| 1 |
<?php |
| 2 |
namespace Elementor\Core\Common\Modules\Connect; |
| 3 |
|
| 4 |
use Elementor\Core\Admin\Menu\Admin_Menu_Manager; |
| 5 |
use Elementor\Plugin; |
| 6 |
use Elementor\Settings; |
| 7 |
use Elementor\Utils; |
| 8 |
use Elementor\Modules\EditorOne\Classes\Menu_Data_Provider; |
| 9 |
use Elementor\Core\Common\Modules\Connect\AdminMenuItems\Editor_One_Connect_Menu; |
| 10 |
|
| 11 |
if ( ! defined( 'ABSPATH' ) ) { |
| 12 |
exit; // Exit if accessed directly. |
| 13 |
} |
| 14 |
|
| 15 |
class Admin { |
| 16 |
|
| 17 |
const PAGE_ID = 'elementor-connect'; |
| 18 |
|
| 19 |
public static $url = ''; |
| 20 |
|
| 21 |
private function get_valid_redirect_to_from_request() { |
| 22 |
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Only reading a URL parameter. |
| 23 |
$raw = Utils::get_super_global_value( $_GET, 'redirect_to' ); |
| 24 |
|
| 25 |
if ( ! $raw ) { |
| 26 |
return ''; |
| 27 |
} |
| 28 |
|
| 29 |
$raw = esc_url_raw( $raw ); |
| 30 |
|
| 31 |
$validated = wp_validate_redirect( $raw, '' ); |
| 32 |
if ( ! $validated ) { |
| 33 |
return ''; |
| 34 |
} |
| 35 |
|
| 36 |
$admin_host = wp_parse_url( admin_url(), PHP_URL_HOST ); |
| 37 |
$dest_host = wp_parse_url( $validated, PHP_URL_HOST ); |
| 38 |
if ( $dest_host && $admin_host && ! hash_equals( $admin_host, $dest_host ) ) { |
| 39 |
return ''; |
| 40 |
} |
| 41 |
|
| 42 |
return $validated; |
| 43 |
} |
| 44 |
|
| 45 |
public function register_admin_menu( Admin_Menu_Manager $admin_menu ) { |
| 46 |
if ( ! $this->is_editor_one_active() ) { |
| 47 |
$admin_menu->register( static::PAGE_ID, new Connect_Menu_Item() ); |
| 48 |
} |
| 49 |
} |
| 50 |
|
| 51 |
public function register_editor_one_menu( Menu_Data_Provider $menu_data_provider ) { |
| 52 |
$menu_data_provider->register_menu( new Editor_One_Connect_Menu() ); |
| 53 |
} |
| 54 |
|
| 55 |
private function is_editor_one_active(): bool { |
| 56 |
return (bool) Plugin::instance()->modules_manager->get_modules( 'editor-one' ); |
| 57 |
} |
| 58 |
|
| 59 |
/** |
| 60 |
* @since 2.3.0 |
| 61 |
* @access public |
| 62 |
*/ |
| 63 |
public function on_load_page() { |
| 64 |
if ( ! $this->user_has_enough_permissions() ) { |
| 65 |
wp_die( 'You do not have sufficient permissions to access this page.', 'You do not have sufficient permissions to access this page.', [ |
| 66 |
'back_link' => true, |
| 67 |
] ); |
| 68 |
} |
| 69 |
|
| 70 |
// Allow a per-request default landing URL when provided via a safe `redirect_to` parameter. |
| 71 |
$maybe_redirect_to = $this->get_valid_redirect_to_from_request(); |
| 72 |
if ( $maybe_redirect_to ) { |
| 73 |
self::$url = $maybe_redirect_to; |
| 74 |
} |
| 75 |
|
| 76 |
if ( isset( $_GET['action'], $_GET['app'] ) ) { |
| 77 |
$manager = Plugin::$instance->common->get_component( 'connect' ); |
| 78 |
|
| 79 |
// phpcs:ignore WordPress.Security.NonceVerification.Recommended |
| 80 |
$app_slug = Utils::get_super_global_value( $_GET, 'app' ); |
| 81 |
$app = $manager->get_app( $app_slug ); |
| 82 |
|
| 83 |
// phpcs:ignore WordPress.Security.NonceVerification.Recommended |
| 84 |
$action = Utils::get_super_global_value( $_GET, 'action' ); |
| 85 |
|
| 86 |
$nonce_action = $app_slug . $action; |
| 87 |
|
| 88 |
if ( ! $app ) { |
| 89 |
wp_die( 'Unknown app: ' . esc_attr( $app_slug ) ); |
| 90 |
} |
| 91 |
|
| 92 |
if ( ! wp_verify_nonce( Utils::get_super_global_value( $_GET, 'nonce' ), $nonce_action ) ) { |
| 93 |
wp_die( 'Invalid Nonce', 'Invalid Nonce', [ |
| 94 |
'back_link' => true, |
| 95 |
] ); |
| 96 |
} |
| 97 |
|
| 98 |
$method = 'action_' . $action; |
| 99 |
|
| 100 |
if ( method_exists( $app, $method ) ) { |
| 101 |
call_user_func( [ $app, $method ] ); |
| 102 |
} |
| 103 |
} |
| 104 |
} |
| 105 |
|
| 106 |
private function user_has_enough_permissions() { |
| 107 |
if ( current_user_can( 'manage_options' ) ) { |
| 108 |
return true; |
| 109 |
} |
| 110 |
|
| 111 |
if ( 'library' === Utils::get_super_global_value( $_GET, 'app' ) ) { |
| 112 |
return current_user_can( 'edit_posts' ); |
| 113 |
} |
| 114 |
|
| 115 |
return false; |
| 116 |
} |
| 117 |
|
| 118 |
/** |
| 119 |
* @since 2.3.0 |
| 120 |
* @access public |
| 121 |
*/ |
| 122 |
public function __construct() { |
| 123 |
self::$url = admin_url( 'admin.php?page=' . self::PAGE_ID ); |
| 124 |
|
| 125 |
add_action( 'elementor/admin/menu/register', [ $this, 'register_admin_menu' ] ); |
| 126 |
|
| 127 |
add_action( 'elementor/editor-one/menu/register', [ $this, 'register_editor_one_menu' ] ); |
| 128 |
|
| 129 |
add_action( 'elementor/admin/menu/after_register', function ( Admin_Menu_Manager $admin_menu, array $hooks ) { |
| 130 |
if ( ! empty( $hooks[ static::PAGE_ID ] ) ) { |
| 131 |
add_action( 'load-' . $hooks[ static::PAGE_ID ], [ $this, 'on_load_page' ] ); |
| 132 |
} |
| 133 |
}, 10, 2 ); |
| 134 |
|
| 135 |
add_action( 'elementor/editor-one/menu/after_register_hidden_submenus', function ( array $hooks ) { |
| 136 |
if ( ! empty( $hooks[ static::PAGE_ID ] ) ) { |
| 137 |
add_action( 'load-' . $hooks[ static::PAGE_ID ], [ $this, 'on_load_page' ] ); |
| 138 |
} |
| 139 |
} ); |
| 140 |
} |
| 141 |
} |
| 142 |
|
