← All changes | common/ratings.php +13 -9 0.3.7 → trunk View file →

		@@ -1,9 +1,9 @@
1	1	<?php
2	2
3		-if ( !class_exists( 'MeowCommon_Ratings' ) ) {
	3	+if ( !class_exists( 'MeowKit_MWCODE_Ratings' ) ) {
4	4
5		- class MeowCommon_Ratings {
	5	+ class MeowKit_MWCODE_Ratings {
6	6	public $mainfile; // plugin main file (media-file-renamer.php)
7	7	public $domain; // domain used for translation (media-file-renamer)
8	8	public $prefix; // used for many things (filters, options, etc)
9	9	public $ignored_domains = [ 'mwai-*' ];
		@@ -55,9 +55,12 @@
55	55	return $rating_date;
56	56	}
57	57
58	58	public function admin_notices_rating() {
59		- if ( isset( $_POST[$this->prefix . '_remind_me'] ) ) {
	59	+ // Verify the nonce before acting on any of the review-notice buttons (CSRF protection).
	60	+ $nonce_ok = isset( $_POST[ $this->prefix . '_rating_nonce' ] )
	61	+ && wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST[ $this->prefix . '_rating_nonce' ] ) ), $this->prefix . '_rating' );
	62	+ if ( $nonce_ok && isset( $_POST[$this->prefix . '_remind_me'] ) ) {
60	63	$two_weeks = strtotime( '+2 weeks' );
61	64	$six_weeks = strtotime( '+6 weeks' );
62	65	$future_date = mt_rand( $two_weeks, $six_weeks );
63	66	update_option( $this->prefix . '_rating_date', $future_date, false );
		@@ -62,14 +65,14 @@
62	65	$future_date = mt_rand( $two_weeks, $six_weeks );
63	66	update_option( $this->prefix . '_rating_date', $future_date, false );
64	67	return;
65	68	}
66		- else if ( isset( $_POST[$this->prefix . '_never_remind_me'] ) ) {
	69	+ else if ( $nonce_ok && isset( $_POST[$this->prefix . '_never_remind_me'] ) ) {
67	70	$twenty_years = strtotime( '+5 years' );
68	71	update_option( $this->prefix . '_rating_date', $twenty_years, false );
69	72	return;
70	73	}
71		- else if ( isset( $_POST[$this->prefix . '_did_it'] ) ) {
	74	+ else if ( $nonce_ok && isset( $_POST[$this->prefix . '_did_it'] ) ) {
72	75	$twenty_years = strtotime( '+100 years' );
73	76	update_option( $this->prefix . '_rating_date', $twenty_years, false );
74	77	return;
75	78	}
		@@ -87,11 +90,12 @@
87	90	$esc_nice_name = 'AI Engine';
88	91	}
89	92	$esc_short_url = esc_attr( $this->nice_short_url_from_file( $this->mainfile ) );
90	93	$escaped_prefix = $this->prefix;
	94	+ $rating_nonce = esc_attr( wp_create_nonce( $this->prefix . '_rating' ) );
91	95	$html .= '<p style="font-size: 100%;">';
92	96	// Translators: %1$s is a plugin nicename, %2$s is a short url (slug)
93		- $url = 'https://wordpress.org/support/plugin/' . $esc_short_url . '/reviews/?rate=5#new-post';
	97	+ $url = 'https://wordpress.org/support/plugin/' . $esc_short_url . '/reviews/';
94	98	$html .= sprintf(
95	99	__( '<h2 style="margin: 0" class="title">You have been using <b>%1$s</b> for some time now. Thank you! 💕</h2><p>If you have a minute, can you write a <b><a target="_blank" href="' . $url . '">little review</a></b> for me? That would <b>really</b> bring me joy and motivation! 💫 <br />Don\'t hesitate to <b>share your feature requests</b> with the review, I always check them and try my best.</p>
96	100	', $this->domain ),
97	101	$esc_nice_name
		@@ -100,9 +104,9 @@
100	104	$html .= '<a target="_blank" class="button button-primary" style="margin-right: 10px;" href="' . $url . '">
101	105	✏️ Write Review
102	106	</a>
103	107	<form method="post" action="" style="margin-right: 10px;">
104		- <input type="hidden" name="' . $escaped_prefix . '_did_it" value="true">
	108	+ <input type="hidden" name="' . $escaped_prefix . '_did_it" value="true"><input type="hidden" name="' . $escaped_prefix . '_rating_nonce" value="' . $rating_nonce . '">
105	109	<input type="submit" name="submit" id="submit" class="button button-secondary" value="'
106	110	. __( '✌️ Done!', $this->domain ) . '">
107	111	</form>
108	112
		@@ -108,15 +112,15 @@
108	112
109	113	<div style="flex: auto;"></div>
110	114
111	115	<form method="post" action="" style="margin-right: 10px;">
112		- <input type="hidden" name="' . $escaped_prefix . '_remind_me" value="true">
	116	+ <input type="hidden" name="' . $escaped_prefix . '_remind_me" value="true"><input type="hidden" name="' . $escaped_prefix . '_rating_nonce" value="' . $rating_nonce . '">
113	117	<input type="submit" name="submit" id="submit" class="button button-secondary" value="'
114	118	. __( '⏰ Remind me later', $this->domain ) . '">
115	119	</form>
116	120
117	121	<form method="post" action="">
118		- <input type="hidden" name="' . $escaped_prefix . '_never_remind_me" value="true">
	122	+ <input type="hidden" name="' . $escaped_prefix . '_never_remind_me" value="true"><input type="hidden" name="' . $escaped_prefix . '_rating_nonce" value="' . $rating_nonce . '">
119	123	<input type="submit" name="submit" id="submit" class="button-link" style="font-size: small;" value="'
120	124	. __( 'Hide', $this->domain ) . '">
121	125	</form>
122	126	</div>';