| @@ -47,11 +47,9 @@ | ||
| 47 | 47 | * Init backups actions |
| 48 | 48 | */ |
| 49 | 49 | public function init() { |
| 50 | 50 | // Page: ManageBackups. |
| 51 | - if ( \mainwp_current_user_can( 'dashboard', 'add_backup_tasks' ) ) { | |
| 52 | - $this->add_action( 'mainwp_addbackup', array( &$this, 'mainwp_addbackup' ) ); | |
| 53 | - } | |
| 51 | + $this->add_action( 'mainwp_addbackup', array( &$this, 'mainwp_addbackup' ) ); | |
| 54 | 52 | if ( \mainwp_current_user_can( 'dashboard', 'edit_backup_tasks' ) ) { |
| 55 | 53 | $this->add_action( 'mainwp_updatebackup', array( &$this, 'mainwp_updatebackup' ) ); |
| 56 | 54 | } |
| 57 | 55 | if ( \mainwp_current_user_can( 'dashboard', 'delete_backup_tasks' ) ) { |
| @@ -56,14 +54,14 @@ | ||
| 56 | 54 | } |
| 57 | 55 | if ( \mainwp_current_user_can( 'dashboard', 'delete_backup_tasks' ) ) { |
| 58 | 56 | $this->add_action( 'mainwp_removebackup', array( &$this, 'mainwp_removebackup' ) ); |
| 59 | 57 | } |
| 60 | - if ( \mainwp_current_user_can( 'dashboard', 'pause_resume_backup_tasks' ) ) { | |
| 61 | - $this->add_action( 'mainwp_pausebackup', array( &$this, 'mainwp_pausebackup' ) ); | |
| 62 | - $this->add_action( 'mainwp_resumebackup', array( &$this, 'mainwp_resumebackup' ) ); | |
| 63 | - } | |
| 58 | + $this->add_action( 'mainwp_pausebackup', array( &$this, 'mainwp_pausebackup' ) ); | |
| 59 | + $this->add_action( 'mainwp_resumebackup', array( &$this, 'mainwp_resumebackup' ) ); | |
| 60 | + | |
| 61 | + $this->add_action( 'mainwp_backuptask_get_sites', array( &$this, 'mainwp_backuptask_get_sites' ) ); | |
| 62 | + | |
| 64 | 63 | if ( \mainwp_current_user_can( 'dashboard', 'run_backup_tasks' ) ) { |
| 65 | - $this->add_action( 'mainwp_backuptask_get_sites', array( &$this, 'mainwp_backuptask_get_sites' ) ); | |
| 66 | 64 | $this->add_action( 'mainwp_backuptask_run_site', array( &$this, 'mainwp_backuptask_run_site' ) ); |
| 67 | 65 | } |
| 68 | 66 | $this->add_action( 'mainwp_backup_upload_file', array( &$this, 'mainwp_backup_upload_file' ) ); |
| 69 | 67 | |
| @@ -72,23 +70,17 @@ | ||
| 72 | 70 | $this->add_action( 'mainwp_backup_run_site', array( &$this, 'mainwp_backup_run_site' ) ); |
| 73 | 71 | } |
| 74 | 72 | if ( \mainwp_current_user_can( 'dashboard', 'execute_backups' ) ) { |
| 75 | 73 | $this->add_action( 'mainwp_backup', array( &$this, 'ajax_mainwp_backup' ) ); |
| 76 | - $this->add_action( 'mainwp_backup_checkpid', array( &$this, 'mainwp_backup_checkpid' ) ); | |
| 77 | 74 | } |
| 78 | - // Task runs share the download, cleanup and progress actions. | |
| 79 | - if ( \mainwp_current_user_can( 'dashboard', 'execute_backups' ) || \mainwp_current_user_can( 'dashboard', 'run_backup_tasks' ) ) { | |
| 80 | - $this->add_action( 'mainwp_createbackup_getfilesize', array( &$this, 'mainwp_createbackup_getfilesize' ) ); | |
| 81 | - $this->add_action( 'mainwp_backup_download_file', array( &$this, 'ajax_mainwp_backup_download_file' ) ); | |
| 82 | - $this->add_action( 'mainwp_backup_delete_file', array( &$this, 'mainwp_backup_delete_file' ) ); | |
| 83 | - $this->add_action( 'mainwp_backup_getfilesize', array( &$this, 'mainwp_backup_getfilesize' ) ); | |
| 84 | - $this->add_action( 'mainwp_backup_upload_getprogress', array( &$this, 'mainwp_backup_upload_getprogress' ) ); | |
| 85 | - $this->add_action( 'mainwp_backup_upload_checkstatus', array( &$this, 'mainwp_backup_upload_checkstatus' ) ); | |
| 86 | - } | |
| 87 | - // Intentionally not capability-gated: the backup-before-update check is | |
| 88 | - // read-only and used by the updates flow, where a user without backup | |
| 89 | - // rights still needs it. | |
| 90 | 75 | $this->add_action( 'mainwp_checkbackups', array( &$this, 'mainwp_checkbackups' ) ); |
| 76 | + $this->add_action( 'mainwp_backup_checkpid', array( &$this, 'mainwp_backup_checkpid' ) ); | |
| 77 | + $this->add_action( 'mainwp_createbackup_getfilesize', array( &$this, 'mainwp_createbackup_getfilesize' ) ); | |
| 78 | + $this->add_action( 'mainwp_backup_download_file', array( &$this, 'ajax_mainwp_backup_download_file' ) ); | |
| 79 | + $this->add_action( 'mainwp_backup_delete_file', array( &$this, 'mainwp_backup_delete_file' ) ); | |
| 80 | + $this->add_action( 'mainwp_backup_getfilesize', array( &$this, 'mainwp_backup_getfilesize' ) ); | |
| 81 | + $this->add_action( 'mainwp_backup_upload_getprogress', array( &$this, 'mainwp_backup_upload_getprogress' ) ); | |
| 82 | + $this->add_action( 'mainwp_backup_upload_checkstatus', array( &$this, 'mainwp_backup_upload_checkstatus' ) ); | |
| 91 | 83 | } |
| 92 | 84 | |
| 93 | 85 | /* |
| 94 | 86 | * Page: Backup |
| @@ -271,28 +263,18 @@ | ||
| 271 | 263 | * @uses \MainWP\Dashboard\MainWP_Backup_Handler::backup_delete_file() |
| 272 | 264 | * @uses \MainWP\Dashboard\MainWP_Exception |
| 273 | 265 | */ |
| 274 | 266 | public function mainwp_backup_delete_file() { |
| 267 | + $this->secure_request( 'mainwp_backup_delete_file' ); | |
| 275 | 268 | // phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized |
| 269 | + $site_id = isset( $_POST['site_id'] ) ? intval( $_POST['site_id'] ) : false; | |
| 276 | 270 | try { |
| 277 | - if ( ! \mainwp_current_user_can( 'dashboard', 'execute_backups' ) && ! \mainwp_current_user_can( 'dashboard', 'run_backup_tasks' ) ) { | |
| 278 | - throw new MainWP_Exception( esc_html__( 'Error - insufficient permissions!', 'mainwp' ) ); | |
| 279 | - } | |
| 280 | - $site_id = isset( $_POST['site_id'] ) ? intval( $_POST['site_id'] ) : 0; | |
| 281 | 271 | if ( ! $site_id ) { |
| 282 | 272 | throw new MainWP_Exception( esc_html__( 'Site ID not found. Please reload the page and try again.', 'mainwp' ) ); |
| 283 | 273 | } |
| 284 | - if ( ! \mainwp_current_user_can( 'site', $site_id ) ) { | |
| 285 | - throw new MainWP_Exception( esc_html__( 'Error - insufficient permissions!', 'mainwp' ) ); | |
| 286 | - } | |
| 287 | 274 | |
| 288 | - // Sanitizing first can hide a NUL or change a custom archive's basename. | |
| 289 | - $file = isset( $_POST['file'] ) && is_string( $_POST['file'] ) ? wp_unslash( $_POST['file'] ) : ''; | |
| 290 | - if ( ! MainWP_Backup_Handler::is_valid_backup_archive_name( $file ) ) { | |
| 291 | - throw new MainWP_Exception( esc_html__( 'Invalid backup archive name.', 'mainwp' ) ); | |
| 292 | - } | |
| 293 | - // Refusals must not record secure_request's duplicate-request marker. | |
| 294 | - $this->secure_request( 'mainwp_backup_delete_file' ); | |
| 275 | + $site_id = isset( $_POST['site_id'] ) ? intval( $_POST['site_id'] ) : 0; | |
| 276 | + $file = isset( $_POST['file'] ) ? sanitize_text_field( wp_unslash( $_POST['file'] ) ) : ''; | |
| 295 | 277 | |
| 296 | 278 | die( wp_json_encode( array( 'result' => MainWP_Backup_Handler::backup_delete_file( $site_id, $file ) ) ) ); |
| 297 | 279 | } catch ( MainWP_Exception $e ) { |
| 298 | 280 | die( |
