← All changes | classes/Controllers/Admin/WidgetEditor.php +14 -9 2.0.4 → 2.6.1 View file →

		@@ -9,8 +9,9 @@
9	9	*/
10	10
11	11	namespace ContentControl\Controllers\Admin;
12	12
	13	+use WP_Widget;
13	14	use ContentControl\Base\Controller;
14	15
15	16	use function ContentControl\Rules\allowed_user_roles;
16	17	use function ContentControl\Widgets\parse_options as parse_widget_options;
		@@ -34,8 +35,10 @@
34	35	/**
35	36	* Enqueue v1 admin scripts.
36	37	*
37	38	* @param mixed $hook Admin page hook name.
	39	+ *
	40	+ * @return void
38	41	*/
39	42	public function enqueue_assets( $hook ) {
40	43	if ( 'widgets.php' === $hook ) {
41	44	wp_enqueue_style( 'content-control-widget-editor' );
		@@ -45,11 +48,13 @@
45	48
46	49	/**
47	50	* Renders additional widget option fields.
48	51	*
49		- * @param \WP_Widget $widget Widget instance.
50		- * @param bool $ret Whether to return the output.
51		- * @param array $instance Widget instance options.
	52	+ * @param \WP_Widget $widget Widget instance.
	53	+ * @param bool $ret Whether to return the output.
	54	+ * @param array<string,mixed> $instance Widget instance options.
	55	+ *
	56	+ * @return void
52	57	*/
53	58	public function fields( $widget, $ret, $instance ) {
54	59	$allowed_user_roles = allowed_user_roles();
55	60
		@@ -91,17 +96,16 @@
91	96
92	97	/**
93	98	* Validates & saves additional widget options.
94	99	*
95		- * @param array $instance Widget instance options.
96		- * @param array $new_instance New widget instance options.
97		- * @param array $old_instance Old widget instance options.
	100	+ * @param array<string,mixed> $instance Widget instance options.
	101	+ * @param array<string,mixed> $new_instance New widget instance options.
	102	+ * @param array<string,mixed> $old_instance Old widget instance options.
98	103	*
99		- * @return array|bool
	104	+ * @return array<string,mixed>|bool
100	105	*/
101	106	public function save( $instance, $new_instance, $old_instance ) {
102		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
103		- if ( isset( $_POST['content-control-widget-editor-nonce'] ) && wp_verify_nonce( $_POST['content-control-widget-editor-nonce'], 'content-control-widget-editor-nonce' ) ) {
	107	+ if ( isset( $_POST['content-control-widget-editor-nonce'] ) && wp_verify_nonce( wp_unslash( sanitize_key( $_POST['content-control-widget-editor-nonce'] ) ), 'content-control-widget-editor-nonce' ) ) {
104	108	$new_instance = parse_widget_options( $new_instance );
105	109	$instance['which_users'] = $new_instance['which_users'];
106	110	$instance['roles'] = $new_instance['roles'];
107	111
		@@ -117,8 +121,9 @@
117	121	} else {
118	122	unset( $instance['roles'] );
119	123	}
120	124	} else {
	125	+ // Failed validation, use old instance.
121	126	$old_instance = parse_widget_options( $old_instance );
122	127	$instance['which_users'] = $old_instance['which_users'];
123	128
124	129	if ( empty( $old_instance['roles'] ) ) {