← All changes | core/common/modules/connect/admin.php +13 -66 4.0.9 → 3.9.2 View file →

		@@ -3,11 +3,8 @@
3	3
4	4	use Elementor\Core\Admin\Menu\Admin_Menu_Manager;
5	5	use Elementor\Plugin;
6	6	use Elementor\Settings;
7		-use Elementor\Utils;
8		-use Elementor\Modules\EditorOne\Classes\Menu_Data_Provider;
9		-use Elementor\Core\Common\Modules\Connect\AdminMenuItems\Editor_One_Connect_Menu;
10	7
11	8	if ( ! defined( 'ABSPATH' ) ) {
12	9	exit; // Exit if accessed directly.
13	10	}
		@@ -17,76 +14,38 @@
17	14	const PAGE_ID = 'elementor-connect';
18	15
19	16	public static $url = '';
20	17
21		- private function get_valid_redirect_to_from_request() {
22		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Only reading a URL parameter.
23		- $raw = Utils::get_super_global_value( $_GET, 'redirect_to' );
24		-
25		- if ( ! $raw ) {
26		- return '';
27		- }
28		-
29		- $raw = esc_url_raw( $raw );
30		-
31		- $validated = wp_validate_redirect( $raw, '' );
32		- if ( ! $validated ) {
33		- return '';
34		- }
35		-
36		- $admin_host = wp_parse_url( admin_url(), PHP_URL_HOST );
37		- $dest_host = wp_parse_url( $validated, PHP_URL_HOST );
38		- if ( $dest_host && $admin_host && ! hash_equals( $admin_host, $dest_host ) ) {
39		- return '';
40		- }
41		-
42		- return $validated;
	18	+ /**
	19	+ * @since 2.3.0
	20	+ * @access public
	21	+ */
	22	+ public function register_admin_menu( Admin_Menu_Manager $admin_menu ) {
	23	+ $admin_menu->register( static::PAGE_ID, new Connect_Menu_Item() );
43	24	}
44	25
45		- public function register_editor_one_menu( Menu_Data_Provider $menu_data_provider ) {
46		- $menu_data_provider->register_menu( new Editor_One_Connect_Menu() );
47		- }
48		-
49	26	/**
50	27	* @since 2.3.0
51	28	* @access public
52	29	*/
53	30	public function on_load_page() {
54		- if ( ! $this->user_has_enough_permissions() ) {
55		- wp_die( 'You do not have sufficient permissions to access this page.', 'You do not have sufficient permissions to access this page.', [
56		- 'back_link' => true,
57		- ] );
58		- }
59		-
60		- // Allow a per-request default landing URL when provided via a safe `redirect_to` parameter.
61		- $maybe_redirect_to = $this->get_valid_redirect_to_from_request();
62		- if ( $maybe_redirect_to ) {
63		- self::$url = $maybe_redirect_to;
64		- }
65		-
66	31	if ( isset( $_GET['action'], $_GET['app'] ) ) {
67	32	$manager = Plugin::$instance->common->get_component( 'connect' );
68		-
69		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
70		- $app_slug = Utils::get_super_global_value( $_GET, 'app' );
	33	+ $app_slug = $_GET['app'];
71	34	$app = $manager->get_app( $app_slug );
	35	+ $nonce_action = $_GET['app'] . $_GET['action'];
72	36
73		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
74		- $action = Utils::get_super_global_value( $_GET, 'action' );
75		-
76		- $nonce_action = $app_slug . $action;
77		-
78	37	if ( ! $app ) {
79	38	wp_die( 'Unknown app: ' . esc_attr( $app_slug ) );
80	39	}
81	40
82		- if ( ! wp_verify_nonce( Utils::get_super_global_value( $_GET, 'nonce' ), $nonce_action ) ) {
	41	+ if ( empty( $_GET['nonce'] ) || ! wp_verify_nonce( $_GET['nonce'], $nonce_action ) ) {
83	42	wp_die( 'Invalid Nonce', 'Invalid Nonce', [
84	43	'back_link' => true,
85	44	] );
86	45	}
87	46
88		- $method = 'action_' . $action;
	47	+ $method = 'action_' . $_GET['action'];
89	48
90	49	if ( method_exists( $app, $method ) ) {
91	50	call_user_func( [ $app, $method ] );
92	51	}
		@@ -92,20 +51,8 @@
92	51	}
93	52	}
94	53	}
95	54
96		- private function user_has_enough_permissions() {
97		- if ( current_user_can( 'manage_options' ) ) {
98		- return true;
99		- }
100		-
101		- if ( 'library' === Utils::get_super_global_value( $_GET, 'app' ) ) {
102		- return current_user_can( 'edit_posts' );
103		- }
104		-
105		- return false;
106		- }
107		-
108	55	/**
109	56	* @since 2.3.0
110	57	* @access public
111	58	*/
		@@ -111,13 +58,13 @@
111	58	*/
112	59	public function __construct() {
113	60	self::$url = admin_url( 'admin.php?page=' . self::PAGE_ID );
114	61
115		- add_action( 'elementor/editor-one/menu/register', [ $this, 'register_editor_one_menu' ] );
	62	+ add_action( 'elementor/admin/menu/register', [ $this, 'register_admin_menu' ] );
116	63
117		- add_action( 'elementor/editor-one/menu/after_register_hidden_submenus', function ( array $hooks ) {
	64	+ add_action( 'elementor/admin/menu/after_register', function ( Admin_Menu_Manager $admin_menu, array $hooks ) {
118	65	if ( ! empty( $hooks[ static::PAGE_ID ] ) ) {
119	66	add_action( 'load-' . $hooks[ static::PAGE_ID ], [ $this, 'on_load_page' ] );
120	67	}
121		- } );
	68	+ }, 10, 2 );
122	69	}
123	70	}