← All changes | lib/admin/groups-admin-groups-remove.php +55 -63 1.11.3 → 4.7.0 View file →

		@@ -24,71 +24,68 @@
24	24	}
25	25
26	26	/**
27	27	* Shows form to confirm removal of a group.
	28	+ *
28	29	* @param int $group_id group id
29	30	*/
30	31	function groups_admin_groups_remove( $group_id ) {
31	32
32		- global $wpdb;
33		-
34		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
35		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	33	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	34	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
36	35	}
37	36
38	37	$group = Groups_Group::read( intval( $group_id ) );
39	38
40		- if ( empty( $group ) ) {
41		- wp_die( __( 'No such group.', GROUPS_PLUGIN_DOMAIN ) );
	39	+ if ( empty( $group ) ) { // @phpstan-ignore empty.variable
	40	+ wp_die( esc_html__( 'No such group.', 'groups' ) );
42	41	}
43	42
44		- $group_table = _groups_get_tablename( 'group' );
45		-
46		- $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	43	+ $current_url = groups_get_current_url();
47	44	$current_url = remove_query_arg( 'action', $current_url );
48	45	$current_url = remove_query_arg( 'group_id', $current_url );
49	46
50		- $output =
51		- '<div class="manage-groups wrap">' .
52		- '<h1>' .
53		- __( 'Remove a group', GROUPS_PLUGIN_DOMAIN ) .
54		- '</h1>' .
55		- '<form id="remove-group" action="' . esc_url( $current_url ) . '" method="post">' .
56		- '<div class="group remove">' .
57		- '<input id="group-id-field" name="group-id-field" type="hidden" value="' . esc_attr( intval( $group->group_id ) ) . '"/>' .
58		- '<ul>' .
59		- '<li>' . sprintf( __( 'Group Name : %s', GROUPS_PLUGIN_DOMAIN ), stripslashes( wp_filter_nohtml_kses( $group->name ) ) ) . '</li>' .
60		- '</ul> ' .
61		- wp_nonce_field( 'groups-remove', GROUPS_ADMIN_GROUPS_NONCE, true, false ) .
62		- '<input class="button button-primary" type="submit" value="' . __( 'Remove', GROUPS_PLUGIN_DOMAIN ) . '"/>' .
63		- '<input type="hidden" value="remove" name="action"/>' .
64		- '<a class="cancel button" href="' . esc_url( $current_url ) . '">' . __( 'Cancel', GROUPS_PLUGIN_DOMAIN ) . '</a>' .
65		- '</div>' .
66		- '</div>' . // .group.remove
67		- '</form>' .
68		- '</div>'; // .manage-groups
	47	+ $output = '<div class="manage-groups wrap">';
	48	+ $output .= '<h1>';
	49	+ $output .= esc_html__( 'Remove a group', 'groups' );
	50	+ $output .= '</h1>';
	51	+ $output .= sprintf( '<form id="remove-group" action="%s" method="post">', esc_url( $current_url ) );
	52	+ $output .= '<div class="group remove">';
	53	+ $output .= sprintf( '<input id="group-id-field" name="group-id-field" type="hidden" value="%s"/>', esc_attr( intval( $group->group_id ) ) );
	54	+ $output .= '<ul>';
	55	+ $output .= '<li>';
	56	+ $output .= sprintf( '%s : <strong>%s</strong> [%d]', esc_html__( 'Group', 'groups' ), stripslashes( wp_filter_nohtml_kses( $group->name ) ), esc_html( $group->group_id ) );
	57	+ $output .= '</li>';
	58	+ $output .= '</ul> ';
	59	+ $output .= wp_nonce_field( 'groups-remove', GROUPS_ADMIN_GROUPS_NONCE, true, false );
	60	+ $output .= sprintf( '<input class="button button-primary" type="submit" value="%s"/>', esc_attr__( 'Remove', 'groups' ) );
	61	+ $output .= '<input type="hidden" value="remove" name="action"/>';
	62	+ $output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
	63	+ $output .= '</div>'; // .group.remove
	64	+ $output .= '</form>';
	65	+ $output .= '</div>'; // .manage-groups
69	66
70		- echo $output;
	67	+ echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
71	68	} // function groups_admin_groups_remove
72	69
73	70	/**
74	71	* Handle remove form submission.
	72	+ *
	73	+ * @return int|false group ID if successful, otherwise false
75	74	*/
76	75	function groups_admin_groups_remove_submit() {
77	76
78		- global $wpdb;
79		-
80	77	$result = false;
81	78
82		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
83		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	79	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	80	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
84	81	}
85	82
86		- if ( !wp_verify_nonce( $_POST[GROUPS_ADMIN_GROUPS_NONCE], 'groups-remove' ) ) {
87		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	83	+ if ( !groups_verify_post_nonce( GROUPS_ADMIN_GROUPS_NONCE, 'groups-remove' ) ) {
	84	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
88	85	}
89	86
90		- $group_id = isset( $_POST['group-id-field'] ) ? $_POST['group-id-field'] : null;
	87	+ $group_id = groups_sanitize_post( 'group-id-field' );
91	88	$group = Groups_Group::read( $group_id );
92	89	if ( $group ) {
93	90	if ( $group->name !== Groups_Registered::REGISTERED_GROUP_NAME ) {
94	91	$result = Groups_Group::delete( $group_id );
		@@ -101,20 +98,17 @@
101	98	* Shows form to confirm bulk-removal of groups.
102	99	*/
103	100	function groups_admin_groups_bulk_remove() {
104	101
105		- global $wpdb;
106		-
107	102	$output = '';
108	103
109		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
110		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	104	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	105	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
111	106	}
112	107
113		- $group_ids = isset( $_POST['group_ids'] ) ? $_POST['group_ids'] : null;
114		-
115		- if ( ! $group_ids ) {
116		- wp_die( __( 'No such groups.', GROUPS_PLUGIN_DOMAIN ) );
	108	+ $group_ids = groups_sanitize_post( 'group_ids' );
	109	+ if ( $group_ids === null || !is_array( $group_ids ) ) {
	110	+ wp_die( esc_html__( 'No such groups.', 'groups' ) );
117	111	}
118	112
119	113	$groups = array();
120	114	foreach ( $group_ids as $group_id ) {
		@@ -123,17 +117,15 @@
123	117	$groups[] = $group;
124	118	}
125	119	}
126	120
127		- $group_table = _groups_get_tablename( 'group' );
128		-
129		- $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	121	+ $current_url = groups_get_current_url();
130	122	$current_url = remove_query_arg( 'action', $current_url );
131	123	$current_url = remove_query_arg( 'group_id', $current_url );
132	124
133	125	$output .= '<div class="manage-groups wrap">';
134	126	$output .= '<h1>';
135		- $output .= __( 'Remove groups', GROUPS_PLUGIN_DOMAIN );
	127	+ $output .= esc_html__( 'Remove groups', 'groups' );
136	128	$output .= '</h1>';
137	129
138	130	$output .= '<form id="groups-action" method="post" action="">';
139	131	$output .= '<div class="group remove">';
		@@ -138,21 +130,21 @@
138	130	$output .= '<form id="groups-action" method="post" action="">';
139	131	$output .= '<div class="group remove">';
140	132
141	133	$output .= '<p>';
142		- $output .= __( 'Please confirm removal of the following groups. This action cannot be undone.', GROUPS_PLUGIN_DOMAIN );
	134	+ $output .= esc_html__( 'Please confirm removal of the following groups. This action cannot be undone.', 'groups' );
143	135	$output .= '</p>';
144	136
	137	+ $output .= '<ul class="groups-group-bulk-remove">';
145	138	foreach ( $groups as $group ) {
146		- $output .= '<input id="group_ids" name="group_ids[]" type="hidden" value="' . esc_attr( intval( $group->group_id ) ) . '"/>';
147		- $output .= '<ul>';
	139	+ $output .= sprintf( '<input id="group_ids" name="group_ids[]" type="hidden" value="%s"/>', esc_attr( intval( $group->group_id ) ) );
148	140	$output .= '<li>';
149		- $output .= sprintf( __( '<strong>%s</strong>', GROUPS_PLUGIN_DOMAIN ), wp_filter_nohtml_kses( $group->name ) );
	141	+ $output .= sprintf( '<strong>%s</strong> [%d]', stripslashes( wp_filter_nohtml_kses( $group->name ) ), esc_html( $group->group_id ) );
150	142	$output .= '</li>';
151		- $output .= '</ul>';
152	143	}
153		- $output .= '<input class="button button-primary" type="submit" name="bulk" value="' . __( "Remove", GROUPS_PLUGIN_DOMAIN ) . '"/>';
154		- $output .= '<a class="cancel button" href="' . esc_url( $current_url ) . '">' . __( 'Cancel', GROUPS_PLUGIN_DOMAIN ) . '</a>';
	144	+ $output .= '</ul>';
	145	+ $output .= sprintf( '<input class="button button-primary" type="submit" name="bulk" value="%s"/>', esc_attr__( 'Remove', 'groups' ) );
	146	+ $output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
155	147
156	148	$output .= '<input type="hidden" name="action" value="groups-action"/>';
157	149	$output .= '<input type="hidden" name="bulk-action" value="remove-group"/>';
158	150	$output .= '<input type="hidden" name="confirm" value="1"/>';
		@@ -161,29 +153,29 @@
161	153	$output .= '</div>';
162	154	$output .= '</form>';
163	155	$output .= '</div>';
164	156
165		- echo $output;
	157	+ echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
166	158	} // function groups_admin_groups_bulk_remove
167	159
168	160	/**
169	161	* Handle remove form submission.
	162	+ *
170	163	* @return array of deleted groups' ids
171	164	*/
172	165	function groups_admin_groups_bulk_remove_submit() {
173		- global $wpdb;
174	166
175	167	$result = array();
176		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
177		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	168	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	169	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
178	170	}
179	171
180		- if ( !wp_verify_nonce( $_POST[GROUPS_ADMIN_GROUPS_ACTION_NONCE], 'admin' ) ) {
181		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	172	+ if ( !groups_verify_post_nonce( GROUPS_ADMIN_GROUPS_ACTION_NONCE, 'admin' ) ) {
	173	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
182	174	}
183	175
184		- $group_ids = isset( $_POST['group_ids'] ) ? $_POST['group_ids'] : null;
185		- if ( $group_ids ) {
	176	+ $group_ids = groups_sanitize_post( 'group_ids' );
	177	+ if ( $group_ids !== null && is_array( $group_ids ) ) {
186	178	foreach ( $group_ids as $group_id ) {
187	179	$group = Groups_Group::read( $group_id );
188	180	if ( $group ) {
189	181	if ( $group->name !== Groups_Registered::REGISTERED_GROUP_NAME ) {