| @@ -14,8 +14,29 @@ | ||
| 14 | 14 | |
| 15 | 15 | private static $meta_options = []; |
| 16 | 16 | |
| 17 | 17 | /** |
| 18 | + * Get initialized WordPress filesystem instance. | |
| 19 | + * | |
| 20 | + * @return WP_Filesystem_Base|false | |
| 21 | + */ | |
| 22 | + public static function get_wp_filesystem() { | |
| 23 | + global $wp_filesystem; | |
| 24 | + | |
| 25 | + if ( ! function_exists( 'WP_Filesystem' ) ) { | |
| 26 | + require_once ABSPATH . 'wp-admin/includes/file.php'; | |
| 27 | + } | |
| 28 | + | |
| 29 | + WP_Filesystem(); | |
| 30 | + | |
| 31 | + if ( ! ( $wp_filesystem instanceof WP_Filesystem_Base ) ) { | |
| 32 | + return false; | |
| 33 | + } | |
| 34 | + | |
| 35 | + return $wp_filesystem; | |
| 36 | + } | |
| 37 | + | |
| 38 | + /** | |
| 18 | 39 | * @return bool |
| 19 | 40 | */ |
| 20 | 41 | public static function is_safe_mode() { |
| 21 | 42 | global $wbcr_inp_safe_mode; |
| @@ -110,9 +131,9 @@ | ||
| 110 | 131 | $tag_names = [ 'id' ]; |
| 111 | 132 | $snippet_type = self::get_snippet_type( $snippet->ID ); |
| 112 | 133 | |
| 113 | 134 | $available_tags = self::getMetaOption( $snippet->ID, 'snippet_tags' ); |
| 114 | - $available_tags = trim( rtrim( $available_tags ) ); | |
| 135 | + $available_tags = ! empty( $available_tags ) ? trim( rtrim( $available_tags ) ) : ''; | |
| 115 | 136 | |
| 116 | 137 | if ( ! empty( $available_tags ) ) { |
| 117 | 138 | $available_tags = array_map( 'trim', explode( ',', $available_tags ) ); |
| 118 | 139 | $available_tags = array_unique( $available_tags ); |
| @@ -157,9 +178,9 @@ | ||
| 157 | 178 | * Get snippet type |
| 158 | 179 | * |
| 159 | 180 | * @param mixed $post_id Post ID. |
| 160 | 181 | * |
| 161 | - * @return array|mixed|string | |
| 182 | + * @return string|false Snippet type string, or false if post is not a valid snippet post type or not found. | |
| 162 | 183 | */ |
| 163 | 184 | public static function get_snippet_type( $post_id = null ) { |
| 164 | 185 | global $post; |
| 165 | 186 | |
| @@ -173,8 +194,14 @@ | ||
| 173 | 194 | } |
| 174 | 195 | |
| 175 | 196 | if ( ! empty( $post_id ) ) { |
| 176 | 197 | $_post = get_post( $post_id ); |
| 198 | + | |
| 199 | + // Security: Validate that the post belongs to the snippet post type | |
| 200 | + // to prevent arbitrary post content execution via shortcodes. | |
| 201 | + if ( empty( $_post ) || WINP_SNIPPETS_POST_TYPE !== $_post->post_type ) { | |
| 202 | + return false; | |
| 203 | + } | |
| 177 | 204 | } |
| 178 | 205 | |
| 179 | 206 | if ( ! empty( $_post ) && WINP_SNIPPETS_POST_TYPE === $_post->post_type ) { |
| 180 | 207 | $_snippet_type = get_post_meta( $_post->ID, 'wbcr_inp_snippet_type', true ); |
| @@ -207,8 +234,12 @@ | ||
| 207 | 234 | |
| 208 | 235 | // (#3) |
| 209 | 236 | $rest_url = wp_parse_url( site_url( $prefix ) ); |
| 210 | 237 | $current_url = wp_parse_url( esc_url( add_query_arg( [] ) ) ); |
| 238 | + | |
| 239 | + if ( empty( $rest_url['path'] ) || empty( $current_url['path'] ) ) { | |
| 240 | + return false; | |
| 241 | + } | |
| 211 | 242 | |
| 212 | 243 | return strpos( $current_url['path'], $rest_url['path'], 0 ) === 0; |
| 213 | 244 | } |
| 214 | 245 | |
