| @@ -1,5 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | +// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean | |
| 3 | +// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate. | |
| 4 | + | |
| 2 | 5 | /** |
| 3 | 6 | * Add extra profile fields for users in admin |
| 4 | 7 | * |
| 5 | 8 | * @author PropertyHive |
| @@ -16,8 +19,9 @@ | ||
| 16 | 19 | |
| 17 | 20 | /** |
| 18 | 21 | * PH_Admin_Profile Class. |
| 19 | 22 | */ |
| 23 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Admin_Profile; preserving the existing PH_* class name is required for plugin and extension compatibility. | |
| 20 | 24 | class PH_Admin_Profile { |
| 21 | 25 | |
| 22 | 26 | /** |
| 23 | 27 | * Hook in tabs. |
| @@ -225,13 +229,18 @@ | ||
| 225 | 229 | * @param int $user_id User ID of the user being saved |
| 226 | 230 | */ |
| 227 | 231 | public function save_extra_user_meta_fields( $user_id ) { |
| 228 | 232 | |
| 229 | - if ( ! current_user_can( 'manage_propertyhive' ) ) { | |
| 233 | + if ( ! current_user_can( 'manage_propertyhive' ) || ! current_user_can( 'edit_user', $user_id ) ) { | |
| 230 | 234 | return; |
| 231 | 235 | } |
| 232 | 236 | |
| 233 | - $user_meta = get_userdata($user_id); | |
| 237 | + if ( ! isset( $_POST['_wpnonce'] ) || ! is_string( $_POST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ), 'update-user_' . $user_id ) ) { | |
| 238 | + return; | |
| 239 | + } | |
| 240 | + | |
| 241 | + $user_meta = get_userdata($user_id); | |
| 242 | + if ( ! $user_meta ) { return; } | |
| 234 | 243 | $user_roles = $user_meta->roles; |
| 235 | 244 | |
| 236 | 245 | if ( ! in_array("administrator", $user_roles) && ! in_array("editor", $user_roles) ) { |
| 237 | 246 | return; |
| @@ -245,9 +254,13 @@ | ||
| 245 | 254 | |
| 246 | 255 | if ( isset( $field['type'] ) && 'checkbox' === $field['type'] ) { |
| 247 | 256 | update_user_meta( $user_id, $key, isset( $_POST[ $key ] ) ); |
| 248 | 257 | } elseif ( isset( $_POST[ $key ] ) ) { |
| 249 | - update_user_meta( $user_id, $key, ph_clean( $_POST[ $key ] ) ); | |
| 258 | + if ( isset( $field['type'] ) && in_array( $field['type'], array( 'text', 'hidden', 'color', 'image', 'select' ), true ) && ! is_scalar( $_POST[ $key ] ) ) { | |
| 259 | + continue; | |
| 260 | + } | |
| 261 | + // Metadata APIs expect slashed values; preserve literal backslashes after sanitizing. | |
| 262 | + update_user_meta( $user_id, $key, wp_slash( ph_clean( wp_unslash( $_POST[ $key ] ) ) ) ); | |
| 250 | 263 | } |
| 251 | 264 | } |
| 252 | 265 | } |
| 253 | 266 | } |
