← All changes | app/Controllers/AdminController.php +60 -11 4.0.0 → 4.0.4 View file →

		@@ -65,12 +65,25 @@
65	65	*
66	66	* @author Peter Featherstone <peter@featherstone.me>
67	67	*
68	68	* @since 3.0
	69	+ * @param bool $valid_nonce Is the form nonce valid or not.
69	70	*
70	71	* @return string Output HTML from rendered view.
71	72	*/
72		- public function rebuild() {
	73	+ public function rebuild( $valid_nonce ) {
	74	+
	75	+ // Check form nonce is valid or not.
	76	+ if ( ! $valid_nonce ) {
	77	+ return $this->view->render(
	78	+ 'admin/main.html.twig',
	79	+ [
	80	+ 'options' => $this->manager->all(),
	81	+ 'alert' => [ 'danger' => 'CSRF token not valid' ]
	82	+ ]
	83	+ );
	84	+ }
	85	+
73	86	update_option('responsive_menu_version', '2.8.9');
74	87
75	88	return $this->view->render(
76	89	'admin/main.html.twig',
		@@ -92,15 +105,27 @@
92	105	* @author Peter Featherstone <peter@featherstone.me>
93	106	*
94	107	* @since 3.1.16
95	108	*
96		- * @param string $theme The theme name to apply
	109	+ * @param string $theme The theme name to apply
	110	+ * @param bool $valid_nonce Is the form nonce valid or not.
97	111	*
98	112	* @return string Output HTML from rendered view.
99	113	*/
100		- public function apply_theme($theme) {
	114	+ public function apply_theme( $theme, $valid_nonce ) {
101	115	$options = $this->manager->all();
102	116
	117	+ // Check form nonce is valid or not.
	118	+ if ( ! $valid_nonce ) {
	119	+ return $this->view->render(
	120	+ 'admin/main.html.twig',
	121	+ [
	122	+ 'options' => $options,
	123	+ 'alert' => [ 'danger' => 'CSRF token not valid' ]
	124	+ ]
	125	+ );
	126	+ }
	127	+
103	128	$upload_folder = wp_upload_dir()['basedir'];
104	129	$theme_folder = $upload_folder . '/responsive-menu-themes/';
105	130	$options_file_location = $theme_folder . $theme . '/options.json';
106	131
		@@ -133,14 +158,19 @@
133	158	* @author Peter Featherstone <peter@featherstone.me>
134	159	*
135	160	* @since 3.1.16
136	161	*
137		- * @param string $theme The theme file location to unzip
	162	+ * @param string $theme The theme file location to unzip
	163	+ * @param bool $valid_nonce Is the form nonce valid or not.
138	164	*
139	165	* @return string Output HTML from rendered view.
140	166	*/
141		- public function import_theme($theme) {
142		- if($theme):
	167	+ public function import_theme( $theme, $valid_nonce ) {
	168	+
	169	+ // Check nonce is valid or not.
	170	+ if ( ! $valid_nonce ):
	171	+ $alert = [ 'danger' => 'CSRF token not valid' ];
	172	+ elseif ( ! empty( $theme ) ):
143	173	WP_Filesystem();
144	174	$upload_folder = wp_upload_dir()['basedir'] . '/responsive-menu-themes';
145	175
146	176	$unzipfile = unzip_file($theme, $upload_folder);
		@@ -228,12 +258,25 @@
228	258	*
229	259	* @since 3.0
230	260	*
231	261	* @param array $default_options An array of the default options.
	262	+ * @param bool $valid_nonce Is the form nonce valid or not.
232	263	*
233	264	* @return string Output HTML from rendered view.
234	265	*/
235		- public function reset($default_options) {
	266	+ public function reset($default_options, $valid_nonce ) {
	267	+
	268	+ // Check form nonce is valid or not.
	269	+ if ( ! $valid_nonce ) {
	270	+ return $this->view->render(
	271	+ 'admin/main.html.twig',
	272	+ [
	273	+ 'options' => $this->manager->all(),
	274	+ 'alert' => [ 'danger' => 'CSRF token not valid' ]
	275	+ ]
	276	+ );
	277	+ }
	278	+
236	279	try {
237	280	$options = $this->manager->updateOptions($default_options);
238	281	$task = new UpdateOptionsTask;
239	282	$task->run($options, $this->view);
		@@ -262,15 +305,21 @@
262	305	*
263	306	* @since 3.0
264	307	*
265	308	* @param array $imported_options An array of the imported options.
	309	+ * @param bool $valid_nonce Is the form nonce valid or not.
266	310	*
267	311	* @return string Output HTML from rendered view.
268	312	*/
269		- public function import($imported_options) {
	313	+ public function import( $imported_options, $valid_nonce ) {
270	314	$errors = [];
271		- if(!empty($imported_options)):
272	315
	316	+ // Check nonce is valid or not.
	317	+ if ( ! $valid_nonce ) {
	318	+ $alert = [ 'danger' => 'CSRF token not valid' ];
	319	+ $options = $this->manager->all();
	320	+ } elseif( ! empty( $imported_options ) ) {
	321	+
273	322	$validator = new Validator();
274	323	if($validator->validate($imported_options)):
275	324	try {
276	325	unset($imported_options['button_click_trigger']);
		@@ -289,13 +338,13 @@
289	338	$alert = ['danger' => $errors];
290	339
291	340	endif;
292	341
293		- else:
	342	+ } else {
294	343	$options = $this->manager->all();
295	344	$alert = ['danger' => 'No import file selected'];
296	345
297		- endif;
	346	+ }
298	347
299	348	return $this->view->render(
300	349	'admin/main.html.twig',
301	350	[