← All changes | core/common/modules/connect/admin.php +13 -68 4.2.0 → 3.7.5 View file →

		@@ -3,11 +3,8 @@
3	3
4	4	use Elementor\Core\Admin\Menu\Admin_Menu_Manager;
5	5	use Elementor\Plugin;
6	6	use Elementor\Settings;
7		-use Elementor\Utils;
8		-use Elementor\Modules\EditorOne\Classes\Menu_Data_Provider;
9		-use Elementor\Core\Common\Modules\Connect\AdminMenuItems\Editor_One_Connect_Menu;
10	7
11	8	if ( ! defined( 'ABSPATH' ) ) {
12	9	exit; // Exit if accessed directly.
13	10	}
		@@ -17,76 +14,42 @@
17	14	const PAGE_ID = 'elementor-connect';
18	15
19	16	public static $url = '';
20	17
21		- private function get_valid_redirect_to_from_request() {
22		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Only reading a URL parameter.
23		- $raw = Utils::get_super_global_value( $_GET, 'redirect_to' );
	18	+ /**
	19	+ * @since 2.3.0
	20	+ * @access public
	21	+ */
	22	+ public function register_admin_menu( Admin_Menu_Manager $admin_menu ) {
24	23
25		- if ( ! $raw ) {
26		- return '';
27		- }
	24	+ $admin_menu->register( static::PAGE_ID, new Connect_Menu_Item() );
28	25
29		- $raw = esc_url_raw( $raw );
30		-
31		- $validated = wp_validate_redirect( $raw, '' );
32		- if ( ! $validated ) {
33		- return '';
34		- }
35		-
36		- $admin_host = wp_parse_url( admin_url(), PHP_URL_HOST );
37		- $dest_host = wp_parse_url( $validated, PHP_URL_HOST );
38		- if ( $dest_host && $admin_host && ! hash_equals( $admin_host, $dest_host ) ) {
39		- return '';
40		- }
41		-
42		- return $validated;
	26	+ // TODO: Find a way to get the hook name from the register.
	27	+ add_action( 'load-elementor_page_' . static::PAGE_ID, [ $this, 'on_load_page' ] );
43	28	}
44	29
45		- public function register_editor_one_menu( Menu_Data_Provider $menu_data_provider ) {
46		- $menu_data_provider->register_menu( new Editor_One_Connect_Menu() );
47		- }
48		-
49	30	/**
50	31	* @since 2.3.0
51	32	* @access public
52	33	*/
53	34	public function on_load_page() {
54		- if ( ! $this->user_has_enough_permissions() ) {
55		- wp_die( 'You do not have sufficient permissions to access this page.', 'You do not have sufficient permissions to access this page.', [
56		- 'back_link' => true,
57		- ] );
58		- }
59		-
60		- // Allow a per-request default landing URL when provided via a safe `redirect_to` parameter.
61		- $maybe_redirect_to = $this->get_valid_redirect_to_from_request();
62		- if ( $maybe_redirect_to ) {
63		- self::$url = $maybe_redirect_to;
64		- }
65		-
66	35	if ( isset( $_GET['action'], $_GET['app'] ) ) {
67	36	$manager = Plugin::$instance->common->get_component( 'connect' );
68		-
69		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
70		- $app_slug = Utils::get_super_global_value( $_GET, 'app' );
	37	+ $app_slug = $_GET['app'];
71	38	$app = $manager->get_app( $app_slug );
	39	+ $nonce_action = $_GET['app'] . $_GET['action'];
72	40
73		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
74		- $action = Utils::get_super_global_value( $_GET, 'action' );
75		-
76		- $nonce_action = $app_slug . $action;
77		-
78	41	if ( ! $app ) {
79	42	wp_die( 'Unknown app: ' . esc_attr( $app_slug ) );
80	43	}
81	44
82		- if ( ! wp_verify_nonce( Utils::get_super_global_value( $_GET, 'nonce' ), $nonce_action ) ) {
	45	+ if ( empty( $_GET['nonce'] ) || ! wp_verify_nonce( $_GET['nonce'], $nonce_action ) ) {
83	46	wp_die( 'Invalid Nonce', 'Invalid Nonce', [
84	47	'back_link' => true,
85	48	] );
86	49	}
87	50
88		- $method = 'action_' . $action;
	51	+ $method = 'action_' . $_GET['action'];
89	52
90	53	if ( method_exists( $app, $method ) ) {
91	54	call_user_func( [ $app, $method ] );
92	55	}
		@@ -92,20 +55,8 @@
92	55	}
93	56	}
94	57	}
95	58
96		- private function user_has_enough_permissions() {
97		- if ( current_user_can( 'manage_options' ) ) {
98		- return true;
99		- }
100		-
101		- if ( 'library' === Utils::get_super_global_value( $_GET, 'app' ) ) {
102		- return current_user_can( 'edit_posts' );
103		- }
104		-
105		- return false;
106		- }
107		-
108	59	/**
109	60	* @since 2.3.0
110	61	* @access public
111	62	*/
		@@ -111,13 +62,7 @@
111	62	*/
112	63	public function __construct() {
113	64	self::$url = admin_url( 'admin.php?page=' . self::PAGE_ID );
114	65
115		- add_action( 'elementor/editor-one/menu/register', [ $this, 'register_editor_one_menu' ] );
116		-
117		- add_action( 'elementor/editor-one/menu/after_register_hidden_submenus', function ( array $hooks ) {
118		- if ( ! empty( $hooks[ static::PAGE_ID ] ) ) {
119		- add_action( 'load-' . $hooks[ static::PAGE_ID ], [ $this, 'on_load_page' ] );
120		- }
121		- } );
	66	+ add_action( 'elementor/admin/menu/register', [ $this, 'register_admin_menu' ] );
122	67	}
123	68	}