← All changes | admin/class-metasync-post-meta-setting.php +13 -9 2.7.0 → 2.7.1 View file →

		@@ -57,9 +57,9 @@
57	57	$post_types = array_diff($post_types, ['attachment']);
58	58
59	59	// Resolve the current post ID in admin_init context: $_GET['post'] on the
60	60	// edit screen, $_POST['post_ID'] on save. Mirrors the sidebar enqueue.
61		- $post_id = isset($_GET['post']) ? intval($_GET['post']) : (isset($_POST['post_ID']) ? intval($_POST['post_ID']) : 0);
	61	+ $post_id = isset($_GET['post']) ? intval($_GET['post']) : (isset($_POST['post_ID']) ? intval($_POST['post_ID']) : 0); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- read-only post ID to pick meta boxes
62	62
63	63	// LPS / custom-HTML pages carry their own baked SEO served before wp_head,
64	64	// so the editable SEO fields here do nothing and mislead editors.
65	65	// otto_pixel.php (where metasync_is_custom_or_lps_page lives) is only
		@@ -297,9 +297,9 @@
297	297	if (defined('REST_REQUEST') && REST_REQUEST && !empty(get_post_meta($post_id, '_metasync_robots_advanced', true))) {
298	298	return;
299	299	}
300	300
301		- $post_data = metasync_sanitize_input_array($_POST);
	301	+ $post_data = metasync_sanitize_input_array($_POST); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- wp_verify_nonce() runs before any meta write
302	302	// Check for new field name first, then old for backward compatibility
303	303	$field_name = isset($post_data['common_robots_meta']) ? 'common_robots_meta' : 'common_robots_mata';
304	304
305	305	// Unchecked checkboxes are omitted from the request. Require the nonce,
		@@ -331,9 +331,9 @@
331	331	if (defined('REST_REQUEST') && REST_REQUEST && !empty(get_post_meta($post_id, '_metasync_robots_advanced', true))) {
332	332	return;
333	333	}
334	334
335		- $post_data = metasync_sanitize_input_array($_POST);
	335	+ $post_data = metasync_sanitize_input_array($_POST); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- wp_verify_nonce() runs before any meta write
336	336	// Check for new field name first, then old for backward compatibility
337	337	$field_name = isset($post_data['advanced_robots_meta']) ? 'advanced_robots_meta' : 'advanced_robots_mata';
338	338
339	339	if (!isset($post_data['metasync_advance_robots_nonce'], $post_data[$field_name]) || !wp_verify_nonce($post_data['metasync_advance_robots_nonce'], 'metasync_advance_robots_nonce'))
		@@ -353,9 +353,9 @@
353	353	{
354	354	if (!current_user_can('edit_post', $post_id))
355	355	return;
356	356
357		- $post_data = metasync_sanitize_input_array($_POST);
	357	+ $post_data = metasync_sanitize_input_array($_POST); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- wp_verify_nonce() runs before any meta write
358	358	// Check for new field name first, then old for backward compatibility
359	359	$field_name = isset($post_data['post_redirect_meta']) ? 'post_redirect_meta' : 'post_redirect_mata';
360	360
361	361	if (!isset($post_data['metasync_post_redirection_nonce'], $post_data[$field_name]) || !wp_verify_nonce($post_data['metasync_post_redirection_nonce'], 'metasync_post_redirection_nonce'))
		@@ -511,9 +511,9 @@
511	511	{
512	512	if (!current_user_can('edit_post', $post_id))
513	513	return;
514	514
515		- $post_data = metasync_sanitize_input_array($_POST);
	515	+ $post_data = metasync_sanitize_input_array($_POST); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- wp_verify_nonce() runs before any meta write
516	516	// Check for new field name first, then old for backward compatibility
517	517	$field_name = isset($post_data['post_canonical_url_meta']) ? 'post_canonical_url_meta' : 'post_canonical_url_mata';
518	518
519	519	if (!isset($post_data['metasync_post_canonical_nonce'], $post_data[$field_name]) || !wp_verify_nonce($post_data['metasync_post_canonical_nonce'], 'metasync_post_canonical_nonce'))
		@@ -674,12 +674,14 @@
674	674
675	675	wp_nonce_field('metasync_seo_meta_nonce', 'metasync_seo_meta_nonce');
676	676	?>
677	677	<p style="color: #666; margin-bottom: 12px;">
	678	+ <?php /* translators: %s: OTTO name (whitelabel). */ ?>
678	679	<?php printf(esc_html__('Set the SEO Title and Meta Description for this post. Leave the field blank to use %s suggestion.', 'metasync'), esc_html(Metasync::get_whitelabel_otto_name())); ?>
679	680	</p>
680	681	<?php if ($title_is_imported) : ?>
681	682	<p style="color: #666; margin-bottom: 12px;">
	683	+ <?php /* translators: %s: OTTO name (whitelabel). */ ?>
682	684	<?php printf(esc_html__('The greyed-out value below was imported from another SEO plugin. It is used only until %s has a suggestion for this page.', 'metasync'), esc_html(Metasync::get_whitelabel_otto_name())); ?>
683	685	</p>
684	686	<?php endif; ?>
685	687	<table class="form-table" style="margin: 0;">
		@@ -719,11 +721,13 @@
719	721	return;
720	722	}
721	723
722	724	if (isset($_POST['metasync_seo_title'])) {
723		- $seo_title = sanitize_text_field($_POST['metasync_seo_title']);
	725	+ $seo_title = sanitize_text_field(wp_unslash($_POST['metasync_seo_title']));
724	726	if (!empty($seo_title)) {
725		- update_post_meta($post_id, '_metasync_seo_title', $seo_title);
	727	+ // update_post_meta() unslashes again, so re-slash to keep
	728	+ // literal backslashes and quotes in the stored value.
	729	+ update_post_meta($post_id, '_metasync_seo_title', wp_slash($seo_title));
726	730	} else {
727	731	delete_post_meta($post_id, '_metasync_seo_title');
728	732	}
729	733	}
		@@ -728,11 +732,11 @@
728	732	}
729	733	}
730	734
731	735	if (isset($_POST['metasync_seo_desc'])) {
732		- $seo_desc = sanitize_textarea_field($_POST['metasync_seo_desc']);
	736	+ $seo_desc = sanitize_textarea_field(wp_unslash($_POST['metasync_seo_desc']));
733	737	if (!empty($seo_desc)) {
734		- update_post_meta($post_id, '_metasync_seo_desc', $seo_desc);
	738	+ update_post_meta($post_id, '_metasync_seo_desc', wp_slash($seo_desc));
735	739	} else {
736	740	delete_post_meta($post_id, '_metasync_seo_desc');
737	741	}
738	742	}