← All changes | includes/admin/tools/export/export-actions.php +29 -64 2.3.2 → 4.17.0 View file →

		@@ -16,33 +16,53 @@
16	16
17	17	/**
18	18	* Process the download file generated by a batch export.
19	19	*
	20	+ * @since 2.21.3 Sanitize 'class' url param.
	21	+ * @since 2.21.0 Sanitize file name. Allow plain file name only.
	22	+ * @since 2.9.0 pass the filename received to the exporter
20	23	* @since 1.5
	24	+ *
21	25	* @return void
22	26	*/
23	27	function give_process_batch_export_form() {
24	28
25		- if ( ! wp_verify_nonce( $_REQUEST['nonce'], 'give-batch-export' ) ) {
26		- wp_die( esc_html__( 'Nonce verification failed.', 'give' ), esc_html__( 'Error', 'give' ), array(
27		- 'response' => 403,
28		- ) );
	29	+ if (! wp_verify_nonce( $_REQUEST['nonce'], 'give-batch-export' )) {
	30	+ wp_die(
	31	+ esc_html__( 'We\'re unable to recognize your session. Please refresh the screen to try again; otherwise contact your website administrator for assistance.', 'give' ),
	32	+ esc_html__( 'Error', 'give' ),
	33	+ ['response' => 403,]
	34	+ );
29	35	}
30	36
31	37	require_once GIVE_PLUGIN_DIR . 'includes/admin/tools/export/class-batch-export.php';
32	38
33		- /**
	39	+ $classname = give_clean($_REQUEST['class']);
	40	+
	41	+ /**
34	42	* Fires before batch export.
35	43	*
36	44	* @since 1.5
37	45	*
38		- * @param string $class Export class.
	46	+ * @param string $classname Export class.
39	47	*/
40		- do_action( 'give_batch_export_class_include', $_REQUEST['class'] );
	48	+ do_action( 'give_batch_export_class_include', $classname );
41	49
42		- $export = new $_REQUEST['class'];
	50	+ if (!is_subclass_of($classname, \Give_Batch_Export::class)) {
	51	+ wp_die(
	52	+ esc_html__(
	53	+ 'We\'re unable to recognize exporter class. Please refresh the screen to try again; otherwise contact your website administrator for assistance.',
	54	+ 'give'
	55	+ ),
	56	+ esc_html__('Error', 'give'),
	57	+ ['response' => 403,]
	58	+ );
	59	+ }
	60	+
	61	+ $filename = basename(sanitize_file_name($_REQUEST['file_name']), '.csv');
	62	+
	63	+ $export = new $classname( 1, $filename );
43	64	$export->export();
44		-
45	65	}
46	66
47	67	add_action( 'give_form_batch_export', 'give_process_batch_export_form' );
48	68
		@@ -105,59 +125,4 @@
105	125	}
106	126
107	127	add_action( 'plugins_loaded', 'give_register_batch_exporters' );
108	128
109		-/**
110		- * Register the donors batch exporter.
111		- *
112		- * @since 1.5.2
113		- */
114		-function give_register_donors_batch_export() {
115		- add_action( 'give_batch_export_class_include', 'give_include_donors_batch_processor', 10, 1 );
116		-}
117		-
118		-add_action( 'give_register_batch_exporter', 'give_register_donors_batch_export', 10 );
119		-
120		-/**
121		- * Loads the donors batch process if needed.
122		- *
123		- * @since 1.5.2
124		- *
125		- * @param string $class The class being requested to run for the batch export.
126		- *
127		- * @return void
128		- */
129		-function give_include_donors_batch_processor( $class ) {
130		-
131		- if ( 'Give_Batch_Donors_Export' === $class ) {
132		- require_once GIVE_PLUGIN_DIR . 'includes/admin/tools/export/class-batch-export-donors.php';
133		- }
134		-
135		-}
136		-
137		-/**
138		- * Register the download products batch exporter
139		- *
140		- * @since 1.5
141		- */
142		-function give_register_forms_batch_export() {
143		- add_action( 'give_batch_export_class_include', 'give_include_forms_batch_processor', 10, 1 );
144		-}
145		-
146		-add_action( 'give_register_batch_exporter', 'give_register_forms_batch_export', 10 );
147		-
148		-/**
149		- * Loads the file downloads batch process if needed
150		- *
151		- * @since 1.5
152		- *
153		- * @param string $class The class being requested to run for the batch export
154		- *
155		- * @return void
156		- */
157		-function give_include_forms_batch_processor( $class ) {
158		-
159		- if ( 'Give_Batch_Forms_Export' === $class ) {
160		- require_once GIVE_PLUGIN_DIR . 'includes/admin/tools/export/class-batch-export-forms.php';
161		- }
162		-
163		-}