← All changes | admin/class-convertkit-admin-settings.php +26 -55 3.3.3 → 2.4.7 View file →

		@@ -6,9 +6,9 @@
6	6	* @author ConvertKit
7	7	*/
8	8
9	9	/**
10		- * Registers a screen at Settings > Kit in the WordPress Administration
	10	+ * Registers a screen at Settings > ConvertKit in the WordPress Administration
11	11	* interface, and handles saving its data.
12	12	*
13	13	* @package ConvertKit
14	14	* @author ConvertKit
		@@ -59,9 +59,9 @@
59	59	// Get active settings section / tab that has been requested.
60	60	$section = $this->get_active_section();
61	61
62	62	/**
63		- * Enqueue JavaScript for the Settings Screen at Settings > Kit
	63	+ * Enqueue JavaScript for the Settings Screen at Settings > ConvertKit
64	64	*
65	65	* @since 1.9.6
66	66	*
67	67	* @param string $section Settings section / tab (general|tools|restrict-content).
		@@ -70,9 +70,9 @@
70	70
71	71	}
72	72
73	73	/**
74		- * Enqueue CSS for the Settings Screens at Settings > Kit
	74	+ * Enqueue CSS for the Settings Screens at Settings > ConvertKit
75	75	*
76	76	* @since 1.9.6
77	77	*
78	78	* @param string $hook Hook.
		@@ -90,9 +90,9 @@
90	90	// Always enqueue Settings CSS, as this is used for the UI across all settings sections.
91	91	wp_enqueue_style( 'convertkit-admin-settings', CONVERTKIT_PLUGIN_URL . 'resources/backend/css/settings.css', array(), CONVERTKIT_PLUGIN_VERSION );
92	92
93	93	/**
94		- * Enqueue CSS for the Settings Screen at Settings > Kit
	94	+ * Enqueue CSS for the Settings Screen at Settings > ConvertKit
95	95	*
96	96	* @since 1.9.6
97	97	*
98	98	* @param string $section Settings section / tab (general|tools|restrict-content).
		@@ -108,10 +108,10 @@
108	108	*/
109	109	public function add_settings_page() {
110	110
111	111	add_options_page(
112		- __( 'Kit', 'convertkit' ),
113		- __( 'Kit', 'convertkit' ),
	112	+ __( 'ConvertKit', 'convertkit' ),
	113	+ __( 'ConvertKit', 'convertkit' ),
114	114	'manage_options',
115	115	self::SETTINGS_PAGE_SLUG,
116	116	array( $this, 'display_settings_page' )
117	117	);
		@@ -128,9 +128,9 @@
128	128	$active_section = $this->get_active_section();
129	129	?>
130	130
131	131	<header>
132		- <h1><?php esc_html_e( 'Kit', 'convertkit' ); ?></h1>
	132	+ <h1><?php esc_html_e( 'ConvertKit', 'convertkit' ); ?></h1>
133	133
134	134	<?php
135	135	// Output Help link tab, if it exists.
136	136	$documentation_url = $this->get_active_section_documentation_url( $active_section );
		@@ -148,30 +148,11 @@
148	148	<?php
149	149	if ( count( $this->sections ) > 1 ) {
150	150	$this->display_section_nav( $active_section );
151	151	}
	152	+ ?>
152	153
153		- /**
154		- * Defines the settings form's method.
155		- *
156		- * @since 3.0.0
157		- *
158		- * @param string $form_method The method of the form.
159		- * @param string $active_section The active section.
160		- */
161		- $form_method = apply_filters( 'convertkit_admin_settings_form_method', 'post', $active_section );
162		-
163		- /**
164		- * Defines the settings form's action URL.
165		- *
166		- * @since 3.0.0
167		- *
168		- * @param string $form_action_url The URL to submit the form to.
169		- * @param string $active_section The active section.
170		- */
171		- $form_action_url = apply_filters( 'convertkit_admin_settings_form_action_url', admin_url( 'options.php' ), $active_section );
172		- ?>
173		- <form method="<?php echo esc_attr( $form_method ); ?>" action="<?php echo esc_url( $form_action_url ); ?>" enctype="multipart/form-data">
	154	+ <form method="post" action="options.php" enctype="multipart/form-data">
174	155	<?php
175	156	// Iterate through sections to find the active section to render.
176	157	if ( isset( $this->sections[ $active_section ] ) ) {
177	158	$this->sections[ $active_section ]->render();
		@@ -206,10 +187,10 @@
206	187	* @return string Tab Name
207	188	*/
208	189	private function get_active_section() {
209	190
210		- if ( filter_has_var( INPUT_GET, 'tab' ) ) {
211		- return filter_input( INPUT_GET, 'tab', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
	191	+ if ( isset( $_GET['tab'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
	192	+ return sanitize_text_field( wp_unslash( $_GET['tab'] ) ); // phpcs:ignore WordPress.Security.NonceVerification
212	193	}
213	194
214	195	// First registered section will be the active section.
215	196	return current( $this->sections )->name;
		@@ -268,12 +249,9 @@
268	249	)
269	250	),
270	251	( $active_section === $section->name ? 'convertkit-tab-active' : '' ),
271	252	esc_html( $section->tab_text ),
272		- wp_kses(
273		- $section->is_beta ? $this->get_beta_tab() : '',
274		- convertkit_kses_allowed_html()
275		- )
	253	+ $section->is_beta ? $this->get_beta_tab() : '' // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
276	254	);
277	255	}
278	256	?>
279	257	</ul>
		@@ -288,9 +266,10 @@
288	266
289	267	}
290	268
291	269	/**
292		- * Returns a 'beta' tab wrapped in a span.
	270	+ * Returns a 'beta' tab wrapped in a span, using wp_kses to ensure only permitted
	271	+ * HTML elements are included in the output.
293	272	*
294	273	* @since 2.1.0
295	274	*
296	275	* @return string
		@@ -296,14 +275,21 @@
296	275	* @return string
297	276	*/
298	277	private function get_beta_tab() {
299	278
300		- return '<span class="convertkit-beta-label">' . esc_html__( 'Beta', 'convertkit' ) . '</span>';
	279	+ return wp_kses(
	280	+ '<span class="convertkit-beta-label">' . esc_html__( 'Beta', 'convertkit' ) . '</span>',
	281	+ array(
	282	+ 'span' => array(
	283	+ 'class' => array(),
	284	+ ),
	285	+ )
	286	+ );
301	287
302	288	}
303	289
304	290	/**
305		- * Registers settings sections at Settings > Kit.
	291	+ * Registers settings sections at Settings > ConvertKit.
306	292	*
307	293	* Each section has its own tab.
308	294	*
309	295	* @since 1.9.6
		@@ -309,31 +295,16 @@
309	295	* @since 1.9.6
310	296	*/
311	297	public function register_sections() {
312	298
313		- // If no Access Token exists, register a settings section that shows a button
314		- // to start the OAuth authentication flow.
315		- $settings = new ConvertKit_Settings();
316		- if ( ! $settings->has_access_and_refresh_token() ) {
317		- // Just register the OAuth screen.
318		- $sections = array(
319		- 'oauth' => new ConvertKit_Admin_Section_OAuth(),
320		- );
321		-
322		- // Assign them to this class.
323		- $this->sections = $sections;
324		-
325		- return;
326		- }
327		-
328	299	// Register the General and Tools settings sections.
329	300	$sections = array(
330		- 'general' => new ConvertKit_Admin_Section_General(),
331		- 'tools' => new ConvertKit_Admin_Section_Tools(),
	301	+ 'general' => new ConvertKit_Settings_General(),
	302	+ 'tools' => new ConvertKit_Settings_Tools(),
332	303	);
333	304
334	305	/**
335		- * Registers settings sections at Settings > Kit.
	306	+ * Registers settings sections at Settings > ConvertKit.
336	307	*
337	308	* @since 1.9.6
338	309	*
339	310	* @param array $sections Array of settings classes that handle individual tabs e.g. General, Tools etc.