← All changes | includes/admin/class-ph-admin-assets.php +40 -29 2.2.6 → 2.3.0 View file →

		@@ -1,5 +1,8 @@
1	1	<?php
	2	+// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean
	3	+// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate.
	4	+
2	5	/**
3	6	* Load assets.
4	7	*
5	8	* @author PropertyHive
		@@ -14,8 +17,9 @@
14	17
15	18	/**
16	19	* PH_Admin_Assets Class
17	20	*/
	21	+// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Admin_Assets; preserving the existing PH_* class name is required for plugin and extension compatibility.
18	22	class PH_Admin_Assets {
19	23
20	24	/**
21	25	* Hook in tabs.
		@@ -64,9 +68,10 @@
64	68	}
65	69
66	70	if ( in_array( $screen->id, array( 'property' ) ) )
67	71	{
68		- if ( isset($_GET['tutorial']) && sanitize_text_field($_GET['tutorial']) == 'yes' )
	72	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only tour asset selection; no data is changed.
	73	+ if ( isset( $_GET['tutorial'] ) && is_string( $_GET['tutorial'] ) && sanitize_text_field( wp_unslash( $_GET['tutorial'] ) ) === 'yes' )
69	74	{
70	75	wp_register_style( 'tour-css', PH()->plugin_url() . '/assets/css/tours/style.css', array(), '1.0.1' );
71	76	wp_register_style( 'driver-css', PH()->plugin_url() . '/assets/css/tours/driver-js.css', array(), '1.0.1' );
72	77	wp_enqueue_style( 'tour-css' );
		@@ -75,14 +80,14 @@
75	80	}
76	81
77	82	if ( in_array( $screen->id, array( 'edit-contact', 'edit-enquiry', 'edit-appraisal', 'edit-viewing', 'edit-offer', 'edit-sale', 'edit-key_date' ) ) )
78	83	{
79		- wp_enqueue_style( 'daterangepicker.css', '//cdn.jsdelivr.net/npm/daterangepicker/daterangepicker.css' );
	84	+ wp_enqueue_style( 'daterangepicker.css', PH()->plugin_url() . '/assets/js/daterangepicker/daterangepicker.css', array(), '3.1.0' );
80	85	}
81	86
82	87	if ( in_array( $screen->id, array( 'edit-key_date') ) )
83	88	{
84		- wp_enqueue_style( 'admin-hide-default-post-data.css', PH()->plugin_url() . '/assets/css/admin-hide-default-post-data.css', PH_VERSION );
	89	+ wp_enqueue_style( 'admin-hide-default-post-data.css', PH()->plugin_url() . '/assets/css/admin-hide-default-post-data.css', array(), PH_VERSION );
85	90	}
86	91
87	92	if (
88	93	get_option('propertyhive_module_disabled_viewings', '') != 'yes' &&
		@@ -120,29 +125,29 @@
120	125	$screen = get_current_screen();
121	126	$suffix = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ? '' : '.min';
122	127
123	128	// Register scripts
124		- wp_register_script( 'propertyhive_dashboard', PH()->plugin_url() . '/assets/js/admin/dashboard' . /*$suffix .*/ '.js', array( 'jquery' ), PH_VERSION );
	129	+ wp_register_script( 'propertyhive_dashboard', PH()->plugin_url() . '/assets/js/admin/dashboard' . /*$suffix .*/ '.js', array( 'jquery' ), PH_VERSION, true );
125	130
126		- wp_register_script( 'propertyhive_admin', PH()->plugin_url() . '/assets/js/admin/admin' . /*$suffix .*/ '.js', array( 'jquery', 'jquery-tiptip' ), PH_VERSION );
	131	+ wp_register_script( 'propertyhive_admin', PH()->plugin_url() . '/assets/js/admin/admin' . /*$suffix .*/ '.js', array( 'jquery', 'jquery-tiptip' ), PH_VERSION, true );
127	132
128	133	wp_register_script( 'jquery-tiptip', PH()->plugin_url() . '/assets/js/jquery-tiptip/jquery.tipTip' . /*$suffix .*/ '.js', array( 'jquery' ), PH_VERSION, true );
129	134
130		- wp_register_script( 'propertyhive_admin_meta_boxes', PH()->plugin_url() . '/assets/js/admin/meta-boxes' . /*$suffix .*/ '.js', array( 'jquery', 'jquery-ui-datepicker', 'jquery-ui-sortable' ), PH_VERSION );
	135	+ wp_register_script( 'propertyhive_admin_meta_boxes', PH()->plugin_url() . '/assets/js/admin/meta-boxes' . /*$suffix .*/ '.js', array( 'jquery', 'jquery-ui-datepicker', 'jquery-ui-sortable' ), PH_VERSION, true );
131	136
132		- wp_register_script( 'propertyhive_admin_settings', PH()->plugin_url() . '/assets/js/admin/settings' . /*$suffix .*/ '.js', array( 'jquery', 'wp-color-picker' ), PH_VERSION );
	137	+ wp_register_script( 'propertyhive_admin_settings', PH()->plugin_url() . '/assets/js/admin/settings' . /*$suffix .*/ '.js', array( 'jquery', 'wp-color-picker' ), PH_VERSION, true );
133	138
134		- wp_register_script( 'propertyhive_admin_recently_viewed', PH()->plugin_url() . '/assets/js/admin/recently-viewed' . /*$suffix .*/ '.js', array( 'jquery' ), PH_VERSION );
	139	+ wp_register_script( 'propertyhive_admin_recently_viewed', PH()->plugin_url() . '/assets/js/admin/recently-viewed' . /*$suffix .*/ '.js', array( 'jquery' ), PH_VERSION, true );
135	140
136		- wp_register_script( 'ajax-chosen', PH()->plugin_url() . '/assets/js/chosen/ajax-chosen.jquery' . /*$suffix .*/ '.js', array('jquery', 'chosen'), PH_VERSION );
	141	+ wp_register_script( 'ajax-chosen', PH()->plugin_url() . '/assets/js/chosen/ajax-chosen.jquery' . /*$suffix .*/ '.js', array('jquery', 'chosen'), PH_VERSION, true );
137	142
138		- wp_register_script( 'chosen', PH()->plugin_url() . '/assets/js/chosen/chosen.jquery' . /*$suffix .*/ '.js', array('jquery'), PH_VERSION );
	143	+ wp_register_script( 'chosen', PH()->plugin_url() . '/assets/js/chosen/chosen.jquery' . /*$suffix .*/ '.js', array('jquery'), PH_VERSION, true );
139	144
140		- wp_register_script( 'multiselect', PH()->plugin_url() . '/assets/js/multiselect/jquery.multiselect' . /*$suffix .*/ '.js', array('jquery'), '2.4.18' );
	145	+ wp_register_script( 'multiselect', PH()->plugin_url() . '/assets/js/multiselect/jquery.multiselect' . /*$suffix .*/ '.js', array('jquery'), '2.4.18', true );
141	146
142		- wp_register_script( 'flot', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot' . $suffix . '.js', array( 'jquery' ), PH_VERSION );
143		- wp_register_script( 'flot-resize', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot.resize' . $suffix . '.js', array( 'jquery', 'flot' ), PH_VERSION );
144		- wp_register_script( 'flot-time', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot.time' . $suffix . '.js', array( 'jquery', 'flot' ), PH_VERSION );
	147	+ wp_register_script( 'flot', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot' . $suffix . '.js', array( 'jquery' ), PH_VERSION, true );
	148	+ wp_register_script( 'flot-resize', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot.resize' . $suffix . '.js', array( 'jquery', 'flot' ), PH_VERSION, true );
	149	+ wp_register_script( 'flot-time', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot.time' . $suffix . '.js', array( 'jquery', 'flot' ), PH_VERSION, true );
145	150	//wp_register_script( 'flot-pie', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot.pie' . $suffix . '.js', array( 'jquery', 'flot' ), PH_VERSION );
146	151	//wp_register_script( 'flot-stack', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot.stack' . $suffix . '.js', array( 'jquery', 'flot' ), PH_VERSION );
147	152
148	153	wp_enqueue_script( 'propertyhive_admin' );
		@@ -153,8 +158,9 @@
153	158	if (
154	159	isset($post->ID) &&
155	160	function_exists( 'use_block_editor_for_post_type' ) &&
156	161	use_block_editor_for_post_type( get_post_type($post->ID) ) &&
	162	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only classic/block editor selection controls the scripts loaded.
157	163	!isset( $_GET['classic-editor'] ) &&
158	164	is_array($tabs) &&
159	165	!empty($tabs)
160	166	)
		@@ -212,16 +218,16 @@
212	218	}
213	219
214	220	if ( in_array( $screen->id, array( 'edit-contact', 'edit-enquiry', 'edit-appraisal', 'edit-viewing', 'edit-offer', 'edit-sale', 'edit-key_date' ) ) )
215	221	{
216		- wp_enqueue_script( 'moment.js', '//cdn.jsdelivr.net/momentjs/latest/moment.min.js' );
217		- wp_enqueue_script( 'daterangepicker.js', '//cdn.jsdelivr.net/npm/daterangepicker/daterangepicker.min.js' );
218		- wp_enqueue_script( 'date_range_filter.js', PH()->plugin_url() . '/assets/js/admin/date_range_filter.js', array('jquery', 'moment.js', 'daterangepicker.js'), PH_VERSION );
	222	+ wp_enqueue_script( 'moment' );
	223	+ wp_enqueue_script( 'daterangepicker.js', PH()->plugin_url() . '/assets/js/daterangepicker/daterangepicker.js', array( 'jquery', 'moment' ), '3.1.0', true );
	224	+ wp_enqueue_script( 'date_range_filter.js', PH()->plugin_url() . '/assets/js/admin/date_range_filter.js', array( 'jquery', 'moment', 'daterangepicker.js' ), PH_VERSION, true );
219	225	}
220	226
221	227	if ( in_array( $screen->id, array( 'edit-key_date' ) ) )
222	228	{
223		- wp_enqueue_script( 'inline-edit-key_date.js', PH()->plugin_url() . '/assets/js/admin/inline-edit-key_date.js', array('jquery'), PH_VERSION );
	229	+ wp_enqueue_script( 'inline-edit-key_date.js', PH()->plugin_url() . '/assets/js/admin/inline-edit-key_date.js', array('jquery'), PH_VERSION, true );
224	230	}
225	231
226	232	if (
227	233	get_option('propertyhive_module_disabled_viewings', '') != 'yes' &&
		@@ -227,9 +233,9 @@
227	233	get_option('propertyhive_module_disabled_viewings', '') != 'yes' &&
228	234	in_array( $screen->id, array( 'property', 'contact' ) )
229	235	)
230	236	{
231		- wp_enqueue_script( 'propertyhive_fancybox', PH()->plugin_url() . '/assets/js/fancybox/jquery.fancybox.js', array('jquery'), '3.5.7' );
	237	+ wp_enqueue_script( 'propertyhive_fancybox', PH()->plugin_url() . '/assets/js/fancybox/jquery.fancybox.js', array('jquery'), '3.5.7', true );
232	238	}
233	239
234	240	if ( in_array( $screen->id, array( 'property' ) ) )
235	241	{
		@@ -238,12 +244,13 @@
238	244	require( ABSPATH . WPINC . '/class-wp-editor.php' );
239	245	}
240	246	add_action( 'admin_print_footer_scripts', array( '_WP_Editors', 'print_default_editor_scripts' ) );
241	247
242		- if ( isset($_GET['tutorial']) && sanitize_text_field($_GET['tutorial']) == 'yes' )
	248	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only tour asset selection; no data is changed.
	249	+ if ( isset( $_GET['tutorial'] ) && is_string( $_GET['tutorial'] ) && sanitize_text_field( wp_unslash( $_GET['tutorial'] ) ) === 'yes' )
243	250	{
244		- wp_enqueue_script( 'driver-js', PH()->plugin_url() . '/assets/js/tours/driver-js.js', array(), '1.0.1' );
245		- wp_register_script( 'tour', PH()->plugin_url() . '/assets/js/tours/tour.js', array( 'driver-js' ), '1.0.1' );
	251	+ wp_enqueue_script( 'driver-js', PH()->plugin_url() . '/assets/js/tours/driver-js.js', array(), '1.0.1', true );
	252	+ wp_register_script( 'tour', PH()->plugin_url() . '/assets/js/tours/tour.js', array( 'driver-js' ), '1.0.1', true );
246	253	wp_enqueue_script( 'tour' );
247	254
248	255	$tours = [
249	256	'add-property' => [
		@@ -313,15 +320,15 @@
313	320	wp_enqueue_script( 'wp-tinymce' );
314	321
315	322	if ( get_option('propertyhive_maps_provider') == 'mapbox' )
316	323	{
317		- wp_register_script('mapbox', PH()->plugin_url() . '/assets/js/mapbox/mapbox-gl.js', false, '3.8.0');
	324	+ wp_register_script('mapbox', PH()->plugin_url() . '/assets/js/mapbox/mapbox-gl.js', false, '3.8.0', true );
318	325	wp_enqueue_script('mapbox');
319	326
320	327	if ( get_option('propertyhive_geocoding_provider') == '' )
321	328	{
322	329	$api_key = get_option('propertyhive_google_maps_geocoding_api_key');
323		- wp_register_script('googlemaps', '//maps.googleapis.com/maps/api/js?' . ( ( $api_key != '' && $api_key !== FALSE ) ? 'key=' . $api_key : '' ), false, '3');
	330	+ wp_register_script('googlemaps', '//maps.googleapis.com/maps/api/js?' . ( ( $api_key != '' && $api_key !== FALSE ) ? 'key=' . $api_key : '' ), false, '3', true );
324	331	wp_enqueue_script('googlemaps');
325	332	}
326	333	}
327	334	elseif ( get_option('propertyhive_maps_provider') == 'osm' )
		@@ -334,9 +341,9 @@
334	341
335	342	if ( get_option('propertyhive_geocoding_provider') == '' )
336	343	{
337	344	$api_key = get_option('propertyhive_google_maps_geocoding_api_key');
338		- wp_register_script('googlemaps', '//maps.googleapis.com/maps/api/js?' . ( ( $api_key != '' && $api_key !== FALSE ) ? 'key=' . $api_key : '' ), false, '3');
	345	+ wp_register_script('googlemaps', '//maps.googleapis.com/maps/api/js?' . ( ( $api_key != '' && $api_key !== FALSE ) ? 'key=' . $api_key : '' ), false, '3', true );
339	346	wp_enqueue_script('googlemaps');
340	347	}
341	348	}
342	349	else
		@@ -341,9 +348,9 @@
341	348	}
342	349	else
343	350	{
344	351	$api_key = get_option('propertyhive_google_maps_api_key');
345		- wp_register_script('googlemaps', '//maps.googleapis.com/maps/api/js?' . ( ( $api_key != '' && $api_key !== FALSE ) ? 'key=' . $api_key : '' ), false, '3');
	352	+ wp_register_script('googlemaps', '//maps.googleapis.com/maps/api/js?' . ( ( $api_key != '' && $api_key !== FALSE ) ? 'key=' . $api_key : '' ), false, '3', true );
346	353	wp_enqueue_script('googlemaps');
347	354	}
348	355
349	356	wp_enqueue_media();
		@@ -361,8 +368,10 @@
361	368	'get_notes_nonce' => wp_create_nonce("get-notes"),
362	369	'pin_note_nonce' => wp_create_nonce("pin-note"),
363	370	'add_note_nonce' => wp_create_nonce("add-note"),
364	371	'delete_note_nonce' => wp_create_nonce("delete-note"),
	372	+ 'add_key_date_nonce' => wp_create_nonce( 'propertyhive-add-key-date' ),
	373	+ 'export_sub_grid_nonce' => wp_create_nonce( 'propertyhive-export-sub-grid' ),
365	374	'viewing_details_meta_nonce' => wp_create_nonce( 'viewing-details-meta-box' ),
366	375	'viewing_actions_nonce' => wp_create_nonce( 'viewing-actions' ),
367	376	'save_key_date_nonce' => wp_create_nonce( 'save-key-date' ),
368	377	'delete_key_date_nonce' => wp_create_nonce( 'delete-key-date' ),
		@@ -394,13 +403,15 @@
394	403	'primary_department_not_active_warning' => __( 'The chosen primary department has not been selected as active', 'propertyhive' ),
395	404	'no_countries_selected' => __( 'Please select which countries you operate in', 'propertyhive' ),
396	405	'default_country_not_in_selected' => __( 'The default country hasn\'t been selected as a country you operate in', 'propertyhive' ),
397	406	'admin_url' => admin_url(),
398		- 'taxonomy_section' => ( ( isset($_GET['section']) ) ? sanitize_text_field($_GET['section']) : '' ),
	407	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only settings section passed through WordPress script localization.
	408	+ 'taxonomy_section' => isset( $_GET['section'] ) && is_string( $_GET['section'] ) ? sanitize_text_field( wp_unslash( $_GET['section'] ) ) : '',
399	409	'ajax_nonce' => wp_create_nonce("updates"),
400	410	'features_settings_url' => admin_url('admin.php?page=ph-settings&tab=features'),
401	411	);
402		- if ( isset($_GET['tab']) && ph_clean($_GET['tab']) == 'licensekey' )
	412	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Settings tab determines whether the existing license status is refreshed.
	413	+ if ( isset( $_GET['tab'] ) && is_string( $_GET['tab'] ) && sanitize_text_field( wp_unslash( $_GET['tab'] ) ) === 'licensekey' )
403	414	{
404	415	$params['valid_pro_license_key'] = PH()->license->is_valid_pro_license_key(true);
405	416	}
406	417	else
		@@ -464,5 +475,5 @@
464	475	}
465	476
466	477	endif;
467	478
468		-return new PH_Admin_Assets();
	479	+return new PH_Admin_Assets();