| @@ -1,8 +1,12 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | namespace Boxzilla; |
| 4 | 4 | |
| 5 | +if (! defined('ABSPATH')) { | |
| 6 | + exit; | |
| 7 | +} | |
| 8 | + | |
| 5 | 9 | class BoxLoader |
| 6 | 10 | { |
| 7 | 11 | /** |
| 8 | 12 | * @var Plugin |
| @@ -107,9 +111,9 @@ | ||
| 107 | 111 | * @return string |
| 108 | 112 | */ |
| 109 | 113 | protected function get_request_url() |
| 110 | 114 | { |
| 111 | - return rtrim($_SERVER['REQUEST_URI'], '/'); | |
| 115 | + return rtrim(wp_unslash($_SERVER['REQUEST_URI'] ?? ''), '/'); | |
| 112 | 116 | } |
| 113 | 117 | |
| 114 | 118 | /** |
| 115 | 119 | * Check if this rule passes (conditional matches expected value) |
| @@ -138,9 +142,9 @@ | ||
| 138 | 142 | break; |
| 139 | 143 | |
| 140 | 144 | case 'is_referer': |
| 141 | 145 | if (! empty($_SERVER['HTTP_REFERER'])) { |
| 142 | - $referer = $_SERVER['HTTP_REFERER']; | |
| 146 | + $referer = wp_unslash($_SERVER['HTTP_REFERER']); | |
| 143 | 147 | $matched = $this->match_patterns($referer, $values, $qualifier === 'contains' || $qualifier === 'not_contains'); |
| 144 | 148 | } |
| 145 | 149 | break; |
| 146 | 150 | |
| @@ -267,9 +271,8 @@ | ||
| 267 | 271 | { |
| 268 | 272 | wp_enqueue_style('boxzilla', $this->plugin->url('/assets/css/styles.css'), [], $this->plugin->version()); |
| 269 | 273 | wp_enqueue_script('boxzilla', $this->plugin->url('/assets/js/script.js'), [], $this->plugin->version(), [ |
| 270 | 274 | 'strategy' => 'defer', |
| 271 | - 'in_footer' => true, | |
| 272 | 275 | ]); |
| 273 | 276 | |
| 274 | 277 | // create boxzilla_Global_Options object |
| 275 | 278 | $plugin_options = $this->options; |
| @@ -283,11 +286,9 @@ | ||
| 283 | 286 | }, |
| 284 | 287 | $boxes |
| 285 | 288 | ), |
| 286 | 289 | ]; |
| 287 | - | |
| 288 | - wp_localize_script('boxzilla', 'boxzilla_options', $data); | |
| 289 | - | |
| 290 | + wp_add_inline_script('boxzilla', 'var boxzilla_options = ' . wp_json_encode($data) . ';', 'before'); | |
| 290 | 291 | do_action('boxzilla_load_assets', $this); |
| 291 | 292 | } |
| 292 | 293 | |
| 293 | 294 | public function print_boxes_content() |
| @@ -298,9 +299,9 @@ | ||
| 298 | 299 | } |
| 299 | 300 | |
| 300 | 301 | echo '<div style="display: none;">'; |
| 301 | 302 | foreach ($boxes as $box) { |
| 302 | - echo "<div id=\"boxzilla-box-{$box->ID}-content\">", $box->get_content(), "</div>"; | |
| 303 | + printf('<div id="boxzilla-box-%d-content">%s</div>', absint($box->ID), $box->get_content()); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 303 | 304 | } |
| 304 | 305 | echo '</div>'; |
| 305 | 306 | } |
| 306 | 307 | |
| @@ -312,9 +313,9 @@ | ||
| 312 | 313 | public function get_matched_boxes() |
| 313 | 314 | { |
| 314 | 315 | static $boxes; |
| 315 | 316 | |
| 316 | - if (is_null($boxes)) { | |
| 317 | + if ($boxes === null) { | |
| 317 | 318 | if (count($this->box_ids_to_load) === 0) { |
| 318 | 319 | return []; |
| 319 | 320 | } |
| 320 | 321 | |
