -243,8 +299,9 @@
243	299	}
244	300	}
245	301
246	302	return false;
	303	+ // phpcs:enable WordPress.Security.NonceVerification.Recommended
247	304	}
248	305	}
249	306
250	307	if ( ! function_exists( 'fs_request_is_action' ) ) {