$notice, 'on_pages' => $on_pages, 'error' => $error, 'time' => $time, 'dismiss' => $dismiss)); foreach(array_keys(get_defined_vars()) as $__v) $__refs[$__v] =& $$__v; do_action('ws_plugin__s2member_during_enqueue_admin_notice', get_defined_vars()); unset($__refs, $__v); // Allow variables to be modified by reference. update_option('ws_plugin__s2member_notices', c_ws_plugin__s2member_utils_arrays::array_unique($notices)); } do_action('ws_plugin__s2member_after_enqueue_admin_notice', get_defined_vars()); } /** * Displays an administrative notice. * * @package s2Member\Admin_Notices * @since 3.5 * * @param string $notice String value of actual notice *(i.e., the message)*. * @param bool $error Optional. True if this notice is regarding an error. Defaults to false. * @param bool $dismiss Optional. If true, the notice will be displayed with a dismissal link. Defaults to false. */ public static function display_admin_notice($notice = '', $error = FALSE, $dismiss = FALSE) { foreach(array_keys(get_defined_vars()) as $__v) $__refs[$__v] =& $$__v; do_action('ws_plugin__s2member_before_display_admin_notice', get_defined_vars()); unset($__refs, $__v); // Allow variables to be modified by reference. if($dismiss) $dismissal_link = '
'. '[ dismiss ]'. '
'; if($notice && is_string($notice) && $error) { if($dismiss && !empty($dismissal_link)) $notice = $dismissal_link.$notice; echo '

'.wp_kses_post($notice).'

'; } else if($notice && is_string($notice)) { if($dismiss && !empty($dismissal_link)) $notice = $dismissal_link.$notice; echo '

'.wp_kses_post($notice).'

'; } do_action('ws_plugin__s2member_after_display_admin_notice', get_defined_vars()); } /** * Displays a branded s2Member administrative notice. * * @package s2Member\Admin_Notices * @since 260904.1923 * * @param string $title Notice title. * @param string $message Main notice message. * @param bool $error Optional. True for an error notice; otherwise an informational notice. * @param string $dismiss_url Optional explicit URL that dismisses the current notice incident. */ public static function display_branded_notice($title = '', $message = '', $error = FALSE, $dismiss_url = '') { $title = trim((string)$title); $message = trim((string)$message); $dismiss_url = trim((string)$dismiss_url); if(!$message) return; $_logo_url = $GLOBALS['WS_PLUGIN__']['s2member']['c']['dir_url'].'/src/images/logo-square-big.png'; $_notice_class = ($error) ? 'notice notice-error' : 'notice notice-info'; //260910.0818 Use WordPress's standard error style for the immediate Red problem and the quieter informational style for the persistent Orange review notice. $_dismiss = (($dismiss_url !== '') ? 'Dismiss' : ''); //260910.0709 The caller owns the nonce-protected incident URL so dismissal follows incident identity, not mutable notice text. //260909.2021 Keep incident dismissal explicit so changing notice text cannot accidentally make a persistent problem look like a new one. echo '
'.$_dismiss.'
'.(($title !== '') ? ''.esc_html($title).'
' : '').wp_kses_post($message).'
'; } /** * Warns administrators when Pro is too old to contain the current Pro updater behavior. * * @package s2Member\Admin_Notices * @since 260917.0425 * * @attaches-to `add_action('admin_notices');` * @attaches-to `add_action('user_admin_notices');` * @attaches-to `add_action('network_admin_notices');` */ public static function outdated_pro_notice() { if(!current_user_can('update_plugins') || !defined('WS_PLUGIN__S2MEMBER_PRO_VERSION') || !defined('WS_PLUGIN__S2MEMBER_VERSION')) return; //260917.0425 v260913 introduced the current background Pro updater flow; Framework owns this fallback warning only for older Pro releases. $_current_updater_version = '260913'; if(version_compare(WS_PLUGIN__S2MEMBER_PRO_VERSION, $_current_updater_version, '>=') || !version_compare(WS_PLUGIN__S2MEMBER_PRO_VERSION, WS_PLUGIN__S2MEMBER_VERSION, '<')) return; $_account_url = 'https://s2member.com/account/'; //260917.2113 s2Member versions begin with yymmdd; show the installed Pro version's approximate age so administrators can immediately see how far behind it is. $_pro_release_age = ''; if(preg_match('/^(\d{2})(\d{2})(\d{2})/', WS_PLUGIN__S2MEMBER_PRO_VERSION, $_pro_version_parts)) { $_pro_release_timestamp = mktime(0, 0, 0, (int) $_pro_version_parts[2], (int) $_pro_version_parts[3], 2000 + (int) $_pro_version_parts[1]); if($_pro_release_timestamp) $_pro_release_age = human_time_diff($_pro_release_timestamp, current_time('timestamp')); } //260917.1937 Keep this urgent notice compact and skimmable: short paragraphs, prominent version age/security risk, and a clearly separated update action. $_message = '

Your s2Member Pro v'.esc_html(WS_PLUGIN__S2MEMBER_PRO_VERSION).($_pro_release_age ? ' is '.esc_html($_pro_release_age).' old and' : '').' is missing important security fixes.

'; $_message .= '

Please install the latest ZIP from WP Admin > Plugins > Add Plugin > Upload Plugin.

'; $_update_button = 'Download the Latest s2Member Pro Now'; //260917.1937 Keep this Framework-owned warning persistent and red; include the action in the message instead of the helper's review slot so no extra
is inserted before it. c_ws_plugin__s2member_admin_notices::display_security_notice($_message.$_update_button, '', array(), '', 'notice-error'); } /** * Displays a branded s2Member security notice. * * @package s2Member\Admin_Notices * @since 260813 * * @param string $message Main notice message. * @param string $review Review prompt shown above the items. * @param array $items Notice items, with safe HTML allowed. * @param string $dismiss_url Optional dismissal URL. * @param string $notice_class Optional WordPress notice severity class. */ public static function display_security_notice($message = '', $review = '', $items = array(), $dismiss_url = '', $notice_class = 'notice-warning') { $message = trim((string)$message); $review = trim((string)$review); $items = (array)$items; if(!$message) return; //260917.0513 Preserve the existing warning style by default, while allowing especially urgent security notices to use WordPress's stronger error styling. $_notice_class = (($notice_class === 'notice-error') ? 'notice notice-error' : 'notice notice-warning'); $_items = array(); foreach($items as $_item) if(is_string($_item) && trim($_item) !== '') $_items[] = '•  '.wp_kses_post($_item).''; $_logo_url = $GLOBALS['WS_PLUGIN__']['s2member']['c']['dir_url'].'/src/images/logo-square-big.png'; $_dismiss = (($dismiss_url !== '') ? 'Dismiss' : ''); //260917.1937 Give urgent red security notices a stronger heading without changing the existing presentation of normal yellow security notices. $_title = (($notice_class === 'notice-error') ? '

s2Member Security Notice

' : 's2Member Security Notice
'); echo '
'.$_dismiss.'
'.$_title.wp_kses_post($message).(($review !== '') ? '
'.wp_kses_post($review) : '').(($_items) ? '
'.implode('
', $_items) : '').'
'; } /** * Records a shortcode user field that is not approved for cross-user display. * * @package s2Member\Admin_Notices * @since 260813 * * @param string $field User field ID. * @param string $shortcode Shortcode name. * @param int $post_id Post/Page ID. */ public static function shortcode_user_field_unapproved($field = '', $shortcode = '', $post_id = 0) { $field = trim((string)$field); $shortcode = trim((string)$shortcode); $post_id = (int)$post_id; if(!$field || !$shortcode) return; $_fields = (array)get_option('ws_plugin__s2member_shortcode_user_fields_transition_fields', array()); $_entry_key = md5(strtolower($field)."\0".strtolower($shortcode)."\0".$post_id); //260813 Keep each detected shortcode location separate, while limiting stored warning data. if(!isset($_fields[$_entry_key]) && count($_fields) >= 40) return; $_old_fields = $_fields; $_fields[$_entry_key] = array('field' => $field, 'shortcode' => $shortcode, 'post_id' => $post_id); if($_fields !== $_old_fields) update_option('ws_plugin__s2member_shortcode_user_fields_transition_fields', $_fields, FALSE); } /** * Dismisses the shortcode user-fields security notice until another affected shortcode is detected. * * @package s2Member\Admin_Notices * @since 260813 */ public static function dismiss_shortcode_user_fields_notice() { if(!is_admin() || !current_user_can('create_users') || empty($_GET['s2member-dismiss-shortcode-user-fields-notice'])) return; check_admin_referer('s2member-dismiss-shortcode-user-fields-notice'); delete_option('ws_plugin__s2member_shortcode_user_fields_transition_fields'); wp_safe_redirect(wp_get_referer() ? wp_get_referer() : admin_url()); exit; } /** * Displays the shared shortcode user-fields security notice. * * @package s2Member\Admin_Notices * @since 260813 */ public static function shortcode_user_fields_notice() { if(!current_user_can('create_users')) return; $_fields = (array)get_option('ws_plugin__s2member_shortcode_user_fields_transition_fields', array()); if(!$_fields) return; //260813 Use the submitted whitelist on save so the notice updates immediately. $_using_submitted_whitelist = !empty($_POST['ws_plugin__s2member_options_save']) && is_string($_POST['ws_plugin__s2member_options_save']) && wp_verify_nonce($_POST['ws_plugin__s2member_options_save'], 'ws-plugin--s2member-options-save') && isset($_POST['ws_plugin__s2member_sc_user_fields_whitelist']) && is_string($_POST['ws_plugin__s2member_sc_user_fields_whitelist']); $_field_whitelist = ($_using_submitted_whitelist) ? trim((string)wp_unslash($_POST['ws_plugin__s2member_sc_user_fields_whitelist'])) : trim((string)$GLOBALS['WS_PLUGIN__']['s2member']['o']['sc_user_fields_whitelist']); $_field_whitelist = ($_field_whitelist !== '') ? preg_split('/\s*,\s*/', strtolower($_field_whitelist), -1, PREG_SPLIT_NO_EMPTY) : array(); $_field_whitelist = array_flip($_field_whitelist); foreach($_fields as $_key => $_details) { if(!is_array($_details) || empty($_details['field']) || empty($_details['shortcode'])) unset($_fields[$_key]); else if(isset($_field_whitelist[strtolower($_details['field'])])) unset($_fields[$_key]); } if(!$_fields) { delete_option('ws_plugin__s2member_shortcode_user_fields_transition_fields'); return; } update_option('ws_plugin__s2member_shortcode_user_fields_transition_fields', $_fields, FALSE); // Build a useful field list with a separate entry for each detected shortcode location. $_field_items = array(); foreach($_fields as $_details) { $_item = esc_html($_details['field']).' — ['.esc_html($_details['shortcode']).']'; $_post_id = (!empty($_details['post_id'])) ? (int)$_details['post_id'] : 0; if($_post_id > 0 && ($_edit_link = get_edit_post_link($_post_id, ''))) { $_post_title = get_the_title($_post_id); $_post_title = ($_post_title !== '') ? $_post_title : '(no title)'; $_item .= ' — '.esc_html($_post_title).' (#'.$_post_id.')'; } $_field_items[] = $_item; } unset($_details, $_item, $_post_id, $_edit_link, $_post_title); $_settings_url = add_query_arg('s2member-open-panel', 'shortcode-user-fields-whitelist', admin_url('/admin.php?page=ws-plugin--s2member-gen-ops')).'#ws-plugin--s2member-shortcode-user-fields-whitelist'; $_dismiss_url = wp_nonce_url(add_query_arg('s2member-dismiss-shortcode-user-fields-notice', '1', admin_url()), 's2member-dismiss-shortcode-user-fields-notice'); $_message = 'Some s2Member shortcodes attempted to display user fields from other accounts that are not in s2Member → General Options → Shortcode User Fields Whitelist. Those cross-user field values were blocked.'; c_ws_plugin__s2member_admin_notices::display_security_notice($_message, 'Review the blocked fields below and allow the ones that are okay for other users to see:', $_field_items, $_dismiss_url); } /** * Processes all administrative notices. * * @package s2Member\Admin_Notices * @since 3.5 * * @attaches-to ``add_action('admin_notices');`` * @attaches-to ``add_action('user_admin_notices');`` * @attaches-to ``add_action('network_admin_notices');`` * @todo Update to ``add_action('all_admin_notices');``. */ public static function admin_notices() { global $pagenow; // This holds the current page filename. do_action('ws_plugin__s2member_before_admin_notices', get_defined_vars()); if(is_admin() && is_array($notices = get_option('ws_plugin__s2member_notices')) && !empty($notices)) { $a = (is_blog_admin()) ? 'blog' : ''; $a = (is_user_admin()) ? 'user' : $a; $a = (is_network_admin()) ? 'network' : $a; $a = (!$a) ? 'blog' : $a; // Default blog admin. foreach($notices as $i => $notice) // Check several things about each notice. { //250510 Fixed for PHP 8.1+: safely normalize on_pages before foreach $notice = (array)$notice; $notice['on_pages'] = empty($notice['on_pages']) ? array('*') : (array)$notice['on_pages']; foreach($notice['on_pages'] as $page) { if(!preg_match('/^(.+?)\:/', $page)) // NO prefix? $page = 'blog:'.ltrim($page, ':'); // `blog:` $adms = preg_split('/\|/', preg_replace('/\:(.*)$/i', '', $page)); $page = preg_replace('/^([^\:]*)\:/i', '', $page); if(empty($adms) || in_array('*', $adms) || in_array($a, $adms)) if(!$page || '*' === $page || $pagenow === $page || @$_GET['page'] === $page) { if(strtotime('now') >= (int)$notice['time']) // Time to show it? { foreach(array_keys(get_defined_vars()) as $__v) $__refs[$__v] =& $$__v; do_action('ws_plugin__s2member_during_admin_notices_before_display', get_defined_vars()); unset($__refs, $__v); // Allow variables to be modified by reference. if(!$notice['dismiss'] || (!empty($_GET['ws-plugin--s2member-dismiss-admin-notice']) && $_GET['ws-plugin--s2member-dismiss-admin-notice'] === md5($notice['notice']))) unset($notices[$i]); // Clear this administrative notice now? if(!$notice['dismiss'] || empty($_GET['ws-plugin--s2member-dismiss-admin-notice']) || $_GET['ws-plugin--s2member-dismiss-admin-notice'] !== md5($notice['notice'])) c_ws_plugin__s2member_admin_notices::display_admin_notice($notice['notice'], $notice['error'], $notice['dismiss']); do_action('ws_plugin__s2member_during_admin_notices_after_display', get_defined_vars()); } continue 2; // This notice processed; continue. } } } $notices = array_merge($notices); // Re-index array. foreach(array_keys(get_defined_vars()) as $__v) $__refs[$__v] =& $$__v; do_action('ws_plugin__s2member_during_admin_notices', get_defined_vars()); unset($__refs, $__v); // Allow variables to be modified by reference. update_option('ws_plugin__s2member_notices', $notices); } do_action('ws_plugin__s2member_after_admin_notices', get_defined_vars()); } } }