| @@ -12,8 +12,9 @@ | ||
| 12 | 12 | * @package PropertyHive/Classes/ |
| 13 | 13 | * @category Class |
| 14 | 14 | * @author PropertyHive |
| 15 | 15 | */ |
| 16 | +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Preserve the existing public PH_User_Contacts extension-compatible class name. | |
| 16 | 17 | class PH_User_Contacts { |
| 17 | 18 | |
| 18 | 19 | /** |
| 19 | 20 | * Hook in methods |
| @@ -36,8 +37,9 @@ | ||
| 36 | 37 | * @return void |
| 37 | 38 | */ |
| 38 | 39 | public static function redirect_to_my_account_if_logged_in() { |
| 39 | 40 | |
| 41 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only Divi builder indicator only bypasses the account-page redirect; it performs no state change. | |
| 40 | 42 | if ( is_admin() || ( defined('DOING_AJAX') && DOING_AJAX ) || isset($_GET['et_fb']) ) |
| 41 | 43 | { |
| 42 | 44 | return; |
| 43 | 45 | } |
| @@ -56,9 +58,9 @@ | ||
| 56 | 58 | { |
| 57 | 59 | $my_account_page_id = get_option( 'propertyhive_my_account_page_id', '' ); |
| 58 | 60 | if ( !empty($my_account_page_id) ) |
| 59 | 61 | { |
| 60 | - wp_redirect( get_permalink($my_account_page_id) ); | |
| 62 | + wp_safe_redirect( get_permalink($my_account_page_id) ); | |
| 61 | 63 | exit(); |
| 62 | 64 | } |
| 63 | 65 | } |
| 64 | 66 | } |
| @@ -66,20 +68,38 @@ | ||
| 66 | 68 | /** |
| 67 | 69 | * Listen for logout parameter |
| 68 | 70 | * @return void |
| 69 | 71 | */ |
| 70 | - public static function listen_for_logout( $user_id ) { | |
| 72 | + public static function listen_for_logout( $user_id = 0 ) { | |
| 71 | 73 | |
| 72 | - if ( isset($_GET['logout']) && $_GET['logout'] == 1 ) | |
| 73 | - { | |
| 74 | - wp_logout(); | |
| 74 | + if ( ! isset( $_GET['logout'] ) || ! is_string( $_GET['logout'] ) || $_GET['logout'] !== '1' ) { | |
| 75 | + return; | |
| 76 | + } | |
| 77 | + if ( ! isset( $_GET['_wpnonce'] ) || ! is_string( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'log-out' ) ) { | |
| 78 | + // Cached/legacy links must ask for confirmation without logging out first. | |
| 79 | + // Keep the confirmation on our route so the existing post-logout redirect filter still runs. | |
| 80 | + $confirmation_url = static function( $url ) { | |
| 81 | + return wp_nonce_url( add_query_arg( 'logout', '1', home_url( '/' ) ), 'log-out' ); | |
| 82 | + }; | |
| 83 | + add_filter( 'logout_url', $confirmation_url, PHP_INT_MAX ); | |
| 84 | + // Core wp_nonce_ays reads redirect_to before calling logout_url. This route | |
| 85 | + // uses its own redirect hook and must not forward arbitrary request values. | |
| 86 | + $_REQUEST['redirect_to'] = ''; | |
| 87 | + try { | |
| 88 | + wp_nonce_ays( 'log-out' ); | |
| 89 | + } finally { | |
| 90 | + remove_filter( 'logout_url', $confirmation_url, PHP_INT_MAX ); | |
| 91 | + } | |
| 92 | + return; | |
| 93 | + } | |
| 75 | 94 | |
| 76 | - // For now redirect to homepage with filter | |
| 77 | - wp_redirect( apply_filters( 'property_logout_redirect_url', home_url( '/' ) ) ); | |
| 78 | - exit; | |
| 79 | - } | |
| 80 | - } | |
| 95 | + wp_logout(); | |
| 81 | 96 | |
| 97 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Existing public property_logout_redirect_url hook must remain available to installed extensions. | |
| 98 | + wp_safe_redirect( apply_filters( 'property_logout_redirect_url', home_url( '/' ) ) ); | |
| 99 | + exit; | |
| 100 | + } | |
| 101 | + | |
| 82 | 102 | /** |
| 83 | 103 | * When user is registered ensure they're also entered as a contact |
| 84 | 104 | * @return array |
| 85 | 105 | */ |
| @@ -184,10 +204,9 @@ | ||
| 184 | 204 | } |
| 185 | 205 | else |
| 186 | 206 | { |
| 187 | 207 | // Something went wrong when inserting the user |
| 188 | - var_dump($user_id); | |
| 189 | - die(); | |
| 208 | + wp_die( esc_html( implode( ' ', $user_id->get_error_messages() ) ) ); | |
| 190 | 209 | } |
| 191 | 210 | } |
| 192 | 211 | else |
| 193 | 212 | { |
