← All changes | classes/Admin/ImporterExporter.php +6 -38 trunk → 6.1 View file →

		@@ -70,14 +70,15 @@
70	70	/**
71	71	* @throws \JsonException
72	72	*/
73	73	public static function import_data(): void {
74		- $verify = AdminActions::verify(WOWP_Plugin::PREFIX . '_import_data');
75	74
	75	+ $verify = AdminActions::verify( WOWP_Plugin::PREFIX . '_import_data' );
	76	+
76	77	if ( ! $verify ) {
77	78	return;
78	79	}
79		- // phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce verification is handled elsewhere.
	80	+
80	81	if ( ! isset( $_FILES['import_file'] ) || empty( $_FILES['import_file']['name'] ) ) {
81	82	wp_die( esc_attr__( 'Please select a file to import', 'float-menu' ),
82	83	esc_attr__( 'Error', 'float-menu' ),
83	84	[ 'response' => 400 ] );
		@@ -98,25 +99,13 @@
98	99
99	100	$import_file = sanitize_text_field( $_FILES['import_file']['tmp_name'] );
100	101	$settings = wp_json_file_decode( $import_file );
101	102
102		- if ( empty( $settings ) || ! is_array( $settings ) ) {
103		- wp_die(
104		- esc_html__( 'The file could not be read or does not contain valid data', 'float-menu' ),
105		- esc_html__( 'Error', 'float-menu' ),
106		- [ 'response' => 400 ] );
107		- }
108		-
109	103	$columns = DBManager::get_columns();
110	104
111	105	$update = ! empty( $_POST['wpie_import_update'] ) ? '1' : '';
112		- // phpcs:enable
113	106
114	107	foreach ( $settings as $key => $val ) {
115		- if ( ! is_object( $val ) ) {
116		- continue;
117		- }
118		-
119	108	$data = [];
120	109	$formats = [];
121	110
122	111	foreach ( $columns as $column ) {
		@@ -122,9 +111,9 @@
122	111	foreach ( $columns as $column ) {
123	112	$name = $column->Field;
124	113
125	114	if ( $name === 'param' ) {
126		- $param_input = self::safe_unserialize( $val->$name ?? '' );
	115	+ $param_input = maybe_unserialize( $val->$name );
127	116	$new_param = UpdateDB::update_param( $param_input );
128	117	$param_output = maybe_serialize( $new_param );
129	118	$data[ $name ] = $param_output;
130	119	} else {
		@@ -172,34 +161,13 @@
172	161	return end( $parts );
173	162	}
174	163
175	164	/**
176		- * Unserialize data coming from an uploaded file.
177		- *
178		- * Objects are never instantiated, so a crafted file cannot trigger
179		- * PHP object injection.
180		- *
181		- * @param mixed $data The value stored in the import file.
182		- *
183		- * @return mixed
184		- */
185		- private static function safe_unserialize( $data ) {
186		- if ( ! is_string( $data ) || ! is_serialized( $data ) ) {
187		- return $data;
188		- }
189		-
190		- return unserialize( $data, [ 'allowed_classes' => false ] );
191		- }
192		-
193		- /**
194	165	* @throws \JsonException
195	166	*/
196	167	public static function export_item( $id = 0, $action = '' ) {
197		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
198		- $page = isset( $_GET['page'] ) ? sanitize_text_field( wp_unslash($_GET['page']) ) : '';
199		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
200		- $action = isset( $_GET['action'] ) ? sanitize_text_field( wp_unslash($_GET['action']) ) : $action;
201		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	168	+ $page = isset( $_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : '';
	169	+ $action = isset( $_GET['action'] ) ? sanitize_text_field( wp_unslash( $_GET['action'] ) ) : $action;
202	170	$id = isset( $_GET['id'] ) ? absint( $_GET['id'] ) : $id;
203	171
204	172	if ( ( $page !== WOWP_Plugin::SLUG ) || ( $action !== 'export' ) || empty( $id ) ) {
205	173	return false;