← All changes | class/class-mainwp-system-handler.php +24 -10 6.2 → 6.3 View file →

		@@ -270,8 +270,9 @@
270	270	*
271	271	* Handle manage sites screen settings
272	272	*/
273	273	public function handle_manage_sites_screen_settings() { // phpcs:ignore -- NOSONAR - required to achieve desired results, pull request solutions appreciated.
	274	+ $can_manage_settings = \mainwp_current_user_can( 'dashboard', 'manage_dashboard_settings' );
274	275	if ( isset( $_POST['wp_nonce'] ) && wp_verify_nonce( sanitize_key( $_POST['wp_nonce'] ), 'ManageSitesScrOptions' ) ) {
275	276	$show_cols = array();
276	277	foreach ( array_map( 'sanitize_text_field', wp_unslash( $_POST ) ) as $key => $val ) {
277	278	if ( false !== strpos( $key, 'mainwp_show_column_' ) ) {
		@@ -285,10 +286,12 @@
285	286	$show_cols[ $col ] = 0; // uncheck, hide columns.
286	287	}
287	288	}
288	289	}
289		- MainWP_Utility::update_option( 'mainwp_use_favicon', 1 );
290		- MainWP_Utility::update_option( 'mainwp_optimize', ( ! isset( $_POST['mainwp_optimize'] ) ? 0 : 1 ) );
	290	+ if ( $can_manage_settings ) {
	291	+ MainWP_Utility::update_option( 'mainwp_use_favicon', 1 );
	292	+ MainWP_Utility::update_option( 'mainwp_optimize', ( ! isset( $_POST['mainwp_optimize'] ) ? 0 : 1 ) );
	293	+ }
291	294	$user = wp_get_current_user();
292	295	if ( $user ) {
293	296	$val = ( isset( $_POST['mainwp_sitesviewmode'] ) ? sanitize_text_field( wp_unslash( $_POST['mainwp_sitesviewmode'] ) ) : 'grid' );
294	297	if ( 'grid' !== $val && 'table' !== $val ) {
		@@ -295,9 +298,11 @@
295	298	$val = 'grid';
296	299	}
297	300	update_user_option( $user->ID, 'mainwp_sitesviewmode', $val, true );
298	301	update_user_option( $user->ID, 'mainwp_settings_show_manage_sites_columns', $show_cols, true );
299		- update_option( 'mainwp_default_sites_per_page', ( isset( $_POST['mainwp_default_sites_per_page'] ) ? intval( $_POST['mainwp_default_sites_per_page'] ) : 25 ) );
	302	+ if ( $can_manage_settings ) {
	303	+ update_option( 'mainwp_default_sites_per_page', ( isset( $_POST['mainwp_default_sites_per_page'] ) ? intval( $_POST['mainwp_default_sites_per_page'] ) : 25 ) );
	304	+ }
300	305	}
301	306	} elseif ( isset( $_POST['wp_nonce'] ) && wp_verify_nonce( sanitize_key( $_POST['wp_nonce'] ), 'SreenshotsSitesScrOptions' ) ) {
302	307	$user = wp_get_current_user();
303	308	if ( $user ) {
		@@ -315,8 +320,9 @@
315	320	*
316	321	* Handle monitoring sites screen settings
317	322	*/
318	323	public function handle_monitoring_sites_screen_settings() { // phpcs:ignore -- NOSONAR - complex.
	324	+ $can_manage_settings = \mainwp_current_user_can( 'dashboard', 'manage_dashboard_settings' );
319	325	if ( isset( $_POST['wp_nonce'] ) && wp_verify_nonce( sanitize_key( $_POST['wp_nonce'] ), 'MonitoringSitesScrOptions' ) ) {
320	326	$show_cols = array();
321	327	foreach ( array_map( 'sanitize_text_field', wp_unslash( $_POST ) ) as $key => $val ) {
322	328	if ( false !== strpos( $key, 'mainwp_show_column_' ) ) {
		@@ -334,15 +340,20 @@
334	340
335	341	$user = wp_get_current_user();
336	342	if ( $user ) {
337	343	update_user_option( $user->ID, 'mainwp_settings_show_monitoring_sites_columns', $show_cols, true );
338		- update_option( 'mainwp_default_monitoring_sites_per_page', ( isset( $_POST['mainwp_default_monitoring_sites_per_page'] ) ? intval( $_POST['mainwp_default_monitoring_sites_per_page'] ) : 25 ) );
	344	+ if ( $can_manage_settings ) {
	345	+ update_option( 'mainwp_default_monitoring_sites_per_page', ( isset( $_POST['mainwp_default_monitoring_sites_per_page'] ) ? intval( $_POST['mainwp_default_monitoring_sites_per_page'] ) : 25 ) );
	346	+ }
339	347	}
340	348
341		- update_option( 'mainwp_disableSitesHealthMonitoring', ( ! isset( $_POST['mainwp_disable_sitesHealthMonitoring'] ) ? 1 : 0 ) );
	349	+ // The Page Settings form includes MainWP_Monitoring_View::render_settings(), so it posts the Site Health fields.
	350	+ if ( $can_manage_settings ) {
	351	+ update_option( 'mainwp_disableSitesHealthMonitoring', ( ! isset( $_POST['mainwp_disable_sitesHealthMonitoring'] ) ? 1 : 0 ) );
342	352
343		- $val = isset( $_POST['mainwp_site_healthThreshold'] ) ? intval( $_POST['mainwp_site_healthThreshold'] ) : 80;
344		- update_option( 'mainwp_sitehealthThreshold', $val );
	353	+ $val = isset( $_POST['mainwp_site_healthThreshold'] ) ? intval( $_POST['mainwp_site_healthThreshold'] ) : 80;
	354	+ update_option( 'mainwp_sitehealthThreshold', $val );
	355	+ }
345	356	}
346	357	}
347	358
348	359	/**
		@@ -412,8 +423,11 @@
412	423	*
413	424	* Handle manage clients screen settings
414	425	*/
415	426	public function handle_updates_screen_settings() { //phpcs:ignore -- NOSONAR - complex.
	427	+ if ( ! \mainwp_current_user_can( 'dashboard', 'manage_dashboard_settings' ) ) {
	428	+ return;
	429	+ }
416	430	if ( isset( $_POST['wp_nonce'] ) && wp_verify_nonce( sanitize_key( $_POST['wp_nonce'] ), 'UpdatesScrOptions' ) ) {
417	431	$val = ( ! isset( $_POST['mainwp_pluginAutomaticDailyUpdate'] ) ? 0 : intval( $_POST['mainwp_pluginAutomaticDailyUpdate'] ) );
418	432	MainWP_Utility::update_option( 'mainwp_pluginAutomaticDailyUpdate', $val );
419	433	$val = ( ! isset( $_POST['mainwp_themeAutomaticDailyUpdate'] ) ? 0 : intval( $_POST['mainwp_themeAutomaticDailyUpdate'] ) );
		@@ -480,9 +494,9 @@
480	494
481	495	$update_selected_mainwp_themes = false;
482	496	$should_redirect = false; // Redirect status.
483	497
484		- if ( isset( $_GET['page'] ) && 'MainWPTools' === $_GET['page'] && isset( $_POST['wp_nonce'] ) && wp_verify_nonce( sanitize_key( $_POST['wp_nonce'] ), 'MainWPTools' ) ) {
	498	+ if ( \mainwp_current_user_can( 'dashboard', 'manage_dashboard_settings' ) && isset( $_GET['page'] ) && 'MainWPTools' === $_GET['page'] && isset( $_POST['wp_nonce'] ) && wp_verify_nonce( sanitize_key( $_POST['wp_nonce'] ), 'MainWPTools' ) ) {
485	499
486	500	$old_settings = MainWP_Settings::get_all_settings_values();
487	501
488	502	if ( isset( $_POST['mainwp_restore_info_messages'] ) && ! empty( $_POST['mainwp_restore_info_messages'] ) ) {
		@@ -1235,12 +1249,12 @@
1235	1249	* @param mixed $reply The reply from the upgrader.
1236	1250	* @param mixed $package The package URL.
1237	1251	* @param mixed $upgrader The upgrader instance.
1238	1252	* @param mixed $hook_extra Extra information about the upgrade, including the plugin being updated.
1239		- * @return void
	1253	+ * @return mixed The reply from the upgrader.
1240	1254	*/
1241	1255	public function hook_refresh_trusted_extension_package_url( $reply, $package, $upgrader, $hook_extra ) {
1242		- if ( isset( $hook_extra['plugin'] ) ) { // && isset( $_POST['mainwpsignature'] ) && isset( $_POST['function'] ) && 'upgradeplugintheme' === $_POST['function'] ) { // phpcs:ignore WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- NOSONAR - hook for plugin update action, it is safe to use $_POST here.
	1256	+ if ( isset( $hook_extra['plugin'] ) ) {
1243	1257	$ext_api_slug = dirname( $hook_extra['plugin'] );
1244	1258	if ( ! empty( $ext_api_slug ) ) {
1245	1259	$rslt_info = MainWP_API_Handler::get_upgrade_information( $ext_api_slug );
1246	1260	if ( ! empty( $rslt_info ) && is_object( $rslt_info ) && property_exists( $rslt_info, 'package' ) && ! empty( $rslt_info->package ) ) {