| @@ -121,8 +121,47 @@ | ||
| 121 | 121 | echo '<div class="'.esc_attr($_notice_class).'" style="position:relative; margin:0 0 15px 2px !important; padding:8px '.(($dismiss_url !== '') ? '60px' : '8px').' 8px 8px !important;">'.$_dismiss.'<table cellspacing="0" cellpadding="0"><tr><td style="vertical-align:top; padding:0 10px 0 0;"><img src="'.esc_url($_logo_url).'" alt="" width="40" height="40" style="border:0;" /></td><td style="vertical-align:top;">'.(($title !== '') ? '<strong>'.esc_html($title).'</strong><br />' : '').wp_kses_post($message).'</td></tr></table></div>'; |
| 122 | 122 | } |
| 123 | 123 | |
| 124 | 124 | /** |
| 125 | + * Warns administrators when Pro is too old to contain the current Pro updater behavior. | |
| 126 | + * | |
| 127 | + * @package s2Member\Admin_Notices | |
| 128 | + * @since 260917.0425 | |
| 129 | + * | |
| 130 | + * @attaches-to `add_action('admin_notices');` | |
| 131 | + * @attaches-to `add_action('user_admin_notices');` | |
| 132 | + * @attaches-to `add_action('network_admin_notices');` | |
| 133 | + */ | |
| 134 | + public static function outdated_pro_notice() | |
| 135 | + { | |
| 136 | + if(!current_user_can('update_plugins') || !defined('WS_PLUGIN__S2MEMBER_PRO_VERSION') || !defined('WS_PLUGIN__S2MEMBER_VERSION')) | |
| 137 | + return; | |
| 138 | + | |
| 139 | + //260917.0425 v260913 introduced the current background Pro updater flow; Framework owns this fallback warning only for older Pro releases. | |
| 140 | + $_current_updater_version = '260913'; | |
| 141 | + if(version_compare(WS_PLUGIN__S2MEMBER_PRO_VERSION, $_current_updater_version, '>=') || !version_compare(WS_PLUGIN__S2MEMBER_PRO_VERSION, WS_PLUGIN__S2MEMBER_VERSION, '<')) | |
| 142 | + return; | |
| 143 | + | |
| 144 | + $_account_url = 'https://s2member.com/account/'; | |
| 145 | + //260917.2113 s2Member versions begin with yymmdd; show the installed Pro version's approximate age so administrators can immediately see how far behind it is. | |
| 146 | + $_pro_release_age = ''; | |
| 147 | + if(preg_match('/^(\d{2})(\d{2})(\d{2})/', WS_PLUGIN__S2MEMBER_PRO_VERSION, $_pro_version_parts)) | |
| 148 | + { | |
| 149 | + $_pro_release_timestamp = mktime(0, 0, 0, (int) $_pro_version_parts[2], (int) $_pro_version_parts[3], 2000 + (int) $_pro_version_parts[1]); | |
| 150 | + if($_pro_release_timestamp) | |
| 151 | + $_pro_release_age = human_time_diff($_pro_release_timestamp, current_time('timestamp')); | |
| 152 | + } | |
| 153 | + | |
| 154 | + //260917.1937 Keep this urgent notice compact and skimmable: short paragraphs, prominent version age/security risk, and a clearly separated update action. | |
| 155 | + $_message = '<p style="line-height:1.3em; margin:.3em 0;"><strong>Your s2Member Pro v'.esc_html(WS_PLUGIN__S2MEMBER_PRO_VERSION).($_pro_release_age ? ' is '.esc_html($_pro_release_age).' old and' : '').' is missing important security fixes</strong>.</p>'; | |
| 156 | + $_message .= '<p style="line-height:1.3em; margin:.3em 0;"><em>Please install the latest ZIP from WP Admin > Plugins > Add Plugin > Upload Plugin.</em></p>'; | |
| 157 | + $_update_button = '<a class="button button-primary" style="margin-top:.3em; background:darkred; border-color:darkred;" href="'.esc_url($_account_url).'" target="_blank" rel="external noopener">Download the Latest s2Member Pro Now</a>'; | |
| 158 | + | |
| 159 | + //260917.1937 Keep this Framework-owned warning persistent and red; include the action in the message instead of the helper's review slot so no extra <br> is inserted before it. | |
| 160 | + c_ws_plugin__s2member_admin_notices::display_security_notice($_message.$_update_button, '', array(), '', 'notice-error'); | |
| 161 | + } | |
| 162 | + | |
| 163 | + /** | |
| 125 | 164 | * Displays a branded s2Member security notice. |
| 126 | 165 | * |
| 127 | 166 | * @package s2Member\Admin_Notices |
| 128 | 167 | * @since 260813 |
| @@ -130,10 +169,11 @@ | ||
| 130 | 169 | * @param string $message Main notice message. |
| 131 | 170 | * @param string $review Review prompt shown above the items. |
| 132 | 171 | * @param array $items Notice items, with safe HTML allowed. |
| 133 | 172 | * @param string $dismiss_url Optional dismissal URL. |
| 173 | + * @param string $notice_class Optional WordPress notice severity class. | |
| 134 | 174 | */ |
| 135 | - public static function display_security_notice($message = '', $review = '', $items = array(), $dismiss_url = '') | |
| 175 | + public static function display_security_notice($message = '', $review = '', $items = array(), $dismiss_url = '', $notice_class = 'notice-warning') | |
| 136 | 176 | { |
| 137 | 177 | $message = trim((string)$message); |
| 138 | 178 | $review = trim((string)$review); |
| 139 | 179 | $items = (array)$items; |
| @@ -139,8 +179,11 @@ | ||
| 139 | 179 | $items = (array)$items; |
| 140 | 180 | if(!$message) |
| 141 | 181 | return; |
| 142 | 182 | |
| 183 | + //260917.0513 Preserve the existing warning style by default, while allowing especially urgent security notices to use WordPress's stronger error styling. | |
| 184 | + $_notice_class = (($notice_class === 'notice-error') ? 'notice notice-error' : 'notice notice-warning'); | |
| 185 | + | |
| 143 | 186 | $_items = array(); |
| 144 | 187 | foreach($items as $_item) |
| 145 | 188 | if(is_string($_item) && trim($_item) !== '') |
| 146 | 189 | $_items[] = '<em>• '.wp_kses_post($_item).'</em>'; |
| @@ -146,9 +189,12 @@ | ||
| 146 | 189 | $_items[] = '<em>• '.wp_kses_post($_item).'</em>'; |
| 147 | 190 | |
| 148 | 191 | $_logo_url = $GLOBALS['WS_PLUGIN__']['s2member']['c']['dir_url'].'/src/images/logo-square-big.png'; |
| 149 | 192 | $_dismiss = (($dismiss_url !== '') ? '<a href="'.esc_url($dismiss_url).'" title="Dismiss until detected again" style="position:absolute; top:8px; right:10px; text-decoration:none;">Dismiss</a>' : ''); |
| 150 | - echo '<div class="notice notice-warning" style="position:relative; margin:0 0 15px 2px !important; padding:8px 60px 8px 8px !important;">'.$_dismiss.'<table cellspacing="0" cellpadding="0"><tr><td style="vertical-align:top; padding:0 10px 0 0;"><img src="'.esc_url($_logo_url).'" alt="" width="40" height="40" style="border:0;" /></td><td style="vertical-align:top;"><strong>s2Member Security Notice</strong><br />'.wp_kses_post($message).(($review !== '') ? '<br />'.wp_kses_post($review) : '').(($_items) ? '<br />'.implode('<br />', $_items) : '').'</td></tr></table></div>'; | |
| 193 | + | |
| 194 | + //260917.1937 Give urgent red security notices a stronger heading without changing the existing presentation of normal yellow security notices. | |
| 195 | + $_title = (($notice_class === 'notice-error') ? '<h2 style="margin:0 0 .3em; color:darkred;">s2Member Security Notice</h2>' : '<strong>s2Member Security Notice</strong><br />'); | |
| 196 | + echo '<div class="'.esc_attr($_notice_class).'" style="position:relative; margin:0 0 15px 2px !important; padding:8px 60px 8px 8px !important;">'.$_dismiss.'<table cellspacing="0" cellpadding="0"><tr><td style="vertical-align:top; padding:0 10px 0 0;"><img src="'.esc_url($_logo_url).'" alt="" width="40" height="40" style="border:0;" /></td><td style="vertical-align:top;">'.$_title.wp_kses_post($message).(($review !== '') ? '<br />'.wp_kses_post($review) : '').(($_items) ? '<br />'.implode('<br />', $_items) : '').'</td></tr></table></div>'; | |
| 151 | 197 | } |
| 152 | 198 | |
| 153 | 199 | /** |
| 154 | 200 | * Records a shortcode user field that is not approved for cross-user display. |
| @@ -251,10 +297,10 @@ | ||
| 251 | 297 | unset($_details, $_item, $_post_id, $_edit_link, $_post_title); |
| 252 | 298 | |
| 253 | 299 | $_settings_url = add_query_arg('s2member-open-panel', 'shortcode-user-fields-whitelist', admin_url('/admin.php?page=ws-plugin--s2member-gen-ops')).'#ws-plugin--s2member-shortcode-user-fields-whitelist'; |
| 254 | 300 | $_dismiss_url = wp_nonce_url(add_query_arg('s2member-dismiss-shortcode-user-fields-notice', '1', admin_url()), 's2member-dismiss-shortcode-user-fields-notice'); |
| 255 | - $_message = 'Some s2Member shortcodes use user fields that are not in <em><a href="'.esc_url($_settings_url).'">s2Member → General Options → Shortcode User Fields Whitelist</a></em>'; | |
| 256 | - c_ws_plugin__s2member_admin_notices::display_security_notice($_message, 'Review the fields below and allow the ones that are okay for other users to see:', $_field_items, $_dismiss_url); | |
| 301 | + $_message = 'Some s2Member shortcodes attempted to display user fields from other accounts that are not in <em><a href="'.esc_url($_settings_url).'">s2Member → General Options → Shortcode User Fields Whitelist</a></em>. Those cross-user field values were blocked.'; | |
| 302 | + c_ws_plugin__s2member_admin_notices::display_security_notice($_message, 'Review the blocked fields below and allow the ones that are okay for other users to see:', $_field_items, $_dismiss_url); | |
| 257 | 303 | } |
| 258 | 304 | |
| 259 | 305 | /** |
| 260 | 306 | * Processes all administrative notices. |
| @@ -284,9 +330,9 @@ | ||
| 284 | 330 | { |
| 285 | 331 | //250510 Fixed for PHP 8.1+: safely normalize on_pages before foreach |
| 286 | 332 | $notice = (array)$notice; |
| 287 | 333 | $notice['on_pages'] = empty($notice['on_pages']) ? array('*') : (array)$notice['on_pages']; |
| 288 | - foreach($notice['on_pages'] as $page) | |
| 334 | + foreach($notice['on_pages'] as $page) | |
| 289 | 335 | { |
| 290 | 336 | if(!preg_match('/^(.+?)\:/', $page)) // NO prefix? |
| 291 | 337 | $page = 'blog:'.ltrim($page, ':'); // `blog:` |
| 292 | 338 | |
