← All changes | admin-core/inc/log-status.php +7 -165 3.1.3 → 3.3.0 View file →

		@@ -13,8 +13,13 @@
13	13	}
14	14
15	15	/**
16	16	* Class LogStatus.
	17	+ *
	18	+ * Reads the log directory for the debug UI. The download/delete handlers live in
	19	+ * ajax/debugger.php, which resolves the filename through get_log_files() and adds a
	20	+ * realpath containment check; the unreferenced copies that used to sit here took
	21	+ * $_REQUEST['handle'] straight onto the log path and were removed.
17	22	*/
18	23	class LogStatus {
19	24
20	25	/**
		@@ -26,17 +31,8 @@
26	31	*/
27	32	private static $instance;
28	33
29	34	/**
30		- * Deleted
31		- *
32		- * @access private
33		- * @var object Class object.
34		- * @since 1.0.0
35		- */
36		- private static $file_deleted = false;
37		-
38		- /**
39	35	* Initiator
40	36	*
41	37	* @since 1.0.0
42	38	* @return object initialized object of class.
		@@ -48,17 +44,8 @@
48	44	return self::$instance;
49	45	}
50	46
51	47	/**
52		- * Instance
53		- *
54		- * @access private
55		- * @var string Class object.
56		- * @since 1.0.0
57		- */
58		- private $menu_slug;
59		-
60		- /**
61	48	* Constructor
62	49	*
63	50	* @since 1.0.0
64	51	*/
		@@ -65,82 +52,8 @@
65	52	public function __construct() {
66	53	}
67	54
68	55	/**
69		- * User action like download or delete log files.
70		- */
71		- public function user_actions() {
72		-
73		- // Ignoring nonce verification as using SuperGlobal variables on WordPress hooks.
74		- if ( ! empty( $_REQUEST['handle'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended
75		-
76		- if ( ! current_user_can( 'cartflows_manage_settings' ) ) {
77		-
78		- wp_die( esc_html__( 'You don\'t have permission to view this page.', 'cartflows' ) );
79		- }
80		-
81		- if ( isset( $_REQUEST['btn_action'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended
82		-
83		- $button_action = sanitize_text_field( wp_unslash( $_REQUEST['btn_action'] ) ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended
84		-
85		- switch ( $button_action ) {
86		- case 'remove-log':
87		- $this->delete_log_file();
88		- break;
89		-
90		- case 'download-log':
91		- $this->download_log_file();
92		- break;
93		-
94		- default:
95		- break;
96		- }
97		- }
98		- }
99		- }
100		-
101		- /**
102		- * Show the log page contents for file log handler.
103		- */
104		- public function display_logs() {
105		-
106		- if ( self::$file_deleted ) {
107		- echo "<div class='wcf-notice updated inline wcf-delete-log--message'>" . esc_html__( 'Log deleted successfully!', 'cartflows' ) . ' </div>';
108		- }
109		-
110		- $logs = $this->get_log_files();
111		-
112		- $form_url = esc_url(
113		- add_query_arg(
114		- array(
115		- 'page' => 'cartflows',
116		- 'action' => 'wcf-log',
117		- ),
118		- admin_url( '/admin.php' )
119		- )
120		- );
121		-
122		- $viewed_log = '';
123		- $viewed_log_file = '';
124		-
125		- // Calling this function on CartFlows action hook. Hence ignoring nonce.
126		- if ( ! empty( $_REQUEST['log_file'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended
127		-
128		- $filename = sanitize_text_field( wp_unslash( $_REQUEST['log_file'] ) ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended
129		-
130		- if ( isset( $logs[ $filename ] ) ) {
131		- $viewed_log = $filename;
132		- $viewed_log_file = $viewed_log . '.log';
133		- }
134		- } elseif ( ! empty( $logs ) ) {
135		- $viewed_log = current( $logs ) ? pathinfo( current( $logs ), PATHINFO_FILENAME ) : '';
136		- $viewed_log_file = $viewed_log . '.log';
137		- }
138		-
139		- include_once CARTFLOWS_ADMIN_CORE_DIR . 'views/debugger.php';
140		- }
141		-
142		- /**
143	56	* Get all log files in the log directory.
144	57	*
145	58	* @return array
146	59	*/
		@@ -145,13 +58,13 @@
145	58	* @return array
146	59	*/
147	60	public function get_log_files() {
148	61	// Condition for multisite instances:
149		- // Return empty array if log directory doesn't exist yet or is not readable.
	62	+ // Return empty array if log directory doesn't exist yet or is not readable.
150	63	if ( ! is_dir( CARTFLOWS_LOG_DIR ) || ! is_readable( CARTFLOWS_LOG_DIR ) ) {
151	64	return array();
152	65	}
153		-
	66	+
154	67	$files = scandir( CARTFLOWS_LOG_DIR );
155	68	$result = array();
156	69
157	70	if ( ! empty( $files ) ) {
		@@ -162,79 +75,8 @@
162	75	}
163	76	}
164	77
165	78	return $result;
166		- }
167		-
168		- /**
169		- * Delete Provided log file
170		- */
171		- public function delete_log_file() {
172		-
173		- if ( empty( $_REQUEST['_wpnonce'] ) ||
174		- ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'remove_log' )
175		- ) {
176		- wp_die( esc_html__( 'Nonce verification failed. Please refresh the page and retry.', 'cartflows' ) );
177		- }
178		-
179		- if ( empty( $_REQUEST['handle'] ) ) {
180		- wp_die( esc_html__( 'Filename is empty. Please refresh the page and retry.', 'cartflows' ) );
181		- }
182		-
183		- $file_name = basename( trim( sanitize_text_field( wp_unslash( $_REQUEST['handle'] ) ) ) );
184		-
185		- if ( '' === $file_name || '.log' !== substr( $file_name, -4 ) ) {
186		- wp_die( esc_html__( 'Invalid file.', 'cartflows' ) );
187		- }
188		-
189		- $log_dir = CARTFLOWS_LOG_DIR;
190		- $real_dir = realpath( $log_dir );
191		- $real_path = realpath( $log_dir . $file_name );
192		-
193		- if ( false === $real_path || false === $real_dir || 0 !== strpos( $real_path, trailingslashit( $real_dir ) ) ) {
194		- wp_die( esc_html__( 'Invalid file.', 'cartflows' ) );
195		- }
196		-
197		- if ( file_exists( $real_path ) ) {
198		- wp_delete_file( $real_path );
199		- self::$file_deleted = true;
200		- }
201		- }
202		-
203		- /**
204		- * Download the selected log file.
205		- */
206		- public function download_log_file() {
207		-
208		- if ( empty( $_REQUEST['_wpnonce'] ) ||
209		- ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'download_log' )
210		- ) {
211		- wp_die( esc_html__( 'Nonce verification failed. Please refresh the page and retry.', 'cartflows' ) );
212		- }
213		-
214		- $file_name = isset( $_REQUEST['handle'] ) ? trim( sanitize_text_field( wp_unslash( $_REQUEST['handle'] ) ) ) : '';
215		- $file_path = CARTFLOWS_LOG_DIR . $file_name;
216		-
217		- if ( ! file_exists( $file_path ) ) {
218		- return;
219		- }
220		-
221		- $file_extension = pathinfo( $file_name, PATHINFO_EXTENSION );
222		- $allowed_files = array( 'log' );
223		-
224		- // Return if the desired file is not found for download.
225		- if ( ! in_array( $file_extension, $allowed_files, true ) || strpos( $file_name, '.php' ) !== false ) {
226		- wp_die( esc_html__( 'Invalid file.', 'cartflows' ) );
227		- return;
228		- }
229		-
230		- header( 'Content-Type: text/log; charset=utf-8' );
231		- header( 'Content-Disposition: attachment; filename=' . $file_name );
232		- header( 'Pragma: no-cache' );
233		- header( 'Expires: 0' );
234		-
235		- echo file_get_contents( $file_path ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
236		- exit;
237	79	}
238	80	}
239	81
240	82	LogStatus::get_instance();