← All changes | admin/class-convertkit-admin-setup-wizard.php +21 -116 3.4.2 → 2.4.7 View file →

		@@ -37,17 +37,8 @@
37	37	*/
38	38	public $error = false;
39	39
40	40	/**
41		- * Holds the Post Type to generate.
42		- *
43		- * @since 3.3.9
44		- *
45		- * @var string
46		- */
47		- public $post_type = 'page';
48		-
49		- /**
50	41	* The required user capability to access the setup wizard.
51	42	*
52	43	* @since 1.9.8.4
53	44	*
		@@ -59,11 +50,11 @@
59	50	* The current step in the setup process the user is on.
60	51	*
61	52	* @since 1.9.8.4
62	53	*
63		- * @var string
	54	+ * @var int
64	55	*/
65		- public $step = 'start';
	56	+ public $step = 1;
66	57
67	58	/**
68	59	* The programmatic name of the setup screen.
69	60	*
		@@ -173,24 +164,14 @@
173	164	set_current_screen( $this->page_name );
174	165
175	166	// If the convertkit-modal parameter exists and is 1, set the flag to denote
176	167	// this wizard is served in a modal.
177		- if ( filter_has_var( INPUT_GET, 'convertkit-modal' ) && filter_input( INPUT_GET, 'convertkit-modal', FILTER_SANITIZE_NUMBER_INT ) === '1' ) {
	168	+ if ( array_key_exists( 'convertkit-modal', $_REQUEST ) && $_REQUEST['convertkit-modal'] === '1' ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
178	169	$this->is_modal = true;
179	170	}
180	171
181		- /**
182		- * Define the steps for the setup wizard.
183		- *
184		- * @since 3.1.8
185		- *
186		- * @param array $steps The steps for the setup wizard.
187		- * @return array The steps for the setup wizard.
188		- */
189		- $this->steps = apply_filters( 'convertkit_admin_setup_wizard_steps_' . $this->page_name, $this->steps );
190		-
191	172	// Define the step the user is on in the setup process.
192		- $this->step = $this->get_current_step();
	173	+ $this->step = ( isset( $_REQUEST['step'] ) ? absint( $_REQUEST['step'] ) : 1 ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
193	174
194	175	// Process any posted form data.
195	176	$this->process_form();
196	177
		@@ -212,68 +193,8 @@
212	193
213	194	}
214	195
215	196	/**
216		- * Returns the current step in the setup process.
217		- *
218		- * @since 3.1.7
219		- *
220		- * @return string Current step.
221		- */
222		- public function get_current_step() {
223		-
224		- $step = ( filter_has_var( INPUT_GET, 'step' ) ? filter_input( INPUT_GET, 'step', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) : 'start' );
225		-
226		- // Fallback to 'start' if the step is a registered step.
227		- if ( ! array_key_exists( $step, $this->steps ) ) {
228		- $step = 'start';
229		- }
230		-
231		- return $step;
232		-
233		- }
234		-
235		- /**
236		- * Get the number of the current step.
237		- *
238		- * @since 3.1.7
239		- *
240		- * @return int Step number.
241		- */
242		- public function get_current_step_number() {
243		-
244		- return array_search( $this->step, array_keys( $this->steps ), true ) + 1;
245		-
246		- }
247		-
248		- /**
249		- * Get the step by number.
250		- *
251		- * @since 3.1.7
252		- *
253		- * @param int $number Step number (1 based index).
254		- * @return string Step name/key.
255		- */
256		- public function get_step_key_by_number( $number ) {
257		-
258		- return array_keys( $this->steps )[ $number - 1 ];
259		-
260		- }
261		-
262		- /**
263		- * Get the total number of steps.
264		- *
265		- * @since 3.1.7
266		- *
267		- * @return int Total steps.
268		- */
269		- public function get_total_steps() {
270		-
271		- return count( $this->steps );
272		-
273		- }
274		-
275		- /**
276	197	* Process submitted form data for the given setup wizard name and current step.
277	198	*
278	199	* @since 1.9.8.4
279	200	*/
		@@ -278,14 +199,23 @@
278	199	* @since 1.9.8.4
279	200	*/
280	201	private function process_form() {
281	202
	203	+ // Run security checks.
	204	+ if ( ! isset( $_POST['_wpnonce'] ) ) {
	205	+ return;
	206	+ }
	207	+ if ( ! wp_verify_nonce( sanitize_key( $_POST['_wpnonce'] ), $this->page_name ) ) {
	208	+ $this->error = __( 'Invalid nonce specified.', 'convertkit' );
	209	+ return;
	210	+ }
	211	+
282	212	/**
283	213	* Process submitted form data for the given setup wizard name and current step.
284	214	*
285	215	* @since 1.9.8.4
286	216	*
287		- * @param string $step Current step.
	217	+ * @param int $step Current step number.
288	218	*/
289	219	do_action( 'convertkit_admin_setup_wizard_process_form_' . $this->page_name, $this->step );
290	220
291	221	}
		@@ -309,14 +239,14 @@
309	239	admin_url( 'options.php' )
310	240	);
311	241
312	242	// Define the previous step URL if we're not on the first or last step.
313		- if ( $this->get_current_step_number() > 1 && $this->get_current_step_number() < $this->get_total_steps() ) {
	243	+ if ( $this->step > 1 && $this->step < count( $this->steps ) ) {
314	244	$this->previous_step_url = add_query_arg(
315	245	array(
316	246	'page' => $this->page_name,
317	247	'convertkit-modal' => $this->is_modal(),
318		- 'step' => $this->get_step_key_by_number( $this->get_current_step_number() - 1 ),
	248	+ 'step' => ( $this->step - 1 ),
319	249	),
320	250	admin_url( 'options.php' )
321	251	);
322	252	}
		@@ -321,14 +251,14 @@
321	251	);
322	252	}
323	253
324	254	// Define the next step URL if we're not on the last page.
325		- if ( $this->get_current_step_number() < $this->get_total_steps() ) {
	255	+ if ( $this->step < count( $this->steps ) ) {
326	256	$this->next_step_url = add_query_arg(
327	257	array(
328	258	'page' => $this->page_name,
329	259	'convertkit-modal' => $this->is_modal(),
330		- 'step' => $this->get_step_key_by_number( $this->get_current_step_number() + 1 ),
	260	+ 'step' => ( $this->step + 1 ),
331	261	),
332	262	admin_url( 'options.php' )
333	263	);
334	264	}
		@@ -346,9 +276,9 @@
346	276	* Load any data into class variables for the given setup wizard name and current step.
347	277	*
348	278	* @since 1.9.8.4
349	279	*
350		- * @param string $step Current step.
	280	+ * @param int $step Current step number.
351	281	*/
352	282	do_action( 'convertkit_admin_setup_wizard_load_screen_data_' . $this->page_name, $this->step );
353	283
354	284	}
		@@ -481,12 +411,12 @@
481	411	return false;
482	412	}
483	413
484	414	// Bail if we're not on the setup screen.
485		- if ( ! filter_has_var( INPUT_GET, 'page' ) ) {
	415	+ if ( ! isset( $_GET['page'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
486	416	return false;
487	417	}
488		- if ( filter_input( INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) !== $this->page_name ) {
	418	+ if ( sanitize_text_field( $_GET['page'] ) !== $this->page_name ) { // phpcs:ignore WordPress.Security.NonceVerification
489	419	return false;
490	420	}
491	421
492	422	return true;
		@@ -512,33 +442,8 @@
512	442	return false;
513	443	}
514	444
515	445	return true;
516		-
517		- }
518		-
519		- /**
520		- * Sets the Post Type from the request, ensuring it is supported by the Plugin.
521		- *
522		- * @since 3.3.9
523		- */
524		- protected function set_post_type() {
525		-
526		- $this->post_type = ( filter_has_var( INPUT_GET, 'ck_post_type' ) ? filter_input( INPUT_GET, 'ck_post_type', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) : 'page' );
527		-
528		- if ( ! in_array( $this->post_type, convertkit_get_supported_post_types(), true ) ) {
529		- wp_die(
530		- sprintf(
531		- /* translators: Post Type */
532		- esc_html__( 'The post type `%s` is not supported for Member Content.', 'convertkit' ),
533		- esc_html( $this->post_type )
534		- ),
535		- esc_html__( 'WordPress Error', 'convertkit' ),
536		- array(
537		- 'back_link' => true,
538		- )
539		- );
540		- }
541	446
542	447	}
543	448
544	449	}