← All changes | includes/class-wp-admin.php +19 -10 1.2.16 → trunk View file →

		@@ -78,9 +78,9 @@
78	78	return $url;
79	79	}
80	80
81	81	public function render_tools_page() {
82		- wp_redirect( $this->get_app_url() );
	82	+ wp_safe_redirect( $this->get_app_url() );
83	83	exit();
84	84	}
85	85
86	86	public function get_tools_page_url( $troubleshoot_url = '' ) {
		@@ -94,27 +94,36 @@
94	94	return $url;
95	95	}
96	96
97	97	public function redirect_tools_page() {
	98	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing check on admin_init; no state change.
98	99	if ( empty( $_GET['page'] ) || $_GET['page'] !== 'plugin-detective' ) {
99	100	return;
100	101	}
101		-
	102	+
	103	+ // Defense in depth: this handler mints an authenticated pd_api token, so gate
	104	+ // it on the same capability the API enforces. WordPress's admin-menu access
	105	+ // check already blocks low-privileged users from this page, but don't rely on
	106	+ // that ordering — never mint a token for a user who couldn't use it anyway.
	107	+ if ( ! current_user_can( 'activate_plugins' ) ) {
	108	+ return;
	109	+ }
	110	+
102	111	if ( class_exists( 'ITSEC_Core' ) && $itsec_storage = get_option( 'itsec-storage' ) ) {
103	112	if ( !empty( $itsec_storage['system-tweaks']['plugins_php'] ) ) {
104	113	echo '<h1>iThemes Security is preventing Plugin Detective from operating properly</h1>';
105	114	echo '<h3>To fix this: <code>Go to Security > Settings > System Tweaks</code> and <strong>uncheck</strong> the checkbox setting for <code>Disable PHP in Plugins</code></h3>';
106		- echo '<h3><a href="'. admin_url( 'admin.php?page=itsec&module=system-tweaks&module_type=recommended' ).'">Go there now</a></h3>';
	115	+ echo '<h3><a href="'. esc_url( admin_url( 'admin.php?page=itsec&module=system-tweaks&module_type=recommended' ) ).'">Go there now</a></h3>';
107	116	exit();
108	117	}
109	118	}
110	119
111	120	$troubleshoot_url = '';
112		- if ( !empty( $_GET['url'] ) ) {
113		- $troubleshoot_url = sanitize_text_field( $_GET['url'] );
	121	+ if ( ! empty( $_GET['url'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only redirect parameter; no state change.
	122	+ $troubleshoot_url = sanitize_text_field( wp_unslash( $_GET['url'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only redirect parameter.
114	123	}
115	124
116		- wp_redirect( $this->get_app_url( $troubleshoot_url ) );
	125	+ wp_safe_redirect( $this->get_app_url( $troubleshoot_url ) );
117	126	exit();
118	127	}
119	128
120	129	/**
		@@ -123,11 +132,11 @@
123	132	public function admin_bar_menu() {
124	133	global $wp_admin_bar;
125	134
126	135	$current_url = '';
127		- if ( !empty( $_SERVER['REQUEST_URI'] ) ) {
128		- $desired_relative_path = (string)$_SERVER['REQUEST_URI'];
129		- $relative_path_to_wp_directory = (string)parse_url( site_url(), PHP_URL_PATH );
	136	+ if ( ! empty( $_SERVER['REQUEST_URI'] ) ) {
	137	+ $desired_relative_path = sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) );
	138	+ $relative_path_to_wp_directory = (string) wp_parse_url( site_url(), PHP_URL_PATH );
130	139
131	140	if ( ! empty( $relative_path_to_wp_directory ) && strpos( $desired_relative_path, $relative_path_to_wp_directory ) === 0 ) {
132	141	$desired_relative_path = substr( $desired_relative_path, strlen( $relative_path_to_wp_directory ) );
133	142	}
		@@ -144,8 +153,8 @@
144	153	'href' => $this->get_tools_page_url( $current_url )
145	154	) );
146	155	}
147	156
148		- wp_enqueue_style( 'plugin_detective', $this->plugin->url( 'assets/admin.css' ) );
	157	+ wp_enqueue_style( 'plugin_detective', $this->plugin->url( 'assets/admin.css' ), array(), $this->plugin->version );
149	158	}
150	159
151	160	}