| @@ -2,11 +2,11 @@ | ||
| 2 | 2 | /** |
| 3 | 3 | * Plugin Name: CryptX |
| 4 | 4 | * Plugin URI: https://wordpress.org/plugins/cryptx/ |
| 5 | 5 | * Description: CryptX encrypts email addresses in your posts, pages, comments, and text widgets to protect them from spam bots while keeping them readable for your visitors. |
| 6 | - * Version: 4.2.1 | |
| 6 | + * Version: 4.0.6 | |
| 7 | 7 | * Requires at least: 6.7 |
| 8 | - * Tested up to: 7.1 | |
| 8 | + * Tested up to: 6.9 | |
| 9 | 9 | * Requires PHP: 8.1 |
| 10 | 10 | * Author: Ralf Weber |
| 11 | 11 | * Author URI: https://weber-nrw.de/ |
| 12 | 12 | * License: GPL v2 or later |
| @@ -35,9 +35,9 @@ | ||
| 35 | 35 | exit; |
| 36 | 36 | } |
| 37 | 37 | |
| 38 | 38 | // Plugin constants |
| 39 | -define('CRYPTX_VERSION', '4.2.1'); | |
| 39 | +define('CRYPTX_VERSION', '4.0.6'); | |
| 40 | 40 | define('CRYPTX_PLUGIN_FILE', __FILE__); |
| 41 | 41 | define('CRYPTX_PLUGIN_BASENAME', plugin_basename(__FILE__)); |
| 42 | 42 | define('CRYPTX_BASENAME', plugin_basename(__FILE__)); // Add this missing constant |
| 43 | 43 | define('CRYPTX_DIR_PATH', plugin_dir_path(__FILE__)); |
| @@ -43,64 +43,36 @@ | ||
| 43 | 43 | define('CRYPTX_DIR_PATH', plugin_dir_path(__FILE__)); |
| 44 | 44 | define('CRYPTX_DIR_URL', plugin_dir_url(__FILE__)); |
| 45 | 45 | define('CRYPTX_BASEFOLDER', dirname(CRYPTX_PLUGIN_BASENAME)); |
| 46 | 46 | |
| 47 | -// Minimum requirements. Keep these in sync with the plugin header above and | |
| 48 | -// with "Requires at least" / "Requires PHP" in readme.txt. They are defined | |
| 49 | -// once and used both for the check and for the notice, so the number shown to | |
| 50 | -// the user cannot drift away from the number actually enforced. | |
| 51 | -define('CRYPTX_MIN_PHP', '8.1'); | |
| 52 | -define('CRYPTX_MIN_WP', '6.7'); | |
| 53 | - | |
| 54 | -/** | |
| 55 | - * Shows an admin notice to whoever is in a position to act on it. | |
| 56 | - * | |
| 57 | - * Registered on both admin_notices and network_admin_notices. Without the | |
| 58 | - * second, a network administrator working in the network backend -- the only | |
| 59 | - * person who can deactivate a network-activated plugin -- never saw that the | |
| 60 | - * server runs too old a PHP, or that a class file is missing. The capability | |
| 61 | - * differs per screen: on a site it is activate_plugins, in the network backend | |
| 62 | - * manage_network_plugins, which a mere site administrator does not hold. | |
| 63 | - * | |
| 64 | - * @param string $message The message, already translated and unescaped. | |
| 65 | - * | |
| 66 | - * @return void | |
| 67 | - */ | |
| 68 | -function cryptx_admin_notice(string $message): void | |
| 69 | -{ | |
| 70 | - $render = static function () use ($message): void { | |
| 71 | - $capability = is_network_admin() ? 'manage_network_plugins' : 'activate_plugins'; | |
| 72 | - | |
| 73 | - if (!current_user_can($capability)) { | |
| 74 | - return; | |
| 75 | - } | |
| 76 | - | |
| 77 | - printf('<div class="notice notice-error"><p>%s</p></div>', esc_html($message)); | |
| 78 | - }; | |
| 79 | - | |
| 80 | - add_action('admin_notices', $render); | |
| 81 | - add_action('network_admin_notices', $render); | |
| 82 | -} | |
| 83 | - | |
| 84 | -if (version_compare(PHP_VERSION, CRYPTX_MIN_PHP, '<')) { | |
| 85 | - cryptx_admin_notice(sprintf( | |
| 86 | - /* translators: %1$s: Required PHP version, %2$s: Current PHP version */ | |
| 87 | - __('CryptX requires PHP version %1$s or higher. You are running version %2$s. Please update PHP.', 'cryptx'), | |
| 88 | - CRYPTX_MIN_PHP, | |
| 89 | - PHP_VERSION | |
| 90 | - )); | |
| 47 | +// Minimum requirements check | |
| 48 | +if (version_compare(PHP_VERSION, '8.1', '<')) { | |
| 49 | + add_action('admin_notices', function() { | |
| 50 | + echo '<div class="notice notice-error"><p>'; | |
| 51 | + printf( | |
| 52 | + /* translators: %1$s: Required PHP version, %2$s: Current PHP version */ | |
| 53 | + esc_html__('CryptX requires PHP version %1$s or higher. You are running version %2$s. Please update PHP.', 'cryptx'), | |
| 54 | + '8.1.0', | |
| 55 | + PHP_VERSION | |
| 56 | + ); | |
| 57 | + echo '</p></div>'; | |
| 58 | + }); | |
| 91 | 59 | return; |
| 92 | 60 | } |
| 93 | 61 | |
| 94 | 62 | // WordPress version check |
| 95 | 63 | global $wp_version; |
| 96 | -if (version_compare($wp_version, CRYPTX_MIN_WP, '<')) { | |
| 97 | - cryptx_admin_notice(sprintf( | |
| 98 | - /* translators: %1$s: Required WordPress version, %2$s: Current WordPress version */ | |
| 99 | - __('CryptX requires WordPress version %1$s or higher. You are running version %2$s. Please update WordPress.', 'cryptx'), | |
| 100 | - CRYPTX_MIN_WP, | |
| 101 | - $GLOBALS['wp_version'] | |
| 102 | - )); | |
| 64 | +if (version_compare($wp_version, '6.7', '<')) { | |
| 65 | + add_action('admin_notices', function() { | |
| 66 | + echo '<div class="notice notice-error"><p>'; | |
| 67 | + printf( | |
| 68 | + /* translators: %1$s: Required WordPress version, %2$s: Current WordPress version */ | |
| 69 | + esc_html__('CryptX requires WordPress version %1$s or higher. You are running version %2$s. Please update WordPress.', 'cryptx'), | |
| 70 | + '5.0', | |
| 71 | + esc_html($GLOBALS['wp_version']) | |
| 72 | + ); | |
| 73 | + echo '</p></div>'; | |
| 74 | + }); | |
| 103 | 75 | return; |
| 104 | 76 | } |
| 105 | 77 | |
| 106 | 78 | // Autoloader for plugin classes |
| @@ -124,14 +96,14 @@ | ||
| 124 | 96 | require_once $file; |
| 125 | 97 | } |
| 126 | 98 | }); |
| 127 | 99 | |
| 128 | -// The settings screen posts nothing: it talks to the REST routes in | |
| 129 | -// CryptX\Admin\RestController, which carry their own capability check and are | |
| 130 | -// covered by WordPress' REST nonce. The global cryptx_nonce_check() that used | |
| 131 | -// to sit here guarded $_POST['cryptX_var'], a key nothing has sent since the | |
| 132 | -// old settings form was removed in 4.1.0 -- a dead guard next to a live one is | |
| 133 | -// a trap for whoever wires up the next form. | |
| 100 | +function cryptx_nonce_check() { | |
| 101 | + if ( isset( $_REQUEST['_wpnonce'] ) && ! wp_verify_nonce( sanitize_text_field(wp_unslash($_REQUEST['_wpnonce'])), 'cryptX' ) ) { | |
| 102 | + wp_die( esc_html__( 'Security check failed. Please try again.', 'cryptx' ), esc_html__( 'Error', 'cryptx' ) ); | |
| 103 | + } | |
| 104 | +} | |
| 105 | +add_action( 'admin_init', 'cryptx_nonce_check' ); | |
| 134 | 106 | |
| 135 | 107 | // Initialize the plugin |
| 136 | 108 | add_action('plugins_loaded', function() { |
| 137 | 109 | // Check if all required classes can be loaded |
| @@ -137,17 +109,14 @@ | ||
| 137 | 109 | // Check if all required classes can be loaded |
| 138 | 110 | $requiredClasses = [ |
| 139 | 111 | 'CryptX\\CryptX', |
| 140 | 112 | 'CryptX\\Config', |
| 113 | + 'CryptX\\CryptXSettingsTabs', | |
| 141 | 114 | 'CryptX\\SecureEncryption', |
| 142 | - 'CryptX\\Exposure', | |
| 143 | - 'CryptX\\Block', | |
| 144 | - 'CryptX\\ImageToken', | |
| 145 | - 'CryptX\\Admin\\NetworkDefaults', | |
| 146 | - 'CryptX\\Admin\\SettingsPage', | |
| 147 | - 'CryptX\\Admin\\SettingsSchema', | |
| 148 | - 'CryptX\\Admin\\RestController', | |
| 149 | - 'CryptX\\Admin\\SiteHealth', | |
| 115 | + 'CryptX\\Admin\\ChangelogSettingsTab', | |
| 116 | + 'CryptX\\Admin\\GeneralSettingsTab', | |
| 117 | + 'CryptX\\Admin\\PresentationSettingsTab', | |
| 118 | + 'CryptX\\Util\\DataSanitizer', | |
| 150 | 119 | ]; |
| 151 | 120 | |
| 152 | 121 | $missingClasses = []; |
| 153 | 122 | foreach ($requiredClasses as $class) { |
| @@ -156,11 +125,13 @@ | ||
| 156 | 125 | } |
| 157 | 126 | } |
| 158 | 127 | |
| 159 | 128 | if (!empty($missingClasses)) { |
| 160 | - cryptx_admin_notice( | |
| 161 | - __('CryptX: Missing required classes: ', 'cryptx') . implode(', ', $missingClasses) | |
| 162 | - ); | |
| 129 | + add_action('admin_notices', function() use ($missingClasses) { | |
| 130 | + echo '<div class="notice notice-error"><p>'; | |
| 131 | + echo esc_html__('CryptX: Missing required classes: ', 'cryptx') . esc_html( implode(', ', $missingClasses), 'cryptx'); | |
| 132 | + echo '</p></div>'; | |
| 133 | + }); | |
| 163 | 134 | return; |
| 164 | 135 | } |
| 165 | 136 | |
| 166 | 137 | // Initialize the main plugin class |
| @@ -166,194 +137,39 @@ | ||
| 166 | 137 | // Initialize the main plugin class |
| 167 | 138 | try { |
| 168 | 139 | $cryptx_instance = CryptX\CryptX::get_instance(); |
| 169 | 140 | $cryptx_instance->startCryptX(); |
| 170 | - cryptx_register_action_links(); | |
| 171 | - | |
| 172 | - // Guarded here as well as inside register(), and deliberately not | |
| 173 | - // listed in $requiredClasses above. Both of those would load the file | |
| 174 | - // on every single front-end and admin request -- class_exists() runs | |
| 175 | - // the autoloader, and so does a static call -- to register commands | |
| 176 | - // that only exist under WP-CLI. | |
| 177 | - // | |
| 178 | - // class_exists() is still asked so that a package missing the file | |
| 179 | - // cannot raise a fatal Error, which catch (Exception) below would not | |
| 180 | - // have caught. It buys no notice: the commands are then simply absent. | |
| 181 | - // That is the right silence -- nothing a visitor or an administrator | |
| 182 | - // sees depends on them. | |
| 183 | - if (defined('WP_CLI') && WP_CLI && class_exists('CryptX\Cli')) { | |
| 184 | - CryptX\Cli::register(); | |
| 185 | - } | |
| 186 | 141 | } catch (Exception $e) { |
| 187 | - cryptx_admin_notice( | |
| 188 | - __('CryptX initialization failed: ', 'cryptx') . $e->getMessage() | |
| 189 | - ); | |
| 142 | + add_action('admin_notices', function() use ($e) { | |
| 143 | + echo '<div class="notice notice-error"><p>'; | |
| 144 | + echo esc_html__('CryptX initialization failed: ', 'cryptx') . esc_html($e->getMessage()); | |
| 145 | + echo '</p></div>'; | |
| 146 | + }); | |
| 190 | 147 | } |
| 191 | 148 | }); |
| 192 | 149 | |
| 193 | -/** | |
| 194 | - * Runs a callback once for every site of the network, in batches. | |
| 195 | - * | |
| 196 | - * get_sites() without a limit pulls the whole network into memory, and a | |
| 197 | - * network can have thousands of sites. Same construction as uninstall.php, | |
| 198 | - * deliberately: the two do the same job at opposite ends of the plugin's life, | |
| 199 | - * and one of them being cleverer than the other only makes both harder to | |
| 200 | - * trust. | |
| 201 | - * | |
| 202 | - * On a single site the callback simply runs once. | |
| 203 | - * | |
| 204 | - * @param callable $callback Receives nothing; runs with the site switched in. | |
| 205 | - * | |
| 206 | - * @return void | |
| 207 | - */ | |
| 208 | -function cryptx_for_each_site(callable $callback): void | |
| 209 | -{ | |
| 210 | - if (!is_multisite()) { | |
| 211 | - $callback(); | |
| 150 | +// Remove the strict activation requirements - let the plugin handle fallbacks | |
| 151 | +register_activation_hook(__FILE__, function() { | |
| 152 | + // Just flush rewrite rules | |
| 153 | + flush_rewrite_rules(); | |
| 154 | +}); | |
| 212 | 155 | |
| 213 | - return; | |
| 214 | - } | |
| 215 | - | |
| 216 | - $batch_size = 100; | |
| 217 | - $offset = 0; | |
| 218 | - | |
| 219 | - do { | |
| 220 | - $site_ids = get_sites([ | |
| 221 | - 'fields' => 'ids', | |
| 222 | - 'number' => $batch_size, | |
| 223 | - 'offset' => $offset, | |
| 224 | - 'orderby' => 'id', | |
| 225 | - 'update_site_meta_cache' => false, | |
| 226 | - ]); | |
| 227 | - | |
| 228 | - foreach ($site_ids as $site_id) { | |
| 229 | - switch_to_blog($site_id); | |
| 230 | - | |
| 231 | - // finally, so a failing callback does not leave the blog stack | |
| 232 | - // switched for whatever runs next. It does not keep the loop | |
| 233 | - // going: an exception still travels upwards and the remaining | |
| 234 | - // sites are skipped. Catching it here would hide a broken site | |
| 235 | - // instead, and that is a trade to make deliberately, not in | |
| 236 | - // passing. | |
| 237 | - try { | |
| 238 | - $callback(); | |
| 239 | - } finally { | |
| 240 | - restore_current_blog(); | |
| 241 | - } | |
| 242 | - } | |
| 243 | - | |
| 244 | - $offset += $batch_size; | |
| 245 | - } while (count($site_ids) === $batch_size); | |
| 246 | -} | |
| 247 | - | |
| 248 | -/** | |
| 249 | - * Removes the plugin's transients from the site that is currently switched in. | |
| 250 | - * | |
| 251 | - * @return void | |
| 252 | - */ | |
| 253 | -function cryptx_delete_transients(): void | |
| 254 | -{ | |
| 156 | +// Plugin deactivation hook | |
| 157 | +register_deactivation_hook(__FILE__, function() { | |
| 158 | + // Clean up any transients or cached data | |
| 255 | 159 | global $wpdb; |
| 256 | - | |
| 257 | - // The LIKE patterns run through $wpdb->esc_like() and $wpdb->prepare(). | |
| 258 | - // No user input is involved here, so this is not a hole, but "_" is a | |
| 259 | - // single-character wildcard in LIKE: unescaped, '_transient_cryptx_%' also | |
| 260 | - // matches names like 'Xtransient1cryptxZ...' belonging to other plugins. | |
| 261 | - // esc_like() turns those underscores into literal ones. The table name is | |
| 262 | - // an identifier, not a value, and therefore must stay outside prepare(). | |
| 263 | - $transientLike = $wpdb->esc_like('_transient_cryptx_') . '%'; | |
| 264 | - $transientTimeoutLike = $wpdb->esc_like('_transient_timeout_cryptx_') . '%'; | |
| 265 | - | |
| 266 | - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching | |
| 267 | - $wpdb->query($wpdb->prepare("DELETE FROM {$wpdb->options} WHERE option_name LIKE %s", $transientLike)); | |
| 268 | - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching | |
| 269 | - $wpdb->query($wpdb->prepare("DELETE FROM {$wpdb->options} WHERE option_name LIKE %s", $transientTimeoutLike)); | |
| 270 | -} | |
| 271 | - | |
| 272 | -/** | |
| 273 | - * Sets up the plugin's options for the site that is currently switched in. | |
| 274 | - * | |
| 275 | - * @return void | |
| 276 | - */ | |
| 277 | -function cryptx_install_site(): void | |
| 278 | -{ | |
| 279 | - if (!class_exists('CryptX\\CryptX')) { | |
| 280 | - return; | |
| 281 | - } | |
| 282 | - | |
| 283 | - CryptX\CryptX::get_instance()->installCryptX(); | |
| 284 | -} | |
| 285 | - | |
| 286 | -// Activation. | |
| 287 | -// | |
| 288 | -// $network_wide is true when someone ticks "Network Activate". WordPress then | |
| 289 | -// fires this hook exactly once, not once per site -- so without the loop, every | |
| 290 | -// site but the current one is left without its stored options and, more to the | |
| 291 | -// point, without the one-time migration of the pre-4.0 "cryptxoff" post meta. | |
| 292 | -// The plugin still works there, because the defaults fill in, but a site that | |
| 293 | -// carried excluded posts from an old version would silently lose them. | |
| 294 | -register_activation_hook(__FILE__, function ($network_wide = false) { | |
| 295 | - if ($network_wide) { | |
| 296 | - cryptx_for_each_site('cryptx_install_site'); | |
| 297 | - } else { | |
| 298 | - cryptx_install_site(); | |
| 299 | - } | |
| 300 | - | |
| 301 | - flush_rewrite_rules(); | |
| 160 | + $wpdb->query("DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_cryptx_%'"); | |
| 161 | + $wpdb->query("DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_timeout_cryptx_%'"); | |
| 302 | 162 | }); |
| 303 | 163 | |
| 304 | -// Deactivation. Same reason, other direction: the transients of every site but | |
| 305 | -// the current one used to survive a network deactivation. | |
| 306 | -register_deactivation_hook(__FILE__, function ($network_wide = false) { | |
| 307 | - if ($network_wide) { | |
| 308 | - cryptx_for_each_site('cryptx_delete_transients'); | |
| 309 | - } else { | |
| 310 | - cryptx_delete_transients(); | |
| 311 | - } | |
| 164 | +// Add plugin action links - updated to match the settings page slug | |
| 165 | +add_filter('plugin_action_links_' . plugin_basename(__FILE__), function($links) { | |
| 166 | + $settings_link = '<a href="' . admin_url('options-general.php?page=cryptx') . '">' . | |
| 167 | + esc_html__('Settings', 'cryptx') . '</a>'; | |
| 168 | + array_unshift($links, $settings_link); | |
| 169 | + return $links; | |
| 312 | 170 | }); |
| 313 | 171 | |
| 314 | -// A site created while the plugin is network-active gets the same treatment as | |
| 315 | -// one that existed at activation time. Without this the new site works -- the | |
| 316 | -// defaults see to that -- but nothing is ever written until someone saves, and | |
| 317 | -// the behaviour differs from every other site in the network for no reason | |
| 318 | -// anybody could see. | |
| 319 | -add_action('wp_initialize_site', function ($site) { | |
| 320 | - // The network option directly, not is_plugin_active_for_network(): that | |
| 321 | - // lives in wp-admin/includes/plugin.php, which is not loaded when a site is | |
| 322 | - // created over the REST API or WP-CLI -- exactly the paths that create sites | |
| 323 | - // in bulk. | |
| 324 | - $network_active = get_site_option('active_sitewide_plugins', []); | |
| 325 | - | |
| 326 | - if (!isset($network_active[CRYPTX_PLUGIN_BASENAME])) { | |
| 327 | - return; | |
| 328 | - } | |
| 329 | - | |
| 330 | - $site_id = is_object($site) ? (int) $site->blog_id : (int) $site; | |
| 331 | - | |
| 332 | - switch_to_blog($site_id); | |
| 333 | - cryptx_install_site(); | |
| 334 | - restore_current_blog(); | |
| 335 | -}, 20); | |
| 336 | - | |
| 337 | -// Add plugin action links. | |
| 338 | -// | |
| 339 | -// Registered inside the successful-initialisation path on purpose, not at the | |
| 340 | -// top level of this file. It refers to a class constant, and the plugins screen | |
| 341 | -// is exactly where someone goes to switch off a plugin whose class files are | |
| 342 | -// missing -- a fatal error there would take away the only lever they have. | |
| 343 | -// A plugin that did not initialise has no settings page to link to anyway. | |
| 344 | -function cryptx_register_action_links(): void | |
| 345 | -{ | |
| 346 | - add_filter('plugin_action_links_' . CRYPTX_PLUGIN_BASENAME, function ($links) { | |
| 347 | - $settings_link = '<a href="' . | |
| 348 | - esc_url(admin_url('options-general.php?page=' . CryptX\Admin\SettingsPage::MENU_SLUG)) . | |
| 349 | - '">' . esc_html__('Settings', 'cryptx') . '</a>'; | |
| 350 | - array_unshift($links, $settings_link); | |
| 351 | - | |
| 352 | - return $links; | |
| 353 | - }); | |
| 354 | -} | |
| 355 | - | |
| 356 | 172 | /** |
| 357 | 173 | * Encrypts the given content using the CryptX library and wraps it with a shortcode. |
| 358 | 174 | * |
| 359 | 175 | * @param string $content The content to be encrypted. |
| @@ -364,20 +180,11 @@ | ||
| 364 | 180 | if (!function_exists('cryptx_encrypt')) { |
| 365 | 181 | function cryptx_encrypt(string $content, ?array $args = []): string |
| 366 | 182 | { |
| 367 | 183 | $cryptXInstance = Cryptx\CryptX::get_instance(); |
| 368 | - // $attributesString contains the escaped (esc_attr()) shortcode attributes from $args | |
| 369 | - // The signature allows null, convertArrayToArgumentString() does not. | |
| 370 | - $attributesString = $cryptXInstance->convertArrayToArgumentString($args ?? []); | |
| 184 | + $attributesString = $cryptXInstance->convertArrayToArgumentString($args); | |
| 185 | + $shortcode = '[cryptx' . esc_attr($attributesString) . ']' . esc_html($content) . '[/cryptx]'; | |
| 371 | 186 | |
| 372 | - // wp_kses_post() and not esc_html(): the caller passes content, and | |
| 373 | - // content in WordPress may carry markup. esc_html() turned a "<br>" in | |
| 374 | - // a theme field into a visible "<br>" -- reported in the support | |
| 375 | - // forum, and worked around there with html_entity_decode(), which | |
| 376 | - // undoes the plugin's own protection in the Unicode and entity modes. | |
| 377 | - // wp_kses_post keeps what a post may contain and drops the rest. | |
| 378 | - $shortcode = '[cryptx' . $attributesString . ']' . wp_kses_post($content) . '[/cryptx]'; | |
| 379 | - | |
| 380 | 187 | return do_shortcode($shortcode); |
| 381 | 188 | } |
| 382 | 189 | } |
| 383 | 190 | |
| @@ -389,13 +196,9 @@ | ||
| 389 | 196 | */ |
| 390 | 197 | if (!function_exists('encryptx')) { |
| 391 | 198 | function encryptx(string $content, ?array $args = []): string |
| 392 | 199 | { |
| 393 | - _doing_it_wrong( | |
| 394 | - 'encryptx', | |
| 395 | - esc_html__('This function is deprecated. Use cryptx_encrypt() instead.', 'cryptx'), | |
| 396 | - '4.0.5' | |
| 397 | - ); | |
| 200 | + __doing_it_wrong( 'badly_named', 'This method has been deprecated in favor of better_named_function "cryptx_encrypt"', '6.9' ); | |
| 398 | 201 | |
| 399 | 202 | return cryptx_encrypt($content, $args); |
| 400 | 203 | } |
| 401 | 204 | } |
