← All changes | admin/class-convertkit-admin-setup-wizard.php +83 -22 2.3.2 → 3.2.3 View file →

		@@ -50,11 +50,11 @@
50	50	* The current step in the setup process the user is on.
51	51	*
52	52	* @since 1.9.8.4
53	53	*
54		- * @var int
	54	+ * @var string
55	55	*/
56		- public $step = 1;
	56	+ public $step = 'start';
57	57
58	58	/**
59	59	* The programmatic name of the setup screen.
60	60	*
		@@ -164,14 +164,24 @@
164	164	set_current_screen( $this->page_name );
165	165
166	166	// If the convertkit-modal parameter exists and is 1, set the flag to denote
167	167	// this wizard is served in a modal.
168		- if ( array_key_exists( 'convertkit-modal', $_REQUEST ) && $_REQUEST['convertkit-modal'] === '1' ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	168	+ if ( filter_has_var( INPUT_GET, 'convertkit-modal' ) && filter_input( INPUT_GET, 'convertkit-modal', FILTER_SANITIZE_NUMBER_INT ) === '1' ) {
169	169	$this->is_modal = true;
170	170	}
171	171
	172	+ /**
	173	+ * Define the steps for the setup wizard.
	174	+ *
	175	+ * @since 3.1.8
	176	+ *
	177	+ * @param array $steps The steps for the setup wizard.
	178	+ * @return array The steps for the setup wizard.
	179	+ */
	180	+ $this->steps = apply_filters( 'convertkit_admin_setup_wizard_steps_' . $this->page_name, $this->steps );
	181	+
172	182	// Define the step the user is on in the setup process.
173		- $this->step = ( isset( $_REQUEST['step'] ) ? absint( $_REQUEST['step'] ) : 1 ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	183	+ $this->step = $this->get_current_step();
174	184
175	185	// Process any posted form data.
176	186	$this->process_form();
177	187
		@@ -193,8 +203,68 @@
193	203
194	204	}
195	205
196	206	/**
	207	+ * Returns the current step in the setup process.
	208	+ *
	209	+ * @since 3.1.7
	210	+ *
	211	+ * @return string Current step.
	212	+ */
	213	+ public function get_current_step() {
	214	+
	215	+ $step = ( filter_has_var( INPUT_GET, 'step' ) ? filter_input( INPUT_GET, 'step', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) : 'start' );
	216	+
	217	+ // Fallback to 'start' if the step is a registered step.
	218	+ if ( ! array_key_exists( $step, $this->steps ) ) {
	219	+ $step = 'start';
	220	+ }
	221	+
	222	+ return $step;
	223	+
	224	+ }
	225	+
	226	+ /**
	227	+ * Get the number of the current step.
	228	+ *
	229	+ * @since 3.1.7
	230	+ *
	231	+ * @return int Step number.
	232	+ */
	233	+ public function get_current_step_number() {
	234	+
	235	+ return array_search( $this->step, array_keys( $this->steps ), true ) + 1;
	236	+
	237	+ }
	238	+
	239	+ /**
	240	+ * Get the step by number.
	241	+ *
	242	+ * @since 3.1.7
	243	+ *
	244	+ * @param int $number Step number (1 based index).
	245	+ * @return string Step name/key.
	246	+ */
	247	+ public function get_step_key_by_number( $number ) {
	248	+
	249	+ return array_keys( $this->steps )[ $number - 1 ];
	250	+
	251	+ }
	252	+
	253	+ /**
	254	+ * Get the total number of steps.
	255	+ *
	256	+ * @since 3.1.7
	257	+ *
	258	+ * @return int Total steps.
	259	+ */
	260	+ public function get_total_steps() {
	261	+
	262	+ return count( $this->steps );
	263	+
	264	+ }
	265	+
	266	+ /**
197	267	* Process submitted form data for the given setup wizard name and current step.
198	268	*
199	269	* @since 1.9.8.4
200	270	*/
		@@ -199,23 +269,14 @@
199	269	* @since 1.9.8.4
200	270	*/
201	271	private function process_form() {
202	272
203		- // Run security checks.
204		- if ( ! isset( $_POST['_wpnonce'] ) ) {
205		- return;
206		- }
207		- if ( ! wp_verify_nonce( sanitize_key( $_POST['_wpnonce'] ), $this->page_name ) ) {
208		- $this->error = __( 'Invalid nonce specified.', 'convertkit' );
209		- return;
210		- }
211		-
212	273	/**
213	274	* Process submitted form data for the given setup wizard name and current step.
214	275	*
215	276	* @since 1.9.8.4
216	277	*
217		- * @param int $step Current step number.
	278	+ * @param string $step Current step.
218	279	*/
219	280	do_action( 'convertkit_admin_setup_wizard_process_form_' . $this->page_name, $this->step );
220	281
221	282	}
		@@ -239,14 +300,14 @@
239	300	admin_url( 'options.php' )
240	301	);
241	302
242	303	// Define the previous step URL if we're not on the first or last step.
243		- if ( $this->step > 1 && $this->step < count( $this->steps ) ) {
	304	+ if ( $this->get_current_step_number() > 1 && $this->get_current_step_number() < $this->get_total_steps() ) {
244	305	$this->previous_step_url = add_query_arg(
245	306	array(
246	307	'page' => $this->page_name,
247	308	'convertkit-modal' => $this->is_modal(),
248		- 'step' => ( $this->step - 1 ),
	309	+ 'step' => $this->get_step_key_by_number( $this->get_current_step_number() - 1 ),
249	310	),
250	311	admin_url( 'options.php' )
251	312	);
252	313	}
		@@ -251,14 +312,14 @@
251	312	);
252	313	}
253	314
254	315	// Define the next step URL if we're not on the last page.
255		- if ( $this->step < count( $this->steps ) ) {
	316	+ if ( $this->get_current_step_number() < $this->get_total_steps() ) {
256	317	$this->next_step_url = add_query_arg(
257	318	array(
258	319	'page' => $this->page_name,
259	320	'convertkit-modal' => $this->is_modal(),
260		- 'step' => ( $this->step + 1 ),
	321	+ 'step' => $this->get_step_key_by_number( $this->get_current_step_number() + 1 ),
261	322	),
262	323	admin_url( 'options.php' )
263	324	);
264	325	}
		@@ -276,9 +337,9 @@
276	337	* Load any data into class variables for the given setup wizard name and current step.
277	338	*
278	339	* @since 1.9.8.4
279	340	*
280		- * @param int $step Current step number.
	341	+ * @param string $step Current step.
281	342	*/
282	343	do_action( 'convertkit_admin_setup_wizard_load_screen_data_' . $this->page_name, $this->step );
283	344
284	345	}
		@@ -294,9 +355,9 @@
294	355	convertkit_select2_enqueue_scripts();
295	356
296	357	// Enqueue JS.
297	358	wp_enqueue_script( 'convertkit-admin-preview-output', CONVERTKIT_PLUGIN_URL . 'resources/backend/js/preview-output.js', array( 'jquery' ), CONVERTKIT_PLUGIN_VERSION, true );
298		- wp_enqueue_script( 'convertkit-admin-setup-wizard', CONVERTKIT_PLUGIN_URL . 'resources/backend/js/setup-wizard.js', array( 'jquery' ), CONVERTKIT_PLUGIN_VERSION, true );
	359	+ wp_enqueue_script( 'convertkit-admin-setup-wizard', CONVERTKIT_PLUGIN_URL . 'resources/backend/js/setup-wizard.js', array(), CONVERTKIT_PLUGIN_VERSION, true );
299	360
300	361	}
301	362
302	363	/**
		@@ -411,12 +472,12 @@
411	472	return false;
412	473	}
413	474
414	475	// Bail if we're not on the setup screen.
415		- if ( ! isset( $_GET['page'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
	476	+ if ( ! filter_has_var( INPUT_GET, 'page' ) ) {
416	477	return false;
417	478	}
418		- if ( sanitize_text_field( $_GET['page'] ) !== $this->page_name ) { // phpcs:ignore WordPress.Security.NonceVerification
	479	+ if ( filter_input( INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) !== $this->page_name ) {
419	480	return false;
420	481	}
421	482
422	483	return true;