← All changes | lib/admin/groups-admin-groups-add.php +54 -42 1.10.1 → 4.7.1 View file →

		@@ -22,8 +22,10 @@
22	22	if ( !defined( 'ABSPATH' ) ) {
23	23	exit;
24	24	}
25	25
	26	+// phpcs:disable PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	27	+
26	28	/**
27	29	* Show add group form.
28	30	*/
29	31	function groups_admin_groups_add() {
		@@ -31,33 +33,33 @@
31	33	global $wpdb;
32	34
33	35	$output = '';
34	36
35		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
36		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	37	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	38	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
37	39	}
38	40
39		- $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	41	+ $current_url = groups_get_current_url();
40	42	$current_url = remove_query_arg( 'paged', $current_url );
41	43	$current_url = remove_query_arg( 'action', $current_url );
42	44	$current_url = remove_query_arg( 'group_id', $current_url );
43	45
44		- $parent_id = isset( $_POST['parent-id-field'] ) ? $_POST['parent-id-field'] : '';
45		- $name = isset( $_POST['name-field'] ) ? $_POST['name-field'] : '';
46		- $description = isset( $_POST['description-field'] ) ? $_POST['description-field'] : '';
	46	+ $parent_id = groups_sanitize_post( 'parent-id-field' ) ?? '';
	47	+ $name = isset( $_POST['name-field'] ) ? sanitize_text_field( $_POST['name-field'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	48	+ $description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
47	49
48		- $group_table = _groups_get_tablename( 'group' );
49	50	$parent_select = '<select name="parent-id-field">';
50		- $parent_select .= '<option value="">--</option>';
51		- $groups = $wpdb->get_results( "SELECT * FROM $group_table" );
52		- foreach ( $groups as $group ) {
53		- $parent_select .= '<option value="' . esc_attr( $group->group_id ) . '">' . wp_filter_nohtml_kses( $group->name ) . '</option>';
54		- }
	51	+ $parent_select .= sprintf(
	52	+ '<option value="" %s>--</option>',
	53	+ empty( $parent_id ) ? 'selected="selected"' : ''
	54	+ );
	55	+ $tree = Groups_Utility::get_tree();
	56	+ Groups_Utility::render_tree_options( $tree, $parent_select, 0, array( $parent_id ) );
55	57	$parent_select .= '</select>';
56	58
57	59	$output .= '<div class="manage-groups wrap">';
58	60	$output .= '<h1>';
59		- $output .= __( 'Add a new group', GROUPS_PLUGIN_DOMAIN );
	61	+ $output .= esc_html__( 'Add a new group', 'groups' );
60	62	$output .= '</h1>';
61	63
62	64	$output .= Groups_Admin::render_messages();
63	65
		@@ -65,16 +67,16 @@
65	67	$output .= '<div class="group new">';
66	68
67	69	$output .= '<div class="field">';
68	70	$output .= '<label for="name-field" class="field-label first required">';
69		- $output .= __( 'Name', GROUPS_PLUGIN_DOMAIN );
	71	+ $output .= esc_html__( 'Name', 'groups' );
70	72	$output .= '</label>';
71		- $output .= '<input id="name-field" name="name-field" class="namefield" type="text" value="' . esc_attr( stripslashes( $name ) ) . '"/>';
	73	+ $output .= sprintf( '<input id="name-field" name="name-field" class="namefield" type="text" value="%s"/>', esc_attr( stripslashes( $name ) ) );
72	74	$output .= '</div>';
73	75
74	76	$output .= '<div class="field">';
75	77	$output .= '<label for="parent-id-field" class="field-label">';
76		- $output .= __( 'Parent', GROUPS_PLUGIN_DOMAIN );
	78	+ $output .= esc_html__( 'Parent', 'groups' );
77	79	$output .= '</label>';
78	80	$output .= $parent_select;
79	81	$output .= '</div>';
80	82
		@@ -79,9 +81,9 @@
79	81	$output .= '</div>';
80	82
81	83	$output .= '<div class="field">';
82	84	$output .= '<label for="description-field" class="field-label description-field">';
83		- $output .= __( 'Description', GROUPS_PLUGIN_DOMAIN );
	85	+ $output .= esc_html__( 'Description', 'groups' );
84	86	$output .= '</label>';
85	87	$output .= '<textarea id="description-field" name="description-field" rows="5" cols="45">';
86	88	$output .= stripslashes( wp_filter_nohtml_kses( $description ) );
87	89	$output .= '</textarea>';
		@@ -89,25 +91,31 @@
89	91
90	92	$output .= '<div class="field">';
91	93
92	94	$capability_table = _groups_get_tablename( "capability" );
93		- $capabilities = $wpdb->get_results( "SELECT * FROM $capability_table ORDER BY capability" );
	95	+ $capabilities = $wpdb->get_results( "SELECT * FROM $capability_table ORDER BY capability" ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	96	+ $selected_capabilities = groups_sanitize_post( 'capability_ids' ) ?? array();
94	97
95	98	$output .= '<div class="select-capability-container" style="width:62%;">';
96	99	$output .= '<label>';
97		- $output .= __( 'Capabilities', GROUPS_PLUGIN_DOMAIN );
	100	+ $output .= esc_html__( 'Capabilities', 'groups' );
98	101	$output .= sprintf(
99	102	'<select class="select capability" name="capability_ids[]" multiple="multiple" placeholder="%s">',
100		- __( 'Choose capabilities &hellip;', GROUPS_PLUGIN_DOMAIN )
	103	+ esc_attr__( 'Choose capabilities &hellip;', 'groups' )
101	104	);
102		- foreach( $capabilities as $capability ) {
103		- $output .= sprintf( '<option value="%s">%s</option>', esc_attr( $capability->capability_id ), wp_filter_nohtml_kses( $capability->capability ) );
	105	+ foreach ( $capabilities as $capability ) {
	106	+ $output .= sprintf(
	107	+ '<option value="%s" %s>%s</option>',
	108	+ esc_attr( $capability->capability_id ),
	109	+ in_array( $capability->capability_id, $selected_capabilities ) ? 'selected="selected"' : '',
	110	+ stripslashes( wp_filter_nohtml_kses( $capability->capability ) )
	111	+ );
104	112	}
105	113	$output .= '</select>';
106	114	$output .= '</label>';
107	115	$output .= '</div>';
108	116	$output .= '<p class="description">';
109		- $output .= __( 'These capabilities will be assigned to the group.', GROUPS_PLUGIN_DOMAIN );
	117	+ $output .= esc_html__( 'These capabilities will be assigned to the group.', 'groups' );
110	118	$output .= '</p>';
111	119
112	120	$output .= Groups_UIE::render_select( '.select.capability' );
113	121	$output .= '</div>';
		@@ -115,46 +123,46 @@
115	123	$output .= apply_filters( 'groups_admin_groups_add_form_after_fields', '' );
116	124
117	125	$output .= '<div class="field">';
118	126	$output .= wp_nonce_field( 'groups-add', GROUPS_ADMIN_GROUPS_NONCE, true, false );
119		- $output .= '<input class="button button-primary" type="submit" value="' . __( 'Add', GROUPS_PLUGIN_DOMAIN ) . '"/>';
	127	+ $output .= sprintf( '<input class="button button-primary" type="submit" value="%s"/>', esc_attr__( 'Add', 'groups' ) );
120	128	$output .= '<input type="hidden" value="add" name="action"/>';
121		- $output .= '<a class="cancel button" href="' . esc_url( $current_url ) . '">' . __( 'Cancel', GROUPS_PLUGIN_DOMAIN ) . '</a>';
	129	+ $output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
122	130	$output .= '</div>';
123	131	$output .= '</div>'; // .group.new
124	132	$output .= '</form>';
125	133	$output .= '</div>'; // .manage-groups
126	134
127		- echo $output;
	135	+ echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
128	136	} // function groups_admin_groups_add
129	137
130	138	/**
131	139	* Handle add group form submission.
	140	+ *
132	141	* @return int new group's id or false if unsuccessful
133	142	*/
134	143	function groups_admin_groups_add_submit() {
135	144
136		- global $wpdb;
137		-
138		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
139		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	145	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	146	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
140	147	}
141	148
142		- if ( !wp_verify_nonce( $_POST[GROUPS_ADMIN_GROUPS_NONCE], 'groups-add' ) ) {
143		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	149	+ if ( !groups_verify_post_nonce( GROUPS_ADMIN_GROUPS_NONCE, 'groups-add' ) ) {
	150	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
144	151	}
145	152
146	153	$creator_id = get_current_user_id();
147		- $datetime = date( 'Y-m-d H:i:s', time() );
148		- $parent_id = isset( $_POST['parent-id-field'] ) ? $_POST['parent-id-field'] : null;
149		- $description = isset( $_POST['description-field'] ) ? $_POST['description-field'] : '';
150		- $name = isset( $_POST['name-field'] ) ? $_POST['name-field'] : null;
	154	+ $datetime = date( 'Y-m-d H:i:s', time() ); // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date
	155	+ $parent_id = groups_sanitize_post( 'parent-id-field' );
	156	+ $description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	157	+ $name = isset( $_POST['name-field'] ) ? sanitize_text_field( $_POST['name-field'] ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
151	158
152	159	$group_id = Groups_Group::create( compact( "creator_id", "datetime", "parent_id", "description", "name" ) );
153	160	if ( $group_id ) {
154		- if ( !empty( $_POST['capability_ids'] ) ) {
155		- $caps = $_POST['capability_ids'];
156		- foreach( $caps as $cap ) {
	161	+ $caps = groups_sanitize_post( 'capability_ids' );
	162	+ if ( is_array( $caps ) ) {
	163	+ $caps = array_map( 'sanitize_text_field', $caps );
	164	+ foreach ( $caps as $cap ) {
157	165	Groups_Group_Capability::create( array( 'group_id' => $group_id, 'capability_id' => $cap ) );
158	166	}
159	167	}
160	168	do_action( 'groups_admin_groups_add_submit_success', $group_id );
		@@ -159,11 +167,15 @@
159	167	}
160	168	do_action( 'groups_admin_groups_add_submit_success', $group_id );
161	169	} else {
162	170	if ( !$name ) {
163		- Groups_Admin::add_message( __( 'The name must not be empty.', GROUPS_PLUGIN_DOMAIN ), 'error' );
164		- } else if ( Groups_Group::read_by_name( $name ) ) {
165		- Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> group already exists.', GROUPS_PLUGIN_DOMAIN ), stripslashes( wp_filter_nohtml_kses( ( $name ) ) ) ), 'error' );
	171	+ Groups_Admin::add_message( __( 'The name must not be empty.', 'groups' ), 'error' );
	172	+ } else {
	173	+ $other_group = Groups_Group::read_by_name( $name );
	174	+ if ( $other_group ) {
	175	+ /* translators: group name */
	176	+ Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> group already exists.', 'groups' ), stripslashes( wp_filter_nohtml_kses( ( $other_group->name ) ) ) ), 'error' );
	177	+ }
166	178	}
167	179	}
168	180
169	181	return $group_id;