← All changes | Admin/Forms/Add_Gallery.php +59 -46 2.43 → 3.37 View file →

		@@ -1,48 +1,53 @@
1	1	<?php
	2	+
2	3	namespace Photonic_Plugin\Admin\Forms;
3	4
	5	+use Photonic_Plugin\Core\Photonic;
	6	+
	7	+if (!current_user_can('edit_posts')) {
	8	+ wp_die(esc_html__('You are not authorized to use this capability.', 'photonic'));
	9	+}
	10	+
4	11	/**
5	12	* Creates a form in the "Add Media" screen under the new "Photonic" tab. This form lets you insert the gallery shortcode with
6	13	* the right arguments for native WP galleries, Flickr, Google Photos, SmugMug, Zenfolio and Instagram.
7		- *
8	14	*/
9		-
10	15	class Add_Gallery {
11		- private static $instance = null;
	16	+ private static ?Add_Gallery $instance = null;
12	17
13	18	private function __construct() {
14	19	}
15	20
16		- public static function get_instance() {
17		- if (self::$instance == null) {
	21	+ public static function get_instance(): Add_Gallery {
	22	+ if (null === self::$instance) {
18	23	self::$instance = new Add_Gallery();
19	24	}
20	25	return self::$instance;
21	26	}
22	27
23		- function build_form() {
	28	+ public function build_form() {
24	29	global $photonic_alternative_shortcode;
25	30	$shortcode = empty($photonic_alternative_shortcode) ? 'gallery' : $photonic_alternative_shortcode;
26	31
27		- $selected_tab = isset($_GET['photonic-tab']) ? esc_attr($_GET['photonic-tab']) : 'default';
28		- if (!in_array($selected_tab, ['default', 'flickr', 'google', 'smugmug', 'zenfolio', 'instagram'])) {
	32	+ $selected_tab = sanitize_text_field($_GET['photonic-tab'] ?? 'default'); // phpcs:ignore WordPress.Security.NonceVerification
	33	+ if (!in_array($selected_tab, ['default', 'flickr', 'google', 'smugmug', 'zenfolio', 'instagram'], true)) {
29	34	$selected_tab = 'default';
30	35	}
31	36
32	37	?>
33	38	<script type="text/javascript">
34		- jQuery(document).ready(function($) {
35		- window.photonicAdminHtmlEncode = function photonicAdminHtmlEncode(value){
	39	+ jQuery(document).ready(function ($) {
	40	+ window.photonicAdminHtmlEncode = function photonicAdminHtmlEncode(value) {
36	41	return $('<div/>').text(value).html();
37	42	};
38	43
39		- $('#photonic-shortcode-form input[type="text"], #photonic-shortcode-form select').change(function() {
	44	+ $('#photonic-shortcode-form input[type="text"], #photonic-shortcode-form select').change(function () {
40	45	var comboValues = $('#photonic-shortcode-form').serializeArray();
41	46	var newValues = [];
42	47	var len = comboValues.length;
43	48
44		- $(comboValues).each(function(i, obj) {
	49	+ $(comboValues).each(function (i, obj) {
45	50	var individual = this;
46	51	if (individual['name'].trim() !== 'photonic-shortcode' && individual['name'].trim() !== 'photonic-submit' &&
47	52	individual['name'].trim() !== 'photonic-cancel' && individual['value'].trim() !== '') {
48	53	newValues.push(individual['name'] + "='" + photonicAdminHtmlEncode(decodeURIComponent(individual['value'].trim())) + "'");
		@@ -48,11 +53,10 @@
48	53	newValues.push(individual['name'] + "='" + photonicAdminHtmlEncode(decodeURIComponent(individual['value'].trim())) + "'");
49	54	}
50	55	});
51	56
52		- var shortcode = "[<?php echo $shortcode; ?> type='<?php echo $selected_tab; ?>' ";
53		- len = newValues.length;
54		- $(newValues).each(function() {
	57	+ var shortcode = "[<?php echo esc_html($shortcode); ?> type='<?php echo esc_attr($selected_tab); ?>' ";
	58	+ $(newValues).each(function () {
55	59	shortcode += this + ' ';
56	60	});
57	61	shortcode += ']';
58	62
		@@ -62,9 +66,9 @@
62	66	$('#photonic-shortcode-form select').change();
63	67	});
64	68	</script>
65	69	<?php
66		- require_once(PHOTONIC_PATH.'/Admin/Forms/Vanilla_Form.php');
	70	+ require_once PHOTONIC_PATH . '/Admin/Forms/Vanilla_Form.php';
67	71	$form = Vanilla_Form::get_instance();
68	72	$fields = $form->get_fields();
69	73
70	74	echo "<form id='photonic-shortcode-form' method='post' action=''>";
		@@ -70,17 +74,23 @@
70	74	echo "<form id='photonic-shortcode-form' method='post' action=''>";
71	75	$this->build_tabs($selected_tab, $fields);
72	76	}
73	77
74		- function build_tabs($selected_tab, $fields) {
	78	+ private function build_tabs($selected_tab, $fields) {
75	79	$tab_list = '';
76	80	$field_list = [];
77	81	$prelude = '';
	82	+
	83	+ $user = get_current_user_id();
	84	+ if (0 === $user) {
	85	+ $user = wp_rand(1);
	86	+ }
	87	+
78	88	foreach ($fields as $tab => $field_group) {
79		- $tab_list .= "<li><a href='".esc_url(add_query_arg(['photonic-tab' => $tab]))."' class='".($tab == $selected_tab ? 'current' : '')."'>".esc_attr($field_group['name'])."</a> | </li>";
80		- if ($tab == $selected_tab) {
	89	+ $tab_list .= "<li><a href='" . esc_url(add_query_arg(['photonic-tab' => $tab, 'nonce' => wp_create_nonce('photonic-vanilla-form-' . $user)])) . "' class='" . ($tab === $selected_tab ? 'current' : '') . "'>" . esc_attr($field_group['name']) . "</a> | </li>";
	90	+ if ($tab === $selected_tab) {
81	91	$field_list = $field_group['fields'];
82		- $prelude = isset($field_group['prelude']) ? $field_group['prelude'] : '';
	92	+ $prelude = $field_group['prelude'] ?? '';
83	93	}
84	94	}
85	95
86	96	echo "<ul class='subsubsub'>";
		@@ -86,13 +96,15 @@
86	96	echo "<ul class='subsubsub'>";
87	97	if (strlen($tab_list) > 8) {
88	98	$tab_list = substr($tab_list, 0, -8);
89	99	}
90		- echo $tab_list;
	100	+ echo wp_kses_post($tab_list);
91	101	echo "</ul>";
92	102
93	103	if (!empty($prelude)) {
94		- echo "<p class='prelude'>"; print_r($prelude); echo "</p>";
	104	+ echo "<p class='prelude'>";
	105	+ echo wp_kses_post($prelude);
	106	+ echo "</p>";
95	107	}
96	108
97	109	$this->build_table($field_list);
98	110	$this->show_shortcode_preview();
		@@ -97,67 +109,68 @@
97	109	$this->build_table($field_list);
98	110	$this->show_shortcode_preview();
99	111	}
100	112
101		- function build_table($field_list) {
	113	+ private function build_table($field_list) {
102	114	echo "<table class='photonic-form'>";
103	115	foreach ($field_list as $field) {
104	116	echo "<tr>";
105		- echo "<th scope='row'>{$field['name']} ".(isset($field['req']) && $field['req'] ? '(*)' : '')." </th>";
106		- $alt_id = !empty($field['alt_id']) ? " alt_id='{$field['alt_id']}' " : '';
	117	+ echo wp_kses_post("<th scope='row'>{$field['name']} " . (isset($field['req']) && $field['req'] ? '(*)' : '') . " </th>");
107	118	switch ($field['type']) {
108	119	case 'text':
109		- echo "<td><input type='text' name='{$field['id']}' value='".(isset($field['std']) ? $field['std'] : '')."' $alt_id/></td>";
	120	+ echo "<td><input type='text' name='" . esc_attr($field['id']) . "' value='" . esc_attr($field['std'] ?? '') . "' /></td>";
110	121	break;
111	122
112	123	case 'select':
113		- echo "<td><select name='{$field['id']}' $alt_id>";
114		- $default = isset($field['std']) ? $field['std'] : '';
	124	+ echo "<td><select name='" . esc_attr($field['id']) . "'>";
	125	+ $default = $field['std'] ?? '';
115	126	foreach ($field['options'] as $option_name => $option_value) {
116		- if ($option_name == $default) {
	127	+ if ($option_name === $default) {
117	128	$selected = 'selected';
118	129	}
119	130	else {
120	131	$selected = '';
121	132	}
122		- echo "<option value='$option_name' $selected>".esc_attr($option_value)."</option>";
	133	+ echo "<option value='" . esc_attr($option_name) . "' " . esc_attr($selected) . ">" . esc_attr($option_value) . "</option>";
123	134	}
124	135	echo "</select></td>";
125	136	break;
126	137
127	138	case 'raw':
128		- echo "<td>".$field['std']."</td>";
	139	+ echo "<td>" . wp_kses($field['std'], ['select' => ['name'], 'option' => ['value', 'selected']]) . "</td>";
129	140	break;
130	141	}
131		- echo "<td class='hint'>".(isset($field['hint']) ? $field['hint'] : '')."</td>";
	142	+ echo "<td class='hint'>" . wp_kses_post($field['hint'] ?? '') . "</td>";
132	143	echo "</tr>";
133	144	}
134	145	echo "</table>";
135	146	}
136	147
137		- function show_shortcode_preview() {
	148	+ private function show_shortcode_preview() {
138	149	echo "<div class='preview'>";
139	150	echo "<script type='text/javascript'></script>";
140		- echo "<h4>".esc_html__('Shortcode preview', 'photonic')."</h4>";
	151	+ echo "<h4>" . esc_html__('Shortcode preview', 'photonic') . "</h4>";
141	152	echo "<pre class='html' id='photonic-preview' name='photonic-preview'></pre>";
142	153	echo "<input type='hidden' id='photonic-shortcode' name='photonic-shortcode' />";
143	154	echo "</div>";
144	155
145	156	echo "<div class='button-panel'>";
146		- echo get_submit_button(esc_html__('Insert into post', 'photonic'), 'primary', 'photonic-submit', false);
147		- echo get_submit_button(esc_html__('Cancel', 'photonic'), 'delete', 'photonic-cancel', false);
	157	+ echo wp_kses(get_submit_button(esc_html__('Insert into post', 'photonic'), 'primary', 'photonic-submit', false), Photonic::$safe_tags);
	158	+ echo wp_kses(get_submit_button(esc_html__('Cancel', 'photonic'), 'delete', 'photonic-cancel', false), Photonic::$safe_tags);
148	159	echo "</div>";
149	160	}
150	161	}
151	162
152		-if (isset($_POST['photonic-submit'])) {
153		- $shortcode = stripslashes($_POST['photonic-shortcode']);
154		- media_send_to_editor($shortcode);
155		- return;
	163	+if (current_user_can('edit_posts') && isset($_REQUEST['nonce']) && wp_verify_nonce($_REQUEST['nonce'], 'photonic-vanilla-form-' . get_current_user_id())) {
	164	+ if (isset($_POST['photonic-submit'])) {
	165	+ $photonic_user_shortcode = stripslashes(sanitize_text_field($_POST['photonic-shortcode'] ?? ''));
	166	+ media_send_to_editor($photonic_user_shortcode);
	167	+ return;
	168	+ }
	169	+ elseif (isset($_POST['photonic-cancel'])) {
	170	+ media_send_to_editor('');
	171	+ return;
	172	+ }
156	173	}
157		-else if (isset($_POST['photonic-cancel'])) {
158		- media_send_to_editor('');
159		- return;
160		-}
161	174
162		-$add_gallery = Add_Gallery::get_instance();
163		-$add_gallery->build_form();
	175	+$photonic_add_gallery_form = Add_Gallery::get_instance();
	176	+$photonic_add_gallery_form->build_form();