← All changes | admin/section/class-convertkit-admin-section-base.php +15 -251 3.4.2 → 2.7.4 View file →

		@@ -46,9 +46,9 @@
46	46	* Holds the settings class for the section.
47	47	*
48	48	* @since 1.9.6
49	49	*
50		- * @var false|ConvertKit_Settings|ConvertKit_ContactForm7_Settings|ConvertKit_Wishlist_Settings|ConvertKit_Settings_Restrict_Content|ConvertKit_Settings_Broadcasts|ConvertKit_Forminator_Settings|ConvertKit_Settings_MCP
	50	+ * @var false|ConvertKit_Settings|ConvertKit_ContactForm7_Settings|ConvertKit_Wishlist_Settings|ConvertKit_Settings_Restrict_Content|ConvertKit_Settings_Broadcasts|ConvertKit_Forminator_Settings
51	51	*/
52	52	public $settings;
53	53
54	54	/**
		@@ -88,13 +88,8 @@
88	88	if ( empty( $this->tab_text ) ) {
89	89	$this->tab_text = $this->title;
90	90	}
91	91
92		- // Output the Intercom messenger if we're on the Plugin's settings screen.
93		- if ( $this->on_settings_screen( $this->name ) ) {
94		- add_action( 'admin_footer', array( $this, 'output_intercom' ) );
95		- }
96		-
97	92	// Register the settings section.
98	93	$this->register_section();
99	94
100	95	}
		@@ -108,32 +103,27 @@
108	103	* @return bool
109	104	*/
110	105	public function on_settings_screen( $tab ) {
111	106
112		- // Bail if this is an AJAX or Cron request.
113		- if ( wp_doing_ajax() || wp_doing_cron() ) {
114		- return false;
115		- }
	107	+ // phpcs:disable WordPress.Security.NonceVerification
116	108
117	109	// Bail if we're not on the settings screen.
118		- if ( ! filter_has_var( INPUT_GET, 'page' ) ) {
	110	+ if ( ! array_key_exists( 'page', $_REQUEST ) ) {
119	111	return false;
120	112	}
121		- if ( filter_input( INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) !== '_wp_convertkit_settings' ) {
	113	+ if ( sanitize_text_field( $_REQUEST['page'] ) !== '_wp_convertkit_settings' ) {
122	114	return false;
123	115	}
124	116
125	117	// Define current settings tab.
126	118	// General screen won't always be loaded with a `tab` parameter.
127		- if ( filter_has_var( INPUT_GET, 'tab' ) ) {
128		- $current_tab = filter_input( INPUT_GET, 'tab', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
129		- } else {
130		- $current_tab = 'general';
131		- }
	119	+ $current_tab = ( array_key_exists( 'tab', $_REQUEST ) ? sanitize_text_field( $_REQUEST['tab'] ) : 'general' );
132	120
133	121	// Return whether the request is for the current settings tab.
134	122	return ( $current_tab === $tab );
135	123
	124	+ // phpcs:enable
	125	+
136	126	}
137	127
138	128	/**
139	129	* Register settings section.
		@@ -139,13 +129,8 @@
139	129	* Register settings section.
140	130	*/
141	131	public function register_section() {
142	132
143		- // Don't register a settings section if no settings key is defined.
144		- if ( empty( $this->settings_key ) ) {
145		- return;
146		- }
147		-
148	133	// Register settings sections.
149	134	foreach ( $this->settings_sections as $name => $settings_section ) {
150	135	// Determine if this settings section needs to be wrapped in its own container.
151	136	$wrap = array();
		@@ -213,26 +198,20 @@
213	198	*/
214	199	$notices = apply_filters( 'convertkit_settings_base_register_notices', $notices );
215	200
216	201	// Output the verbose error description if supplied (e.g. OAuth).
217		- if ( filter_has_var( INPUT_GET, 'error_description' ) ) {
218		- $this->output_error( filter_input( INPUT_GET, 'error_description', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
	202	+ if ( isset( $_REQUEST['error_description'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
	203	+ $this->output_error( sanitize_text_field( $_REQUEST['error_description'] ) ); // phpcs:ignore WordPress.Security.NonceVerification
219	204	}
220	205
221	206	// Output error notification if defined.
222		- if ( filter_has_var( INPUT_GET, 'error' ) ) {
223		- $error = filter_input( INPUT_GET, 'error', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
224		- if ( array_key_exists( $error, $notices ) ) {
225		- $this->output_error( $notices[ $error ] );
226		- }
	207	+ if ( isset( $_REQUEST['error'] ) && array_key_exists( sanitize_text_field( $_REQUEST['error'] ), $notices ) ) { // phpcs:ignore WordPress.Security.NonceVerification
	208	+ $this->output_error( $notices[ sanitize_text_field( $_REQUEST['error'] ) ] ); // phpcs:ignore WordPress.Security.NonceVerification
227	209	}
228	210
229	211	// Output success notification if defined.
230		- if ( filter_has_var( INPUT_GET, 'success' ) ) {
231		- $success = filter_input( INPUT_GET, 'success', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
232		- if ( array_key_exists( $success, $notices ) ) {
233		- $this->output_success( $notices[ $success ] );
234		- }
	212	+ if ( isset( $_REQUEST['success'] ) && array_key_exists( sanitize_text_field( $_REQUEST['success'] ), $notices ) ) { // phpcs:ignore WordPress.Security.NonceVerification
	213	+ $this->output_success( $notices[ sanitize_text_field( $_REQUEST['success'] ) ] ); // phpcs:ignore WordPress.Security.NonceVerification
235	214	}
236	215
237	216	}
238	217
		@@ -272,12 +251,9 @@
272	251	* @since 2.0.0
273	252	*/
274	253	public function render_container_start() {
275	254
276		- echo wp_kses(
277		- $this->get_render_container_start(),
278		- convertkit_kses_allowed_html()
279		- );
	255	+ echo $this->get_render_container_start(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
280	256
281	257	}
282	258
283	259	/**
		@@ -287,12 +263,9 @@
287	263	* @since 2.0.0
288	264	*/
289	265	public function render_container_end() {
290	266
291		- echo wp_kses(
292		- $this->get_render_container_end(),
293		- convertkit_kses_allowed_html()
294		- );
	267	+ echo $this->get_render_container_end(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
295	268
296	269	}
297	270
298	271	/**
		@@ -476,34 +449,8 @@
476	449
477	450	}
478	451
479	452	/**
480		- * Outputs a masked value.
481		- *
482		- * @since 2.8.5
483		- *
484		- * @param string $value Value.
485		- * @param bool|string $description Description.
486		- */
487		- public function output_masked_value( $value, $description = false ) {
488		-
489		- $html = sprintf(
490		- '<code>%s</code>',
491		- str_repeat( '*', strlen( $value ) - 4 ) . substr( $value, - 4 )
492		- );
493		-
494		- if ( $description ) {
495		- $html .= $this->get_description( $description );
496		- }
497		-
498		- echo wp_kses(
499		- $html,
500		- convertkit_kses_allowed_html()
501		- );
502		-
503		- }
504		-
505		- /**
506	453	* Returns a text field.
507	454	*
508	455	* @since 1.9.6
509	456	*
		@@ -528,27 +475,8 @@
528	475
529	476	}
530	477
531	478	/**
532		- * Outputs a text field.
533		- *
534		- * @since 2.8.5
535		- *
536		- * @param string $name Name.
537		- * @param string $value Value.
538		- * @param bool|string|array $description Description (false|string|array).
539		- * @param bool|array $css_classes CSS Classes (false|array).
540		- */
541		- public function output_text_field( $name, $value = '', $description = false, $css_classes = false ) {
542		-
543		- echo wp_kses(
544		- $this->get_text_field( $name, $value, $description, $css_classes ),
545		- convertkit_kses_allowed_html()
546		- );
547		-
548		- }
549		-
550		- /**
551	479	* Returns a number field.
552	480	*
553	481	* @since 2.6.1
554	482	*
		@@ -579,30 +507,8 @@
579	507
580	508	}
581	509
582	510	/**
583		- * Outputs a number field.
584		- *
585		- * @since 2.8.5
586		- *
587		- * @param string $name Name.
588		- * @param string $value Value.
589		- * @param int|float $min `min` attribute value.
590		- * @param int|float $max `max` attribute value.
591		- * @param int|float $step `step` attribute value.
592		- * @param bool|string|array $description Description (false|string|array).
593		- * @param bool|array $css_classes CSS Classes (false|array).
594		- */
595		- public function output_number_field( $name, $value = '', $min = 0, $max = 9999, $step = 1, $description = false, $css_classes = false ) {
596		-
597		- echo wp_kses(
598		- $this->get_number_field( $name, $value, $min, $max, $step, $description, $css_classes ),
599		- convertkit_kses_allowed_html()
600		- );
601		-
602		- }
603		-
604		- /**
605	511	* Returns a textarea field.
606	512	*
607	513	* @since 2.3.5
608	514	*
		@@ -627,27 +533,8 @@
627	533
628	534	}
629	535
630	536	/**
631		- * Outputs a textarea field.
632		- *
633		- * @since 2.8.5
634		- *
635		- * @param string $name Name.
636		- * @param string $value Value.
637		- * @param bool|string|array $description Description (false|string|array).
638		- * @param bool|array $css_classes CSS Classes (false|array).
639		- */
640		- public function output_textarea_field( $name, $value = '', $description = false, $css_classes = false ) {
641		-
642		- echo wp_kses(
643		- $this->get_textarea_field( $name, $value, $description, $css_classes ),
644		- convertkit_kses_allowed_html()
645		- );
646		-
647		- }
648		-
649		- /**
650	537	* Returns a date field.
651	538	*
652	539	* @since 2.2.8
653	540	*
		@@ -672,27 +559,8 @@
672	559
673	560	}
674	561
675	562	/**
676		- * Outputs a date field.
677		- *
678		- * @since 2.8.5
679		- *
680		- * @param string $name Name.
681		- * @param string $value Value.
682		- * @param bool|string|array $description Description (false|string|array).
683		- * @param bool|array $css_classes CSS Classes (false|array).
684		- */
685		- public function output_date_field( $name, $value = '', $description = false, $css_classes = false ) {
686		-
687		- echo wp_kses(
688		- $this->get_date_field( $name, $value, $description, $css_classes ),
689		- convertkit_kses_allowed_html()
690		- );
691		-
692		- }
693		-
694		- /**
695	563	* Returns a select dropdown field.
696	564	*
697	565	* @since 1.9.6
698	566	*
		@@ -739,29 +607,8 @@
739	607
740	608	}
741	609
742	610	/**
743		- * Outputs a select dropdown field.
744		- *
745		- * @since 2.8.5
746		- *
747		- * @param string $name Name.
748		- * @param string $value Value.
749		- * @param array $options Options / Choices.
750		- * @param bool|string $description Description.
751		- * @param bool|array $css_classes <select> CSS class(es).
752		- * @param bool|array $attributes <select> attributes.
753		- */
754		- public function output_select_field( $name, $value = '', $options = array(), $description = false, $css_classes = false, $attributes = false ) {
755		-
756		- echo wp_kses(
757		- $this->get_select_field( $name, $value, $options, $description, $css_classes, $attributes ),
758		- convertkit_kses_allowed_html()
759		- );
760		-
761		- }
762		-
763		- /**
764	611	* Returns a checkbox field.
765	612	*
766	613	* @since 1.9.6
767	614	*
		@@ -807,91 +654,8 @@
807	654	}
808	655
809	656	// Return field with description appended to it.
810	657	return $html . $this->get_description( $description );
811		-
812		- }
813		-
814		- /**
815		- * Outputs a checkbox field.
816		- *
817		- * @since 2.8.5
818		- *
819		- * @param string $name Name.
820		- * @param string $value Value.
821		- * @param bool $checked Should checkbox be checked/ticked.
822		- * @param bool|string $label Label.
823		- * @param bool|string|array $description Description.
824		- * @param bool|array $css_classes CSS class(es).
825		- */
826		- public function output_checkbox_field( $name, $value, $checked = false, $label = '', $description = false, $css_classes = false ) {
827		-
828		- echo wp_kses(
829		- $this->get_checkbox_field( $name, $value, $checked, $label, $description, $css_classes ),
830		- convertkit_kses_allowed_html()
831		- );
832		-
833		- }
834		-
835		- /**
836		- * Returns a link button.
837		- *
838		- * @since 2.8.5
839		- *
840		- * @param string $url URL.
841		- * @param string $label Button Label.
842		- * @param bool|array $css_classes CSS class(es).
843		- * @return string HTML Link Button
844		- */
845		- public function get_link_button( $url, $label, $css_classes = false ) {
846		-
847		- return sprintf(
848		- '<a href="%s" class="button %s">%s</a>',
849		- esc_url( $url ),
850		- ( is_array( $css_classes ) ? implode( ' ', $css_classes ) : '' ),
851		- esc_html( $label )
852		- );
853		-
854		- }
855		-
856		- /**
857		- * Outputs a link button.
858		- *
859		- * @since 2.8.5
860		- *
861		- * @param string $url URL.
862		- * @param string $label Button Label.
863		- * @param bool|array $css_classes CSS class(es).
864		- */
865		- public function output_link_button( $url, $label, $css_classes = false ) {
866		-
867		- echo wp_kses(
868		- $this->get_link_button( $url, $label, $css_classes ),
869		- convertkit_kses_allowed_html()
870		- );
871		-
872		- }
873		-
874		- /**
875		- * Outputs the given code in a code block, with a button to copy the code
876		- * to the clipboard.
877		- *
878		- * Requires the settings.css and ui.js resources to be enqueued on the screen
879		- * calling this method.
880		- *
881		- * @since 3.4.1
882		- *
883		- * @param string $code Code to display.
884		- * @param string $id Optional ID attribute to assign to the code element.
885		- */
886		- public function output_code_block( $code, $id = '' ) {
887		-
888		- ?>
889		- <div class="kit-code">
890		- <pre><code<?php echo ( ! empty( $id ) ? ' id="' . esc_attr( $id ) . '"' : '' ); ?>><?php echo esc_html( $code ); ?></code></pre>
891		- <button type="button" class="button button-secondary kit-code-copy"><?php esc_html_e( 'Copy', 'convertkit' ); ?></button>
892		- </div>
893		- <?php
894	658
895	659	}
896	660
897	661	/**