← All changes | common/admin.php +43 -69 0.5.1 → trunk View file →

		@@ -160,9 +160,9 @@
160	160
161	161	// Promote AI Engine on the WordPress 7 Connectors page when AI Engine
162	162	// itself isn't installed. When AI Engine is active, its own banner
163	163	// takes over — so this path only runs on "bare" Meow Apps installs.
164		- add_action( 'admin_footer', [ $this, 'maybe_render_wpai_promo' ] );
	164	+ add_action( 'admin_enqueue_scripts', [ $this, 'maybe_render_wpai_promo' ] );
165	165
166	166	MeowKit_MWCODE_Admin::$loaded = true;
167	167	}
168	168
		@@ -272,9 +272,11 @@
272	272	<button type="button" id="meowapps-license-submit" class="button button-primary">Validate & Register</button>
273	273	</div>
274	274	</div>
275	275	</div>
276		- <script>
	276	+ <?php
	277	+ ob_start();
	278	+ ?>
277	279	(function() {
278	280	var modal = document.getElementById('meowapps-network-license-modal');
279	281	var input = document.getElementById('meowapps-license-key-input');
280	282	var message = document.getElementById('meowapps-license-message');
		@@ -384,10 +386,10 @@
384	386	submitBtn.textContent = 'Validate & Register';
385	387	});
386	388	});
387	389	})();
388		- </script>
389	390	<?php
	391	+ wp_print_inline_script_tag( ob_get_clean() );
390	392	}
391	393
392	394	public function request_verify_ssl() {
393	395	return get_option( 'force_sslverify', false );
		@@ -405,9 +407,12 @@
405	407	return $file;
406	408	}
407	409
408	410	public function admin_notices_licensed_free() {
409		- if ( isset( $_POST[$this->prefix . '_reset_sub'] ) ) {
	411	+ // Verify the nonce before removing the license from a POST request (CSRF protection).
	412	+ if ( isset( $_POST[$this->prefix . '_reset_sub'] )
	413	+ && isset( $_POST[ $this->prefix . '_reset_sub_nonce' ] )
	414	+ && wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST[ $this->prefix . '_reset_sub_nonce' ] ) ), $this->prefix . '_reset_sub' ) ) {
410	415	delete_option( $this->prefix . '_pro_serial' );
411	416	delete_option( $this->prefix . '_license' );
412	417	return;
413	418	}
		@@ -417,9 +422,9 @@
417	422	$this->nice_name_from_file( $this->mainfile )
418	423	);
419	424	$html .= '<p>
420	425	<form method="post" action="">
421		- <input type="hidden" name="' . $this->prefix . '_reset_sub" value="true">
	426	+ <input type="hidden" name="' . $this->prefix . '_reset_sub" value="true"><input type="hidden" name="' . $this->prefix . '_reset_sub_nonce" value="' . esc_attr( wp_create_nonce( $this->prefix . '_reset_sub' ) ) . '">
422	427	<input type="submit" name="submit" id="submit" class="button" value="'
423	428	. __( 'Remove the license', $this->domain ) . '">
424	429	</form>
425	430	</p>';
		@@ -429,9 +434,9 @@
429	434
430	435	public function admin_menu_start() {
431	436	// Hide the admin if user doesn't like Meow much
432	437	if ( get_option( 'meowapps_hide_meowapps', false ) ) {
433		- register_setting( 'general', 'meowapps_hide_meowapps' );
	438	+ register_setting( 'general', 'meowapps_hide_meowapps', [ 'type' => 'boolean', 'sanitize_callback' => 'rest_sanitize_boolean' ] );
434	439	add_settings_field( 'meowapps_hide_ads', 'Meow Apps Menu', [ $this, 'meowapps_hide_dashboard_callback' ], 'general' );
435	440	return;
436	441	}
437	442
		@@ -475,69 +480,31 @@
475	480	//
476	481	// The !important rules also override an older "display: none" style that
477	482	// previous-generation Meow Apps common copies inject for .wp-menu-image;
478	483	// if any of them load first, ours still wins.
479		- add_action( 'admin_head', function () {
480		- echo '<style>
481		- #toplevel_page_meowapps-main-menu .meowapps-menu-icon {
482		- width: 20px;
483		- height: auto;
484		- position: absolute;
485		- margin-left: -28px;
486		- margin-top: 3px;
487		- }
488		- #toplevel_page_meowapps-main-menu .wp-menu-image {
489		- display: block !important;
490		- position: relative;
491		- }
492		- #toplevel_page_meowapps-main-menu .wp-menu-image::before {
493		- display: none !important;
494		- }
495		- #toplevel_page_meowapps-main-menu .wp-menu-image .meowapps-menu-icon-folded {
496		- display: none;
497		- position: absolute;
498		- top: 50%;
499		- left: 50%;
500		- transform: translate(-50%, calc(-50% - 3px));
501		- width: 20px;
502		- height: auto;
503		- }
504		- body.folded #toplevel_page_meowapps-main-menu .wp-menu-image .meowapps-menu-icon-folded {
505		- display: block;
506		- }
507		- body.folded #toplevel_page_meowapps-main-menu .meowapps-menu-icon {
508		- display: none;
509		- }
	484	+ // Enqueue the menu-icon CSS/JS through the assets API instead of echoing inline tags.
	485	+ add_action( 'admin_enqueue_scripts', function () {
	486	+ $css = '
	487	+ #toplevel_page_meowapps-main-menu .meowapps-menu-icon { width: 20px; height: auto; position: absolute; margin-left: -28px; margin-top: 3px; }
	488	+ #toplevel_page_meowapps-main-menu .wp-menu-image { display: block !important; position: relative; }
	489	+ #toplevel_page_meowapps-main-menu .wp-menu-image::before { display: none !important; }
	490	+ #toplevel_page_meowapps-main-menu .wp-menu-image .meowapps-menu-icon-folded { display: none; position: absolute; top: 50%; left: 50%; transform: translate(-50%, calc(-50% - 3px)); width: 20px; height: auto; }
	491	+ body.folded #toplevel_page_meowapps-main-menu .wp-menu-image .meowapps-menu-icon-folded { display: block; }
	492	+ body.folded #toplevel_page_meowapps-main-menu .meowapps-menu-icon { display: none; }
510	493	@media only screen and (max-width: 960px) {
511		- body.auto-fold #toplevel_page_meowapps-main-menu .wp-menu-image .meowapps-menu-icon-folded {
512		- display: block;
513		- }
514		- body.auto-fold #toplevel_page_meowapps-main-menu .meowapps-menu-icon {
515		- display: none;
516		- }
517		- }
518		- </style>';
519		- }, 999 );
	494	+ body.auto-fold #toplevel_page_meowapps-main-menu .wp-menu-image .meowapps-menu-icon-folded { display: block; }
	495	+ body.auto-fold #toplevel_page_meowapps-main-menu .meowapps-menu-icon { display: none; }
	496	+ }';
	497	+ wp_add_inline_style( 'admin-menu', $css );
520	498
521		- // Inject a clone of the in-title cat icon into the .wp-menu-image slot.
522		- // CSS above shows it only when the sidebar is folded; in the normal
523		- // expanded state the .wp-menu-name <img> stays the visible icon.
524		- add_action( 'admin_footer', function () {
525		- ?>
526		- <script>
527		- ( function () {
528		- var li = document.getElementById( 'toplevel_page_meowapps-main-menu' );
529		- if ( !li ) { return; }
530		- var src = li.querySelector( '.meowapps-menu-icon' );
531		- var slot = li.querySelector( '.wp-menu-image' );
532		- if ( !src || !slot || slot.querySelector( '.meowapps-menu-icon-folded' ) ) { return; }
533		- var clone = src.cloneNode();
534		- clone.className = 'meowapps-menu-icon-folded';
535		- clone.removeAttribute( 'style' );
536		- slot.appendChild( clone );
537		- } )();
538		- </script>
539		- <?php
	499	+ // Clone the in-title cat icon into the .wp-menu-image slot (CSS shows it only when folded).
	500	+ $js = 'document.addEventListener("DOMContentLoaded", function () {'
	501	+ . 'var li = document.getElementById("toplevel_page_meowapps-main-menu"); if ( !li ) { return; }'
	502	+ . 'var src = li.querySelector(".meowapps-menu-icon"); var slot = li.querySelector(".wp-menu-image");'
	503	+ . 'if ( !src || !slot || slot.querySelector(".meowapps-menu-icon-folded") ) { return; }'
	504	+ . 'var clone = src.cloneNode(); clone.className = "meowapps-menu-icon-folded"; clone.removeAttribute("style"); slot.appendChild(clone);'
	505	+ . '});';
	506	+ wp_add_inline_script( 'common', $js );
540	507	} );
541	508	}
542	509
543	510	public function meowapps_hide_dashboard_callback() {
		@@ -637,10 +604,12 @@
637	604	'installUrl' => $install_url,
638	605	'wporgUrl' => $wporg_url,
639	606	'learnUrl' => $learn_url,
640	607	);
	608	+ wp_register_style( 'meowapps-common-inline', false );
	609	+ wp_enqueue_style( 'meowapps-common-inline' );
	610	+ ob_start();
641	611	?>
642		- <style>
643	612	.meowapps-wpai-promo {
644	613	margin: 0 0 16px; padding: 14px 18px;
645	614	display: flex; align-items: flex-start; gap: 14px;
646	615	background: #f0f4ff; border: 1px solid #d6deff; border-radius: 4px;
		@@ -683,10 +652,15 @@
683	652	background: transparent; color: #6b7280;
684	653	font-weight: 500; padding: 7px 10px;
685	654	}
686	655	.meowapps-wpai-promo-btn-dismiss:hover { color: #1e1e1e; background: rgba(0,0,0,0.04); }
687		- </style>
688		- <script>
	656	+ <?php
	657	+ wp_add_inline_style( 'meowapps-common-inline', ob_get_clean() );
	658	+
	659	+ wp_register_script( 'meowapps-common-inline', false, array(), false, true );
	660	+ wp_enqueue_script( 'meowapps-common-inline' );
	661	+ ob_start();
	662	+ ?>
689	663	(function () {
690	664	var D = <?php echo wp_json_encode( $payload ); ?>;
691	665	try { if (localStorage.getItem('meowapps-wpai-promo-dismissed') === '1') return; } catch (e) {}
692	666
		@@ -767,9 +741,9 @@
767	741	if (app && 'MutationObserver' in window) {
768	742	new MutationObserver(ensure).observe(app, { childList: true, subtree: true });
769	743	}
770	744	})();
771		- </script>
772	745	<?php
	746	+ wp_add_inline_script( 'meowapps-common-inline', ob_get_clean() );
773	747	}
774	748	}
775	749	}