← All changes | admin/class-metasync-post-meta-setting.php +86 -14 2.6.24 → 2.7.1 View file →

		@@ -17,8 +17,19 @@
17	17	}
18	18
19	19	class Metasync_Post_Meta_Settings
20	20	{
	21	+ /**
	22	+ * Description written onto every redirection row this meta box owns.
	23	+ *
	24	+ * Rows created here live in the shared redirections table alongside rules
	25	+ * added by hand on the Redirections screen, and carry no other marker. The
	26	+ * prefix is therefore how the redirect engine tells the two apart, so that
	27	+ * switching the Redirection feature off stops these rows without touching
	28	+ * anyone's manually-added rules.
	29	+ */
	30	+ const POST_REDIRECT_DESCRIPTION_PREFIX = 'Post redirection meta box for post #';
	31	+
21	32	private $common;
22	33
23	34	public function __construct()
24	35	{
		@@ -46,9 +57,9 @@
46	57	$post_types = array_diff($post_types, ['attachment']);
47	58
48	59	// Resolve the current post ID in admin_init context: $_GET['post'] on the
49	60	// edit screen, $_POST['post_ID'] on save. Mirrors the sidebar enqueue.
50		- $post_id = isset($_GET['post']) ? intval($_GET['post']) : (isset($_POST['post_ID']) ? intval($_POST['post_ID']) : 0);
	61	+ $post_id = isset($_GET['post']) ? intval($_GET['post']) : (isset($_POST['post_ID']) ? intval($_POST['post_ID']) : 0); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- read-only post ID to pick meta boxes
51	62
52	63	// LPS / custom-HTML pages carry their own baked SEO served before wp_head,
53	64	// so the editable SEO fields here do nothing and mislead editors.
54	65	// otto_pixel.php (where metasync_is_custom_or_lps_page lives) is only
		@@ -286,9 +297,9 @@
286	297	if (defined('REST_REQUEST') && REST_REQUEST && !empty(get_post_meta($post_id, '_metasync_robots_advanced', true))) {
287	298	return;
288	299	}
289	300
290		- $post_data = metasync_sanitize_input_array($_POST);
	301	+ $post_data = metasync_sanitize_input_array($_POST); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- wp_verify_nonce() runs before any meta write
291	302	// Check for new field name first, then old for backward compatibility
292	303	$field_name = isset($post_data['common_robots_meta']) ? 'common_robots_meta' : 'common_robots_mata';
293	304
294	305	// Unchecked checkboxes are omitted from the request. Require the nonce,
		@@ -320,9 +331,9 @@
320	331	if (defined('REST_REQUEST') && REST_REQUEST && !empty(get_post_meta($post_id, '_metasync_robots_advanced', true))) {
321	332	return;
322	333	}
323	334
324		- $post_data = metasync_sanitize_input_array($_POST);
	335	+ $post_data = metasync_sanitize_input_array($_POST); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- wp_verify_nonce() runs before any meta write
325	336	// Check for new field name first, then old for backward compatibility
326	337	$field_name = isset($post_data['advanced_robots_meta']) ? 'advanced_robots_meta' : 'advanced_robots_mata';
327	338
328	339	if (!isset($post_data['metasync_advance_robots_nonce'], $post_data[$field_name]) || !wp_verify_nonce($post_data['metasync_advance_robots_nonce'], 'metasync_advance_robots_nonce'))
		@@ -342,9 +353,9 @@
342	353	{
343	354	if (!current_user_can('edit_post', $post_id))
344	355	return;
345	356
346		- $post_data = metasync_sanitize_input_array($_POST);
	357	+ $post_data = metasync_sanitize_input_array($_POST); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- wp_verify_nonce() runs before any meta write
347	358	// Check for new field name first, then old for backward compatibility
348	359	$field_name = isset($post_data['post_redirect_meta']) ? 'post_redirect_meta' : 'post_redirect_mata';
349	360
350	361	if (!isset($post_data['metasync_post_redirection_nonce'], $post_data[$field_name]) || !wp_verify_nonce($post_data['metasync_post_redirection_nonce'], 'metasync_post_redirection_nonce'))
		@@ -380,8 +391,29 @@
380	391	*
381	392	* @param int $post_id The post being saved.
382	393	* @param array $meta Sanitized meta box values (enable/type/url).
383	394	*/
	395	+ /**
	396	+ * Whether a redirection row was created by the per-post Redirection meta box.
	397	+ *
	398	+ * @param object $row Row from the redirections table.
	399	+ * @return bool True for rows this meta box owns.
	400	+ */
	401	+ public static function owns_redirect_row($row)
	402	+ {
	403	+ // A row missing the column, or carrying a non-string, is not ours.
	404	+ // isset() on a non-object is simply false, so no type check is needed.
	405	+ if (!isset($row->description) || !is_string($row->description)) {
	406	+ return false;
	407	+ }
	408	+
	409	+ return strncmp(
	410	+ $row->description,
	411	+ self::POST_REDIRECT_DESCRIPTION_PREFIX,
	412	+ strlen(self::POST_REDIRECT_DESCRIPTION_PREFIX)
	413	+ ) === 0;
	414	+ }
	415	+
384	416	public static function sync_post_redirect_rule($post_id, $meta)
385	417	{
386	418	// Never act on autosaves or revisions — their permalink isn't the public URL.
387	419	if (wp_is_post_revision($post_id) || wp_is_post_autosave($post_id) || !class_exists('Metasync_Redirection_Database')) {
		@@ -387,8 +419,15 @@
387	419	if (wp_is_post_revision($post_id) || wp_is_post_autosave($post_id) || !class_exists('Metasync_Redirection_Database')) {
388	420	return;
389	421	}
390	422
	423	+ // Redirection feature switched off. Return before touching the table so a
	424	+ // disabled feature neither creates new rows nor deletes the row a post
	425	+ // already owns — re-enabling must restore the redirect exactly as it was.
	426	+ if (Metasync_Feature_Flags::is_disabled(Metasync_Feature_Flags::REDIRECTION)) {
	427	+ return;
	428	+ }
	429	+
391	430	$db = new Metasync_Redirection_Database();
392	431	$existing_row_id = (int) get_post_meta($post_id, '_metasync_post_redirect_row_id', true);
393	432
394	433	// The metabox posts the literal string 'true', but REST/platform
		@@ -423,8 +462,21 @@
423	462	// keep the previously stored rule and skip the write. The guard above
424	463	// already returned when a non-410/451 type had an empty destination,
425	464	// so $dest is known non-empty here.
426	465	if (!$is_gone) {
	466	+ // Destination guard — same checks as the admin form and MCP tools.
	467	+ // Backslashes and protocol-relative hosts bypass host validation in
	468	+ // browsers while looking internal to wp_validate_redirect. On a
	469	+ // bad destination we keep the previously stored rule and skip the
	470	+ // write, same skip-write semantics as the loop guard below.
	471	+ if (!class_exists('Metasync_Redirection_Validator')) {
	472	+ require_once dirname(__FILE__, 2) . '/redirections/class-metasync-redirection-validator.php';
	473	+ }
	474	+ if (!Metasync_Redirection_Validator::is_safe_destination_syntax($dest)
	475	+ || (!get_option('metasync_allow_external_redirects', 0) && wp_validate_redirect($dest, '') !== $dest)) {
	476	+ return;
	477	+ }
	478	+
427	479	if (!class_exists('Metasync_Redirection')) {
428	480	require_once dirname(__FILE__, 2) . '/redirections/class-metasync-redirection.php';
429	481	}
430	482	$db_ref = $db;
		@@ -440,9 +492,9 @@
440	492	'http_code' => $type,
441	493	'status' => 'active',
442	494	'pattern_type' => 'exact',
443	495	'regex_pattern' => null,
444		- 'description' => sprintf('Post redirection meta box for post #%d', $post_id),
	496	+ 'description' => self::POST_REDIRECT_DESCRIPTION_PREFIX . $post_id,
445	497	];
446	498
447	499	// Update the row we own if it still exists; otherwise create it and remember its id.
448	500	if ($existing_row_id > 0 && $db->find($existing_row_id)) {
		@@ -459,9 +511,9 @@
459	511	{
460	512	if (!current_user_can('edit_post', $post_id))
461	513	return;
462	514
463		- $post_data = metasync_sanitize_input_array($_POST);
	515	+ $post_data = metasync_sanitize_input_array($_POST); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- wp_verify_nonce() runs before any meta write
464	516	// Check for new field name first, then old for backward compatibility
465	517	$field_name = isset($post_data['post_canonical_url_meta']) ? 'post_canonical_url_meta' : 'post_canonical_url_mata';
466	518
467	519	if (!isset($post_data['metasync_post_canonical_nonce'], $post_data[$field_name]) || !wp_verify_nonce($post_data['metasync_post_canonical_nonce'], 'metasync_post_canonical_nonce'))
		@@ -605,24 +657,42 @@
605	657	{
606	658	global $post;
607	659	$seo_title = get_post_meta($post->ID, '_metasync_seo_title', true);
608	660	$seo_desc = get_post_meta($post->ID, '_metasync_seo_desc', true);
609		- $otto_title = get_post_meta($post->ID, '_metasync_otto_title', true);
610		- $otto_desc = get_post_meta($post->ID, '_metasync_otto_description', true);
611	661
	662	+ // Values brought in by the external SEO importer apply only where OTTO
	663	+ // has no suggestion, so show them as the placeholder in exactly that
	664	+ // case. Without this the field looks empty after an import and the user
	665	+ // concludes nothing was imported. Which tier fills the placeholder is
	666	+ // Metasync_Seo_Precedence's call, not this screen's.
	667	+ $title_fallback = Metasync_Seo_Precedence::fallback($post->ID, Metasync_Seo_Precedence::FIELD_TITLE);
	668	+ $desc_fallback = Metasync_Seo_Precedence::fallback($post->ID, Metasync_Seo_Precedence::FIELD_DESCRIPTION);
	669	+
	670	+ $title_placeholder = $title_fallback['value'];
	671	+ $desc_placeholder = $desc_fallback['value'];
	672	+
	673	+ $title_is_imported = $title_fallback['source'] === Metasync_Seo_Precedence::SOURCE_IMPORTED;
	674	+
612	675	wp_nonce_field('metasync_seo_meta_nonce', 'metasync_seo_meta_nonce');
613	676	?>
614	677	<p style="color: #666; margin-bottom: 12px;">
	678	+ <?php /* translators: %s: OTTO name (whitelabel). */ ?>
615	679	<?php printf(esc_html__('Set the SEO Title and Meta Description for this post. Leave the field blank to use %s suggestion.', 'metasync'), esc_html(Metasync::get_whitelabel_otto_name())); ?>
616	680	</p>
	681	+ <?php if ($title_is_imported) : ?>
	682	+ <p style="color: #666; margin-bottom: 12px;">
	683	+ <?php /* translators: %s: OTTO name (whitelabel). */ ?>
	684	+ <?php printf(esc_html__('The greyed-out value below was imported from another SEO plugin. It is used only until %s has a suggestion for this page.', 'metasync'), esc_html(Metasync::get_whitelabel_otto_name())); ?>
	685	+ </p>
	686	+ <?php endif; ?>
617	687	<table class="form-table" style="margin: 0;">
618	688	<tr>
619	689	<th scope="row"><label for="metasync_seo_title"><?php esc_html_e('SEO Title', 'metasync'); ?></label></th>
620		- <td><input type="text" id="metasync_seo_title" name="metasync_seo_title" value="<?php echo esc_attr($seo_title); ?>" class="large-text" placeholder="<?php echo esc_attr($otto_title); ?>" /></td>
	690	+ <td><input type="text" id="metasync_seo_title" name="metasync_seo_title" value="<?php echo esc_attr($seo_title); ?>" class="large-text" placeholder="<?php echo esc_attr($title_placeholder); ?>" /></td>
621	691	</tr>
622	692	<tr>
623	693	<th scope="row"><label for="metasync_seo_desc"><?php esc_html_e('Meta Description', 'metasync'); ?></label></th>
624		- <td><textarea id="metasync_seo_desc" name="metasync_seo_desc" class="large-text" rows="3" placeholder="<?php echo esc_attr($otto_desc); ?>"><?php echo esc_textarea($seo_desc); ?></textarea></td>
	694	+ <td><textarea id="metasync_seo_desc" name="metasync_seo_desc" class="large-text" rows="3" placeholder="<?php echo esc_attr($desc_placeholder); ?>"><?php echo esc_textarea($seo_desc); ?></textarea></td>
625	695	</tr>
626	696	</table>
627	697	<?php
628	698	}
		@@ -651,11 +721,13 @@
651	721	return;
652	722	}
653	723
654	724	if (isset($_POST['metasync_seo_title'])) {
655		- $seo_title = sanitize_text_field($_POST['metasync_seo_title']);
	725	+ $seo_title = sanitize_text_field(wp_unslash($_POST['metasync_seo_title']));
656	726	if (!empty($seo_title)) {
657		- update_post_meta($post_id, '_metasync_seo_title', $seo_title);
	727	+ // update_post_meta() unslashes again, so re-slash to keep
	728	+ // literal backslashes and quotes in the stored value.
	729	+ update_post_meta($post_id, '_metasync_seo_title', wp_slash($seo_title));
658	730	} else {
659	731	delete_post_meta($post_id, '_metasync_seo_title');
660	732	}
661	733	}
		@@ -660,11 +732,11 @@
660	732	}
661	733	}
662	734
663	735	if (isset($_POST['metasync_seo_desc'])) {
664		- $seo_desc = sanitize_textarea_field($_POST['metasync_seo_desc']);
	736	+ $seo_desc = sanitize_textarea_field(wp_unslash($_POST['metasync_seo_desc']));
665	737	if (!empty($seo_desc)) {
666		- update_post_meta($post_id, '_metasync_seo_desc', $seo_desc);
	738	+ update_post_meta($post_id, '_metasync_seo_desc', wp_slash($seo_desc));
667	739	} else {
668	740	delete_post_meta($post_id, '_metasync_seo_desc');
669	741	}
670	742	}