mainwp / class / class-mainwp-meta-boxes.php

class-mainwp-meta-boxes.php in MainWP Dashboard: Self-hosted WordPress Management for Agencies 5.2.2, at class/class-mainwp-meta-boxes.php

278 lines 10.4 KB

Raw Download Zip

1	<?php
2	/**
3	* This file handles the addintion and updating of Post Meta Boxes.
4	*
5	* @package MainWP/Dashboard
6	*/
7
8	namespace MainWP\Dashboard;
9
10	/**
11	* Class MainWP_Meta_Boxes
12	*
13	* @package MainWP\Dashboard
14	*/
15	class MainWP_Meta_Boxes { // phpcs:ignore Generic.Classes.OpeningBraceSameLine.ContentAfterBrace -- NOSONAR.
16
17	/**
18	* Method select_sites_handle()
19	*
20	* Update Post meta for Select Sites Meta boxes.
21	*
22	* @param mixed $post_id Post ID.
23	* @param mixed $post_type Post type.
24	*
25	* @return int $post_id Post ID.
26	*/
27	public function select_sites_handle( $post_id, $post_type ) { // phpcs:ignore -- NOSONAR - complex function. Current complexity is the only way to achieve desired results, pull request solutions appreciated.
28
29	/**
30	* Verify this came from the our screen and with proper authorization.
31	*/
32	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
33	if ( ! isset( $_POST['select_sites_nonce'] ) \|\| ! wp_verify_nonce( sanitize_key( $_POST['select_sites_nonce'] ), 'select_sites_' . $post_id ) ) {
34	return $post_id;
35	}
36
37	/**
38	* Verify if this is an auto save routine. If it is our form has not been submitted, so we dont want to do anything.
39	*/
40	if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
41	return $post_id;
42	}
43
44	/**
45	* Check permissions.
46	*/
47	if ( ! current_user_can( 'edit_post', $post_id ) ) {
48	return $post_id;
49	}
50
51	/**
52	* OK, we're authenticated: we need to find and save the data.
53	*/
54	$_post = get_post( $post_id );
55	if ( $_post->post_type === $post_type && isset( $_POST['select_by'] ) ) {
56	$selected_wp = array();
57	if ( isset( $_POST['selected_sites'] ) ) {
58	if ( is_array( $_POST['selected_sites'] ) ) {
59	$selected_wp = ! empty( $_POST['selected_sites'] ) ? array_map( 'sanitize_text_field', wp_unslash( $_POST['selected_sites'] ) ) : array();
60	} else { // radio selection.
61	$selected_wp = ! empty( $_POST['selected_sites'] ) ? array( sanitize_text_field( wp_unslash( $_POST['selected_sites'] ) ) ) : array();
62	}
63	}
64	update_post_meta( $post_id, '_selected_sites', $selected_wp );
65	$selected_groups = array();
66	if ( isset( $_POST['selected_groups'] ) ) {
67	if ( is_array( $_POST['selected_groups'] ) ) {
68	$selected_groups = ! empty( $_POST['selected_groups'] ) ? array_map( 'sanitize_text_field', wp_unslash( $_POST['selected_groups'] ) ) : array();
69	} else { // radio selection.
70	$selected_groups = ! empty( $_POST['selected_groups'] ) ? array( sanitize_text_field( wp_unslash( $_POST['selected_groups'] ) ) ) : array();
71	}
72	}
73	update_post_meta( $post_id, '_selected_groups', $selected_groups );
74	$selected_clients = array();
75	if ( isset( $_POST['selected_clients'] ) ) {
76	if ( is_array( $_POST['selected_clients'] ) ) {
77	$selected_clients = ! empty( $_POST['selected_clients'] ) ? array_map( 'sanitize_text_field', wp_unslash( $_POST['selected_clients'] ) ) : array();
78	} else { // radio selection.
79	$selected_clients = ! empty( $_POST['selected_clients'] ) ? array( sanitize_text_field( wp_unslash( $_POST['selected_clients'] ) ) ) : array();
80	}
81	}
82	update_post_meta( $post_id, '_selected_clients', $selected_clients );
83	update_post_meta( $post_id, '_selected_by', sanitize_text_field( wp_unslash( $_POST['select_by'] ) ) );
84
85	if ( ( 'group' === $_POST['select_by'] && ! empty( $selected_groups ) ) \|\| ( 'site' === $_POST['select_by'] && ! empty( $selected_wp ) ) \|\| ( 'client' === $_POST['select_by'] && ! empty( $selected_clients ) ) ) {
86	return sanitize_text_field( wp_unslash( $_POST['select_by'] ) );
87	}
88	}
89	// phpcs:enable
90
91	return $post_id;
92	}
93
94	/**
95	* Method add_categories()
96	*
97	* Add categories.
98	*
99	* @param int $post_id Post ID.
100	*/
101	public function add_categories( $post_id = false ) {
102	if ( empty( $post_id ) ) {
103	return;
104	}
105	$post = get_post( $post_id );
106	MainWP_Post::render_categories_list( $post );
107	}
108
109	/**
110	* Method add_categories_handle()
111	*
112	* Handle adding categories.
113	*
114	* @param int $post_id Post ID.
115	* @param string $post_type Post type.
116	*/
117	public function add_categories_handle( $post_id, $post_type ) {
118	/**
119	* Verify this came from the our screen and with proper authorization.
120	*/
121
122	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
123	if ( ! isset( $_POST['post_category_nonce'] ) \|\| ! wp_verify_nonce( sanitize_key( $_POST['post_category_nonce'] ), 'post_category_' . $post_id ) ) {
124	return;
125	}
126
127	/**
128	* Verify if this is an auto save routine. If it is our form has not been submitted, so we dont want to do anything.
129	*/
130	if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
131	return;
132	}
133
134	/**
135	* Check permissions.
136	*/
137	if ( ! current_user_can( 'edit_post', $post_id ) ) {
138	return;
139	}
140
141	/**
142	* OK, we're authenticated: we need to find and save the data.
143	*/
144	$_post = get_post( $post_id );
145	if ( $_post->post_type === $post_type ) {
146	if ( isset( $_POST['post_category'] ) && is_array( $_POST['post_category'] ) ) {
147	update_post_meta( $post_id, '_categories', base64_encode( implode( ',', wp_unslash( $_POST['post_category'] ) ) ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
148	do_action( 'mainwp_bulkpost_categories_handle', $post_id, wp_unslash( $_POST['post_category'] ) );
149	}
150
151	$post_existing = ! empty( $_POST['post_only_existing'] ) ? 1 : 0;
152	update_post_meta( $post_id, '_post_to_only_existing_categories', $post_existing );
153	}
154	// phpcs:enable
155	}
156
157	/**
158	* Method add_tags()
159	*
160	* Add tags to Post array.
161	*
162	* @param object $post Post object.
163	*/
164	public function add_tags( $post ) {
165	$this->add_extra( 'Tags', '_tags', 'add_tags', $post );
166	}
167
168	/**
169	* Method add_tags_handle()
170	*
171	* Add Tags to post array handler.
172	*
173	* @param int $post_id Post ID.
174	* @param string $post_type Post type.
175	*/
176	public function add_tags_handle( $post_id, $post_type ) {
177	$this->add_extra_handle( 'Tags', '_tags', 'add_tags', $post_id, $post_type );
178	if ( isset( $_POST['add_tags'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
179	do_action( 'mainwp_bulkpost_tags_handle', $post_id, $post_type, wp_strip_all_tags( wp_unslash( $_POST['add_tags'] ) ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
180	}
181	}
182
183	/**
184	* Method add_slug()
185	*
186	* Add Slug to Post object.
187	*
188	* @param object $post Post object.
189	*/
190	public function add_slug( $post ) {
191	$this->add_extra( 'Slug', '_slug', 'add_slug', $post );
192	}
193
194	/**
195	* Method add_extra()
196	*
197	* Add nounce to post object.
198	*
199	* @param string $title Post title.
200	* @param string $saveto Save to.
201	* @param string $prefix Custom prefix.
202	* @param object $post Post object.
203	*/
204	private function add_extra( $title, $saveto, $prefix, $post ) {
205	unset( $title );
206	$extra = base64_decode( get_post_meta( $post->ID, $saveto, true ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_decode used for http encoding compatible.
207	?>
208	<input type="hidden" name="<?php echo esc_attr( $prefix ); ?>_nonce" value="<?php echo esc_attr( wp_create_nonce( $prefix . '_' . $post->ID ) ); ?>"/>
209	<input type="text" name="<?php echo esc_attr( $prefix ); ?>" value="<?php echo esc_attr( $extra ); ?>"/>
210	<?php
211	}
212
213
214	/**
215	* Method add_slug_handle()
216	*
217	* Add post slug.
218	*
219	* @param int $post_id Post ID.
220	* @param string $post_type Post type.
221	*/
222	public function add_slug_handle( $post_id, $post_type ) {
223	$this->add_extra_handle( 'Slug', '_slug', 'add_slug', $post_id, $post_type );
224	}
225
226	/**
227	* Method add_extra_handle()
228	*
229	* Update Post meta & add Security Nonce Prefix.
230	*
231	* @param string $title Post title.
232	* @param string $saveto Where to save.
233	* @param string $prefix Custom prefix.
234	* @param int $post_id Post ID.
235	* @param string $post_type Post type.
236	*
237	* @return int $post_id Post ID.
238	*/
239	private function add_extra_handle( $title, $saveto, $prefix, $post_id, $post_type ) {
240	unset( $title );
241	/**
242	* Verify this came from the our screen and with proper authorization.
243	*/
244	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
245	if ( ! isset( $_POST[ $prefix . '_nonce' ] ) \|\| ! wp_verify_nonce( sanitize_key( $_POST[ $prefix . '_nonce' ] ), $prefix . '_' . $post_id ) ) {
246	return $post_id;
247	}
248
249	/**
250	* Verify if this is an auto save routine. If it is our form has not been submitted, so we dont want to do anything.
251	*/
252	if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
253	return $post_id;
254	}
255
256	/**
257	* Check permissions.
258	*/
259	if ( ! current_user_can( 'edit_post', $post_id ) ) {
260	return $post_id;
261	}
262
263	/**
264	* OK, we're authenticated: we need to find and save the data.
265	*/
266	$_post = get_post( $post_id );
267	if ( $_post->post_type === $post_type && isset( $_POST[ $prefix ] ) ) {
268	$value = isset( $_POST[ $prefix ] ) ? base64_encode( wp_unslash( $_POST[ $prefix ] ) ) : ''; // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
269	update_post_meta( $post_id, $saveto, $value );
270	return $value;
271	}
272	// phpcs:enable
273
274	return $post_id;
275	}
276	}
277	?>
278