| @@ -142,9 +142,9 @@ | ||
| 142 | 142 | return; |
| 143 | 143 | } |
| 144 | 144 | |
| 145 | 145 | // Don't show on dev panel page itself |
| 146 | - $current_page = isset( $_GET['page'] ) ? sanitize_text_field( $_GET['page'] ) : ''; | |
| 146 | + $current_page = isset( $_GET['page'] ) ? sanitize_text_field(wp_unslash($_GET['page'])) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only page check | |
| 147 | 147 | if ( $current_page === Metasync_Admin::$page_slug . '-dev-tools' ) { |
| 148 | 148 | return; |
| 149 | 149 | } |
| 150 | 150 | |
| @@ -169,9 +169,9 @@ | ||
| 169 | 169 | * @param string $hook The current admin page. |
| 170 | 170 | */ |
| 171 | 171 | public function enqueue_scripts( $hook ) { |
| 172 | 172 | // Only load on dev panel page |
| 173 | - if ( isset( $_GET['page'] ) && $_GET['page'] === Metasync_Admin::$page_slug . '-dev-tools' ) { | |
| 173 | + if ( isset( $_GET['page'] ) && $_GET['page'] === Metasync_Admin::$page_slug . '-dev-tools' ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only page check | |
| 174 | 174 | wp_enqueue_style( 'metasync-admin' ); |
| 175 | 175 | } |
| 176 | 176 | } |
| 177 | 177 | |
| @@ -398,9 +398,9 @@ | ||
| 398 | 398 | |
| 399 | 399 | // Handle mode switch |
| 400 | 400 | if ( isset( $_POST['switch_endpoints_submit'] ) ) { |
| 401 | 401 | if ( wp_verify_nonce( $_POST['switch_endpoints_nonce'], 'metasync_switch_endpoints' ) ) { |
| 402 | - $new_mode = sanitize_text_field( $_POST['endpoint_mode'] ); | |
| 402 | + $new_mode = sanitize_text_field(wp_unslash($_POST['endpoint_mode'])); | |
| 403 | 403 | $result = Metasync_Endpoint_Manager::set_mode( $new_mode ); |
| 404 | 404 | |
| 405 | 405 | if ( $result ) { |
| 406 | 406 | $message = 'Successfully switched to ' . esc_html( $new_mode ) . ' mode!'; |
| @@ -586,9 +586,9 @@ | ||
| 586 | 586 | return; |
| 587 | 587 | } |
| 588 | 588 | |
| 589 | 589 | // Get and validate mode |
| 590 | - $mode = isset( $_POST['endpoint_mode'] ) ? sanitize_text_field( $_POST['endpoint_mode'] ) : ''; | |
| 590 | + $mode = isset( $_POST['endpoint_mode'] ) ? sanitize_text_field(wp_unslash($_POST['endpoint_mode'])) : ''; | |
| 591 | 591 | if ( ! in_array( $mode, array( 'production', 'staging' ), true ) ) { |
| 592 | 592 | wp_send_json_error( array( 'message' => 'Invalid mode' ) ); |
| 593 | 593 | return; |
| 594 | 594 | } |
