← All changes | modules/widgets/class-jetpack-instagram-widget.php +18 -12 13.7.2 → 16.3-a.1 View file →

		@@ -7,8 +7,12 @@
7	7
8	8	use Automattic\Jetpack\Connection\Client;
9	9	use Automattic\Jetpack\Connection\Manager;
10	10
	11	+if ( ! defined( 'ABSPATH' ) ) {
	12	+ exit( 0 );
	13	+}
	14	+
11	15	/**
12	16	* This is the actual Instagram widget along with other code that only applies to the widget.
13	17	*/
14	18	class Jetpack_Instagram_Widget extends WP_Widget {
		@@ -46,12 +50,8 @@
46	50	'show_instance_in_rest' => true,
47	51	)
48	52	);
49	53
50		- if ( is_active_widget( false, false, self::ID_BASE ) || is_active_widget( false, false, 'monster' ) || is_customize_preview() ) {
51		- add_action( 'wp_enqueue_scripts', array( $this, 'enqueue_css' ) );
52		- }
53		-
54	54	add_action( 'wp_ajax_wpcom_instagram_widget_update_widget_token_id', array( $this, 'ajax_update_widget_token_id' ) );
55	55
56	56	$this->valid_options = array(
57	57	/**
		@@ -121,16 +121,18 @@
121	121	/**
122	122	* Updates the widget's option in the database to have the passed Keyring token ID.
123	123	*
124	124	* Sends a json success or error response.
	125	+ *
	126	+ * @return never
125	127	*/
126	128	public function ajax_update_widget_token_id() {
127	129	if ( ! check_ajax_referer( 'instagram-widget-save-token', 'savetoken', false ) ) {
128		- wp_send_json_error( array( 'message' => 'bad_nonce' ), 403 );
	130	+ wp_send_json_error( array( 'message' => 'bad_nonce' ), 403, JSON_UNESCAPED_SLASHES );
129	131	}
130	132
131	133	if ( ! current_user_can( 'customize' ) ) {
132		- wp_send_json_error( array( 'message' => 'not_authorized' ), 403 );
	134	+ wp_send_json_error( array( 'message' => 'not_authorized' ), 403, JSON_UNESCAPED_SLASHES );
133	135	}
134	136
135	137	$token_id = ! empty( $_POST['keyring_id'] ) ? (int) $_POST['keyring_id'] : null;
136	138	$widget_id = ! empty( $_POST['instagram_widget_id'] ) ? (int) $_POST['instagram_widget_id'] : null;
		@@ -144,9 +146,9 @@
144	146	'id' => $token_id,
145	147	)
146	148	);
147	149	if ( get_current_user_id() !== (int) $token->meta['user_id'] ) {
148		- return wp_send_json_error( array( 'message' => 'not_authorized' ), 403 );
	150	+ wp_send_json_error( array( 'message' => 'not_authorized' ), 403, JSON_UNESCAPED_SLASHES );
149	151	}
150	152	}
151	153
152	154	$this->update_widget_token_id( $token_id, $widget_id );
		@@ -151,9 +153,9 @@
151	153
152	154	$this->update_widget_token_id( $token_id, $widget_id );
153	155	$this->update_widget_token_legacy_status( false );
154	156
155		- return wp_send_json_success( null, 200 );
	157	+ wp_send_json_success( null, 200, JSON_UNESCAPED_SLASHES );
156	158	}
157	159
158	160	/**
159	161	* Updates the widget's option in the database to show if it is for legacy API or not.
		@@ -274,8 +276,11 @@
274	276	if ( ( ! $status['valid'] || ! is_array( $images ) ) && ! current_user_can( 'edit_theme_options' ) ) {
275	277	return;
276	278	}
277	279
	280	+ // Enqueue front end assets.
	281	+ $this->enqueue_css();
	282	+
278	283	echo $args['before_widget']; //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
279	284
280	285	// Always show a title on an unconfigured widget.
281	286	if ( ! $status['valid'] && empty( $instance['title'] ) ) {
		@@ -388,8 +393,9 @@
388	393	* Outputs the widget configuration form for the widget administration page.
389	394	* Allows the user to add new Instagram Keyring tokens and more.
390	395	*
391	396	* @param array $instance The widget instance (configuration options).
	397	+ * @return string|void
392	398	*/
393	399	public function form( $instance ) {
394	400	$instance = wp_parse_args( $instance, $this->defaults );
395	401
		@@ -406,9 +412,9 @@
406	412	}
407	413
408	414	// If coming back to the widgets page from an action, expand this widget.
409	415	if ( isset( $_GET['instagram_widget_id'] ) && (int) $_GET['instagram_widget_id'] === (int) $this->number ) {
410		- echo '<script type="text/javascript">jQuery(document).ready(function($){ $(\'.widget[id$="wpcom_instagram_widget-' . esc_js( $this->number ) . '"] .widget-inside\').slideDown(\'fast\'); });</script>';
	416	+ echo '<script type="text/javascript">jQuery(document).ready(function($){ $(\'.widget[id$="wpcom_instagram_widget-' . intval( $this->number ) . '"] .widget-inside\').slideDown(\'fast\'); });</script>';
411	417	}
412	418
413	419	$status = $this->get_token_status( $instance['token_id'] );
414	420
		@@ -471,15 +477,15 @@
471	477	button.dataset.connecturl, //TODO: Check if this needs validation it could be a XSS problem. Check the domain maybe?
472	478	'_blank',
473	479	'toolbar=0,location=0,menubar=0,' + getScreenCenterSpecs( 700, 700 )
474	480	);
475		- button.innerText = '<?php echo esc_js( __( 'Connecting…', 'jetpack' ) ); ?>';
	481	+ button.innerText = <?php echo wp_json_encode( __( 'Connecting…', 'jetpack' ), JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>;
476	482	button.disabled = true;
477	483	window.onmessage = function( { data } ) {
478	484	if ( !! data.keyring_id ) {
479	485	var payload = {
480	486	action: 'wpcom_instagram_widget_update_widget_token_id',
481		- savetoken: '<?php echo esc_js( wp_create_nonce( 'instagram-widget-save-token' ) ); ?>',
	487	+ savetoken: <?php echo wp_json_encode( wp_create_nonce( 'instagram-widget-save-token' ), JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>,
482	488	keyring_id: data.keyring_id,
483	489	instagram_widget_id: button.dataset.widgetid,
484	490	};
485	491	jQuery.post( ajaxurl, payload, function( response ) {
		@@ -484,9 +490,9 @@
484	490	};
485	491	jQuery.post( ajaxurl, payload, function( response ) {
486	492	var widget = jQuery(button).closest('div.widget');
487	493	if ( ! window.wpWidgets ) {
488		- window.location = '<?php echo esc_js( add_query_arg( array( 'autofocus[panel]' => 'widgets' ), admin_url( 'customize.php' ) ) ); ?>';
	494	+ window.location = <?php echo wp_json_encode( add_query_arg( array( 'autofocus[panel]' => 'widgets' ), admin_url( 'customize.php' ) ), JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>;
489	495	} else {
490	496	wpWidgets.save( widget, 0, 1, 1 );
491	497	}
492	498	} );