elementor / core / common / modules / connect / admin.php

admin.php in Elementor Website Builder – more than just a page builder 3.32.1, at core/common/modules/connect/admin.php

126 lines 3.2 KB

Raw Download Zip

1	<?php
2	namespace Elementor\Core\Common\Modules\Connect;
3
4	use Elementor\Core\Admin\Menu\Admin_Menu_Manager;
5	use Elementor\Plugin;
6	use Elementor\Settings;
7	use Elementor\Utils;
8
9	if ( ! defined( 'ABSPATH' ) ) {
10	exit; // Exit if accessed directly.
11	}
12
13	class Admin {
14
15	const PAGE_ID = 'elementor-connect';
16
17	public static $url = '';
18
19	private function get_valid_redirect_to_from_request() {
20	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Only reading a URL parameter.
21	$raw = Utils::get_super_global_value( $_GET, 'redirect_to' );
22
23	if ( ! $raw ) {
24	return '';
25	}
26
27	$raw = esc_url_raw( $raw );
28
29	$validated = wp_validate_redirect( $raw, '' );
30	if ( ! $validated ) {
31	return '';
32	}
33
34	$admin_host = wp_parse_url( admin_url(), PHP_URL_HOST );
35	$dest_host = wp_parse_url( $validated, PHP_URL_HOST );
36	if ( $dest_host && $admin_host && ! hash_equals( $admin_host, $dest_host ) ) {
37	return '';
38	}
39
40	return $validated;
41	}
42
43	/**
44	* @since 2.3.0
45	* @access public
46	*/
47	public function register_admin_menu( Admin_Menu_Manager $admin_menu ) {
48	$admin_menu->register( static::PAGE_ID, new Connect_Menu_Item() );
49	}
50
51	/**
52	* @since 2.3.0
53	* @access public
54	*/
55	public function on_load_page() {
56	if ( ! $this->user_has_enough_permissions() ) {
57	wp_die( 'You do not have sufficient permissions to access this page.', 'You do not have sufficient permissions to access this page.', [
58	'back_link' => true,
59	] );
60	}
61
62	// Allow a per-request default landing URL when provided via a safe `redirect_to` parameter.
63	$maybe_redirect_to = $this->get_valid_redirect_to_from_request();
64	if ( $maybe_redirect_to ) {
65	self::$url = $maybe_redirect_to;
66	}
67
68	if ( isset( $_GET['action'], $_GET['app'] ) ) {
69	$manager = Plugin::$instance->common->get_component( 'connect' );
70
71	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
72	$app_slug = Utils::get_super_global_value( $_GET, 'app' );
73	$app = $manager->get_app( $app_slug );
74
75	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
76	$action = Utils::get_super_global_value( $_GET, 'action' );
77
78	$nonce_action = $app_slug . $action;
79
80	if ( ! $app ) {
81	wp_die( 'Unknown app: ' . esc_attr( $app_slug ) );
82	}
83
84	if ( ! wp_verify_nonce( Utils::get_super_global_value( $_GET, 'nonce' ), $nonce_action ) ) {
85	wp_die( 'Invalid Nonce', 'Invalid Nonce', [
86	'back_link' => true,
87	] );
88	}
89
90	$method = 'action_' . $action;
91
92	if ( method_exists( $app, $method ) ) {
93	call_user_func( [ $app, $method ] );
94	}
95	}
96	}
97
98	private function user_has_enough_permissions() {
99	if ( current_user_can( 'manage_options' ) ) {
100	return true;
101	}
102
103	if ( 'library' === Utils::get_super_global_value( $_GET, 'app' ) ) {
104	return current_user_can( 'edit_posts' );
105	}
106
107	return false;
108	}
109
110	/**
111	* @since 2.3.0
112	* @access public
113	*/
114	public function __construct() {
115	self::$url = admin_url( 'admin.php?page=' . self::PAGE_ID );
116
117	add_action( 'elementor/admin/menu/register', [ $this, 'register_admin_menu' ] );
118
119	add_action( 'elementor/admin/menu/after_register', function ( Admin_Menu_Manager $admin_menu, array $hooks ) {
120	if ( ! empty( $hooks[ static::PAGE_ID ] ) ) {
121	add_action( 'load-' . $hooks[ static::PAGE_ID ], [ $this, 'on_load_page' ] );
122	}
123	}, 10, 2 );
124	}
125	}
126