← All changes | includes/Admin/Notice.php +31 -18 3.2.9 → trunk View file →

		@@ -160,9 +160,11 @@
160	160	add_action( 'wpdeveloper_before_upsale_notice_for_' . $this->plugin_name, array( $this, 'before_upsale' ) );
161	161	add_action( 'wpdeveloper_after_upsale_notice_for_' . $this->plugin_name, array( $this, 'after' ) );
162	162	add_action( $this->do_notice_action, array( $this, 'content' ) );
163	163	if ( current_user_can( 'install_plugins' ) ) {
	164	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reviewed for the NotificationX codebase: acceptable in this context.
164	165	if ( isset( $_GET['plugin'] ) && $_GET['plugin'] == $this->plugin_name ) {
	166	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reviewed for the NotificationX codebase: acceptable in this context.
165	167	if ( isset( $_GET['tab'] ) && $_GET['tab'] === 'plugin-information' ) {
166	168	return;
167	169	}
168	170	do_action( 'wpdeveloper_notice_clicked_for_' . $this->plugin_name );
		@@ -258,9 +260,9 @@
258	260	* @param string $time
259	261	* @return integer
260	262	*/
261	263	public function makeTime( $current, $time ) {
262		- return intval( strtotime( date( 'r', $current ) . " +$time" ) );
	264	+ return intval( strtotime( gmdate( 'r', $current ) . " +$time" ) );
263	265	}
264	266	/**
265	267	* Automatice Maybe Later.
266	268	*
		@@ -280,21 +282,29 @@
280	282	*
281	283	* @return void
282	284	*/
283	285	public function clicked() {
	286	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reviewed for the NotificationX codebase: acceptable in this context.
284	287	if ( isset( $_GET['plugin'] ) ) {
285		- $plugin = sanitize_text_field( $_GET['plugin'] );
	288	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reviewed for the NotificationX codebase: acceptable in this context.
	289	+ $plugin = sanitize_text_field( wp_unslash( $_GET['plugin'] ) );
286	290	if ( $plugin === $this->plugin_name ) {
287	291	$options_data = $this->get_options_data();
288	292	$clicked_from = current( $this->next_notice() );
	293	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reviewed for the NotificationX codebase: acceptable in this context.
289	294	if ( isset( $_GET['plugin_action'] ) ) {
290		- $plugin_action = sanitize_text_field( $_GET['plugin_action'] );
	295	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reviewed for the NotificationX codebase: acceptable in this context.
	296	+ $plugin_action = sanitize_text_field( wp_unslash( $_GET['plugin_action'] ) );
291	297	}
	298	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reviewed for the NotificationX codebase: acceptable in this context.
292	299	if ( isset( $_GET['dismiss'] ) ) {
293		- $dismiss = sanitize_text_field( $_GET['dismiss'] );
	300	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reviewed for the NotificationX codebase: acceptable in this context.
	301	+ $dismiss = sanitize_text_field( wp_unslash( $_GET['dismiss'] ) );
294	302	}
	303	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reviewed for the NotificationX codebase: acceptable in this context.
295	304	if ( isset( $_GET['later'] ) ) {
296		- $later = sanitize_text_field( $_GET['later'] );
	305	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reviewed for the NotificationX codebase: acceptable in this context.
	306	+ $later = sanitize_text_field( wp_unslash( $_GET['later'] ) );
297	307	}
298	308
299	309	$later_time = '';
300	310
		@@ -342,10 +352,11 @@
342	352	*
343	353	* @return void
344	354	*/
345	355	private function redirect_to() {
346		- $request_uri = parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH );
347		- $query_string = parse_url( $_SERVER['REQUEST_URI'], PHP_URL_QUERY );
	356	+ $current_uri = isset( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
	357	+ $request_uri = wp_parse_url( $current_uri, PHP_URL_PATH );
	358	+ $query_string = wp_parse_url( $current_uri, PHP_URL_QUERY );
348	359	parse_str( $query_string, $current_url );
349	360
350	361	$unset_array = array( 'dismiss', 'plugin', '_wpnonce', 'later', 'plugin_action', 'marketing_optin' );
351	362
		@@ -571,12 +582,14 @@
571	582	if ( get_user_meta( get_current_user_id(), $this->plugin_name . '_' . $current_notice, true ) ) {
572	583	return;
573	584	}
574	585	if ( $current_notice == 'opt_in' ) {
	586	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- Reviewed for the NotificationX codebase: acceptable in this context.
575	587	do_action( $this->do_notice_action );
576	588	return;
577	589	}
578	590	do_action( 'wpdeveloper_before_notice_for_' . $this->plugin_name );
	591	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- Reviewed for the NotificationX codebase: acceptable in this context.
579	592	do_action( $this->do_notice_action );
580	593	do_action( 'wpdeveloper_after_notice_for_' . $this->plugin_name );
581	594	}
582	595	/**
		@@ -809,10 +822,10 @@
809	822	if ( ! isset( $_POST['action'] ) || ( $_POST['action'] !== 'wpdeveloper_notice_dissmiss_for_' . $this->plugin_name ) ) {
810	823	return;
811	824	}
812	825
813		- $dismiss = isset( $_POST['dismiss'] ) ? sanitize_text_field( $_POST['dismiss'] ) : false;
814		- $notice = isset( $_POST['notice'] ) ? sanitize_text_field( $_POST['notice'] ) : false;
	826	+ $dismiss = isset( $_POST['dismiss'] ) ? sanitize_text_field( wp_unslash( $_POST['dismiss'] ) ) : false;
	827	+ $notice = isset( $_POST['notice'] ) ? sanitize_text_field( wp_unslash( $_POST['notice'] ) ) : false;
815	828	if ( $dismiss ) {
816	829	update_user_meta( get_current_user_id(), $this->plugin_name . '_' . $notice, true );
817	830	$this->update( $notice );
818	831	echo 'success';
		@@ -835,9 +848,9 @@
835	848	if ( ! isset( $_POST['action'] ) || ( $_POST['action'] !== 'wpdeveloper_upsale_notice_dissmiss_for_' . $this->plugin_name ) ) {
836	849	return;
837	850	}
838	851
839		- $dismiss = isset( $_POST['dismiss'] ) ? sanitize_text_field( $_POST['dismiss'] ) : false;
	852	+ $dismiss = isset( $_POST['dismiss'] ) ? sanitize_text_field( wp_unslash( $_POST['dismiss'] ) ) : false;
840	853	if ( $dismiss ) {
841	854	$this->update( 'upsale' );
842	855	echo 'success';
843	856	} else {
		@@ -851,16 +864,16 @@
851	864	<script type="text/javascript">
852	865	jQuery(document).ready( function($) {
853	866	if( $('.notice').length > 0 ) {
854	867	if( $('.notice').find('.notice-dismiss').length > 0 ) {
855		- $('.notice.<?php echo $this->plugin_name; ?>').on('click', 'button.notice-dismiss', function(e) {
	868	+ $('.notice.<?php echo esc_js( $this->plugin_name ); ?>').on('click', 'button.notice-dismiss', function(e) {
856	869	e.preventDefault();
857	870	$.ajax({
858		- url: '<?php echo admin_url( 'admin-ajax.php' ); ?>',
	871	+ url: '<?php echo esc_url( admin_url( 'admin-ajax.php' ) ); ?>',
859	872	type: 'post',
860	873	data: {
861	874	action: 'wpdeveloper_notice_dissmiss_for_<?php echo esc_js( $this->plugin_name ); ?>',
862		- _wpnonce: '<?php echo wp_create_nonce( 'wpdeveloper_notice_dissmiss' ); ?>',
	875	+ _wpnonce: '<?php echo esc_js( wp_create_nonce( 'wpdeveloper_notice_dissmiss' ) ); ?>',
863	876	dismiss: true,
864	877	notice: $(this).data('notice'),
865	878	},
866	879	success: function(response) {
		@@ -904,13 +917,13 @@
904	917	self.addClass('install-now updating-message');
905	918	self.text('<?php echo esc_html__( 'Installing...', 'notificationx' ); ?>');
906	919
907	920	$.ajax({
908		- url: '<?php echo admin_url( 'admin-ajax.php' ); ?>',
	921	+ url: '<?php echo esc_url( admin_url( 'admin-ajax.php' ) ); ?>',
909	922	type: 'POST',
910	923	data: {
911	924	action: 'wpdeveloper_upsale_core_install_<?php echo esc_attr( $this->plugin_name ); ?>',
912		- _wpnonce: '<?php echo wp_create_nonce( 'wpdeveloper_upsale_core_install_' . esc_attr( $this->plugin_name ) ); ?>',
	925	+ _wpnonce: '<?php echo esc_js( wp_create_nonce( 'wpdeveloper_upsale_core_install_' . esc_attr( $this->plugin_name ) ) ); ?>',
913	926	slug : '<?php echo esc_html( $plugin_slug ); ?>',
914	927	file : '<?php echo esc_html( $plugin_file ); ?>'
915	928	},
916	929	success: function(response) {
		@@ -915,9 +928,9 @@
915	928	},
916	929	success: function(response) {
917	930	self.text('<?php echo esc_html__( 'Installed', 'notificationx' ); ?>');
918	931	<?php if ( ! empty( $page_slug ) ) : ?>
919		- window.location.href = '<?php echo admin_url( "admin.php?page={$page_slug}" ); ?>';
	932	+ window.location.href = '<?php echo esc_url( admin_url( "admin.php?page={$page_slug}" ) ); ?>';
920	933	<?php endif; ?>
921	934	},
922	935	error: function(error) {
923	936	self.removeClass('install-now updating-message');
		@@ -934,13 +947,13 @@
934	947
935	948	$('.wpdeveloper-upsale-notice').on('click', 'button.notice-dismiss', function (e) {
936	949	e.preventDefault();
937	950	$.ajax({
938		- url: '<?php echo admin_url( 'admin-ajax.php' ); ?>',
	951	+ url: '<?php echo esc_url( admin_url( 'admin-ajax.php' ) ); ?>',
939	952	type: 'post',
940	953	data: {
941	954	action: 'wpdeveloper_upsale_notice_dissmiss_for_<?php echo esc_attr( $this->plugin_name ); ?>',
942		- _wpnonce: '<?php echo wp_create_nonce( 'wpdeveloper_upsale_notice_dissmiss' ); ?>',
	955	+ _wpnonce: '<?php echo esc_js( wp_create_nonce( 'wpdeveloper_upsale_notice_dissmiss' ) ); ?>',
943	956	dismiss: true
944	957	},
945	958	success: function(response) {
946	959	console.log('Successfully saved!');