← All changes | lib/admin/groups-admin-groups-edit.php +72 -56 1.11.3 → 4.7.0 View file →

		@@ -22,10 +22,13 @@
22	22	if ( !defined( 'ABSPATH' ) ) {
23	23	exit;
24	24	}
25	25
	26	+// phpcs:disable PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	27	+
26	28	/**
27	29	* Show edit group form.
	30	+ *
28	31	* @param int $group_id group id
29	32	*/
30	33	function groups_admin_groups_edit( $group_id ) {
31	34
		@@ -32,59 +35,62 @@
32	35	global $wpdb;
33	36
34	37	$output = '';
35	38
36		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
37		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	39	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	40	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
38	41	}
39	42
40	43	$group = Groups_Group::read( intval( $group_id ) );
41	44
42		- if ( empty( $group ) ) {
43		- wp_die( __( 'No such group.', GROUPS_PLUGIN_DOMAIN ) );
	45	+ if ( empty( $group ) ) { // @phpstan-ignore empty.variable
	46	+ wp_die( esc_html__( 'No such group.', 'groups' ) );
44	47	}
45	48
46		- $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	49	+ $current_url = groups_get_current_url();
47	50	$current_url = remove_query_arg( 'action', $current_url );
48	51	$current_url = remove_query_arg( 'group_id', $current_url );
49	52
50		- $name = isset( $_POST['name-field'] ) ? $_POST['name-field'] : $group->name;
51		- $description = isset( $_POST['description-field'] ) ? $_POST['description-field'] : $group->description;
52		- $parent_id = isset( $_POST['parent-id-field'] ) ? $_POST['parent-id-field'] : $group->parent_id;
	53	+ $name = isset( $_POST['name-field'] ) ? sanitize_text_field( $_POST['name-field'] ) : $group->name; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	54	+ $description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ( $group->description !== null ? $group->description : '' ); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	55	+ $parent_id = groups_sanitize_post( 'parent-id-field' ) ?? $group->parent_id;
53	56
54		- $group_table = _groups_get_tablename( 'group' );
55	57	$parent_select = '<select name="parent-id-field">';
56		- $parent_select .= '<option value="">--</option>';
57		- $groups = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM $group_table WHERE group_id != %d", $group->group_id ) );
58		- foreach ( $groups as $g ) {
59		- $selected = ( $g->group_id == $group->parent_id ? ' selected="selected" ' : '' );
60		- $parent_select .= '<option ' . $selected . 'value="' . esc_attr( $g->group_id ) . '">' . wp_filter_nohtml_kses( $g->name ) . '</option>';
61		- }
	58	+ $parent_select .= sprintf(
	59	+ '<option value="" %s>--</option>',
	60	+ empty( $parent_id ) ? 'selected="selected"' : ''
	61	+ );
	62	+ $tree = Groups_Utility::get_tree();
	63	+ Groups_Utility::render_tree_options( $tree, $parent_select, 0, array( $parent_id ) );
62	64	$parent_select .= '</select>';
63	65
64		- $name_readonly = ( $name !== Groups_Registered::REGISTERED_GROUP_NAME ) ? "" : ' readonly="readonly" ';
	66	+ $name_readonly = ( $name !== Groups_Registered::REGISTERED_GROUP_NAME ) ? '' : 'readonly="readonly"';
65	67
66	68	$output .= '<div class="manage-groups wrap">';
67	69	$output .= '<h1>';
68		- $output .= __( 'Edit a group', GROUPS_PLUGIN_DOMAIN );
	70	+ $output .= esc_html__( 'Edit a group', 'groups' );
69	71	$output .= '</h1>';
70	72
71	73	$output .= Groups_Admin::render_messages();
72	74
73		- $output .= '<form id="edit-group" action="' . esc_url( $current_url ) . '" method="post">';
	75	+ $output .= sprintf( '<form id="edit-group" action="%s" method="post">', esc_url( $current_url ) );
74	76	$output .= '<div class="group edit">';
75		- $output .= '<input id="group-id-field" name="group-id-field" type="hidden" value="' . esc_attr( intval( $group_id ) ) . '"/>';
	77	+ $output .= sprintf( '<input id="group-id-field" name="group-id-field" type="hidden" value="%s"/>', esc_attr( intval( $group_id ) ) );
76	78
77	79	$output .= '<div class="field">';
78	80	$output .= '<label for="name-field" class="field-label first required">';
79		- $output .= __( 'Name', GROUPS_PLUGIN_DOMAIN );
	81	+ $output .= esc_html__( 'Name', 'groups' );
80	82	$output .= '</label>';
81		- $output .= '<input ' . $name_readonly . ' id="name-field" name="name-field" class="namefield" type="text" value="' . esc_attr( stripslashes( $name ) ) . '"/>';
	83	+ $output .= sprintf(
	84	+ '<input %s id="name-field" name="name-field" class="namefield" type="text" value="%s"/>',
	85	+ $name_readonly,
	86	+ esc_attr( stripslashes( $name ) )
	87	+ );
82	88	$output .= '</div>';
83	89
84	90	$output .= '<div class="field">';
85	91	$output .= '<label for="parent-id-field" class="field-label">';
86		- $output .= __( 'Parent', GROUPS_PLUGIN_DOMAIN );
	92	+ $output .= esc_html__( 'Parent', 'groups' );
87	93	$output .= '</label>';
88	94	$output .= $parent_select;
89	95	$output .= '</div>';
90	96
		@@ -89,9 +95,9 @@
89	95	$output .= '</div>';
90	96
91	97	$output .= '<div class="field">';
92	98	$output .= '<label for="description-field" class="field-label description-field">';
93		- $output .= __( 'Description', GROUPS_PLUGIN_DOMAIN );
	99	+ $output .= esc_html__( 'Description', 'groups' );
94	100	$output .= '</label>';
95	101	$output .= '<textarea id="description-field" name="description-field" rows="5" cols="45">';
96	102	$output .= stripslashes( wp_filter_nohtml_kses( $description ) );
97	103	$output .= '</textarea>';
		@@ -99,9 +105,9 @@
99	105
100	106	$capability_table = _groups_get_tablename( 'capability' );
101	107	$group_capability_table = _groups_get_tablename( 'group_capability' );
102	108	$group_capabilities = $wpdb->get_results( $wpdb->prepare(
103		- "SELECT * FROM $capability_table WHERE capability_id IN ( SELECT capability_id FROM $group_capability_table WHERE group_id = %d )",
	109	+ "SELECT * FROM $capability_table WHERE capability_id IN ( SELECT capability_id FROM $group_capability_table WHERE group_id = %d )", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
104	110	Groups_Utility::id( $group_id )
105	111	) );
106	112	$group_capabilities_array = array();
107	113	if ( count( $group_capabilities ) > 0 ) {
		@@ -108,44 +114,49 @@
108	114	foreach ( $group_capabilities as $group_capability ) {
109	115	$group_capabilities_array[] = $group_capability->capability_id;
110	116	}
111	117	}
112		- $capabilities = $wpdb->get_results( "SELECT * FROM $capability_table ORDER BY capability" );
113	118
	119	+ $capabilities = $wpdb->get_results( "SELECT * FROM $capability_table ORDER BY capability" ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	120	+
114	121	$output .= '<div class="field">';
115	122	$output .= '<div class="select-capability-container" style="width:62%;">';
116	123	$output .= '<label>';
117		- $output .= __( 'Capabilities', GROUPS_PLUGIN_DOMAIN );
	124	+ $output .= esc_html__( 'Capabilities', 'groups' );
118	125	$output .= sprintf(
119	126	'<select class="select capability" name="capability_ids[]" multiple="multiple" placeholder="%s">',
120		- __( 'Choose capabilities &hellip;', GROUPS_PLUGIN_DOMAIN )
	127	+ esc_attr__( 'Choose capabilities &hellip;', 'groups' )
121	128	);
122		- foreach( $capabilities as $capability ) {
	129	+ foreach ( $capabilities as $capability ) {
123	130	$selected = in_array( $capability->capability_id, $group_capabilities_array ) ? ' selected="selected" ' : '';
124		- $output .= sprintf( '<option value="%s" %s>%s</option>', esc_attr( $capability->capability_id ), $selected, wp_filter_nohtml_kses( $capability->capability ) );
	131	+ $output .= sprintf( '<option value="%s" %s>%s</option>', esc_attr( $capability->capability_id ), $selected, stripslashes( wp_filter_nohtml_kses( $capability->capability ) ) );
125	132	}
126	133	$output .= '</select>';
127	134	$output .= '</label>';
128	135	$output .= '</div>'; // .select-capability-container
129	136	$output .= '<p class="description">';
130		- $output .= __( 'The chosen capabilities are assigned to the group.', GROUPS_PLUGIN_DOMAIN );
	137	+ $output .= esc_html__( 'The chosen capabilities are assigned to the group.', 'groups' );
131	138	$output .= '</p>';
132	139	$output .= '</div>'; // .field
133	140	$output .= Groups_UIE::render_select( '.select.capability' );
134	141
135	142	$group_object = new Groups_Group( $group_id );
136		- $group_capabilities = $group_object->capabilities;
137		- $group_capabilities_deep = $group_object->capabilities_deep;
138		- if ( ( count( $group_capabilities_deep ) - count( $group_capabilities ) ) > 0 ) {
	143	+ $group_capabilities = $group_object->get_capabilities();
	144	+ $group_capabilities_deep = $group_object->get_capabilities_deep();
	145	+ if (
	146	+ (
	147	+ ( !empty( $group_capabilities_deep ) ? count( $group_capabilities_deep ) : 0 ) -
	148	+ ( !empty( $group_capabilities ) ? count( $group_capabilities ) : 0 )
	149	+ ) > 0
	150	+ ) {
139	151	usort( $group_capabilities_deep, array( 'Groups_Utility', 'cmp' ) );
140	152	$output .= '<div class="field">';
141		- $output .= __( 'Inherited capabilities:', GROUPS_PLUGIN_DOMAIN );
	153	+ $output .= esc_html__( 'Inherited capabilities:', 'groups' );
142	154	$output .= ' ';
143	155	$inherited_caps = array();
144	156	foreach ( $group_capabilities_deep as $group_capability ) {
145		- $class = '';
146	157	if ( empty( $group_capabilities ) || !in_array( $group_capability, $group_capabilities ) ) {
147		- $inherited_caps[] = wp_filter_nohtml_kses( $group_capability->capability->capability );
	158	+ $inherited_caps[] = wp_filter_nohtml_kses( $group_capability->get_capability() );
148	159	}
149	160	}
150	161	$output .= implode( ' ', $inherited_caps );
151	162	$output .= '</div>';
		@@ -154,55 +165,60 @@
154	165	$output .= apply_filters( 'groups_admin_groups_edit_form_after_fields', '', $group_id );
155	166
156	167	$output .= '<div class="field">';
157	168	$output .= wp_nonce_field( 'groups-edit', GROUPS_ADMIN_GROUPS_NONCE, true, false );
158		- $output .= '<input class="button button-primary" type="submit" value="' . __( 'Save', GROUPS_PLUGIN_DOMAIN ) . '"/>';
	169	+ $output .= sprintf( '<input class="button button-primary" type="submit" value="%s"/>', esc_attr__( 'Save', 'groups' ) );
159	170	$output .= '<input type="hidden" value="edit" name="action"/>';
160		- $output .= '<a class="cancel button" href="' . esc_url( $current_url ) . '">' . __( 'Cancel', GROUPS_PLUGIN_DOMAIN ) . '</a>';
	171	+ $output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
161	172	$output .= '</div>';
162	173	$output .= '</div>'; // .group.edit
163	174	$output .= '</form>';
164	175	$output .= '</div>'; // .manage-groups
165	176
166		- echo $output;
	177	+ echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
167	178	} // function groups_admin_groups_edit
168	179
169	180	/**
170	181	* Handle edit form submission.
	182	+ *
	183	+ * @return int|boolean group ID or false on failure
171	184	*/
172	185	function groups_admin_groups_edit_submit() {
	186	+
173	187	global $wpdb;
174	188
175		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
176		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	189	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	190	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
177	191	}
178	192
179		- if ( !wp_verify_nonce( $_POST[GROUPS_ADMIN_GROUPS_NONCE], 'groups-edit' ) ) {
180		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	193	+ if ( !groups_verify_post_nonce( GROUPS_ADMIN_GROUPS_NONCE, 'groups-edit' ) ) {
	194	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
181	195	}
182	196
183		- $group_id = isset( $_POST['group-id-field'] ) ? $_POST['group-id-field'] : null;
	197	+ $group_id = groups_sanitize_post( 'group-id-field' );
184	198	$group = Groups_Group::read( $group_id );
185	199	if ( $group ) {
186	200	$group_id = $group->group_id;
187	201	if ( $group->name !== Groups_Registered::REGISTERED_GROUP_NAME ) {
188		- $name = isset( $_POST['name-field'] ) ? $_POST['name-field'] : null;
	202	+ $name = isset( $_POST['name-field'] ) ? sanitize_text_field( $_POST['name-field'] ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
189	203	} else {
190	204	$name = Groups_Registered::REGISTERED_GROUP_NAME;
191	205	}
192		- $parent_id = isset( $_POST['parent-id-field'] ) ? $_POST['parent-id-field'] : null;
193		- $description = isset( $_POST['description-field'] ) ? $_POST['description-field'] : '';
	206	+ $parent_id = groups_sanitize_post( 'parent-id-field' );
	207	+ $description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
194	208
195	209	if ( empty( $name ) ) {
196		- Groups_Admin::add_message( __( 'The <em>Name</em> must not be empty.', GROUPS_PLUGIN_DOMAIN ), 'error' );
	210	+ Groups_Admin::add_message( __( 'The <em>Name</em> must not be empty.', 'groups' ), 'error' );
197	211	return false;
198	212	}
199	213
200		- if ( $other_group = Groups_Group::read_by_name( $name ) ) {
	214	+ $other_group = Groups_Group::read_by_name( $name );
	215	+ if ( $other_group ) {
201	216	if ( $other_group->group_id != $group_id ) {
202	217	Groups_Admin::add_message(
203	218	sprintf(
204		- __( 'The <em>%s</em> group already exists and cannot be used to name this one.', GROUPS_PLUGIN_DOMAIN ), stripslashes( wp_filter_nohtml_kses( $other_group->name ) )
	219	+ /* translators: group name */
	220	+ __( 'The <em>%s</em> group already exists and cannot be used to name this one.', 'groups' ), stripslashes( wp_filter_nohtml_kses( $other_group->name ) )
205	221	),
206	222	'error'
207	223	);
208	224	return false;
		@@ -213,9 +229,9 @@
213	229	if ( $group_id ) {
214	230	$capability_table = _groups_get_tablename( "capability" );
215	231	$group_capability_table = _groups_get_tablename( "group_capability" );
216	232	$group_capabilities = $wpdb->get_results( $wpdb->prepare(
217		- "SELECT * FROM $capability_table WHERE capability_id IN ( SELECT capability_id FROM $group_capability_table WHERE group_id = %d )",
	233	+ "SELECT * FROM $capability_table WHERE capability_id IN ( SELECT capability_id FROM $group_capability_table WHERE group_id = %d )", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
218	234	Groups_Utility::id( $group_id )
219	235	) );
220	236	$group_capabilities_array = array();
221	237	foreach ( $group_capabilities as $group_capability ) {
		@@ -221,20 +237,20 @@
221	237	foreach ( $group_capabilities as $group_capability ) {
222	238	$group_capabilities_array[] = $group_capability->capability_id;
223	239	}
224	240
225		- $caps = array();
226		- if ( isset( $_POST['capability_ids'] ) ) {
227		- $caps = $_POST['capability_ids'];
	241	+ $caps = groups_sanitize_post( 'capability_ids' );
	242	+ if ( !is_array( $caps ) ) {
	243	+ $caps = array();
228	244	}
229	245	// delete
230		- foreach( $group_capabilities_array as $group_cap ) {
	246	+ foreach ( $group_capabilities_array as $group_cap ) {
231	247	if ( !in_array( $group_cap, $caps ) ) {
232	248	Groups_Group_Capability::delete( $group_id, $group_cap );
233	249	}
234	250	}
235	251	// add
236		- foreach( $caps as $cap ) {
	252	+ foreach ( $caps as $cap ) {
237	253	if ( !in_array( $cap, $group_capabilities_array ) ) {
238	254	Groups_Group_Capability::create( array( 'group_id' => $group_id, 'capability_id' => $cap ) );
239	255	}
240	256	}