← All changes | includes/class-metasync-admin-pages.php +21 -8 2.7.1 → 2.7.2 View file →

		@@ -269,8 +269,18 @@
269	269	$this->admin->render_layout_open('Settings', $settings_current_page, 'Manage all plugin settings and configuration.');
270	270	?>
271	271	<?php
272	272	/*
	273	+ * options.php redirects back here after the native (no-JavaScript)
	274	+ * settings submit. Scoped to metasync_messages so field-level
	275	+ * rejections (e.g. invalid white-label branding) print without the
	276	+ * generic "Settings saved." notice that would otherwise accompany
	277	+ * a rejected save.
	278	+ */
	279	+ settings_errors('metasync_messages');
	280	+ ?>
	281	+ <?php
	282	+ /*
273	283	# Temporarily commented out: Clear Cache notice and button (can be re-enabled later)
274	284
275	285	* <div class="notice notice-success">
276	286	* <p>
		@@ -783,21 +793,21 @@
783	793	}
784	794	});
785	795
786	796	function hasPassword() {
787		- var passwordField = $('input[name="<?php echo Metasync_Admin::option_key; ?>[whitelabel][settings_password]"]');
	797	+ var passwordField = $('input[name="<?php echo esc_attr(Metasync_Admin::option_key); ?>[whitelabel][settings_password]"]');
788	798	var passwordValue = passwordField.val();
789	799	return passwordValue && passwordValue.length > 0;
790	800	}
791	801
792	802	function hasRecoveryEmail() {
793		- var recoveryEmailField = $('input[name="<?php echo Metasync_Admin::option_key; ?>[whitelabel][recovery_email]"]');
	803	+ var recoveryEmailField = $('input[name="<?php echo esc_attr(Metasync_Admin::option_key); ?>[whitelabel][recovery_email]"]');
794	804	var emailValue = recoveryEmailField.val();
795	805	return emailValue && emailValue.length > 0 && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(emailValue);
796	806	}
797	807
798		- var passwordField = $('input[name="<?php echo Metasync_Admin::option_key; ?>[whitelabel][settings_password]"]');
799		- var recoveryEmailField = $('input[name="<?php echo Metasync_Admin::option_key; ?>[whitelabel][recovery_email]"]');
	808	+ var passwordField = $('input[name="<?php echo esc_attr(Metasync_Admin::option_key); ?>[whitelabel][settings_password]"]');
	809	+ var recoveryEmailField = $('input[name="<?php echo esc_attr(Metasync_Admin::option_key); ?>[whitelabel][recovery_email]"]');
800	810
801	811	passwordField.on('blur', function() {
802	812	if (hasPassword() && !hasRecoveryEmail()) {
803	813	showModal(
		@@ -835,9 +845,9 @@
835	845	'You must set a <strong>Settings Password</strong> before enabling "Hide Settings".<br><br>Please scroll up to the <strong>Branding</strong> section and set a password first.'
836	846	);
837	847
838	848	setTimeout(function() {
839		- $('input[name="<?php echo Metasync_Admin::option_key; ?>[whitelabel][settings_password]"]').focus();
	849	+ $('input[name="<?php echo esc_attr(Metasync_Admin::option_key); ?>[whitelabel][settings_password]"]').focus();
840	850	}, 300);
841	851
842	852	return false;
843	853	}
		@@ -973,9 +983,9 @@
973	983	'method': 'post',
974	984	'action': ''
975	985	});
976	986
977		- logoutForm.append('<?php echo wp_nonce_field("whitelabel_logout_nonce", "whitelabel_logout_nonce", true, false); ?>');
	987	+ logoutForm.append('<?php echo wp_nonce_field("whitelabel_logout_nonce", "whitelabel_logout_nonce", true, false); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- nonce markup from wp_nonce_field() is safe by construction; kses-based escaping strips the <input> and breaks the logout nonce ?>');
978	988
979	989	logoutForm.append($('<input>', {
980	990	'type': 'hidden',
981	991	'name': 'whitelabel_logout',
		@@ -1047,9 +1057,9 @@
1047	1057	$.ajax({
1048	1058	url: ajaxUrl,
1049	1059	type: 'POST',
1050	1060	dataType: 'json',
1051		- data: { action: action, nonce: '<?php echo wp_create_nonce('metasync_nonce'); ?>' },
	1061	+ data: { action: action, nonce: '<?php echo esc_attr(wp_create_nonce('metasync_nonce')); ?>' },
1052	1062	timeout: 35000,
1053	1063	success: function(response, textStatus, xhr) {
1054	1064	try {
1055	1065	if (response && response.success && response.data) {
		@@ -1365,9 +1375,9 @@
1365	1375	<p style="color: var(--dashboard-text-secondary); margin-bottom: 20px;">Access your <?php echo esc_html(Metasync::get_effective_plugin_name()); ?> dashboard to view analytics, manage SEO settings, and monitor your site performance.</p>
1366	1376	<?php
1367	1377	if (!isset(Metasync::get_option('general')['linkgraph_token']) || Metasync::get_option('general')['linkgraph_token'] == '') {
1368	1378	echo '<p style="color: #d54e21; margin-bottom: 15px;">Authentication required: Please authenticate with your ' . esc_html(Metasync::get_effective_plugin_name()) . ' account and save your auth token in general settings.</p>';
1369		- echo '<a href="' . admin_url('admin.php?page=' . Metasync_Admin::$page_slug) . '" class="button button-secondary">Go to Settings</a>';
	1379	+ echo '<a href="' . esc_url(admin_url('admin.php?page=' . Metasync_Admin::$page_slug)) . '" class="button button-secondary">Go to Settings</a>';
1370	1380	} else {
1371	1381	echo '<a href="' . esc_url($this->admin->get_dashboard_url()) . '" target="_blank" class="button button-primary">Open Dashboard</a>';
1372	1382	}
1373	1383	?>
		@@ -1406,8 +1416,11 @@
1406	1416
1407	1417	if (is_wp_error($result)) {
1408	1418	echo '<div class="notice notice-error"><p>' . esc_html($result->get_error_message()) . '</p></div>';
1409	1419	} else {
	1420	+ Metasync_PostHog::feature('robots_txt_saved', array(
	1421	+ 'warning_count' => count($validation['warnings']),
	1422	+ ));
1410	1423	echo '<div class="notice notice-success"><p>' . esc_html__('robots.txt file saved successfully!', 'metasync') . '</p></div>';
1411	1424
1412	1425	if (!empty($validation['warnings'])) {
1413	1426	foreach ($validation['warnings'] as $warning) {