← All changes | includes/Admin/Settings.php +197 -0 3.2.13 → trunk View file →

		@@ -80,8 +80,20 @@
80	80	$data = NotificationX::get_instance()->normalize( $this->settings_form() );
81	81	// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Reviewed for the NotificationX codebase: acceptable in this context.
82	82	$settings = apply_filters('nx_settings_page_settings', $this->get( 'settings', [] ));
83	83
	84	+ /*
	85	+ * `/builder` resolves `read_notificationx` -- the lowest capability the
	86	+ * product defines -- and this blob is handed straight to it. The
	87	+ * `settingsRedirect` flag below only tells the admin app not to render
	88	+ * the settings screen; it is a client-side routing hint, not a boundary.
	89	+ * Without this, a view-only delegate received every API key, client
	90	+ * secret and OAuth token stored on the site.
	91	+ */
	92	+ if ( ! current_user_can( 'edit_notificationx_settings' ) ) {
	93	+ $settings = self::redact_secret_settings( $settings );
	94	+ }
	95	+
84	96	$data['current_page'] = 'settings';
85	97	$data['rest'] = REST::get_instance()->rest_data();
86	98	$data['savedValues'] = $settings;
87	99	$data['values'] = $settings;
		@@ -669,8 +681,13 @@
669	681	$remove_before_save = [
670	682	'empty',
671	683	];
672	684
	685	+ // Must run before the role map is derived below, or the posted values
	686	+ // would still reach `nx_settings_saved` and be written to the roles.
	687	+ $settings = $this->preserve_role_settings( $settings );
	688	+ $settings = $this->preserve_secret_settings( $settings );
	689	+
673	690	$roles = $this->get_selected_roles( $settings );
674	691	$settings = array_merge( $settings, $roles );
675	692
676	693	// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Reviewed for the NotificationX codebase: acceptable in this context.
		@@ -680,11 +697,17 @@
680	697	if ( isset( $settings[ $key ] ) ) {
681	698	unset( $settings[ $key ] );
682	699	}
683	700	}
	701	+ $settings = $this->preserve_protected_settings( $settings );
	702	+
684	703	// need this to ensure saved value don't return empty array instead of object.
685	704	if ( ! empty( $settings['delete_settings'] ) ) {
686	705	$settings = [ 'empty' => true ];
	706	+ // The reset discards everything preserved above, so re-apply the
	707	+ // role gate: a settings administrator must not be able to rewrite
	708	+ // role assignments by routing through a settings reset.
	709	+ $settings = $this->preserve_role_settings( $settings );
687	710	}
688	711
689	712	$this->set( 'settings', $settings );
690	713	delete_transient( 'nx_get_field_names' );
		@@ -690,8 +713,182 @@
690	713	delete_transient( 'nx_get_field_names' );
691	714	// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Reviewed for the NotificationX codebase: acceptable in this context.
692	715	do_action( 'nx_settings_saved', $settings );
693	716	return true;
	717	+ }
	718	+
	719	+ /**
	720	+ * Force server-owned settings back to their stored values.
	721	+ *
	722	+ * `save_settings()` replaces the whole blob with the posted one, so every key
	723	+ * the admin app is holding wins -- right for fields a merchant edits, wrong
	724	+ * for state only the server writes. OAuth tokens are the case that bites:
	725	+ * they live inside `settings`, so they are handed to the admin app on page
	726	+ * load and posted straight back. Disconnecting an account and then saving
	727	+ * from a tab opened *before* the disconnect wrote the revoked token back and
	728	+ * the integration silently kept working -- with Google Analytics that showed
	729	+ * up as live viewer counts on a supposedly disconnected site.
	730	+ *
	731	+ * Keys listed here can only be changed by the code that owns them.
	732	+ *
	733	+ * @param array $settings Incoming settings.
	734	+ * @return array
	735	+ */
	736	+ protected function preserve_protected_settings( $settings ) {
	737	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Reviewed for the NotificationX codebase: acceptable in this context.
	738	+ $protected = apply_filters( 'nx_protected_settings', [
	739	+ 'nx_pa_settings', // Google Analytics OAuth token.
	740	+ ] );
	741	+
	742	+ // `get()` returns false for a missing key, and false is also what a
	743	+ // disconnect stores -- so only a sentinel separates "stored as false"
	744	+ // from "never stored", and the two need different handling.
	745	+ $missing = new \stdClass();
	746	+
	747	+ foreach ( (array) $protected as $key ) {
	748	+ if ( ! is_string( $key ) || '' === $key ) {
	749	+ continue;
	750	+ }
	751	+ $stored = $this->get( "settings.{$key}", $missing );
	752	+ if ( $missing === $stored ) {
	753	+ unset( $settings[ $key ] );
	754	+ continue;
	755	+ }
	756	+ $settings[ $key ] = $stored;
	757	+ }
	758	+
	759	+ return $settings;
	760	+ }
	761	+
	762	+ /**
	763	+ * Settings keys holding credentials rather than configuration.
	764	+ *
	765	+ * These are values a site owner pastes in once and which grant access to a
	766	+ * third-party account. They must never reach a client that is not entitled
	767	+ * to edit settings, and must never be written into an export file.
	768	+ *
	769	+ * Pro registers its own integrations, so the list is filterable; keep the
	770	+ * free baseline broad rather than minimal, because a key omitted here is a
	771	+ * key that leaks.
	772	+ *
	773	+ * @return array
	774	+ */
	775	+ public static function get_secret_settings_keys() {
	776	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Reviewed for the NotificationX codebase: acceptable in this context.
	777	+ return (array) apply_filters( 'nx_secret_settings', [
	778	+ 'nx_pa_settings', // Google Analytics OAuth access + refresh token.
	779	+ 'token_info',
	780	+ 'ga_client_secret',
	781	+ 'yt_client_secret',
	782	+ 'openai_access_token',
	783	+ 'mailchimp_api_key',
	784	+ 'activecampaign_api_key',
	785	+ 'brevo_api_key',
	786	+ 'convertkit_api_key',
	787	+ 'convertkit_api_secret',
	788	+ 'google_review_api_key',
	789	+ 'google_youtube_api_key',
	790	+ 'zapier_api_key',
	791	+ 'ifttt_api_key',
	792	+ 'envato_token',
	793	+ 'gmap_token',
	794	+ ] );
	795	+ }
	796	+
	797	+ /**
	798	+ * Strip credentials out of a settings blob.
	799	+ *
	800	+ * Keys are removed outright rather than blanked. A blanked value is
	801	+ * indistinguishable from "the user cleared this field" once it is posted
	802	+ * back, which would silently destroy working integrations; an absent key is
	803	+ * unambiguous and is restored by `preserve_secret_settings()` on save.
	804	+ *
	805	+ * @param array $settings
	806	+ * @return array
	807	+ */
	808	+ public static function redact_secret_settings( $settings ) {
	809	+ if ( ! is_array( $settings ) ) {
	810	+ return $settings;
	811	+ }
	812	+ foreach ( self::get_secret_settings_keys() as $key ) {
	813	+ unset( $settings[ $key ] );
	814	+ }
	815	+ return $settings;
	816	+ }
	817	+
	818	+ /**
	819	+ * Carry stored credentials across a save that does not carry them.
	820	+ *
	821	+ * Counterpart to `redact_secret_settings()`. An export has its credentials
	822	+ * stripped, so importing one would otherwise blank every integration on the
	823	+ * target site. Absent key means "unchanged"; a key that *is* present wins,
	824	+ * so a settings administrator editing an API key in the UI still works, and
	825	+ * deliberately clearing a field still clears it.
	826	+ *
	827	+ * Unlike `preserve_protected_settings()` these values are user-owned, so
	828	+ * they must stay editable -- that is why this cannot simply force the
	829	+ * stored value back.
	830	+ *
	831	+ * @param array $settings Incoming settings.
	832	+ * @return array
	833	+ */
	834	+ protected function preserve_secret_settings( $settings ) {
	835	+ if ( ! is_array( $settings ) ) {
	836	+ return $settings;
	837	+ }
	838	+
	839	+ $missing = new \stdClass();
	840	+
	841	+ foreach ( self::get_secret_settings_keys() as $key ) {
	842	+ if ( array_key_exists( $key, $settings ) ) {
	843	+ continue;
	844	+ }
	845	+ $stored = $this->get( "settings.{$key}", $missing );
	846	+ if ( $missing !== $stored ) {
	847	+ $settings[ $key ] = $stored;
	848	+ }
	849	+ }
	850	+
	851	+ return $settings;
	852	+ }
	853	+
	854	+ /**
	855	+ * Keep role assignments out of reach of a plain settings administrator.
	856	+ *
	857	+ * The role selectors grant and revoke capabilities across every role on the
	858	+ * site, which is authority well beyond "may edit NotificationX settings".
	859	+ * Pro hides these fields from the settings form unless the user can
	860	+ * `delete_users` (RoleManagement::tab_advanced), but that is a filter on the
	861	+ * form schema -- it never runs on save, so posting the keys directly to
	862	+ * `/settings` bypassed it entirely.
	863	+ *
	864	+ * @param array $settings Incoming settings.
	865	+ * @return array
	866	+ */
	867	+ protected function preserve_role_settings( $settings ) {
	868	+ if ( ! is_array( $settings ) || current_user_can( 'delete_users' ) ) {
	869	+ return $settings;
	870	+ }
	871	+
	872	+ $role_keys = [
	873	+ 'notification_view_roles',
	874	+ 'notification_roles',
	875	+ 'settings_roles',
	876	+ 'analytics_roles',
	877	+ ];
	878	+
	879	+ $missing = new \stdClass();
	880	+
	881	+ foreach ( $role_keys as $key ) {
	882	+ $stored = $this->get( "settings.{$key}", $missing );
	883	+ if ( $missing === $stored ) {
	884	+ unset( $settings[ $key ] );
	885	+ continue;
	886	+ }
	887	+ $settings[ $key ] = $stored;
	888	+ }
	889	+
	890	+ return $settings;
694	891	}
695	892
696	893	public function get_role_map( $settings = [] ) {
697	894	if ( empty( $settings ) || count( $settings ) == 1 ) {