← All changes | src/component/class-hub-connector.php +42 -23 6.0.0 → 6.3.0 View file →

		@@ -55,9 +55,9 @@
55	55	return ! self::get_hcm_status() && wp_verify_nonce( defender_get_data_from_request( '_def_nonce', 'g' ), self::CONNECTION_ACTION );
56	56	}
57	57
58	58	$page_action = sanitize_text_field( wp_unslash( $_GET['page_action'] ?? '' ) );
59		- $is_hub_callback = ! empty( $_GET['hub_connector_callback'] );
	59	+ $is_hub_callback = isset( $_GET['hub_connector_callback'] ) && '1' === $_GET['hub_connector_callback'];
60	60
61	61	if ( self::CONNECTION_ACTION === $page_action || $is_hub_callback ) {
62	62	return false;
63	63	}
		@@ -113,11 +113,14 @@
113	113	*
114	114	* @return bool
115	115	*/
116	116	public static function is_team_selection_callback(): bool {
117		- return ! empty( $_REQUEST['hub_connector_callback'] ) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
118		- && ! empty( $_REQUEST['user_apikey'] ) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
119		- && 1 === (int) ( $_REQUEST['is_multi_auth'] ?? 0 ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	117	+ // Follow the approach implemented in HC module. Skip a sanitization step to avoid ruining the input.
	118	+ $is_multi_auth = isset( $_REQUEST['is_multi_auth'] ) ? (int) $_REQUEST['is_multi_auth'] : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	119	+
	120	+ return isset( $_REQUEST['hub_connector_callback'] ) && '1' === $_REQUEST['hub_connector_callback'] // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	121	+ && isset( $_REQUEST['user_apikey'] ) && '' !== $_REQUEST['user_apikey'] // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	122	+ && 1 === $is_multi_auth;
120	123	}
121	124
122	125	/**
123	126	* Gets the label for the button to connect the site to the Hub.
		@@ -337,13 +340,16 @@
337	340
338	341	return false;
339	342	}
340	343
341		- $page_action = sanitize_text_field( wp_unslash( $_REQUEST['page_action'] ?? '' ) );
342		- $syncing = current_user_can( 'manage_options' )
343		- && self::verify_auth_nonce()
344		- && self::CONNECTION_ACTION === $page_action
345		- && ! empty( $_REQUEST['set_apikey'] );
	344	+ $syncing = false;
	345	+ if ( current_user_can( 'manage_options' ) && self::verify_auth_nonce() ) {
	346	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verified above by self::verify_auth_nonce().
	347	+ $page_action = sanitize_text_field( wp_unslash( $_REQUEST['page_action'] ?? '' ) );
	348	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verified above by self::verify_auth_nonce().
	349	+ $set_apikey = sanitize_text_field( wp_unslash( $_REQUEST['set_apikey'] ?? '' ) );
	350	+ $syncing = self::CONNECTION_ACTION === $page_action && '' !== $set_apikey;
	351	+ }
346	352
347	353	if ( $syncing ) {
348	354	set_site_transient( self::SYNCING_TRANSIENT_KEY, true, MINUTE_IN_SECONDS );
349	355	}
		@@ -356,14 +362,16 @@
356	362	*
357	363	* @return bool
358	364	*/
359	365	public static function has_error_in_login() {
	366	+ // phpcs:disable WordPress.Security.NonceVerification.Recommended -- Read-only URL parameter check / validated via verify_auth_nonce below.
360	367	$page_action = sanitize_text_field( wp_unslash( $_GET['page_action'] ?? '' ) );
361		- $api_error = sanitize_text_field( wp_unslash( $_GET['api_error'] ?? 0 ) );
362		- $is_hub_callback = ! empty( $_GET['hub_connector_callback'] );
	368	+ $api_error = sanitize_text_field( wp_unslash( $_GET['api_error'] ?? '' ) );
	369	+ $is_hub_callback = isset( $_GET['hub_connector_callback'] ) && '1' === $_GET['hub_connector_callback'];
	370	+ $has_api_error = ! in_array( trim( $api_error ), array( '', '0' ), true );
363	371
364	372	if ( self::CONNECTION_ACTION === $page_action ) {
365		- return ! empty( $api_error );
	373	+ return $has_api_error;
366	374	}
367	375
368	376	if ( ! $is_hub_callback || ! self::verify_auth_nonce() ) {
369	377	return false;
		@@ -368,9 +376,9 @@
368	376	if ( ! $is_hub_callback || ! self::verify_auth_nonce() ) {
369	377	return false;
370	378	}
371	379
372		- return ! empty( $api_error );
	380	+ return $has_api_error;
373	381	}
374	382
375	383	/**
376	384	* Get authentication error messages. Copied from HC.
		@@ -504,9 +512,9 @@
504	512	$error = __( 'Google login failed. Please try again.', 'defender-security' );
505	513	break;
506	514	default:
507	515	// Use the actual error message passed through from the sync poll if available.
508		- if ( ! empty( $_GET['api_error_msg'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	516	+ if ( isset( $_GET['api_error_msg'] ) && '' !== $_GET['api_error_msg'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
509	517	$error = sanitize_text_field( wp_unslash( $_GET['api_error_msg'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
510	518	} else {
511	519	$error = __( 'Unknown error. Please update the WPMU DEV Dashboard plugin and try again.', 'defender-security' );
512	520	}
		@@ -512,9 +520,9 @@
512	520	}
513	521	break;
514	522	}
515	523	}
516		- } elseif ( ! empty( $_REQUEST['connection_error'] ) ) {
	524	+ } elseif ( isset( $_REQUEST['connection_error'] ) && '' !== $_REQUEST['connection_error'] ) {
517	525	// Variable `$connection_error` is set by the UI function `render_dashboard`.
518	526	$error = sprintf(
519	527	'%s<br>%s<br><em>%s</em>',
520	528	__( 'Your server had a problem connecting to WPMU DEV. Please try again.', 'defender-security' ),
		@@ -524,9 +532,9 @@
524	532	__( '"Is PHP on my server properly configured to be able to contact %s with a POST HTTP request via fsockopen or CURL?"', 'defender-security' ),
525	533	\WPMUDEV\Hub\Connector\Data::get()->server_url()
526	534	)
527	535	);
528		- } elseif ( ! empty( $_REQUEST['invalid_key'] ) ) {
	536	+ } elseif ( isset( $_REQUEST['invalid_key'] ) && '' !== $_REQUEST['invalid_key'] ) {
529	537	// Invalid API key.
530	538	$error = __( 'Your API Key was invalid. Please try again.', 'defender-security' );
531	539	}
532	540
		@@ -567,9 +575,9 @@
567	575	} else {
568	576	$args = self::get_connection_args( $target_page );
569	577	}
570	578
571		- if ( ! empty( $utm_campaign ) ) {
	579	+ if ( '' !== trim( $utm_campaign ) ) {
572	580	$args['utm_campaign'] = sanitize_text_field( $utm_campaign );
573	581	}
574	582
575	583	$admin_url = self::get_admin_url();
		@@ -587,9 +595,9 @@
587	595	*/
588	596	public static function get_hub_connector_callback_url( string $target_page = 'wp-defender', string $utm_campaign = '' ): string {
589	597	$args = self::get_connection_args( $target_page );
590	598
591		- if ( ! empty( $utm_campaign ) ) {
	599	+ if ( '' !== trim( $utm_campaign ) ) {
592	600	$args['utm_campaign'] = sanitize_text_field( $utm_campaign );
593	601	}
594	602
595	603	return add_query_arg( $args, self::get_admin_url() );
		@@ -680,18 +688,29 @@
680	688	if ( ! class_exists( '\WPMUDEV\Hub\Connector\Data' ) ) {
681	689	return null;
682	690	}
683	691
684		- $api_logged_in = self::is_logged_in();
685		- $is_pro = wd_di()->get( WPMUDEV::class )->is_pro();
	692	+ $api_logged_in = self::is_logged_in();
	693	+ $dashboard_connected = self::is_wpmudev_dashboard_connected();
	694	+ $is_pro = wd_di()->get( WPMUDEV::class )->is_pro();
686	695
687		- if ( ! $api_logged_in && ! $is_pro ) {
	696	+ if ( ! $api_logged_in && ! $dashboard_connected && ! $is_pro ) {
688	697	return null;
689	698	}
690	699
691		- $raw = \WPMUDEV\Hub\Connector\Data::get()->profile_data( true );
	700	+ if (
	701	+ $dashboard_connected &&
	702	+ ! $api_logged_in &&
	703	+ is_object( \WPMUDEV_Dashboard::$settings ) &&
	704	+ method_exists( \WPMUDEV_Dashboard::$settings, 'get' )
	705	+ ) {
	706	+ $dashboard_profile = \WPMUDEV_Dashboard::$settings->get( 'profile_data' );
	707	+ $raw = $dashboard_profile['profile'] ?? array();
	708	+ } else {
	709	+ $raw = \WPMUDEV\Hub\Connector\Data::get()->profile_data( true );
	710	+ }
692	711
693		- if ( ! is_array( $raw ) || empty( $raw['user_name'] ) ) {
	712	+ if ( ! is_array( $raw ) || ! isset( $raw['user_name'] ) || '' === trim( $raw['user_name'] ) ) {
694	713	return null;
695	714	}
696	715
697	716	$display_name = isset( $raw['name'] ) ? (string) $raw['name'] : '';