| @@ -1,9 +1,9 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | -if ( !class_exists( 'MeowCommon_News' ) ) { | |
| 3 | +if ( !class_exists( 'MeowKit_MWCODE_News' ) ) { | |
| 4 | 4 | |
| 5 | - class MeowCommon_News { | |
| 5 | + class MeowKit_MWCODE_News { | |
| 6 | 6 | private $domain = null; |
| 7 | 7 | private $topic = null; |
| 8 | 8 | private $fromDate = null; |
| 9 | 9 | private $toDate = null; |
| @@ -62,9 +62,12 @@ | ||
| 62 | 62 | return $news['date']; |
| 63 | 63 | } |
| 64 | 64 | |
| 65 | 65 | public function admin_notices_news() { |
| 66 | - if ( isset( $_POST['meowapps_remind_me'] ) ) { | |
| 66 | + // Verify the nonce before acting on the news-notice buttons (CSRF protection). | |
| 67 | + $nonce_ok = isset( $_POST['meowapps_news_nonce'] ) | |
| 68 | + && wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['meowapps_news_nonce'] ) ), 'meowapps_news' ); | |
| 69 | + if ( $nonce_ok && isset( $_POST['meowapps_remind_me'] ) ) { | |
| 67 | 70 | $news = get_option( 'meowapps_news' ); |
| 68 | 71 | $twelve_hours = strtotime( '+12 hours' ); |
| 69 | 72 | $thirtysix_hours = strtotime( '+36 hours' ); |
| 70 | 73 | $news['date'] = mt_rand( $twelve_hours, $thirtysix_hours ); |
| @@ -70,9 +73,9 @@ | ||
| 70 | 73 | $news['date'] = mt_rand( $twelve_hours, $thirtysix_hours ); |
| 71 | 74 | update_option( 'meowapps_news', $news, false ); |
| 72 | 75 | return; |
| 73 | 76 | } |
| 74 | - else if ( isset( $_POST['meowapps_done_it'] ) ) { | |
| 77 | + else if ( $nonce_ok && isset( $_POST['meowapps_done_it'] ) ) { | |
| 75 | 78 | $news = get_option( 'meowapps_news' ); |
| 76 | 79 | $news['date'] = ''; |
| 77 | 80 | update_option( 'meowapps_news', $news, false ); |
| 78 | 81 | return; |
| @@ -80,24 +83,26 @@ | ||
| 80 | 83 | $html = wp_kses_post( '<div class="notice notice-success" style="margin: 20px 0;">' ); |
| 81 | 84 | $html .= '<p style="font-size: 100%;">'; |
| 82 | 85 | |
| 83 | 86 | // Title |
| 84 | - $html .= sprintf( __( '<h2 style="margin: 0 0 10px 0" class="title">AI Engine by Meow Apps: The Power of AI into WordPress 💫</h2>' ) ); | |
| 87 | + $html .= sprintf( __( '<h2 style="margin: 0 0 10px 0" class="title">AI Engine by Meow Apps: The Power of AI into WordPress 💫</h2>', $this->domain ) ); | |
| 85 | 88 | |
| 86 | 89 | // Content |
| 87 | 90 | $html .= sprintf( __( '<p style="font-size: 14px;">Since the end of 2022, I worked a lot to craft <b>the perfect AI plugin for WordPress</b>. Since March 2023, it\'s perfectly stable and packed with features. You\'ll get chatbots, AI forms, easy model training, content and images generation, a template system that will allow you to create your personal assistants for various tasks and much more! Here it is: <a href="%s" target="_blank">AI Engine</a>. Believe me, you will enjoy this. Have fun, and let me know how it goes! 🥳</p>', $this->domain ), 'https://wordpress.org/plugins/ai-engine/' ); |
| 88 | 91 | |
| 92 | + $news_nonce = esc_attr( wp_create_nonce( 'meowapps_news' ) ); | |
| 93 | + | |
| 89 | 94 | // Buttons |
| 90 | 95 | $html .= '<div style="padding: 10px 0 12px 0; display: flex; align-items: center;">'; |
| 91 | 96 | $html .= '<a href="https://wordpress.org/plugins/ai-engine/" target="_blank" class="button button-primary" style="margin-right: 10px;">' |
| 92 | 97 | . __( '👉 AI Engine at WordPress.org', $this->domain ) . '</a>'; |
| 93 | 98 | $html .= '<form method="post" action="" style="margin-right: 10px;"> |
| 94 | - <input type="hidden" name="meowapps_remind_me" value="true"> | |
| 99 | + <input type="hidden" name="meowapps_remind_me" value="true"><input type="hidden" name="meowapps_news_nonce" value="' . $news_nonce . '"> | |
| 95 | 100 | <input type="submit" name="submit" id="submit" class="button button-primary" value="' |
| 96 | 101 | . __( '⏰ Remind me later', $this->domain ) . '"></form>'; |
| 97 | 102 | $html .= '<div style="flex: auto;"></div>'; |
| 98 | 103 | $html .= '<form method="post" action=""> |
| 99 | - <input type="hidden" name="meowapps_done_it" value="true"> | |
| 104 | + <input type="hidden" name="meowapps_done_it" value="true"><input type="hidden" name="meowapps_news_nonce" value="' . $news_nonce . '"> | |
| 100 | 105 | <input type="submit" name="submit" id="submit" class="button" value="' |
| 101 | 106 | . __( '❌ Delete', $this->domain ) . '"> |
| 102 | 107 | </form> |
| 103 | 108 | </div>'; |
