← All changes | classes/Admin/ImporterExporter.php +6 -58 trunk → 6.0 View file →

		@@ -70,53 +70,22 @@
70	70	/**
71	71	* @throws \JsonException
72	72	*/
73	73	public static function import_data(): void {
74		- $verify = AdminActions::verify(WOWP_Plugin::PREFIX . '_import_data');
75		-
76		- if ( ! $verify ) {
77		- return;
78		- }
79		- // phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce verification is handled elsewhere.
80		- if ( ! isset( $_FILES['import_file'] ) || empty( $_FILES['import_file']['name'] ) ) {
81		- wp_die( esc_attr__( 'Please select a file to import', 'float-menu' ),
82		- esc_attr__( 'Error', 'float-menu' ),
	74	+ if ( self::get_file_extension( $_FILES['import_file']['name'] ) !== 'json' ) {
	75	+ wp_die( esc_attr__( 'Please upload a valid .json file', 'float-menu' ), esc_attr__( 'Error', 'float-menu' ),
83	76	[ 'response' => 400 ] );
84	77	}
85	78
86		- if ( self::get_file_extension( sanitize_text_field( $_FILES['import_file']['name'] ) ) !== 'json' ) {
87		- wp_die(
88		- esc_html__( 'Please upload a valid .json file', 'float-menu' ),
89		- esc_html__( 'Error', 'float-menu' ),
90		- [ 'response' => 400 ] );
91		- }
92	79
93		- if ( empty( $_FILES['import_file']['tmp_name'] ) ) {
94		- wp_die( esc_attr__( 'Please select a file to import', 'float-menu' ),
95		- esc_attr__( 'Error', 'float-menu' ),
96		- [ 'response' => 400 ] );
97		- }
98		-
99		- $import_file = sanitize_text_field( $_FILES['import_file']['tmp_name'] );
	80	+ $import_file = $_FILES['import_file']['tmp_name'];
100	81	$settings = wp_json_file_decode( $import_file );
101	82
102		- if ( empty( $settings ) || ! is_array( $settings ) ) {
103		- wp_die(
104		- esc_html__( 'The file could not be read or does not contain valid data', 'float-menu' ),
105		- esc_html__( 'Error', 'float-menu' ),
106		- [ 'response' => 400 ] );
107		- }
108		-
109	83	$columns = DBManager::get_columns();
110	84
111	85	$update = ! empty( $_POST['wpie_import_update'] ) ? '1' : '';
112		- // phpcs:enable
113	86
114	87	foreach ( $settings as $key => $val ) {
115		- if ( ! is_object( $val ) ) {
116		- continue;
117		- }
118		-
119	88	$data = [];
120	89	$formats = [];
121	90
122	91	foreach ( $columns as $column ) {
		@@ -122,9 +91,9 @@
122	91	foreach ( $columns as $column ) {
123	92	$name = $column->Field;
124	93
125	94	if ( $name === 'param' ) {
126		- $param_input = self::safe_unserialize( $val->$name ?? '' );
	95	+ $param_input = maybe_unserialize( $val->$name );
127	96	$new_param = UpdateDB::update_param( $param_input );
128	97	$param_output = maybe_serialize( $new_param );
129	98	$data[ $name ] = $param_output;
130	99	} else {
		@@ -172,34 +141,13 @@
172	141	return end( $parts );
173	142	}
174	143
175	144	/**
176		- * Unserialize data coming from an uploaded file.
177		- *
178		- * Objects are never instantiated, so a crafted file cannot trigger
179		- * PHP object injection.
180		- *
181		- * @param mixed $data The value stored in the import file.
182		- *
183		- * @return mixed
184		- */
185		- private static function safe_unserialize( $data ) {
186		- if ( ! is_string( $data ) || ! is_serialized( $data ) ) {
187		- return $data;
188		- }
189		-
190		- return unserialize( $data, [ 'allowed_classes' => false ] );
191		- }
192		-
193		- /**
194	145	* @throws \JsonException
195	146	*/
196	147	public static function export_item( $id = 0, $action = '' ) {
197		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
198		- $page = isset( $_GET['page'] ) ? sanitize_text_field( wp_unslash($_GET['page']) ) : '';
199		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
200		- $action = isset( $_GET['action'] ) ? sanitize_text_field( wp_unslash($_GET['action']) ) : $action;
201		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	148	+ $page = isset( $_GET['page'] ) ? sanitize_text_field( $_GET['page'] ) : '';
	149	+ $action = isset( $_GET['action'] ) ? sanitize_text_field( $_GET['action'] ) : $action;
202	150	$id = isset( $_GET['id'] ) ? absint( $_GET['id'] ) : $id;
203	151
204	152	if ( ( $page !== WOWP_Plugin::SLUG ) || ( $action !== 'export' ) || empty( $id ) ) {
205	153	return false;