← All changes | pages/page-mainwp-site-open.php +135 -23 5.2 → 6.2.2 View file →

		@@ -7,8 +7,13 @@
7	7	*/
8	8
9	9	namespace MainWP\Dashboard;
10	10
	11	+// Exit if accessed directly.
	12	+if ( ! defined( 'ABSPATH' ) ) {
	13	+ exit;
	14	+}
	15	+
11	16	/**
12	17	* Class MainWP_Site_Open
13	18	*
14	19	* @package MainWP\Dashboard
		@@ -24,8 +29,38 @@
24	29	return __CLASS__;
25	30	}
26	31
27	32	/**
	33	+ * Method get_open_site_admin_link()
	34	+ *
	35	+ * @param mixed $siteId Site ID.
	36	+ * @param mixed $prt_content Print url or not.
	37	+ * @param mixed $newWindow Open in new window.
	38	+ * @param mixed $opennonce Open nonce.
	39	+ * @param mixed $addition Additional parameters.
	40	+ *
	41	+ * @return string Link to open site.
	42	+ */
	43	+ public static function get_open_site_admin_link( $siteId, $prt_content = false, $newWindow = true, $opennonce = '', $addition = '' ) {
	44	+
	45	+ /**
	46	+ * Filter: mainwp_open_site_addition_url
	47	+ * Filter additional URL parameters for open site URL.
	48	+ *
	49	+ * @since 6.0
	50	+ */
	51	+ $addition = apply_filters( 'mainwp_open_site_addition_url', $addition, $siteId, $newWindow, $opennonce );
	52	+
	53	+ $url = 'admin.php?page=SiteOpen&newWindow=' . ( $newWindow ? 'yes' : 'no' ) . '&websiteid=' . intval( $siteId ) . '&_opennonce=' . ( empty( $opennonce ) ? esc_attr( wp_create_nonce( 'mainwp-admin-nonce' ) ) : esc_attr( $opennonce ) ) . $addition;
	54	+
	55	+ if ( $prt_content ) {
	56	+ echo esc_url( $url );
	57	+ }
	58	+
	59	+ return $url;
	60	+ }
	61	+
	62	+ /**
28	63	* Child Site Dashboard Link redirect handler.
29	64	*
30	65	* This method checks to see if the current user is allow to access the
31	66	* Child Site, then grabs the websiteid, location, openurl & passes it onto
		@@ -37,10 +72,10 @@
37	72	public static function render() { // phpcs:ignore -- NOSONAR - complex.
38	73
39	74	static::verify_open_nonce();
40	75
41		- if ( ! mainwp_current_user_have_right( 'dashboard', 'access_wpadmin_on_child_sites' ) ) {
42		- mainwp_do_not_have_permissions( esc_html__( 'WP-Admin on child sites', 'mainwp' ) );
	76	+ if ( ! \mainwp_current_user_can( 'dashboard', 'access_wpadmin_on_child_sites' ) ) {
	77	+ \mainwp_do_not_have_permissions( esc_html__( 'WP-Admin on child sites', 'mainwp' ) );
43	78
44	79	return;
45	80	}
46	81	// phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		@@ -59,17 +94,70 @@
59	94	if ( isset( $_GET['location'] ) ) {
60	95	$location = base64_decode( wp_unslash( $_GET['location'] ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_decode used for HTTP compatible char.
61	96	}
62	97
	98	+ $request_uri = isset( $_SERVER['REQUEST_URI'] ) ? wp_unslash( $_SERVER['REQUEST_URI'] ) : '';
	99	+
	100	+ $query = wp_parse_url( $request_uri, PHP_URL_QUERY );
	101	+
	102	+ $add_params = array();
	103	+
	104	+ if ( $query ) {
	105	+ parse_str( $query, $add_params );
	106	+ }
	107	+
	108	+ $exclude_keys = array( 'page', 'websiteid', 'location', '_opennonce', '_opennonce', 'openUrl', 'filedl', 'dirdl', 'closeWindow' );
	109	+
63	110	if ( isset( $_GET['openUrl'] ) && 'yes' === $_GET['openUrl'] ) {
64		- static::open_site_location( $website, $location );
	111	+
	112	+ $postdata = MainWP_Connect::get_get_data_authed( $website, 'index.php', 'where', true, array( 'verify_signature' => true ) );
	113	+ $postdata['open_location'] = $location; // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
	114	+ ?>
	115	+ <div class="ui segment" style="padding: 25rem">
	116	+ <div class="ui active dimmer">
	117	+ <div class="ui massive double text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
	118	+ </div>
	119	+ <?php
	120	+ $url = MainWP_Site_Url_Corrector::browser_target_url( $website );
	121	+ $url .= ( '/' !== substr( $url, - 1 ) ? '/' : '' );
	122	+ ?>
	123	+ <form method="POST" action="<?php echo esc_url( $url ); ?>" id="redirectForm"> <?php // phpcs:ignore -- NOSONAR - dublicate id ok. ?>
	124	+ <?php MainWP_UI::generate_wp_nonce( 'mainwp-admin-nonce' ); ?>
	125	+ <?php
	126	+ foreach ( $postdata as $name => $value ) {
	127	+ echo '<input type="hidden" name="' . esc_attr( $name ) . '" value="' . esc_attr( $value ) . '" />';
	128	+ }
	129	+
	130	+ if ( is_array( $add_params ) ) {
	131	+ foreach ( $add_params as $name => $value ) {
	132	+ if ( in_array( $name, $exclude_keys, true ) ) {
	133	+ continue;
	134	+ }
	135	+ echo '<input type="hidden" name="' . esc_attr( $name ) . '" value="' . esc_attr( $value ) . '" />';
	136	+ }
	137	+ }
	138	+
	139	+ ?>
	140	+ </form>
	141	+ </div>
	142	+ <?php
65	143	} else {
66	144	$allow_params = array();
67	145
	146	+ if ( is_array( $add_params ) ) {
	147	+ foreach ( $add_params as $name => $value ) {
	148	+ if ( in_array( $name, $exclude_keys, true ) ) {
	149	+ continue;
	150	+ }
	151	+ $allow_params[ $name ] = $value;
	152	+ }
	153	+ }
	154	+
68	155	$allow_vars = array(
69	156	'filedl',
70	157	'dirdl',
71	158	);
	159	+
72	160	$allow_vars = apply_filters( 'mainwp_open_site_allow_vars', $allow_vars );
73	161	if ( is_array( $allow_vars ) ) {
74	162	foreach ( $allow_vars as $var ) {
75	163	if ( is_string( $var ) && isset( $_GET[ $var ] ) ) {
		@@ -76,8 +164,9 @@
76	164	$allow_params[ $var ] = $_GET[ $var ]; // phpcs:ignore -- ok.
77	165	}
78	166	}
79	167	}
	168	+
80	169	static::open_site( $website, $location, $allow_params );
81	170	}
82	171	// phpcs:enable
83	172	}
		@@ -91,32 +180,53 @@
91	180	*
92	181	* @uses \MainWP\Dashboard\MainWP_Connect::get_get_data_authed()
93	182	*/
94	183	private static function open_site( $website, $location, $params = array() ) {
	184	+ if ( ! is_array( $params ) ) {
	185	+ $params = array();
	186	+ }
	187	+
	188	+ $action_url = '';
95	189	if ( MainWP_Demo_Handle::get_instance()->is_demo_website( $website ) ) {
96		- $action = $website->url . 'wp-admin.html';
	190	+ $action_url = $website->url . 'wp-admin.html';
97	191	} else {
98		- $action = MainWP_Connect::get_get_data_authed( $website, ( null === $location || '' === $location ) ? 'index.php' : $location, 'where', false, $params );
	192	+ if ( ! isset( $params['verify_signature'] ) ) {
	193	+ $params['verify_signature'] = true; // enable for open site.
	194	+ }
	195	+ $action_url = MainWP_Connect::get_get_data_authed( $website, ( null === $location || '' === $location ) ? 'index.php' : $location, 'where', false, $params, MainWP_Site_Url_Corrector::browser_target_url( $website ) );
99	196	}
	197	+
100	198	$open_download = ! empty( $params['filedl'] ) ? true : false;
101	199	$close_window = ! empty( $_GET['closeWindow'] ) ? true : false; //phpcs:ignore -- ok.
	200	+
	201	+ /**
	202	+ * Action: mainwp_site_go_to_wpadmin
	203	+ *
	204	+ * Fire before go to wp admin child site.
	205	+ *
	206	+ * @since 5.5
	207	+ */
	208	+ do_action( 'mainwp_site_go_to_wpadmin', $website, $location, $params, $action_url );
	209	+
	210	+ MainWP_Logger::instance()->debug_for_website( $website, 'open site', 'action [' . $action_url . ']' );
	211	+
102	212	?>
103		- <div class="ui segment" style="padding: 25rem">
104		- <div class="ui active inverted dimmer <?php echo $open_download || $close_window ? 'open-site-close-window' : ''; ?>">
	213	+ <div class="ui segment">
	214	+ <div class="ui active page dimmer <?php echo $open_download || $close_window ? 'open-site-close-window' : ''; ?>" style="margin: 0 !important;">
105	215	<?php
106	216	if ( $open_download ) {
107	217	?>
108		- <div class="ui massive text loader"><?php esc_html_e( 'Downloading...', 'mainwp' ); ?></div>
	218	+ <div class="ui double text loader"><?php esc_html_e( 'Downloading...', 'mainwp' ); ?></div>
109	219	<?php
110	220	} else {
111	221	?>
112		- <div class="ui massive text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
	222	+ <div class="ui double text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
113	223	<?php
114	224	}
115	225	?>
116	226	</div>
117		- <form method="POST" action="<?php echo $action; // phpcs:ignore WordPress.Security.EscapeOutput ?>" id="redirectForm">
118		- <?php wp_nonce_field( 'mainwp-admin-nonce' ); ?>
	227	+ <form method="POST" action="<?php echo $action_url; // phpcs:ignore WordPress.Security.EscapeOutput ?>" id="redirectForm">
	228	+ <?php MainWP_UI::generate_wp_nonce( 'mainwp-admin-nonce' ); ?>
119	229	</form>
120	230	</div>
121	231	<?php
122	232	}
		@@ -165,21 +275,21 @@
165	275	*/
166	276	public static function open_site_restore( $website, $file, $size ) {
167	277	?>
168	278	<div class="ui segment" style="padding: 25rem">
169		- <div class="ui active inverted dimmer">
170		- <div class="ui massive text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
	279	+ <div class="ui active dimmer">
	280	+ <div class="ui massive double text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
171	281	</div>
172	282	<?php
173	283
174		- $url = ( isset( $website->url ) && '' !== $website->url ? $website->url : $website->siteurl );
	284	+ $url = MainWP_Site_Url_Corrector::browser_target_url( $website );
175	285	$url .= ( '/' !== substr( $url, - 1 ) ? '/' : '' );
176	286
177		- $postdata = MainWP_Connect::get_get_data_authed( $website, $file, 'f', true );
	287	+ $postdata = MainWP_Connect::get_get_data_authed( $website, $file, 'f', true, array( 'verify_signature' => true ) );
178	288	$postdata['size'] = $size;
179	289	?>
180	290	<form method="POST" action="<?php echo esc_url( $url ); ?>" id="redirectForm">
181		- <?php wp_nonce_field( 'mainwp-admin-nonce' ); ?>
	291	+ <?php MainWP_UI::generate_wp_nonce( 'mainwp-admin-nonce' ); ?>
182	292	<?php
183	293	foreach ( $postdata as $name => $value ) {
184	294	echo '<input type="hidden" name="' . esc_attr( $name ) . '" value="' . esc_attr( $value ) . '" />';
185	295	}
		@@ -203,8 +313,10 @@
203	313
204	314	/**
205	315	* This opens the site location.
206	316	*
	317	+ * @outdated
	318	+ *
207	319	* @param mixed $website Website ID.
208	320	* @param mixed $open_location Website URL.
209	321	*
210	322	* @uses \MainWP\Dashboard\MainWP_Connect::get_get_data_authed()
		@@ -211,21 +323,21 @@
211	323	*/
212	324	public static function open_site_location( $website, $open_location ) {
213	325	?>
214	326	<div class="ui segment" style="padding: 25rem">
215		- <div class="ui active inverted dimmer">
216		- <div class="ui massive text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
	327	+ <div class="ui active dimmer">
	328	+ <div class="ui massive double text loader"><?php esc_html_e( 'Redirecting...', 'mainwp' ); ?></div>
217	329	</div>
218	330	<?php
219	331
220		- $url = ( isset( $website->url ) && '' !== $website->url ? $website->url : $website->siteurl );
	332	+ $url = MainWP_Site_Url_Corrector::browser_target_url( $website );
221	333	$url .= ( '/' !== substr( $url, - 1 ) ? '/' : '' );
222	334
223		- $postdata = MainWP_Connect::get_get_data_authed( $website, 'index.php', 'where', true );
224		- $postdata['open_location'] = base64_encode( $open_location ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
	335	+ $postdata = MainWP_Connect::get_get_data_authed( $website, 'index.php', 'where', true, array( 'verify_signature' => true ) );
	336	+ $postdata['open_location'] = $open_location; // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- base64_encode used for http encoding compatible.
225	337	?>
226	338	<form method="POST" action="<?php echo esc_url( $url ); ?>" id="redirectForm">
227		- <?php wp_nonce_field( 'mainwp-admin-nonce' ); ?>
	339	+ <?php MainWP_UI::generate_wp_nonce( 'mainwp-admin-nonce' ); ?>
228	340	<?php
229	341	foreach ( $postdata as $name => $value ) {
230	342	echo '<input type="hidden" name="' . esc_attr( $name ) . '" value="' . esc_attr( $value ) . '" />';
231	343	}
		@@ -263,9 +375,9 @@
263	375
264	376	if ( MainWP_Demo_Handle::get_instance()->is_demo_website( $site_id ) ) {
265	377	$open_url = MainWP_Demo_Handle::get_instance()->get_open_site_demo_url( $site_id );
266	378	} else {
267		- $open_url = 'admin.php?page=SiteOpen&newWindow=yes&websiteid=' . $site_id . '&_opennonce=' . esc_html( wp_create_nonce( 'mainwp-admin-nonce' ) );
	379	+ $open_url = self::get_open_site_admin_link( $site_id );
268	380	if ( ! empty( $location ) ) {
269	381	$open_url .= '&location=' . $location;
270	382	}
271	383	}