← All changes | class/class-mainwp-post-base-handler.php +135 -130 5.0.3.1 → 6.2.1 View file →

		@@ -6,157 +6,162 @@
6	6	*/
7	7
8	8	namespace MainWP\Dashboard;
9	9
	10	+// Exit if accessed directly.
	11	+if ( ! defined( 'ABSPATH' ) ) {
	12	+ exit;
	13	+}
	14	+
10	15	/**
11	16	* Class MainWP_Post_Base_Handler
12	17	*
13	18	* @package MainWP\Dashboard
14	19	*/
15		-abstract class MainWP_Post_Base_Handler {
	20	+abstract class MainWP_Post_Base_Handler { // phpcs:ignore Generic.Classes.OpeningBraceSameLine.ContentAfterBrace -- NOSONAR.
16	21
17		- /**
18		- * Protected static variable to hold security nounces.
19		- *
20		- * @var string Security nonce.
21		- */
22		- protected static $security_nonces;
	22	+ /**
	23	+ * Protected static variable to hold security nounces.
	24	+ *
	25	+ * @var string Security nonce.
	26	+ */
	27	+ protected static $security_nonces;
23	28
24		- /**
25		- * Protected static variable to hold security nounces.
26		- *
27		- * @var string Security nonce.
28		- */
29		- protected static $security_names;
	29	+ /**
	30	+ * Protected static variable to hold security nounces.
	31	+ *
	32	+ * @var string Security nonce.
	33	+ */
	34	+ protected static $security_names;
30	35
31		- /**
32		- * Method init()
33		- *
34		- * Force Extending class to define this method.
35		- *
36		- * @return void
37		- */
38		- abstract protected function init();
	36	+ /**
	37	+ * Method init()
	38	+ *
	39	+ * Force Extending class to define this method.
	40	+ *
	41	+ * @return void
	42	+ */
	43	+ abstract protected function init();
39	44
40	45
41		- /**
42		- * Method secure_request()
43		- *
44		- * Add security check to request parameter
45		- *
46		- * @param string $action Action to perform.
47		- * @param string $query_arg Query argument.
48		- *
49		- * @uses \MainWP\Dashboard\MainWP_System_Utility::is_admin()
50		- * @uses \MainWP\Dashboard\MainWP_Utility::update_option()
51		- */
52		- public function secure_request( $action = '', $query_arg = 'security' ) {
53		- if ( ! MainWP_System_Utility::is_admin() ) {
54		- die( 0 );
55		- }
56		- if ( '' === $action ) {
57		- return;
58		- }
	46	+ /**
	47	+ * Method secure_request()
	48	+ *
	49	+ * Add security check to request parameter
	50	+ *
	51	+ * @param string $action Action to perform.
	52	+ * @param string $query_arg Query argument.
	53	+ *
	54	+ * @uses \MainWP\Dashboard\MainWP_System_Utility::is_admin()
	55	+ * @uses \MainWP\Dashboard\MainWP_Utility::update_option()
	56	+ */
	57	+ public function secure_request( $action = '', $query_arg = 'security' ) {
	58	+ if ( ! MainWP_System_Utility::is_admin() ) {
	59	+ die( 0 );
	60	+ }
	61	+ if ( '' === $action ) {
	62	+ return;
	63	+ }
59	64
60		- $this->check_security( $action, $query_arg );
	65	+ $this->check_security( $action, $query_arg );
61	66
62		- if ( isset( $_POST['dts'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
63		- $ajaxPosts = get_option( 'mainwp_ajaxposts' );
64		- if ( ! is_array( $ajaxPosts ) ) {
65		- $ajaxPosts = array();
66		- }
	67	+ if ( isset( $_POST['dts'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	68	+ $ajaxPosts = get_option( 'mainwp_ajaxposts' );
	69	+ if ( ! is_array( $ajaxPosts ) ) {
	70	+ $ajaxPosts = array();
	71	+ }
67	72
68		- // If already processed, just quit!
69		- if ( isset( $ajaxPosts[ $action ] ) && ( $ajaxPosts[ $action ] === $_POST['dts'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
70		- die( wp_json_encode( array( 'error' => esc_html__( 'Double request!', 'mainwp' ) ) ) );
71		- }
	73	+ // If already processed, just quit!
	74	+ if ( isset( $ajaxPosts[ $action ] ) && ( $ajaxPosts[ $action ] === $_POST['dts'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	75	+ die( wp_json_encode( array( 'error' => esc_html__( 'Double request!', 'mainwp' ) ) ) );
	76	+ }
72	77
73		- $ajaxPosts[ $action ] = sanitize_text_field( wp_unslash( $_POST['dts'] ) ); // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
74		- MainWP_Utility::update_option( 'mainwp_ajaxposts', $ajaxPosts );
75		- }
76		- }
	78	+ $ajaxPosts[ $action ] = sanitize_text_field( wp_unslash( $_POST['dts'] ) ); // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	79	+ MainWP_Utility::update_option( 'mainwp_ajaxposts', $ajaxPosts );
	80	+ }
	81	+ }
77	82
78		- /**
79		- * Method check_security()
80		- *
81		- * Check security request.
82		- *
83		- * @param string $action Action to perform.
84		- * @param string $query_arg Query argument.
85		- * @param bool $out_die return or exit.
86		- *
87		- * @return bool true or false
88		- */
89		- public function check_security( $action = - 1, $query_arg = 'security', $out_die = true ) {
90		- $secure = true;
91		- if ( - 1 === $action ) {
92		- $secure = false;
93		- } else {
94		- $result = isset( $_REQUEST[ $query_arg ] ) ? wp_verify_nonce( sanitize_key( $_REQUEST[ $query_arg ] ), $action ) : false; // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	83	+ /**
	84	+ * Method check_security()
	85	+ *
	86	+ * Check security request.
	87	+ *
	88	+ * @param string $action Action to perform.
	89	+ * @param string $query_arg Query argument.
	90	+ * @param bool $out_die return or exit.
	91	+ *
	92	+ * @return bool true or false
	93	+ */
	94	+ public function check_security( $action = - 1, $query_arg = 'security', $out_die = true ) {
	95	+ $secure = true;
	96	+ if ( - 1 === $action ) {
	97	+ $secure = false;
	98	+ } else {
	99	+ $result = isset( $_REQUEST[ $query_arg ] ) ? wp_verify_nonce( sanitize_key( $_REQUEST[ $query_arg ] ), $action ) : false; // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
95	100
96		- if ( ! $result ) {
97		- $secure = false;
98		- }
99		- }
	101	+ if ( ! $result ) {
	102	+ $secure = false;
	103	+ }
	104	+ }
100	105
101		- if ( ! $secure ) {
102		- if ( $out_die ) {
103		- die( wp_json_encode( array( 'error' => esc_html__( 'Insecure request! Please try again. If you keep experiencing the problem, please review MainWP Knowledgebase, and if you still have issues, please let us know in the MainWP Community.', 'mainwp' ) ) ) );
104		- } else {
105		- return false;
106		- }
107		- }
108		- return true;
109		- }
	106	+ if ( ! $secure ) {
	107	+ if ( $out_die ) {
	108	+ die( wp_json_encode( array( 'error' => esc_html__( 'Insecure request! Please try again. If you keep experiencing the problem, please review MainWP Knowledgebase, and if you still have issues, please let us know in the MainWP Community.', 'mainwp' ) ) ) );
	109	+ } else {
	110	+ return false;
	111	+ }
	112	+ }
	113	+ return true;
	114	+ }
110	115
111		- /**
112		- * Method add_action()
113		- *
114		- * Add ajax action.
115		- *
116		- * @param string $action Action to perform.
117		- * @param string $callback Callback to perform.
118		- * @param int $priority priority aciton.
119		- * @param int $accepted number args.
120		- */
121		- public function add_action( $action, $callback, $priority = 10, $accepted = 2 ) {
122		- add_action( 'wp_ajax_' . $action, $callback, $priority, $accepted );
123		- $this->add_action_nonce( $action ); // to fix conflict with Post S M T P plugin.
124		- }
	116	+ /**
	117	+ * Method add_action()
	118	+ *
	119	+ * Add ajax action.
	120	+ *
	121	+ * @param string $action Action to perform.
	122	+ * @param mixed $callback Callback to perform.
	123	+ * @param int $priority priority aciton.
	124	+ * @param int $accepted number args.
	125	+ */
	126	+ public function add_action( $action, $callback, $priority = 10, $accepted = 2 ) {
	127	+ add_action( 'wp_ajax_' . $action, $callback, $priority, $accepted );
	128	+ $this->add_action_nonce( $action ); // to fix conflict with Post S M T P plugin.
	129	+ }
125	130
126		- /**
127		- * Method add_action_nonce()
128		- *
129		- * Add security nonce.
130		- *
131		- * @param string $action Action to perform.
132		- */
133		- public function add_action_nonce( $action ) {
134		- if ( ! is_array( self::$security_names ) ) {
135		- self::$security_names = array();
136		- }
137		- self::$security_names[] = $action;
138		- }
	131	+ /**
	132	+ * Method add_action_nonce()
	133	+ *
	134	+ * Add security nonce.
	135	+ *
	136	+ * @param string $action Action to perform.
	137	+ */
	138	+ public function add_action_nonce( $action ) {
	139	+ if ( ! is_array( static::$security_names ) ) {
	140	+ static::$security_names = array();
	141	+ }
	142	+ static::$security_names[] = $action;
	143	+ }
139	144
140		- /**
141		- * Create the security nonces.
142		- *
143		- * @return self $security_nonces.
144		- */
145		- public function create_security_nonces() {
	145	+ /**
	146	+ * Create the security nonces.
	147	+ *
	148	+ * @return self $security_nonces.
	149	+ */
	150	+ public function create_security_nonces() {
146	151
147		- if ( ! is_array( self::$security_nonces ) ) {
148		- self::$security_nonces = array();
149		- }
150		- self::$security_names = apply_filters( 'mainwp_create_security_nonces', self::$security_names );
151		- if ( ! empty( self::$security_names ) ) {
152		- if ( ! function_exists( 'wp_create_nonce' ) ) {
153		- include_once ABSPATH . WPINC . '/pluggable.php';
154		- }
155		- foreach ( self::$security_names as $action ) {
156		- self::$security_nonces[ $action ] = wp_create_nonce( $action );
157		- }
158		- }
	152	+ if ( ! is_array( static::$security_nonces ) ) {
	153	+ static::$security_nonces = array();
	154	+ }
	155	+ static::$security_names = apply_filters( 'mainwp_create_security_nonces', static::$security_names );
	156	+ if ( ! empty( static::$security_names ) ) {
	157	+ if ( ! function_exists( 'wp_create_nonce' ) ) {
	158	+ include_once ABSPATH . WPINC . '/pluggable.php'; // NOSONAR - WP compatible.
	159	+ }
	160	+ foreach ( static::$security_names as $action ) {
	161	+ static::$security_nonces[ $action ] = wp_create_nonce( $action );
	162	+ }
	163	+ }
159	164
160		- return self::$security_nonces;
161		- }
	165	+ return static::$security_nonces;
	166	+ }
162	167	}