PluginProbe
CryptX / 3.5.2
CryptX v3.5.2
4.2.1 4.2.0 4.1.1 trunk 1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.9 2.0 2.1 2.2 2.3 2.3.1 2.3.2 2.3.3 2.4.0 2.4.1 2.4.2 2.4.3 2.4.4 All 93 releases
← All changes | cryptx.php +42 -379 4.2.0 → 3.5.2 View file →
@@ -1,401 +1,64 @@
1 1 <?php
2 -/**
3 - * Plugin Name: CryptX
4 - * Plugin URI: https://wordpress.org/plugins/cryptx/
5 - * Description: CryptX encrypts email addresses in your posts, pages, comments, and text widgets to protect them from spam bots while keeping them readable for your visitors.
6 - * Version: 4.2.0
2 +/*
3 + * Plugin Name: CryptX
4 + * Plugin URI: http://weber-nrw.de/wordpress/cryptx/
5 + * Description: No more SPAM by spiders scanning you site for email addresses. With CryptX you can hide all your email addresses, with and without a mailto-link, by converting them using javascript or UNICODE.
6 + * Version: 3.5.2
7 7 * Requires at least: 6.7
8 - * Tested up to: 7.1
9 - * Requires PHP: 8.1
10 - * Author: Ralf Weber
11 - * Author URI: https://weber-nrw.de/
8 + * Author: Ralf Weber
9 + * Author URI: http://weber-nrw.de/
12 10 * License: GPL v2 or later
13 11 * License URI: https://www.gnu.org/licenses/gpl-2.0.html
14 - * Text Domain: cryptx
15 - *
16 - * CryptX is free software: you can redistribute it and/or modify
17 - * it under the terms of the GNU General Public License as published by
18 - * the Free Software Foundation, either version 2 of the License, or
19 - * any later version.
20 - *
21 - * CryptX is distributed in the hope that it will be useful,
22 - * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 - * GNU General Public License for more details.
25 - *
26 - * You should have received a copy of the GNU General Public License
27 - * along with CryptX. If not, see https://www.gnu.org/licenses/gpl-2.0.html.
28 - *
29 - * @package CryptX
30 - * @since 1.0.0
31 - */
12 + * Text Domain: cryptx
13 +*/
32 14
33 -// Prevent direct access
34 -if (!defined('ABSPATH')) {
35 - exit;
15 +//avoid direct calls to this file, because now WP core and framework has been used
16 +if ( ! function_exists( 'add_action' ) ) {
17 + header( 'Status: 403 Forbidden' );
18 + header( 'HTTP/1.1 403 Forbidden' );
19 + exit();
36 20 }
37 21
38 -// Plugin constants
39 -define('CRYPTX_VERSION', '4.2.0');
40 -define('CRYPTX_PLUGIN_FILE', __FILE__);
41 -define('CRYPTX_PLUGIN_BASENAME', plugin_basename(__FILE__));
42 -define('CRYPTX_BASENAME', plugin_basename(__FILE__)); // Add this missing constant
43 -define('CRYPTX_DIR_PATH', plugin_dir_path(__FILE__));
44 -define('CRYPTX_DIR_URL', plugin_dir_url(__FILE__));
45 -define('CRYPTX_BASEFOLDER', dirname(CRYPTX_PLUGIN_BASENAME));
22 +/** @const CryptX version */
23 +define( 'CRYPTX_VERSION', "3.5.2" );
24 +define( 'CRYPTX_BASENAME', plugin_basename( __FILE__ ) );
25 +define( 'CRYPTX_BASEFOLDER', plugin_basename( dirname( __FILE__ ) ) );
26 +define( 'CRYPTX_DIR_URL', rtrim( plugin_dir_url( __FILE__ ), "/" ) . "/" );
27 +define( 'CRYPTX_DIR_PATH', plugin_dir_path( __FILE__ ) );
28 +define( 'CRYPTX_FILENAME', str_replace( CRYPTX_BASEFOLDER . '/', '', plugin_basename( __FILE__ ) ) );
46 29
47 -// Minimum requirements. Keep these in sync with the plugin header above and
48 -// with "Requires at least" / "Requires PHP" in readme.txt. They are defined
49 -// once and used both for the check and for the notice, so the number shown to
50 -// the user cannot drift away from the number actually enforced.
51 -define('CRYPTX_MIN_PHP', '8.1');
52 -define('CRYPTX_MIN_WP', '6.7');
30 +spl_autoload_register(function ($class_name) {
31 + // Handle classes in the CryptX namespace
32 + if (strpos($class_name, 'CryptX\\') === 0) {
33 + // Convert namespace separators to directory separators
34 + $file_path = str_replace('\\', DIRECTORY_SEPARATOR, $class_name);
35 + $file_path = str_replace('CryptX' . DIRECTORY_SEPARATOR, '', $file_path);
53 36
54 -/**
55 - * Shows an admin notice to whoever is in a position to act on it.
56 - *
57 - * Registered on both admin_notices and network_admin_notices. Without the
58 - * second, a network administrator working in the network backend -- the only
59 - * person who can deactivate a network-activated plugin -- never saw that the
60 - * server runs too old a PHP, or that a class file is missing. The capability
61 - * differs per screen: on a site it is activate_plugins, in the network backend
62 - * manage_network_plugins, which a mere site administrator does not hold.
63 - *
64 - * @param string $message The message, already translated and unescaped.
65 - *
66 - * @return void
67 - */
68 -function cryptx_admin_notice(string $message): void
69 -{
70 - $render = static function () use ($message): void {
71 - $capability = is_network_admin() ? 'manage_network_plugins' : 'activate_plugins';
37 + // Construct the full file path
38 + $file = CRYPTX_DIR_PATH . 'classes' . DIRECTORY_SEPARATOR . $file_path . '.php';
72 39
73 - if (!current_user_can($capability)) {
74 - return;
40 + if (file_exists($file)) {
41 + require_once $file;
75 42 }
76 -
77 - printf('<div class="notice notice-error"><p>%s</p></div>', esc_html($message));
78 - };
79 -
80 - add_action('admin_notices', $render);
81 - add_action('network_admin_notices', $render);
82 -}
83 -
84 -if (version_compare(PHP_VERSION, CRYPTX_MIN_PHP, '<')) {
85 - cryptx_admin_notice(sprintf(
86 - /* translators: %1$s: Required PHP version, %2$s: Current PHP version */
87 - __('CryptX requires PHP version %1$s or higher. You are running version %2$s. Please update PHP.', 'cryptx'),
88 - CRYPTX_MIN_PHP,
89 - PHP_VERSION
90 - ));
91 - return;
92 -}
93 -
94 -// WordPress version check
95 -global $wp_version;
96 -if (version_compare($wp_version, CRYPTX_MIN_WP, '<')) {
97 - cryptx_admin_notice(sprintf(
98 - /* translators: %1$s: Required WordPress version, %2$s: Current WordPress version */
99 - __('CryptX requires WordPress version %1$s or higher. You are running version %2$s. Please update WordPress.', 'cryptx'),
100 - CRYPTX_MIN_WP,
101 - $GLOBALS['wp_version']
102 - ));
103 - return;
104 -}
105 -
106 -// Autoloader for plugin classes
107 -spl_autoload_register(function ($class) {
108 - // Check if the class belongs to our namespace
109 - if (strpos($class, 'CryptX\\') !== 0) {
110 - return;
111 43 }
112 -
113 - // Remove namespace prefix
114 - $class = substr($class, 7);
115 -
116 - // Convert namespace separators to directory separators
117 - $class = str_replace('\\', DIRECTORY_SEPARATOR, $class);
118 -
119 - // Build the full path
120 - $file = CRYPTX_DIR_PATH . 'classes' . DIRECTORY_SEPARATOR . $class . '.php';
121 -
122 - // Include the file if it exists
123 - if (file_exists($file)) {
124 - require_once $file;
125 - }
126 44 });
127 45
128 -// The settings screen posts nothing: it talks to the REST routes in
129 -// CryptX\Admin\RestController, which carry their own capability check and are
130 -// covered by WordPress' REST nonce. The global cryptx_nonce_check() that used
131 -// to sit here guarded $_POST['cryptX_var'], a key nothing has sent since the
132 -// old settings form was removed in 4.1.0 -- a dead guard next to a live one is
133 -// a trap for whoever wires up the next form.
134 46
135 -// Initialize the plugin
136 -add_action('plugins_loaded', function() {
137 - // Check if all required classes can be loaded
138 - $requiredClasses = [
139 - 'CryptX\\CryptX',
140 - 'CryptX\\Config',
141 - 'CryptX\\SecureEncryption',
142 - 'CryptX\\Exposure',
143 - 'CryptX\\Block',
144 - 'CryptX\\ImageToken',
145 - 'CryptX\\Admin\\NetworkDefaults',
146 - 'CryptX\\Admin\\SettingsPage',
147 - 'CryptX\\Admin\\SettingsSchema',
148 - 'CryptX\\Admin\\RestController',
149 - 'CryptX\\Admin\\SiteHealth',
150 - ];
47 +//require_once( CRYPTX_DIR_PATH . 'classes/CryptX.php' );
48 +//require_once( CRYPTX_DIR_PATH . 'include/admin_option_page.php' );
151 49
152 - $missingClasses = [];
153 - foreach ($requiredClasses as $class) {
154 - if (!class_exists($class)) {
155 - $missingClasses[] = $class;
156 - }
157 - }
50 +$CryptX_instance = CryptX\CryptX::get_instance();
51 +$CryptX_instance->startCryptX();
158 52
159 - if (!empty($missingClasses)) {
160 - cryptx_admin_notice(
161 - __('CryptX: Missing required classes: ', 'cryptx') . implode(', ', $missingClasses)
162 - );
163 - return;
164 - }
165 -
166 - // Initialize the main plugin class
167 - try {
168 - $cryptx_instance = CryptX\CryptX::get_instance();
169 - $cryptx_instance->startCryptX();
170 - cryptx_register_action_links();
171 -
172 - // Guarded here as well as inside register(), and deliberately not
173 - // listed in $requiredClasses above. Both of those would load the file
174 - // on every single front-end and admin request -- class_exists() runs
175 - // the autoloader, and so does a static call -- to register commands
176 - // that only exist under WP-CLI.
177 - //
178 - // class_exists() is still asked so that a package missing the file
179 - // cannot raise a fatal Error, which catch (Exception) below would not
180 - // have caught. It buys no notice: the commands are then simply absent.
181 - // That is the right silence -- nothing a visitor or an administrator
182 - // sees depends on them.
183 - if (defined('WP_CLI') && WP_CLI && class_exists('CryptX\Cli')) {
184 - CryptX\Cli::register();
185 - }
186 - } catch (Exception $e) {
187 - cryptx_admin_notice(
188 - __('CryptX initialization failed: ', 'cryptx') . $e->getMessage()
189 - );
190 - }
191 -});
192 -
193 53 /**
194 - * Runs a callback once for every site of the network, in batches.
54 + * Encrypts the given content using the CryptX WordPress plugin.
195 55 *
196 - * get_sites() without a limit pulls the whole network into memory, and a
197 - * network can have thousands of sites. Same construction as uninstall.php,
198 - * deliberately: the two do the same job at opposite ends of the plugin's life,
199 - * and one of them being cleverer than the other only makes both harder to
200 - * trust.
56 + * @param string|null $content The content to encrypt.
57 + * @param array|null $args The optional arguments for the encryption. Default is an empty array.
201 58 *
202 - * On a single site the callback simply runs once.
203 - *
204 - * @param callable $callback Receives nothing; runs with the site switched in.
205 - *
206 - * @return void
59 + * @return string The encrypted content wrapped in the '[cryptx]' shortcode.
207 60 */
208 -function cryptx_for_each_site(callable $callback): void
209 -{
210 - if (!is_multisite()) {
211 - $callback();
212 -
213 - return;
214 - }
215 -
216 - $batch_size = 100;
217 - $offset = 0;
218 -
219 - do {
220 - $site_ids = get_sites([
221 - 'fields' => 'ids',
222 - 'number' => $batch_size,
223 - 'offset' => $offset,
224 - 'orderby' => 'id',
225 - 'update_site_meta_cache' => false,
226 - ]);
227 -
228 - foreach ($site_ids as $site_id) {
229 - switch_to_blog($site_id);
230 -
231 - // finally, so a failing callback does not leave the blog stack
232 - // switched for whatever runs next. It does not keep the loop
233 - // going: an exception still travels upwards and the remaining
234 - // sites are skipped. Catching it here would hide a broken site
235 - // instead, and that is a trade to make deliberately, not in
236 - // passing.
237 - try {
238 - $callback();
239 - } finally {
240 - restore_current_blog();
241 - }
242 - }
243 -
244 - $offset += $batch_size;
245 - } while (count($site_ids) === $batch_size);
246 -}
247 -
248 -/**
249 - * Removes the plugin's transients from the site that is currently switched in.
250 - *
251 - * @return void
252 - */
253 -function cryptx_delete_transients(): void
254 -{
255 - global $wpdb;
256 -
257 - // The LIKE patterns run through $wpdb->esc_like() and $wpdb->prepare().
258 - // No user input is involved here, so this is not a hole, but "_" is a
259 - // single-character wildcard in LIKE: unescaped, '_transient_cryptx_%' also
260 - // matches names like 'Xtransient1cryptxZ...' belonging to other plugins.
261 - // esc_like() turns those underscores into literal ones. The table name is
262 - // an identifier, not a value, and therefore must stay outside prepare().
263 - $transientLike = $wpdb->esc_like('_transient_cryptx_') . '%';
264 - $transientTimeoutLike = $wpdb->esc_like('_transient_timeout_cryptx_') . '%';
265 -
266 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
267 - $wpdb->query($wpdb->prepare("DELETE FROM {$wpdb->options} WHERE option_name LIKE %s", $transientLike));
268 - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
269 - $wpdb->query($wpdb->prepare("DELETE FROM {$wpdb->options} WHERE option_name LIKE %s", $transientTimeoutLike));
270 -}
271 -
272 -/**
273 - * Sets up the plugin's options for the site that is currently switched in.
274 - *
275 - * @return void
276 - */
277 -function cryptx_install_site(): void
278 -{
279 - if (!class_exists('CryptX\\CryptX')) {
280 - return;
281 - }
282 -
283 - CryptX\CryptX::get_instance()->installCryptX();
284 -}
285 -
286 -// Activation.
287 -//
288 -// $network_wide is true when someone ticks "Network Activate". WordPress then
289 -// fires this hook exactly once, not once per site -- so without the loop, every
290 -// site but the current one is left without its stored options and, more to the
291 -// point, without the one-time migration of the pre-4.0 "cryptxoff" post meta.
292 -// The plugin still works there, because the defaults fill in, but a site that
293 -// carried excluded posts from an old version would silently lose them.
294 -register_activation_hook(__FILE__, function ($network_wide = false) {
295 - if ($network_wide) {
296 - cryptx_for_each_site('cryptx_install_site');
297 - } else {
298 - cryptx_install_site();
299 - }
300 -
301 - flush_rewrite_rules();
302 -});
303 -
304 -// Deactivation. Same reason, other direction: the transients of every site but
305 -// the current one used to survive a network deactivation.
306 -register_deactivation_hook(__FILE__, function ($network_wide = false) {
307 - if ($network_wide) {
308 - cryptx_for_each_site('cryptx_delete_transients');
309 - } else {
310 - cryptx_delete_transients();
311 - }
312 -});
313 -
314 -// A site created while the plugin is network-active gets the same treatment as
315 -// one that existed at activation time. Without this the new site works -- the
316 -// defaults see to that -- but nothing is ever written until someone saves, and
317 -// the behaviour differs from every other site in the network for no reason
318 -// anybody could see.
319 -add_action('wp_initialize_site', function ($site) {
320 - // The network option directly, not is_plugin_active_for_network(): that
321 - // lives in wp-admin/includes/plugin.php, which is not loaded when a site is
322 - // created over the REST API or WP-CLI -- exactly the paths that create sites
323 - // in bulk.
324 - $network_active = get_site_option('active_sitewide_plugins', []);
325 -
326 - if (!isset($network_active[CRYPTX_PLUGIN_BASENAME])) {
327 - return;
328 - }
329 -
330 - $site_id = is_object($site) ? (int) $site->blog_id : (int) $site;
331 -
332 - switch_to_blog($site_id);
333 - cryptx_install_site();
334 - restore_current_blog();
335 -}, 20);
336 -
337 -// Add plugin action links.
338 -//
339 -// Registered inside the successful-initialisation path on purpose, not at the
340 -// top level of this file. It refers to a class constant, and the plugins screen
341 -// is exactly where someone goes to switch off a plugin whose class files are
342 -// missing -- a fatal error there would take away the only lever they have.
343 -// A plugin that did not initialise has no settings page to link to anyway.
344 -function cryptx_register_action_links(): void
345 -{
346 - add_filter('plugin_action_links_' . CRYPTX_PLUGIN_BASENAME, function ($links) {
347 - $settings_link = '<a href="' .
348 - esc_url(admin_url('options-general.php?page=' . CryptX\Admin\SettingsPage::MENU_SLUG)) .
349 - '">' . esc_html__('Settings', 'cryptx') . '</a>';
350 - array_unshift($links, $settings_link);
351 -
352 - return $links;
353 - });
354 -}
355 -
356 -/**
357 - * Encrypts the given content using the CryptX library and wraps it with a shortcode.
358 - *
359 - * @param string $content The content to be encrypted.
360 - * @param array|null $args Optional arguments to customize the encryption process.
361 - *
362 - * @return string The encrypted content wrapped in the appropriate shortcode.
363 - */
364 -if (!function_exists('cryptx_encrypt')) {
365 - function cryptx_encrypt(string $content, ?array $args = []): string
366 - {
367 - $cryptXInstance = Cryptx\CryptX::get_instance();
368 - // $attributesString contains the escaped (esc_attr()) shortcode attributes from $args
369 - // The signature allows null, convertArrayToArgumentString() does not.
370 - $attributesString = $cryptXInstance->convertArrayToArgumentString($args ?? []);
371 -
372 - // wp_kses_post() and not esc_html(): the caller passes content, and
373 - // content in WordPress may carry markup. esc_html() turned a "<br>" in
374 - // a theme field into a visible "&lt;br&gt;" -- reported in the support
375 - // forum, and worked around there with html_entity_decode(), which
376 - // undoes the plugin's own protection in the Unicode and entity modes.
377 - // wp_kses_post keeps what a post may contain and drops the rest.
378 - $shortcode = '[cryptx' . $attributesString . ']' . wp_kses_post($content) . '[/cryptx]';
379 -
380 - return do_shortcode($shortcode);
381 - }
382 -}
383 -
384 -/**
385 - * Encrypts the given content using the CryptX library and wraps it with a shortcode.
386 - *
387 - * @deprecated 4.0.5 Use cryptx_encrypt() instead.
388 - * @see cryptx_encrypt()
389 - */
390 -if (!function_exists('encryptx')) {
391 - function encryptx(string $content, ?array $args = []): string
392 - {
393 - _doing_it_wrong(
394 - 'encryptx',
395 - esc_html__('This function is deprecated. Use cryptx_encrypt() instead.', 'cryptx'),
396 - '4.0.5'
397 - );
398 -
399 - return cryptx_encrypt($content, $args);
400 - }
61 +function encryptx( ?string $content, ?array $args = [] ): string {
62 + $CryptX_instance = Cryptx\CryptX::get_instance();
63 + return do_shortcode( '[cryptx'. $CryptX_instance->convertArrayToArgumentString( $args ).']' . $content . '[/cryptx]' );
401 64 }