← All changes | includes/admin/class-ph-admin-assets.php +40 -30 2.2.4 → 2.3.1 View file →

		@@ -1,5 +1,8 @@
1	1	<?php
	2	+// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean
	3	+// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate.
	4	+
2	5	/**
3	6	* Load assets.
4	7	*
5	8	* @author PropertyHive
		@@ -14,8 +17,9 @@
14	17
15	18	/**
16	19	* PH_Admin_Assets Class
17	20	*/
	21	+// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Admin_Assets; preserving the existing PH_* class name is required for plugin and extension compatibility.
18	22	class PH_Admin_Assets {
19	23
20	24	/**
21	25	* Hook in tabs.
		@@ -64,9 +68,10 @@
64	68	}
65	69
66	70	if ( in_array( $screen->id, array( 'property' ) ) )
67	71	{
68		- if ( isset($_GET['tutorial']) && sanitize_text_field($_GET['tutorial']) == 'yes' )
	72	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only tour asset selection; no data is changed.
	73	+ if ( isset( $_GET['tutorial'] ) && is_string( $_GET['tutorial'] ) && sanitize_text_field( wp_unslash( $_GET['tutorial'] ) ) === 'yes' )
69	74	{
70	75	wp_register_style( 'tour-css', PH()->plugin_url() . '/assets/css/tours/style.css', array(), '1.0.1' );
71	76	wp_register_style( 'driver-css', PH()->plugin_url() . '/assets/css/tours/driver-js.css', array(), '1.0.1' );
72	77	wp_enqueue_style( 'tour-css' );
		@@ -75,14 +80,14 @@
75	80	}
76	81
77	82	if ( in_array( $screen->id, array( 'edit-contact', 'edit-enquiry', 'edit-appraisal', 'edit-viewing', 'edit-offer', 'edit-sale', 'edit-key_date' ) ) )
78	83	{
79		- wp_enqueue_style( 'daterangepicker.css', '//cdn.jsdelivr.net/npm/daterangepicker/daterangepicker.css' );
	84	+ wp_enqueue_style( 'daterangepicker.css', PH()->plugin_url() . '/assets/js/daterangepicker/daterangepicker.css', array(), '3.1.0' );
80	85	}
81	86
82	87	if ( in_array( $screen->id, array( 'edit-key_date') ) )
83	88	{
84		- wp_enqueue_style( 'admin-hide-default-post-data.css', PH()->plugin_url() . '/assets/css/admin-hide-default-post-data.css', PH_VERSION );
	89	+ wp_enqueue_style( 'admin-hide-default-post-data.css', PH()->plugin_url() . '/assets/css/admin-hide-default-post-data.css', array(), PH_VERSION );
85	90	}
86	91
87	92	if (
88	93	get_option('propertyhive_module_disabled_viewings', '') != 'yes' &&
		@@ -117,33 +122,32 @@
117	122	public function admin_scripts() {
118	123	global $wp_query, $post, $tabs;
119	124
120	125	$screen = get_current_screen();
121		- $ph_screen_id = sanitize_title( __( 'PropertyHive', 'propertyhive' ) );
122	126	$suffix = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ? '' : '.min';
123	127
124	128	// Register scripts
125		- wp_register_script( 'propertyhive_dashboard', PH()->plugin_url() . '/assets/js/admin/dashboard' . /*$suffix .*/ '.js', array( 'jquery' ), PH_VERSION );
	129	+ wp_register_script( 'propertyhive_dashboard', PH()->plugin_url() . '/assets/js/admin/dashboard' . /*$suffix .*/ '.js', array( 'jquery' ), PH_VERSION, true );
126	130
127		- wp_register_script( 'propertyhive_admin', PH()->plugin_url() . '/assets/js/admin/admin' . /*$suffix .*/ '.js', array( 'jquery', 'jquery-tiptip' ), PH_VERSION );
	131	+ wp_register_script( 'propertyhive_admin', PH()->plugin_url() . '/assets/js/admin/admin' . /*$suffix .*/ '.js', array( 'jquery', 'jquery-tiptip' ), PH_VERSION, true );
128	132
129	133	wp_register_script( 'jquery-tiptip', PH()->plugin_url() . '/assets/js/jquery-tiptip/jquery.tipTip' . /*$suffix .*/ '.js', array( 'jquery' ), PH_VERSION, true );
130	134
131		- wp_register_script( 'propertyhive_admin_meta_boxes', PH()->plugin_url() . '/assets/js/admin/meta-boxes' . /*$suffix .*/ '.js', array( 'jquery', 'jquery-ui-datepicker', 'jquery-ui-sortable' ), PH_VERSION );
	135	+ wp_register_script( 'propertyhive_admin_meta_boxes', PH()->plugin_url() . '/assets/js/admin/meta-boxes' . /*$suffix .*/ '.js', array( 'jquery', 'jquery-ui-datepicker', 'jquery-ui-sortable' ), PH_VERSION, true );
132	136
133		- wp_register_script( 'propertyhive_admin_settings', PH()->plugin_url() . '/assets/js/admin/settings' . /*$suffix .*/ '.js', array( 'jquery', 'wp-color-picker' ), PH_VERSION );
	137	+ wp_register_script( 'propertyhive_admin_settings', PH()->plugin_url() . '/assets/js/admin/settings' . /*$suffix .*/ '.js', array( 'jquery', 'wp-color-picker' ), PH_VERSION, true );
134	138
135		- wp_register_script( 'propertyhive_admin_recently_viewed', PH()->plugin_url() . '/assets/js/admin/recently-viewed' . /*$suffix .*/ '.js', array( 'jquery' ), PH_VERSION );
	139	+ wp_register_script( 'propertyhive_admin_recently_viewed', PH()->plugin_url() . '/assets/js/admin/recently-viewed' . /*$suffix .*/ '.js', array( 'jquery' ), PH_VERSION, true );
136	140
137		- wp_register_script( 'ajax-chosen', PH()->plugin_url() . '/assets/js/chosen/ajax-chosen.jquery' . /*$suffix .*/ '.js', array('jquery', 'chosen'), PH_VERSION );
	141	+ wp_register_script( 'ajax-chosen', PH()->plugin_url() . '/assets/js/chosen/ajax-chosen.jquery' . /*$suffix .*/ '.js', array('jquery', 'chosen'), PH_VERSION, true );
138	142
139		- wp_register_script( 'chosen', PH()->plugin_url() . '/assets/js/chosen/chosen.jquery' . /*$suffix .*/ '.js', array('jquery'), PH_VERSION );
	143	+ wp_register_script( 'chosen', PH()->plugin_url() . '/assets/js/chosen/chosen.jquery' . /*$suffix .*/ '.js', array('jquery'), PH_VERSION, true );
140	144
141		- wp_register_script( 'multiselect', PH()->plugin_url() . '/assets/js/multiselect/jquery.multiselect' . /*$suffix .*/ '.js', array('jquery'), '2.4.18' );
	145	+ wp_register_script( 'multiselect', PH()->plugin_url() . '/assets/js/multiselect/jquery.multiselect' . /*$suffix .*/ '.js', array('jquery'), '2.4.18', true );
142	146
143		- wp_register_script( 'flot', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot' . $suffix . '.js', array( 'jquery' ), PH_VERSION );
144		- wp_register_script( 'flot-resize', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot.resize' . $suffix . '.js', array( 'jquery', 'flot' ), PH_VERSION );
145		- wp_register_script( 'flot-time', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot.time' . $suffix . '.js', array( 'jquery', 'flot' ), PH_VERSION );
	147	+ wp_register_script( 'flot', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot' . $suffix . '.js', array( 'jquery' ), PH_VERSION, true );
	148	+ wp_register_script( 'flot-resize', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot.resize' . $suffix . '.js', array( 'jquery', 'flot' ), PH_VERSION, true );
	149	+ wp_register_script( 'flot-time', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot.time' . $suffix . '.js', array( 'jquery', 'flot' ), PH_VERSION, true );
146	150	//wp_register_script( 'flot-pie', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot.pie' . $suffix . '.js', array( 'jquery', 'flot' ), PH_VERSION );
147	151	//wp_register_script( 'flot-stack', PH()->plugin_url() . '/assets/js/jquery-flot/jquery.flot.stack' . $suffix . '.js', array( 'jquery', 'flot' ), PH_VERSION );
148	152
149	153	wp_enqueue_script( 'propertyhive_admin' );
		@@ -154,8 +158,9 @@
154	158	if (
155	159	isset($post->ID) &&
156	160	function_exists( 'use_block_editor_for_post_type' ) &&
157	161	use_block_editor_for_post_type( get_post_type($post->ID) ) &&
	162	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only classic/block editor selection controls the scripts loaded.
158	163	!isset( $_GET['classic-editor'] ) &&
159	164	is_array($tabs) &&
160	165	!empty($tabs)
161	166	)
		@@ -213,16 +218,16 @@
213	218	}
214	219
215	220	if ( in_array( $screen->id, array( 'edit-contact', 'edit-enquiry', 'edit-appraisal', 'edit-viewing', 'edit-offer', 'edit-sale', 'edit-key_date' ) ) )
216	221	{
217		- wp_enqueue_script( 'moment.js', '//cdn.jsdelivr.net/momentjs/latest/moment.min.js' );
218		- wp_enqueue_script( 'daterangepicker.js', '//cdn.jsdelivr.net/npm/daterangepicker/daterangepicker.min.js' );
219		- wp_enqueue_script( 'date_range_filter.js', PH()->plugin_url() . '/assets/js/admin/date_range_filter.js', array('jquery', 'moment.js', 'daterangepicker.js'), PH_VERSION );
	222	+ wp_enqueue_script( 'moment' );
	223	+ wp_enqueue_script( 'daterangepicker.js', PH()->plugin_url() . '/assets/js/daterangepicker/daterangepicker.js', array( 'jquery', 'moment' ), '3.1.0', true );
	224	+ wp_enqueue_script( 'date_range_filter.js', PH()->plugin_url() . '/assets/js/admin/date_range_filter.js', array( 'jquery', 'moment', 'daterangepicker.js' ), PH_VERSION, true );
220	225	}
221	226
222	227	if ( in_array( $screen->id, array( 'edit-key_date' ) ) )
223	228	{
224		- wp_enqueue_script( 'inline-edit-key_date.js', PH()->plugin_url() . '/assets/js/admin/inline-edit-key_date.js', array('jquery'), PH_VERSION );
	229	+ wp_enqueue_script( 'inline-edit-key_date.js', PH()->plugin_url() . '/assets/js/admin/inline-edit-key_date.js', array('jquery'), PH_VERSION, true );
225	230	}
226	231
227	232	if (
228	233	get_option('propertyhive_module_disabled_viewings', '') != 'yes' &&
		@@ -228,9 +233,9 @@
228	233	get_option('propertyhive_module_disabled_viewings', '') != 'yes' &&
229	234	in_array( $screen->id, array( 'property', 'contact' ) )
230	235	)
231	236	{
232		- wp_enqueue_script( 'propertyhive_fancybox', PH()->plugin_url() . '/assets/js/fancybox/jquery.fancybox.js', array('jquery'), '3.5.7' );
	237	+ wp_enqueue_script( 'propertyhive_fancybox', PH()->plugin_url() . '/assets/js/fancybox/jquery.fancybox.js', array('jquery'), '3.5.7', true );
233	238	}
234	239
235	240	if ( in_array( $screen->id, array( 'property' ) ) )
236	241	{
		@@ -239,12 +244,13 @@
239	244	require( ABSPATH . WPINC . '/class-wp-editor.php' );
240	245	}
241	246	add_action( 'admin_print_footer_scripts', array( '_WP_Editors', 'print_default_editor_scripts' ) );
242	247
243		- if ( isset($_GET['tutorial']) && sanitize_text_field($_GET['tutorial']) == 'yes' )
	248	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only tour asset selection; no data is changed.
	249	+ if ( isset( $_GET['tutorial'] ) && is_string( $_GET['tutorial'] ) && sanitize_text_field( wp_unslash( $_GET['tutorial'] ) ) === 'yes' )
244	250	{
245		- wp_enqueue_script( 'driver-js', PH()->plugin_url() . '/assets/js/tours/driver-js.js', array(), '1.0.1' );
246		- wp_register_script( 'tour', PH()->plugin_url() . '/assets/js/tours/tour.js', array( 'driver-js' ), '1.0.1' );
	251	+ wp_enqueue_script( 'driver-js', PH()->plugin_url() . '/assets/js/tours/driver-js.js', array(), '1.0.1', true );
	252	+ wp_register_script( 'tour', PH()->plugin_url() . '/assets/js/tours/tour.js', array( 'driver-js' ), '1.0.1', true );
247	253	wp_enqueue_script( 'tour' );
248	254
249	255	$tours = [
250	256	'add-property' => [
		@@ -314,15 +320,15 @@
314	320	wp_enqueue_script( 'wp-tinymce' );
315	321
316	322	if ( get_option('propertyhive_maps_provider') == 'mapbox' )
317	323	{
318		- wp_register_script('mapbox', PH()->plugin_url() . '/assets/js/mapbox/mapbox-gl.js', false, '3.8.0');
	324	+ wp_register_script('mapbox', PH()->plugin_url() . '/assets/js/mapbox/mapbox-gl.js', false, '3.8.0', true );
319	325	wp_enqueue_script('mapbox');
320	326
321	327	if ( get_option('propertyhive_geocoding_provider') == '' )
322	328	{
323	329	$api_key = get_option('propertyhive_google_maps_geocoding_api_key');
324		- wp_register_script('googlemaps', '//maps.googleapis.com/maps/api/js?' . ( ( $api_key != '' && $api_key !== FALSE ) ? 'key=' . $api_key : '' ), false, '3');
	330	+ wp_register_script('googlemaps', '//maps.googleapis.com/maps/api/js?' . ( ( $api_key != '' && $api_key !== FALSE ) ? 'key=' . $api_key : '' ), false, '3', true );
325	331	wp_enqueue_script('googlemaps');
326	332	}
327	333	}
328	334	elseif ( get_option('propertyhive_maps_provider') == 'osm' )
		@@ -335,9 +341,9 @@
335	341
336	342	if ( get_option('propertyhive_geocoding_provider') == '' )
337	343	{
338	344	$api_key = get_option('propertyhive_google_maps_geocoding_api_key');
339		- wp_register_script('googlemaps', '//maps.googleapis.com/maps/api/js?' . ( ( $api_key != '' && $api_key !== FALSE ) ? 'key=' . $api_key : '' ), false, '3');
	345	+ wp_register_script('googlemaps', '//maps.googleapis.com/maps/api/js?' . ( ( $api_key != '' && $api_key !== FALSE ) ? 'key=' . $api_key : '' ), false, '3', true );
340	346	wp_enqueue_script('googlemaps');
341	347	}
342	348	}
343	349	else
		@@ -342,9 +348,9 @@
342	348	}
343	349	else
344	350	{
345	351	$api_key = get_option('propertyhive_google_maps_api_key');
346		- wp_register_script('googlemaps', '//maps.googleapis.com/maps/api/js?' . ( ( $api_key != '' && $api_key !== FALSE ) ? 'key=' . $api_key : '' ), false, '3');
	352	+ wp_register_script('googlemaps', '//maps.googleapis.com/maps/api/js?' . ( ( $api_key != '' && $api_key !== FALSE ) ? 'key=' . $api_key : '' ), false, '3', true );
347	353	wp_enqueue_script('googlemaps');
348	354	}
349	355
350	356	wp_enqueue_media();
		@@ -362,8 +368,10 @@
362	368	'get_notes_nonce' => wp_create_nonce("get-notes"),
363	369	'pin_note_nonce' => wp_create_nonce("pin-note"),
364	370	'add_note_nonce' => wp_create_nonce("add-note"),
365	371	'delete_note_nonce' => wp_create_nonce("delete-note"),
	372	+ 'add_key_date_nonce' => wp_create_nonce( 'propertyhive-add-key-date' ),
	373	+ 'export_sub_grid_nonce' => wp_create_nonce( 'propertyhive-export-sub-grid' ),
366	374	'viewing_details_meta_nonce' => wp_create_nonce( 'viewing-details-meta-box' ),
367	375	'viewing_actions_nonce' => wp_create_nonce( 'viewing-actions' ),
368	376	'save_key_date_nonce' => wp_create_nonce( 'save-key-date' ),
369	377	'delete_key_date_nonce' => wp_create_nonce( 'delete-key-date' ),
		@@ -395,13 +403,15 @@
395	403	'primary_department_not_active_warning' => __( 'The chosen primary department has not been selected as active', 'propertyhive' ),
396	404	'no_countries_selected' => __( 'Please select which countries you operate in', 'propertyhive' ),
397	405	'default_country_not_in_selected' => __( 'The default country hasn\'t been selected as a country you operate in', 'propertyhive' ),
398	406	'admin_url' => admin_url(),
399		- 'taxonomy_section' => ( ( isset($_GET['section']) ) ? sanitize_text_field($_GET['section']) : '' ),
	407	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only settings section passed through WordPress script localization.
	408	+ 'taxonomy_section' => isset( $_GET['section'] ) && is_string( $_GET['section'] ) ? sanitize_text_field( wp_unslash( $_GET['section'] ) ) : '',
400	409	'ajax_nonce' => wp_create_nonce("updates"),
401	410	'features_settings_url' => admin_url('admin.php?page=ph-settings&tab=features'),
402	411	);
403		- if ( isset($_GET['tab']) && ph_clean($_GET['tab']) == 'licensekey' )
	412	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Settings tab determines whether the existing license status is refreshed.
	413	+ if ( isset( $_GET['tab'] ) && is_string( $_GET['tab'] ) && sanitize_text_field( wp_unslash( $_GET['tab'] ) ) === 'licensekey' )
404	414	{
405	415	$params['valid_pro_license_key'] = PH()->license->is_valid_pro_license_key(true);
406	416	}
407	417	else
		@@ -465,5 +475,5 @@
465	475	}
466	476
467	477	endif;
468	478
469		-return new PH_Admin_Assets();
	479	+return new PH_Admin_Assets();