← All changes | includes/Core/Helper.php +128 -30 3.2.9 → 3.3.3 View file →

		@@ -31,8 +31,9 @@
31	31	}
32	32	}
33	33	}
34	34
	35	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Reviewed for the NotificationX codebase: acceptable in this context.
35	36	return apply_filters('nx_post_types', $post_types);
36	37	}
37	38
38	39	/**
		@@ -66,8 +67,9 @@
66	67	}
67	68	$data[$tax_slug] = $tax;
68	69	}
69	70	}
	71	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Reviewed for the NotificationX codebase: acceptable in this context.
70	72	return apply_filters('nx_loop_taxonomies', $data, $taxonomies, $post_type);
71	73	}
72	74
73	75	/**
		@@ -295,13 +297,19 @@
295	297	}
296	298	return ($is_neg ? '-' : '') . $number . $suffix;
297	299	}
298	300
	301	+ /**
	302	+ * Developer log helper. Writes only when WP_DEBUG is on, and is used by the
	303	+ * Pro plugin's Google/YouTube integrations to report API failures.
	304	+ */
299	305	public static function write_log($log) {
300	306	if (true === WP_DEBUG) {
301	307	if (is_array($log) || is_object($log)) {
	308	+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_print_r, WordPress.PHP.DevelopmentFunctions.error_log_error_log
302	309	error_log(print_r($log, true));
303	310	} else {
	311	+ // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
304	312	error_log($log);
305	313	}
306	314	}
307	315	}
		@@ -339,15 +347,15 @@
339	347	return array();
340	348	}
341	349	$new_data = array();
342	350	$timestamp = current_time('timestamp');
343		- $date = date('Y-m-d', $timestamp);
344		- $date_7_days_back = date('Y-m-d', strtotime($date . ' -8 days'));
	351	+ $date = gmdate('Y-m-d', $timestamp);
	352	+ $date_7_days_back = gmdate('Y-m-d', strtotime($date . ' -8 days'));
345	353	$counter_7days = 0;
346	354	$counter_todays = 0;
347	355	foreach ($data as $single_install) {
348		- date('Y-m-d', strtotime($single_install->created)) > $date_7_days_back ? $counter_7days++ : $counter_7days;
349		- date('Y-m-d', strtotime($single_install->created)) == $date ? $counter_todays++ : $counter_todays;
	356	+ gmdate('Y-m-d', strtotime($single_install->created)) > $date_7_days_back ? $counter_7days++ : $counter_7days;
	357	+ gmdate('Y-m-d', strtotime($single_install->created)) == $date ? $counter_todays++ : $counter_todays;
350	358	}
351	359	return array(
352	360	'last_week' => $counter_7days,
353	361	'today' => $counter_todays,
		@@ -458,20 +466,8 @@
458	466	}
459	467
460	468	return false;
461	469	}
462		- public static function remove_old_notice(){
463		- global $wp_filter;
464		- if( isset( $wp_filter['admin_notices']->callbacks[10] ) && is_array( $wp_filter['admin_notices']->callbacks[10] ) ) {
465		- foreach( $wp_filter['admin_notices']->callbacks[10] as $hash => $callbacks ) {
466		- if( is_array( $callbacks['function'] ) && ! empty( $callbacks['function'][0] ) && is_object( $callbacks['function'][0] ) && $callbacks['function'][0] instanceof \NotificationX_Licensing ) {
467		- remove_action( 'admin_notices', $hash );
468		- break;
469		- }
470		- }
471		- }
472		- }
473		-
474	470	public static function remote_get($url, $args = array(), $raw = false, $assoc = null) {
475	471	$defaults = array(
476	472	'timeout' => 20,
477	473	'redirection' => 5,
		@@ -592,9 +588,11 @@
592	588	// Add the number of posts to the query arguments
593	589	$query_args[] = $numberposts;
594	590
595	591	// Prepare and execute the query using wpdb methods
	592	+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- False positive: the query is prepared via $this->wpdb->prepare(), which this sniff does not recognise, and only $wpdb->prefix table names are interpolated. Audited 2026-07-16.
596	593	$sql = $wpdb->prepare( $sql, $query_args );
	594	+ // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.PreparedSQL.NotPrepared -- False positive: the query is prepared via $this->wpdb->prepare(), which this sniff does not recognise, and only $wpdb->prefix table names are interpolated. Audited 2026-07-16.
597	595	$products = $wpdb->get_results( $sql );
598	596
599	597	if ( ! empty( $products ) ) {
600	598	// Loop through the results and build the output array
		@@ -684,9 +682,9 @@
684	682	),
685	683	'description' => array(
686	684	'type' => 'textarea',
687	685	'name' => 'description',
688		- 'label' => __('Description', 'notificationx-pro'),
	686	+ 'label' => __('Description', 'notificationx'),
689	687	'priority' => 30,
690	688	),
691	689	'is_add_script' => array(
692	690	'type' => 'toggle',
		@@ -708,9 +706,9 @@
708	706	),
709	707	'script_url_pattern' => array(
710	708	'type' => 'codeviewer',
711	709	'name' => 'script_url_pattern',
712		- 'label' => __('Script', 'notificationx-pro'),
	710	+ 'label' => __('Script', 'notificationx'),
713	711	'priority' => 45,
714	712	),
715	713	];
716	714	}
		@@ -735,8 +733,9 @@
735	733	$urlparts = wp_parse_url(site_url('/'));
736	734	$domain = preg_replace('/www\./i', '', $urlparts['host']);
737	735	$cookies_removed = array();
738	736	$d_domains = array('_ga', '_fbp', '_gid', '_gat', '__utma', '__utmb', '__utmc', '__utmt', '__utmz');
	737	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Reviewed for the NotificationX codebase: acceptable in this context.
739	738	$d_domains = apply_filters('gdpr_d_domains_filter', $d_domains);
740	739
741	740	// Iterate over all cookies and remove them if they match specific conditions.
742	741	if (isset($_COOKIE) && is_array($_COOKIE) && $domain) :
		@@ -1095,31 +1094,93 @@
1095	1094	}
1096	1095	}
1097	1096
1098	1097	public static function nx_get_visitor_country_code() {
	1098	+ // Country targeting now applies to ALL notification types, so a single page
	1099	+ // load can evaluate several country-targeted notifications. Resolve the
	1100	+ // visitor's country once per request and reuse it. We key the memo on the IP
	1101	+ // and read it with array_key_exists (not isset) so an empty/failed result is
	1102	+ // remembered too and never re-triggers the header/API lookups below within the
	1103	+ // same request. An unknown country is always represented as an empty string.
	1104	+ static $memo = [];
	1105	+
1099	1106	$ip = '';
1100	1107	if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
1101		- $ip = $_SERVER['HTTP_CLIENT_IP'];
	1108	+ $ip = sanitize_text_field(wp_unslash($_SERVER['HTTP_CLIENT_IP']));
1102	1109	} elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
1103		- $ip = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])[0];
	1110	+ $ip = explode(',', sanitize_text_field(wp_unslash($_SERVER['HTTP_X_FORWARDED_FOR'])))[0];
1104	1111	} else {
1105		- $ip = $_SERVER['REMOTE_ADDR'];
	1112	+ $ip = isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : '';
1106	1113	}
1107		-
1108		- // Prevent localhost IP from erroring
1109		- if ($ip === '127.0.0.1' || $ip === '::1') {
1110		- return 'all'; // default fallback for local testing
	1114	+ $ip = trim($ip);
	1115	+
	1116	+ // No usable IP (CLI/cron) or localhost: return an empty code. Callers treat an
	1117	+ // unknown country as "don't filter" (fail-open), so country-targeted
	1118	+ // notifications still show during local testing instead of silently
	1119	+ // disappearing. Bailing here also avoids requesting
	1120	+ // http://ip-api.com/json/?fields=countryCode with an empty IP, which would
	1121	+ // resolve to the SERVER's country and cache nothing.
	1122	+ if ($ip === '' || $ip === '127.0.0.1' || $ip === '::1') {
	1123	+ return apply_filters('nx_visitor_country_code', '', $ip);
1111	1124	}
1112	1125
1113		- $response = wp_remote_get("http://ip-api.com/json/{$ip}?fields=countryCode");
	1126	+ if (array_key_exists($ip, $memo)) {
	1127	+ return apply_filters('nx_visitor_country_code', $memo[$ip], $ip);
	1128	+ }
1114	1129
1115		- if (is_wp_error($response)) {
1116		- return null;
	1130	+ // Let a host/CDN or custom resolver short-circuit the external lookup entirely.
	1131	+ // e.g. Cloudflare sends CF-IPCountry; many hosts expose GEOIP_COUNTRY_CODE.
	1132	+ $header_country = '';
	1133	+ foreach (['HTTP_CF_IPCOUNTRY', 'GEOIP_COUNTRY_CODE', 'HTTP_X_COUNTRY_CODE'] as $h) {
	1134	+ if (!empty($_SERVER[$h])) {
	1135	+ $header_country = strtoupper(sanitize_text_field(wp_unslash($_SERVER[$h])));
	1136	+ break;
	1137	+ }
1117	1138	}
	1139	+ // 'XX'/'T1' are Cloudflare's "unknown"/Tor placeholders — ignore them.
	1140	+ if ($header_country !== '' && !in_array($header_country, ['XX', 'T1'], true)) {
	1141	+ $memo[$ip] = $header_country;
	1142	+ return apply_filters('nx_visitor_country_code', $header_country, $ip);
	1143	+ }
1118	1144
1119		- $data = json_decode(wp_remote_retrieve_body($response), true);
	1145	+ // Per-IP cache so we don't hit the external API on every page load. A
	1146	+ // transient is used deliberately: WordPress serves transients from a
	1147	+ // persistent object cache (Redis/Memcached) when one is available — so those
	1148	+ // sites add zero wp_options rows — and transparently falls back to the options
	1149	+ // table otherwise, so the country stays cached across requests on plain sites
	1150	+ // too (which is what keeps us under ip-api's 45 req/min limit). A cached empty
	1151	+ // string is a remembered "lookup failed" marker, distinct from a miss (false).
	1152	+ $cache_key = 'nx_geo_' . md5($ip);
	1153	+ $cached = get_transient($cache_key);
	1154	+ if (false !== $cached) {
	1155	+ $memo[$ip] = $cached;
	1156	+ return apply_filters('nx_visitor_country_code', $cached, $ip);
	1157	+ }
1120	1158
1121		- return isset($data['countryCode']) ? $data['countryCode'] : null;
	1159	+ $country = '';
	1160	+ $api_endpoint = apply_filters('nx_visitor_country_api', "http://ip-api.com/json/{$ip}?fields=countryCode", $ip);
	1161	+ $response = wp_remote_get($api_endpoint, ['timeout' => 3]);
	1162	+
	1163	+ if (!is_wp_error($response) && (int) wp_remote_retrieve_response_code($response) === 200) {
	1164	+ $data = json_decode(wp_remote_retrieve_body($response), true);
	1165	+ if (isset($data['countryCode']) && $data['countryCode'] !== '') {
	1166	+ $country = $data['countryCode'];
	1167	+ }
	1168	+ }
	1169	+
	1170	+ // Cache successes for the full TTL; negative-cache failures for a short window
	1171	+ // so a rate-limit/timeout (ip-api's free tier is ~45 req/min keyed by the
	1172	+ // SERVER IP, shared across all visitors) doesn't re-hit the API on every
	1173	+ // subsequent page load while it recovers.
	1174	+ $ttl = '' !== $country
	1175	+ ? (int) apply_filters('nx_visitor_country_cache_ttl', 12 * HOUR_IN_SECONDS)
	1176	+ : (int) apply_filters('nx_visitor_country_failed_cache_ttl', 5 * MINUTE_IN_SECONDS);
	1177	+ if ($ttl > 0) {
	1178	+ set_transient($cache_key, $country, $ttl);
	1179	+ }
	1180	+
	1181	+ $memo[$ip] = $country;
	1182	+ return apply_filters('nx_visitor_country_code', $country, $ip);
1122	1183	}
1123	1184
1124	1185	public static function nx_get_all_country($search = '') {
1125	1186	$countries = [
		@@ -1319,8 +1380,45 @@
1319	1380	return strpos(strtolower($name), $search) !== false;
1320	1381	});
1321	1382	}
1322	1383	return $countries;
	1384	+ }
	1385	+
	1386	+
	1387	+ /**
	1388	+ * Delete a design document that NotificationX itself owns.
	1389	+ *
	1390	+ * The ID reaching the callers of this method arrives in a REST payload, so
	1391	+ * it is attacker-controlled. Without a post-type check, any user holding
	1392	+ * `edit_notificationx` could pass an arbitrary ID and force-delete any post
	1393	+ * on the site -- pages, products, orders -- with no trash to recover from.
	1394	+ * Only documents of a post type NotificationX creates may be removed here.
	1395	+ *
	1396	+ * A `current_user_can( 'delete_post' )` check is deliberately NOT applied.
	1397	+ * These post types register with `capability_type => 'post'`, so that meta
	1398	+ * cap resolves to the primitive `delete_posts`. A custom role delegated only
	1399	+ * "Who Can Create Notification?" does not hold `delete_posts`, and gating on
	1400	+ * it would stop that role from removing its own designs -- breaking exactly
	1401	+ * the delegated workflow this boundary exists to support. Actor authority is
	1402	+ * already established by the route's `edit_notificationx` permission
	1403	+ * callback; what was missing, and what this restores, is object authority.
	1404	+ *
	1405	+ * @param int|string $post_id Candidate post ID, untrusted.
	1406	+ * @param string $expected_type Post type NotificationX owns.
	1407	+ * @return bool True when a post was deleted.
	1408	+ */
	1409	+ public static function delete_owned_post( $post_id, $expected_type ) {
	1410	+ $post_id = absint( $post_id );
	1411	+ if ( ! $post_id ) {
	1412	+ return false;
	1413	+ }
	1414	+
	1415	+ $post = get_post( $post_id );
	1416	+ if ( ! $post || $expected_type !== $post->post_type ) {
	1417	+ return false;
	1418	+ }
	1419	+
	1420	+ return (bool) wp_delete_post( $post_id, true );
1323	1421	}
1324	1422
1325	1423
1326	1424	}