| @@ -103,9 +103,9 @@ | ||
| 103 | 103 | <p> |
| 104 | 104 | <a href="<?php echo esc_url(admin_url('admin.php?page=easy-invoice-migration')); ?>" class="button button-primary"> |
| 105 | 105 | <?php esc_html_e('Run Migration', 'easy-invoice'); ?> |
| 106 | 106 | </a> |
| 107 | - <a href="<?php echo esc_url(admin_url('admin.php?page=easy-invoice-migration&action=skip')); ?>" class="button button-secondary"> | |
| 107 | + <a href="<?php echo esc_url(wp_nonce_url(admin_url('admin.php?page=easy-invoice-migration&action=skip'), 'easy_invoice_migration_skip')); ?>" class="button button-secondary"> | |
| 108 | 108 | <?php esc_html_e('Skip for Now', 'easy-invoice'); ?> |
| 109 | 109 | </a> |
| 110 | 110 | </p> |
| 111 | 111 | </div> |
| @@ -165,9 +165,9 @@ | ||
| 165 | 165 | */ |
| 166 | 166 | public static function render_migration_page_handler() { |
| 167 | 167 | // Check if user has permissions |
| 168 | 168 | if (!current_user_can('manage_options')) { |
| 169 | - wp_die(__('You do not have sufficient permissions to access this page.', 'easy-invoice')); | |
| 169 | + wp_die(esc_html__('You do not have sufficient permissions to access this page.', 'easy-invoice')); | |
| 170 | 170 | } |
| 171 | 171 | |
| 172 | 172 | // Ensure page is set properly |
| 173 | 173 | if (!isset($_GET['page'])) { |
| @@ -191,11 +191,13 @@ | ||
| 191 | 191 | */ |
| 192 | 192 | public static function handle_migration_redirect() { |
| 193 | 193 | if (isset($_GET['page']) && $_GET['page'] === 'easy-invoice-migration') { |
| 194 | 194 | // Handle skip action |
| 195 | - if (isset($_GET['action']) && $_GET['action'] === 'skip') { | |
| 195 | + if (isset($_GET['action']) && $_GET['action'] === 'skip' | |
| 196 | + && current_user_can('manage_options') | |
| 197 | + && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'easy_invoice_migration_skip')) { | |
| 196 | 198 | update_option('easy_invoice_migration_skipped', true); |
| 197 | - wp_redirect(admin_url('admin.php?page=easy-invoice')); | |
| 199 | + wp_safe_redirect(admin_url('admin.php?page=easy-invoice')); | |
| 198 | 200 | exit; |
| 199 | 201 | } |
| 200 | 202 | |
| 201 | 203 | // Enqueue migration assets |
