← All changes | Core/Admin/Logtivity_Admin.php +34 -12 3.3.8 → 3.3.10 View file →

		@@ -42,9 +42,8 @@
42	42	{
43	43	add_action('admin_menu', [$this, 'registerOptionsPage']);
44	44
45	45	add_action('wp_ajax_logtivity_update_settings', [$this, 'update']);
46		- add_action('wp_ajax_nopriv_logtivity_update_settings', [$this, 'update']);
47	46
48	47	add_action('wp_ajax_logtivity_register_site', [$this, 'registerSite']);
49	48
50	49	add_filter('logtivity_hide_from_menu', [$this, 'shouldHidePluginFromUI']);
		@@ -67,9 +66,10 @@
67	66	* @return array
68	67	*/
69	68	public function maybeHideFromMenu(array $plugins): array
70	69	{
71		- if ($name = (new Logtivity_Options())->customPluginName()) {
	70	+ $name = (new Logtivity_Options())->customPluginName();
	71	+ if ($name) {
72	72	if (isset($plugins['logtivity/logtivity.php'])) {
73	73	$plugins['logtivity/logtivity.php']['Name'] = $name;
74	74	}
75	75	}
		@@ -77,8 +77,9 @@
77	77	if (!$this->shouldHidePluginFromUI()) {
78	78	return $plugins;
79	79	}
80	80
	81	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- show_all only controls local admin list display.
81	82	$shouldHide = !array_key_exists('show_all', $_GET);
82	83
83	84	if ($shouldHide) {
84	85	$hiddenPlugins = [
		@@ -98,9 +99,11 @@
98	99	* @return bool
99	100	*/
100	101	public function shouldHidePluginFromUI(bool $value = false): bool
101	102	{
102		- if (static::$shouldHidePluginFromUI = (new Logtivity_Options())->isPluginHiddenFromUI()) {
	103	+ static::$shouldHidePluginFromUI = (new Logtivity_Options())->isPluginHiddenFromUI();
	104	+
	105	+ if (static::$shouldHidePluginFromUI) {
103	106	return static::$shouldHidePluginFromUI;
104	107	}
105	108
106	109	return $value;
		@@ -155,13 +158,14 @@
155	158	*/
156	159	public function showLogIndexPage(): void
157	160	{
158	161	if (!current_user_can(Logtivity::ACCESS_LOGS)) {
159		- wp_die(__('You do not have sufficient permissions to access this page.'));
	162	+ wp_die(esc_html__('You do not have sufficient permissions to access this page.', 'logtivity'));
160	163	}
161	164
162	165	$options = $this->options->getOptions();
163	166
	167	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- logtivity_view() renders trusted plugin templates.
164	168	echo logtivity_view('log-index', compact('options'));
165	169	}
166	170
167	171	/**
		@@ -171,13 +175,14 @@
171	175	*/
172	176	public function showSettingsPage(): void
173	177	{
174	178	if (!current_user_can(Logtivity::ACCESS_SETTINGS)) {
175		- wp_die(__('You do not have sufficient permissions to access this page.'));
	179	+ wp_die(esc_html__('You do not have sufficient permissions to access this page.', 'logtivity'));
176	180	}
177	181
178	182	$options = $this->options->getOptions();
179	183
	184	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- logtivity_view() renders trusted plugin templates.
180	185	echo logtivity_view('settings', compact('options'));
181	186	}
182	187
183	188	/**
		@@ -187,13 +192,14 @@
187	192	*/
188	193	public function showRegisterSitePage(): void
189	194	{
190	195	if (!current_user_can(Logtivity::ACCESS_SETTINGS)) {
191		- wp_die(__('You do not have sufficient permissions to access this page.'));
	196	+ wp_die(esc_html__('You do not have sufficient permissions to access this page.', 'logtivity'));
192	197	}
193	198
194	199	$options = $this->options->getOptions();
195	200
	201	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- logtivity_view() renders trusted plugin templates.
196	202	echo logtivity_view('register', compact('options'));
197	203	}
198	204
199	205	/**
		@@ -200,11 +206,15 @@
200	206	* @return void
201	207	*/
202	208	public function update(): void
203	209	{
	210	+ $nonce = isset($_POST['logtivity_update_settings'])
	211	+ ? sanitize_text_field(wp_unslash($_POST['logtivity_update_settings']))
	212	+ : '';
	213	+
204	214	if (
205	215	!wp_verify_nonce(
206		- sanitize_text_field($_POST['logtivity_update_settings'] ?? null),
	216	+ $nonce,
207	217	'logtivity_update_settings'
208	218	)
209	219	) {
210	220	wp_safe_redirect($this->settingsPageUrl());
		@@ -210,11 +220,9 @@
210	220	wp_safe_redirect($this->settingsPageUrl());
211	221	exit();
212	222	}
213	223
214		- $user = new Logtivity_Wp_User();
215		-
216		- if (!$user->hasRole('administrator')) {
	224	+ if (!current_user_can(Logtivity::ACCESS_SETTINGS)) {
217	225	wp_safe_redirect($this->settingsPageUrl());
218	226	exit();
219	227	}
220	228
		@@ -228,8 +236,12 @@
228	236	delete_transient('dismissed-logtivity-site-url-has-changed-notice');
229	237
230	238	$this->options->update();
231	239
	240	+ if (!$this->options->getOption('logtivity_enable_debug_mode')) {
	241	+ (new Logtivity_Debug_Log())->delete();
	242	+ }
	243	+
232	244	(new Logtivity_Check_For_New_Settings())->checkForNewSettings();
233	245
234	246	wp_safe_redirect($this->settingsPageUrl());
235	247	exit();
		@@ -242,15 +254,25 @@
242	254	*/
243	255	public function registerSite(): void
244	256	{
245	257	try {
	258	+ if (!current_user_can(Logtivity::ACCESS_SETTINGS)) {
	259	+ wp_send_json_error('Unauthorized');
	260	+ }
	261	+
	262	+ $nonce = isset($_POST['logtivity_register_site'])
	263	+ ? sanitize_text_field(wp_unslash($_POST['logtivity_register_site']))
	264	+ : '';
	265	+
246	266	if (
247	267	wp_verify_nonce(
248		- sanitize_text_field($_POST['logtivity_register_site'] ?? null),
	268	+ $nonce,
249	269	'logtivity_register_site'
250	270	)
251	271	) {
252		- $teamApi = sanitize_text_field($_POST['logtivity_team_api_key'] ?? null);
	272	+ $teamApi = isset($_POST['logtivity_team_api_key'])
	273	+ ? sanitize_text_field(wp_unslash($_POST['logtivity_team_api_key']))
	274	+ : '';
253	275
254	276	$response = Logtivity::registerSite($teamApi);
255	277
256	278