PluginProbe
Jetpack – WP Security, Backup, Speed, & Growth / 16.3-a.1
Jetpack – WP Security, Backup, Speed, & Growth v16.3-a.1
16.3-a.3 16.3-a.1 16.2 16.2-beta 12.0.3 12.1.3 12.2.3 12.3.2 12.4.2 12.5.2 12.6.4 12.7.3 12.8.3 12.9.5 13.0.2 13.1.5 13.2.4 13.3.3 13.4.5 13.5.2 13.6.2 13.7.2 13.8.3 13.9.2 14.0.1 All 504 releases
← All changes | sal/class.json-api-post-base.php +59 -24 13.6.216.3-a.1 View file →
@@ -10,8 +10,12 @@
10 10 */
11 11
12 12 use Automattic\Jetpack\Status;
13 13
14 +if ( ! defined( 'ABSPATH' ) ) {
15 + exit( 0 );
16 +}
17 +
14 18 require_once __DIR__ . '/class.json-api-metadata.php';
15 19 require_once __DIR__ . '/class.json-api-date.php';
16 20 require_once ABSPATH . 'wp-admin/includes/post.php';
17 21 require_once ABSPATH . 'wp-includes/post.php';
@@ -422,25 +426,44 @@
422 426 public function get_publicize_urls() {
423 427 $publicize_urls = array();
424 428 $publicize = get_post_meta( $this->post->ID, 'publicize_results', true );
425 429 if ( $publicize ) {
426 - foreach ( $publicize as $service => $data ) {
427 - switch ( $service ) {
428 - // @todo explore removing once Twitter is removed from Publicize.
429 - case 'twitter':
430 - foreach ( $data as $datum ) {
431 - $publicize_urls[] = esc_url_raw( "https://twitter.com/{$datum['user_id']}/status/{$datum['post_id']}" );
432 - }
433 - break;
434 - case 'fb':
435 - foreach ( $data as $datum ) {
436 - $publicize_urls[] = esc_url_raw( "https://www.facebook.com/permalink.php?story_fbid={$datum['post_id']}&id={$datum['user_id']}" );
437 - }
438 - break;
430 + // get_post_meta(..., true) will return a string if the value was stored as a scalar or serialized, so we may need to unserialize.
431 + if ( is_string( $publicize ) ) {
432 + $maybe_array_publicize = maybe_unserialize( $publicize );
433 + if ( ! is_array( $maybe_array_publicize ) ) {
434 + $maybe_array_publicize = json_decode( $publicize, true );
439 435 }
436 + if ( is_array( $maybe_array_publicize ) ) {
437 + $publicize = $maybe_array_publicize;
438 + } else {
439 + return $publicize_urls;
440 + }
440 441 }
442 +
443 + if ( is_array( $publicize ) ) {
444 + foreach ( $publicize as $service => $data ) {
445 + switch ( $service ) {
446 + // @todo explore removing once Twitter is removed from Publicize.
447 + case 'twitter':
448 + foreach ( $data as $datum ) {
449 + if ( isset( $datum['user_id'] ) && isset( $datum['post_id'] ) ) {
450 + $publicize_urls[] = esc_url_raw( "https://twitter.com/{$datum['user_id']}/status/{$datum['post_id']}" );
451 + }
452 + }
453 + break;
454 + case 'fb':
455 + foreach ( $data as $datum ) {
456 + if ( isset( $datum['user_id'] ) && isset( $datum['post_id'] ) ) {
457 + $publicize_urls[] = esc_url_raw( "https://www.facebook.com/permalink.php?story_fbid={$datum['post_id']}&id={$datum['user_id']}" );
458 + }
459 + }
460 + break;
461 + }
462 + }
463 + }
441 464 }
442 - return (array) $publicize_urls;
465 + return $publicize_urls;
443 466 }
444 467
445 468 /**
446 469 * Returns a string with the page's custom template metadata.
@@ -557,9 +580,9 @@
557 580 public function get_title() {
558 581 if ( 'display' === $this->context ) {
559 582 return (string) get_the_title( $this->post->ID );
560 583 } else {
561 - return (string) htmlspecialchars_decode( $this->post->post_title, ENT_QUOTES );
584 + return htmlspecialchars_decode( $this->post->post_title, ENT_QUOTES );
562 585 }
563 586 }
564 587
565 588 /**
@@ -653,14 +676,23 @@
653 676 */
654 677 public function get_password() {
655 678 $password = (string) $this->post->post_password;
656 679 if ( 'edit' === $this->context ) {
657 - $password = htmlspecialchars_decode( (string) $password, ENT_QUOTES );
680 + $password = htmlspecialchars_decode( $password, ENT_QUOTES );
658 681 }
659 682 return $password;
660 683 }
661 684
662 685 /**
686 + * Returns true if the post has a password set, regardless of whether the current user can view or receive the password value.
687 + *
688 + * @return bool
689 + */
690 + public function get_has_password(): bool {
691 + return strlen( (string) $this->post->post_password ) > 0;
692 + }
693 +
694 + /**
663 695 * Returns an object representing a post's parent, and false if it doesn't have one.
664 696 *
665 697 * @return object|bool
666 698 */
@@ -666,12 +698,15 @@
666 698 */
667 699 public function get_parent() {
668 700 if ( $this->post->post_parent ) {
669 701 $parent = get_post( $this->post->post_parent );
702 + if ( ! $parent ) {
703 + return false;
704 + }
670 705 if ( 'display' === $this->context ) {
671 706 $parent_title = (string) get_the_title( $parent->ID );
672 707 } else {
673 - $parent_title = (string) htmlspecialchars_decode( $this->post->post_title, ENT_QUOTES );
708 + $parent_title = htmlspecialchars_decode( $this->post->post_title, ENT_QUOTES );
674 709 }
675 710 return (object) array(
676 711 'ID' => (int) $parent->ID,
677 712 'type' => (string) $parent->post_type,
@@ -790,9 +825,9 @@
790 825 // @todo: factor this out
791 826 // phpcs:disable WordPress.NamingConventions.ValidVariableName
792 827 if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
793 828 $active_blog = get_active_blog_for_user( $user->ID );
794 - $site_id = $active_blog->blog_id;
829 + $site_id = $active_blog->blog_id ?? -1;
795 830 $profile_URL = "https://gravatar.com/{$user->user_login}";
796 831 } else {
797 832 $profile_URL = 'https://gravatar.com/' . md5( strtolower( trim( $user->user_email ) ) );
798 833 $site_id = -1;
@@ -918,9 +953,9 @@
918 953 }
919 954
920 955 $file = basename( wp_get_attachment_url( $media_item->ID ) );
921 956 $file_info = pathinfo( $file );
922 - $ext = isset( $file_info['extension'] ) ? $file_info['extension'] : '';
957 + $ext = $file_info['extension'] ?? '';
923 958
924 959 $response = array(
925 960 'ID' => $media_item->ID,
926 961 'URL' => wp_get_attachment_url( $media_item->ID ),
@@ -958,9 +993,11 @@
958 993 */
959 994 $sizes = apply_filters( 'rest_api_thumbnail_sizes', $metadata['sizes'], $media_id );
960 995 if ( is_array( $sizes ) ) {
961 996 foreach ( $sizes as $size => $size_details ) {
962 - $response['thumbnails'][ $size ] = dirname( $response['URL'] ) . '/' . $size_details['file'];
997 + if ( isset( $size_details['file'] ) ) {
998 + $response['thumbnails'][ $size ] = dirname( $response['URL'] ) . '/' . $size_details['file'];
999 + }
963 1000 }
964 1001 }
965 1002 }
966 1003
@@ -1016,13 +1053,11 @@
1016 1053 }
1017 1054 }
1018 1055 }
1019 1056
1020 - $response['videopress_guid'] = $info->guid;
1057 + $response['videopress_guid'] = $info->guid ?? null;
1021 1058 $response['videopress_processing_done'] = true;
1022 - if ( '0000-00-00 00:00:00' === $info->finish_date_gmt ) {
1023 - $response['videopress_processing_done'] = false;
1024 - }
1059 + $response['videopress_processing_done'] = isset( $info->finish_date_gmt ) && '0000-00-00 00:00:00' !== $info->finish_date_gmt ? $info->finish_date_gmt : false;
1025 1060 }
1026 1061 }
1027 1062
1028 1063 $response['thumbnails'] = (object) $response['thumbnails'];