mainwp / class / class-mainwp-meta-boxes.php

class-mainwp-meta-boxes.php in MainWP Dashboard: Self-hosted WordPress Management for Agencies 6.1.2, at class/class-mainwp-meta-boxes.php

283 lines 10.5 KB

Raw Download Zip

1	<?php
2	/**
3	* This file handles the addintion and updating of Post Meta Boxes.
4	*
5	* @package MainWP/Dashboard
6	*/
7
8	namespace MainWP\Dashboard;
9
10	// Exit if accessed directly.
11	if ( ! defined( 'ABSPATH' ) ) {
12	exit;
13	}
14
15	/**
16	* Class MainWP_Meta_Boxes
17	*
18	* @package MainWP\Dashboard
19	*/
20	class MainWP_Meta_Boxes { // phpcs:ignore Generic.Classes.OpeningBraceSameLine.ContentAfterBrace -- NOSONAR.
21
22	/**
23	* Method select_sites_handle()
24	*
25	* Update Post meta for Select Sites Meta boxes.
26	*
27	* @param mixed $post_id Post ID.
28	* @param mixed $post_type Post type.
29	*
30	* @return int $post_id Post ID.
31	*/
32	public function select_sites_handle( $post_id, $post_type ) { // phpcs:ignore -- NOSONAR - complex function. Current complexity is the only way to achieve desired results, pull request solutions appreciated.
33
34	/**
35	* Verify this came from the our screen and with proper authorization.
36	*/
37	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
38	if ( ! isset( $_POST['select_sites_nonce'] ) \|\| ! wp_verify_nonce( sanitize_key( $_POST['select_sites_nonce'] ), 'select_sites_' . $post_id ) ) {
39	return $post_id;
40	}
41
42	/**
43	* Verify if this is an auto save routine. If it is our form has not been submitted, so we dont want to do anything.
44	*/
45	if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
46	return $post_id;
47	}
48
49	/**
50	* Check permissions.
51	*/
52	if ( ! current_user_can( 'edit_post', $post_id ) ) {
53	return $post_id;
54	}
55
56	/**
57	* OK, we're authenticated: we need to find and save the data.
58	*/
59	$_post = get_post( $post_id );
60	if ( $_post->post_type === $post_type && isset( $_POST['select_by'] ) ) {
61	$selected_wp = array();
62	if ( isset( $_POST['selected_sites'] ) ) {
63	if ( is_array( $_POST['selected_sites'] ) ) {
64	$selected_wp = ! empty( $_POST['selected_sites'] ) ? array_map( 'sanitize_text_field', wp_unslash( $_POST['selected_sites'] ) ) : array();
65	} else { // radio selection.
66	$selected_wp = ! empty( $_POST['selected_sites'] ) ? array( sanitize_text_field( wp_unslash( $_POST['selected_sites'] ) ) ) : array();
67	}
68	}
69	update_post_meta( $post_id, '_selected_sites', $selected_wp );
70	$selected_groups = array();
71	if ( isset( $_POST['selected_groups'] ) ) {
72	if ( is_array( $_POST['selected_groups'] ) ) {
73	$selected_groups = ! empty( $_POST['selected_groups'] ) ? array_map( 'sanitize_text_field', wp_unslash( $_POST['selected_groups'] ) ) : array();
74	} else { // radio selection.
75	$selected_groups = ! empty( $_POST['selected_groups'] ) ? array( sanitize_text_field( wp_unslash( $_POST['selected_groups'] ) ) ) : array();
76	}
77	}
78	update_post_meta( $post_id, '_selected_groups', $selected_groups );
79	$selected_clients = array();
80	if ( isset( $_POST['selected_clients'] ) ) {
81	if ( is_array( $_POST['selected_clients'] ) ) {
82	$selected_clients = ! empty( $_POST['selected_clients'] ) ? array_map( 'sanitize_text_field', wp_unslash( $_POST['selected_clients'] ) ) : array();
83	} else { // radio selection.
84	$selected_clients = ! empty( $_POST['selected_clients'] ) ? array( sanitize_text_field( wp_unslash( $_POST['selected_clients'] ) ) ) : array();
85	}
86	}
87	update_post_meta( $post_id, '_selected_clients', $selected_clients );
88	update_post_meta( $post_id, '_selected_by', sanitize_text_field( wp_unslash( $_POST['select_by'] ) ) );
89
90	if ( ( 'group' === $_POST['select_by'] && ! empty( $selected_groups ) ) \|\| ( 'site' === $_POST['select_by'] && ! empty( $selected_wp ) ) \|\| ( 'client' === $_POST['select_by'] && ! empty( $selected_clients ) ) ) {
91	return sanitize_text_field( wp_unslash( $_POST['select_by'] ) );
92	}
93	}
94	// phpcs:enable
95
96	return $post_id;
97	}
98
99	/**
100	* Method add_categories()
101	*
102	* Add categories.
103	*
104	* @param int $post_id Post ID.
105	*/
106	public function add_categories( $post_id = false ) {
107	if ( empty( $post_id ) ) {
108	return;
109	}
110	$post = get_post( $post_id );
111	MainWP_Post::render_categories_list( $post );
112	}
113
114	/**
115	* Method add_categories_handle()
116	*
117	* Handle adding categories.
118	*
119	* @param int $post_id Post ID.
120	* @param string $post_type Post type.
121	*/
122	public function add_categories_handle( $post_id, $post_type ) {
123	/**
124	* Verify this came from the our screen and with proper authorization.
125	*/
126
127	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
128	if ( ! isset( $_POST['post_category_nonce'] ) \|\| ! wp_verify_nonce( sanitize_key( $_POST['post_category_nonce'] ), 'post_category_' . $post_id ) ) {
129	return;
130	}
131
132	/**
133	* Verify if this is an auto save routine. If it is our form has not been submitted, so we dont want to do anything.
134	*/
135	if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
136	return;
137	}
138
139	/**
140	* Check permissions.
141	*/
142	if ( ! current_user_can( 'edit_post', $post_id ) ) {
143	return;
144	}
145
146	/**
147	* OK, we're authenticated: we need to find and save the data.
148	*/
149	$_post = get_post( $post_id );
150	if ( $_post->post_type === $post_type ) {
151	if ( isset( $_POST['post_category'] ) && is_array( $_POST['post_category'] ) ) {
152	update_post_meta( $post_id, '_categories', base64_encode( implode( ',', wp_unslash( $_POST['post_category'] ) ) ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
153	do_action( 'mainwp_bulkpost_categories_handle', $post_id, wp_unslash( $_POST['post_category'] ) );
154	}
155
156	$post_existing = ! empty( $_POST['post_only_existing'] ) ? 1 : 0;
157	update_post_meta( $post_id, '_post_to_only_existing_categories', $post_existing );
158	}
159	// phpcs:enable
160	}
161
162	/**
163	* Method add_tags()
164	*
165	* Add tags to Post array.
166	*
167	* @param object $post Post object.
168	*/
169	public function add_tags( $post ) {
170	$this->add_extra( 'Tags', '_tags', 'add_tags', $post );
171	}
172
173	/**
174	* Method add_tags_handle()
175	*
176	* Add Tags to post array handler.
177	*
178	* @param int $post_id Post ID.
179	* @param string $post_type Post type.
180	*/
181	public function add_tags_handle( $post_id, $post_type ) {
182	$this->add_extra_handle( 'Tags', '_tags', 'add_tags', $post_id, $post_type );
183	if ( isset( $_POST['add_tags'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
184	do_action( 'mainwp_bulkpost_tags_handle', $post_id, $post_type, wp_strip_all_tags( wp_unslash( $_POST['add_tags'] ) ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
185	}
186	}
187
188	/**
189	* Method add_slug()
190	*
191	* Add Slug to Post object.
192	*
193	* @param object $post Post object.
194	*/
195	public function add_slug( $post ) {
196	$this->add_extra( 'Slug', '_slug', 'add_slug', $post );
197	}
198
199	/**
200	* Method add_extra()
201	*
202	* Add nounce to post object.
203	*
204	* @param string $title Post title.
205	* @param string $saveto Save to.
206	* @param string $prefix Custom prefix.
207	* @param object $post Post object.
208	*/
209	private function add_extra( $title, $saveto, $prefix, $post ) {
210	unset( $title );
211	$extra = base64_decode( get_post_meta( $post->ID, $saveto, true ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_decode used for http encoding compatible.
212	?>
213	<input type="hidden" name="<?php echo esc_attr( $prefix ); ?>_nonce" value="<?php echo esc_attr( wp_create_nonce( $prefix . '_' . $post->ID ) ); ?>"/>
214	<input type="text" name="<?php echo esc_attr( $prefix ); ?>" value="<?php echo esc_attr( $extra ); ?>"/>
215	<?php
216	}
217
218
219	/**
220	* Method add_slug_handle()
221	*
222	* Add post slug.
223	*
224	* @param int $post_id Post ID.
225	* @param string $post_type Post type.
226	*/
227	public function add_slug_handle( $post_id, $post_type ) {
228	$this->add_extra_handle( 'Slug', '_slug', 'add_slug', $post_id, $post_type );
229	}
230
231	/**
232	* Method add_extra_handle()
233	*
234	* Update Post meta & add Security Nonce Prefix.
235	*
236	* @param string $title Post title.
237	* @param string $saveto Where to save.
238	* @param string $prefix Custom prefix.
239	* @param int $post_id Post ID.
240	* @param string $post_type Post type.
241	*
242	* @return int $post_id Post ID.
243	*/
244	private function add_extra_handle( $title, $saveto, $prefix, $post_id, $post_type ) {
245	unset( $title );
246	/**
247	* Verify this came from the our screen and with proper authorization.
248	*/
249	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
250	if ( ! isset( $_POST[ $prefix . '_nonce' ] ) \|\| ! wp_verify_nonce( sanitize_key( $_POST[ $prefix . '_nonce' ] ), $prefix . '_' . $post_id ) ) {
251	return $post_id;
252	}
253
254	/**
255	* Verify if this is an auto save routine. If it is our form has not been submitted, so we dont want to do anything.
256	*/
257	if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
258	return $post_id;
259	}
260
261	/**
262	* Check permissions.
263	*/
264	if ( ! current_user_can( 'edit_post', $post_id ) ) {
265	return $post_id;
266	}
267
268	/**
269	* OK, we're authenticated: we need to find and save the data.
270	*/
271	$_post = get_post( $post_id );
272	if ( $_post->post_type === $post_type && isset( $_POST[ $prefix ] ) ) {
273	$value = isset( $_POST[ $prefix ] ) ? base64_encode( wp_unslash( $_POST[ $prefix ] ) ) : ''; // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
274	update_post_meta( $post_id, $saveto, $value );
275	return $value;
276	}
277	// phpcs:enable
278
279	return $post_id;
280	}
281	}
282	?>
283