| @@ -191,10 +191,16 @@ | ||
| 191 | 191 | * @return void |
| 192 | 192 | */ |
| 193 | 193 | public function maybeSettingsUpdated(): void |
| 194 | 194 | { |
| 195 | - $optionPage = sanitize_text_field($_POST['option_page'] ?? ''); | |
| 196 | - $action = sanitize_text_field($_POST['action'] ?? ''); | |
| 195 | + // phpcs:disable WordPress.Security.NonceVerification.Missing -- Passive logger reads core settings request after WordPress validates it. | |
| 196 | + $optionPage = isset($_POST['option_page']) | |
| 197 | + ? sanitize_text_field(wp_unslash($_POST['option_page'])) | |
| 198 | + : ''; | |
| 199 | + $action = isset($_POST['action']) | |
| 200 | + ? sanitize_text_field(wp_unslash($_POST['action'])) | |
| 201 | + : ''; | |
| 202 | + // phpcs:enable WordPress.Security.NonceVerification.Missing | |
| 197 | 203 | |
| 198 | 204 | if ($optionPage && $action == 'update') { |
| 199 | 205 | Logtivity::log() |
| 200 | 206 | ->setAction('Settings Updated') |
| @@ -251,9 +257,11 @@ | ||
| 251 | 257 | * @return string |
| 252 | 258 | */ |
| 253 | 259 | private function getRequestMethod(): string |
| 254 | 260 | { |
| 255 | - return sanitize_text_field($_SERVER['REQUEST_METHOD'] ?? ''); | |
| 261 | + return isset($_SERVER['REQUEST_METHOD']) | |
| 262 | + ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_METHOD'])) | |
| 263 | + : ''; | |
| 256 | 264 | } |
| 257 | 265 | |
| 258 | 266 | /** |
| 259 | 267 | * @param string $oldStructure |
