← All changes | includes/admin/class-ph-admin-reports.php +19 -4 2.2.6 → 2.3.0 View file →

		@@ -14,8 +14,9 @@
14	14
15	15	/**
16	16	* PH_Admin_Reports
17	17	*/
	18	+// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Admin_Reports; preserving the existing PH_* class name is required for plugin and extension compatibility.
18	19	class PH_Admin_Reports {
19	20
20	21	/**
21	22	* Handles the display of the main Property Hive reports page in admin.
		@@ -24,13 +25,26 @@
24	25	* @return void
25	26	*/
26	27	public static function output() {
27	28
28		- $reports = self::get_reports();
29		- $first_tab = array_keys( $reports );
30		- $current_tab = ! empty( $_GET['tab'] ) ? sanitize_title( $_GET['tab'] ) : $first_tab[0];
31		- $current_report = isset( $_GET['report'] ) ? sanitize_title( $_GET['report'] ) : current( array_keys( $reports[ $current_tab ]['reports'] ) );
	29	+ if ( ! current_user_can( 'manage_propertyhive' ) ) {
	30	+ return;
	31	+ }
32	32
	33	+ $reports = self::get_reports();
	34	+ if ( empty( $reports ) ) {
	35	+ return;
	36	+ }
	37	+ $first_tab = array_keys( $reports );
	38	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Authorized read-only report navigation; no state-changing action is performed.
	39	+ $current_tab = ! empty( $_GET['tab'] ) && is_string( $_GET['tab'] ) ? sanitize_title( wp_unslash( $_GET['tab'] ) ) : $first_tab[0];
	40	+ if ( ! isset( $reports[ $current_tab ] ) ) {
	41	+ $current_tab = $first_tab[0];
	42	+ }
	43	+ $report_keys = array_keys( $reports[ $current_tab ]['reports'] );
	44	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Authorized read-only report navigation; callbacks are selected only from registered reports.
	45	+ $current_report = isset( $_GET['report'] ) && is_string( $_GET['report'] ) ? sanitize_title( wp_unslash( $_GET['report'] ) ) : current( $report_keys );
	46	+
33	47	include_once( 'reports/class-ph-admin-report.php' );
34	48	include_once( 'views/html-admin-page-reports.php' );
35	49	}
36	50
		@@ -125,8 +139,9 @@
125	139	public static function get_report( $name ) {
126	140	$name = sanitize_title( str_replace( '_', '-', $name ) );
127	141	$class = 'PH_Report_' . str_replace( '-', '_', $name );
128	142
	143	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Existing public Property Hive extension hook ph_admin_reports_path; changing the established name would detach installed callbacks.
129	144	include_once( apply_filters( 'ph_admin_reports_path', 'reports/class-ph-report-' . $name . '.php', $name, $class ) );
130	145
131	146	if ( ! class_exists( $class ) )
132	147	return;