elementor / core / common / modules / connect / admin.php

admin.php in Elementor Website Builder – more than just a page builder 4.1.0-dev1, at core/common/modules/connect/admin.php

124 lines 3.3 KB

Raw Download Zip

1	<?php
2	namespace Elementor\Core\Common\Modules\Connect;
3
4	use Elementor\Core\Admin\Menu\Admin_Menu_Manager;
5	use Elementor\Plugin;
6	use Elementor\Settings;
7	use Elementor\Utils;
8	use Elementor\Modules\EditorOne\Classes\Menu_Data_Provider;
9	use Elementor\Core\Common\Modules\Connect\AdminMenuItems\Editor_One_Connect_Menu;
10
11	if ( ! defined( 'ABSPATH' ) ) {
12	exit; // Exit if accessed directly.
13	}
14
15	class Admin {
16
17	const PAGE_ID = 'elementor-connect';
18
19	public static $url = '';
20
21	private function get_valid_redirect_to_from_request() {
22	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Only reading a URL parameter.
23	$raw = Utils::get_super_global_value( $_GET, 'redirect_to' );
24
25	if ( ! $raw ) {
26	return '';
27	}
28
29	$raw = esc_url_raw( $raw );
30
31	$validated = wp_validate_redirect( $raw, '' );
32	if ( ! $validated ) {
33	return '';
34	}
35
36	$admin_host = wp_parse_url( admin_url(), PHP_URL_HOST );
37	$dest_host = wp_parse_url( $validated, PHP_URL_HOST );
38	if ( $dest_host && $admin_host && ! hash_equals( $admin_host, $dest_host ) ) {
39	return '';
40	}
41
42	return $validated;
43	}
44
45	public function register_editor_one_menu( Menu_Data_Provider $menu_data_provider ) {
46	$menu_data_provider->register_menu( new Editor_One_Connect_Menu() );
47	}
48
49	/**
50	* @since 2.3.0
51	* @access public
52	*/
53	public function on_load_page() {
54	if ( ! $this->user_has_enough_permissions() ) {
55	wp_die( 'You do not have sufficient permissions to access this page.', 'You do not have sufficient permissions to access this page.', [
56	'back_link' => true,
57	] );
58	}
59
60	// Allow a per-request default landing URL when provided via a safe `redirect_to` parameter.
61	$maybe_redirect_to = $this->get_valid_redirect_to_from_request();
62	if ( $maybe_redirect_to ) {
63	self::$url = $maybe_redirect_to;
64	}
65
66	if ( isset( $_GET['action'], $_GET['app'] ) ) {
67	$manager = Plugin::$instance->common->get_component( 'connect' );
68
69	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
70	$app_slug = Utils::get_super_global_value( $_GET, 'app' );
71	$app = $manager->get_app( $app_slug );
72
73	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
74	$action = Utils::get_super_global_value( $_GET, 'action' );
75
76	$nonce_action = $app_slug . $action;
77
78	if ( ! $app ) {
79	wp_die( 'Unknown app: ' . esc_attr( $app_slug ) );
80	}
81
82	if ( ! wp_verify_nonce( Utils::get_super_global_value( $_GET, 'nonce' ), $nonce_action ) ) {
83	wp_die( 'Invalid Nonce', 'Invalid Nonce', [
84	'back_link' => true,
85	] );
86	}
87
88	$method = 'action_' . $action;
89
90	if ( method_exists( $app, $method ) ) {
91	call_user_func( [ $app, $method ] );
92	}
93	}
94	}
95
96	private function user_has_enough_permissions() {
97	if ( current_user_can( 'manage_options' ) ) {
98	return true;
99	}
100
101	if ( 'library' === Utils::get_super_global_value( $_GET, 'app' ) ) {
102	return current_user_can( 'edit_posts' );
103	}
104
105	return false;
106	}
107
108	/**
109	* @since 2.3.0
110	* @access public
111	*/
112	public function __construct() {
113	self::$url = admin_url( 'admin.php?page=' . self::PAGE_ID );
114
115	add_action( 'elementor/editor-one/menu/register', [ $this, 'register_editor_one_menu' ] );
116
117	add_action( 'elementor/editor-one/menu/after_register_hidden_submenus', function ( array $hooks ) {
118	if ( ! empty( $hooks[ static::PAGE_ID ] ) ) {
119	add_action( 'load-' . $hooks[ static::PAGE_ID ], [ $this, 'on_load_page' ] );
120	}
121	} );
122	}
123	}
124