← All changes | admin/class-convertkit-admin-setup-wizard.php +12 -32 2.2.6 → 2.8.6 View file →

		@@ -123,38 +123,27 @@
123	123	}
124	124
125	125	// Define actions to register the setup screen.
126	126	add_action( 'admin_menu', array( $this, 'register_screen' ) );
127		- add_action( 'admin_head', array( $this, 'hide_screen_from_menu' ) );
128	127	add_action( 'admin_init', array( $this, 'maybe_load_setup_screen' ) );
129	128
130	129	}
131	130
132	131	/**
133		- * Register the setup screen in WordPress' Dashboard, so that index.php?page={$this->page_name}
	132	+ * Register the wizard screen in WordPress' Dashboard, so that options.php?page={$this->page_name}
134	133	* does not 404 when in the WordPress Admin interface.
135	134	*
	135	+ * Ensures the WordPress user has the given required_capability to access this screen.
	136	+ *
136	137	* @since 1.9.8.4
137	138	*/
138	139	public function register_screen() {
139	140
140		- add_dashboard_page( '', '', 'edit_posts', $this->page_name, '__return_false' );
	141	+ add_submenu_page( '', '', '', $this->required_capability, $this->page_name, '__return_false' );
141	142
142	143	}
143	144
144	145	/**
145		- * Hides the menu registered when register_screen() above is called, otherwise
146		- * we would have a blank submenu entry below the Dashboard menu.
147		- *
148		- * @since 1.9.8.4
149		- */
150		- public function hide_screen_from_menu() {
151		-
152		- remove_submenu_page( 'index.php', $this->page_name );
153		-
154		- }
155		-
156		- /**
157	146	* Loads the setup screen if the request URL is for this class
158	147	*
159	148	* @since 1.9.8.4
160	149	*/
		@@ -175,14 +164,14 @@
175	164	set_current_screen( $this->page_name );
176	165
177	166	// If the convertkit-modal parameter exists and is 1, set the flag to denote
178	167	// this wizard is served in a modal.
179		- if ( array_key_exists( 'convertkit-modal', $_REQUEST ) && $_REQUEST['convertkit-modal'] === '1' ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	168	+ if ( filter_has_var( INPUT_GET, 'convertkit-modal' ) && filter_input( INPUT_GET, 'convertkit-modal', FILTER_SANITIZE_NUMBER_INT ) === '1' ) {
180	169	$this->is_modal = true;
181	170	}
182	171
183	172	// Define the step the user is on in the setup process.
184		- $this->step = ( isset( $_REQUEST['step'] ) ? absint( $_REQUEST['step'] ) : 1 ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	173	+ $this->step = ( filter_has_var( INPUT_GET, 'step' ) ? absint( filter_input( INPUT_GET, 'step', FILTER_SANITIZE_NUMBER_INT ) ) : 1 );
185	174
186	175	// Process any posted form data.
187	176	$this->process_form();
188	177
		@@ -210,17 +199,8 @@
210	199	* @since 1.9.8.4
211	200	*/
212	201	private function process_form() {
213	202
214		- // Run security checks.
215		- if ( ! isset( $_POST['_wpnonce'] ) ) {
216		- return;
217		- }
218		- if ( ! wp_verify_nonce( sanitize_key( $_POST['_wpnonce'] ), $this->page_name ) ) {
219		- $this->error = __( 'Invalid nonce specified.', 'convertkit' );
220		- return;
221		- }
222		-
223	203	/**
224	204	* Process submitted form data for the given setup wizard name and current step.
225	205	*
226	206	* @since 1.9.8.4
		@@ -246,9 +226,9 @@
246	226	'page' => $this->page_name,
247	227	'convertkit-modal' => $this->is_modal(),
248	228	'step' => $this->step,
249	229	),
250		- admin_url( 'index.php' )
	230	+ admin_url( 'options.php' )
251	231	);
252	232
253	233	// Define the previous step URL if we're not on the first or last step.
254	234	if ( $this->step > 1 && $this->step < count( $this->steps ) ) {
		@@ -257,9 +237,9 @@
257	237	'page' => $this->page_name,
258	238	'convertkit-modal' => $this->is_modal(),
259	239	'step' => ( $this->step - 1 ),
260	240	),
261		- admin_url( 'index.php' )
	241	+ admin_url( 'options.php' )
262	242	);
263	243	}
264	244
265	245	// Define the next step URL if we're not on the last page.
		@@ -269,9 +249,9 @@
269	249	'page' => $this->page_name,
270	250	'convertkit-modal' => $this->is_modal(),
271	251	'step' => ( $this->step + 1 ),
272	252	),
273		- admin_url( 'index.php' )
	253	+ admin_url( 'options.php' )
274	254	);
275	255	}
276	256
277	257	}
		@@ -305,9 +285,9 @@
305	285	convertkit_select2_enqueue_scripts();
306	286
307	287	// Enqueue JS.
308	288	wp_enqueue_script( 'convertkit-admin-preview-output', CONVERTKIT_PLUGIN_URL . 'resources/backend/js/preview-output.js', array( 'jquery' ), CONVERTKIT_PLUGIN_VERSION, true );
309		- wp_enqueue_script( 'convertkit-admin-setup-wizard', CONVERTKIT_PLUGIN_URL . 'resources/backend/js/setup-wizard.js', array( 'jquery' ), CONVERTKIT_PLUGIN_VERSION, true );
	289	+ wp_enqueue_script( 'convertkit-admin-setup-wizard', CONVERTKIT_PLUGIN_URL . 'resources/backend/js/setup-wizard.js', array(), CONVERTKIT_PLUGIN_VERSION, true );
310	290
311	291	}
312	292
313	293	/**
		@@ -422,12 +402,12 @@
422	402	return false;
423	403	}
424	404
425	405	// Bail if we're not on the setup screen.
426		- if ( ! isset( $_GET['page'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
	406	+ if ( ! filter_has_var( INPUT_GET, 'page' ) ) {
427	407	return false;
428	408	}
429		- if ( sanitize_text_field( $_GET['page'] ) !== $this->page_name ) { // phpcs:ignore WordPress.Security.NonceVerification
	409	+ if ( filter_input( INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) !== $this->page_name ) {
430	410	return false;
431	411	}
432	412
433	413	return true;