← All changes | admin/admin-bar.php +9 -12 4.0.21 → 4.1.16 View file →

		@@ -34,11 +34,8 @@
34	34	}
35	35
36	36	function add_admin_bar_menu()
37	37	{
38		- if (empty(berqwp_get_license_key())) {
39		- return;
40		- }
41	38
42	39	if (!current_user_can('edit_posts')) {
43	40	return;
44	41	}
		@@ -176,9 +173,9 @@
176	173
177	174	function handle_clear_cache_action()
178	175	{
179	176	// Check if the user has the necessary nonce and the action matches
180		- if (isset($_GET['action']) && $_GET['action'] === 'clear_cache' && wp_verify_nonce($_GET['_wpnonce'], 'clear_cache_action')) {
	177	+ if (isset($_GET['action']) && $_GET['action'] === 'clear_cache' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'clear_cache_action')) {
181	178
182	179	$cache = berqCache::getInstance();
183	180	$cache->delete_cache_files(is_multisite()); // If is multisite flush all sites
184	181
		@@ -198,9 +195,9 @@
198	195
199	196	function handle_warmup_cache_action()
200	197	{
201	198	// Check if the user has the necessary nonce and the action matches
202		- if (isset($_GET['action']) && $_GET['action'] === 'warmup_cache' && wp_verify_nonce($_GET['_wpnonce'], 'warmup_cache_action')) {
	199	+ if (isset($_GET['action']) && $_GET['action'] === 'warmup_cache' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'warmup_cache_action')) {
203	200
204	201	// trigger cache warmup
205	202	do_action('berqwp_cache_warmup');
206	203
		@@ -214,11 +211,11 @@
214	211
215	212	function handle_purge_page_action()
216	213	{
217	214	// Check if the user has the necessary nonce and the action matches
218		- if (isset($_GET['action']) && $_GET['action'] === 'berq_purge_page' && wp_verify_nonce($_GET['_wpnonce'], 'berq_purge_page_action')) {
	215	+ if (isset($_GET['action']) && $_GET['action'] === 'berq_purge_page' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'berq_purge_page_action')) {
219	216
220		- $page_url = $_GET['uri'];
	217	+ $page_url = esc_url_raw(wp_unslash($_GET['uri'] ?? ''));
221	218
222	219	berqCache::purge_page($page_url, true);
223	220
224	221	if (is_admin()) {
		@@ -233,11 +230,11 @@
233	230
234	231	function handle_request_cache_action()
235	232	{
236	233	// Check if the user has the necessary nonce and the action matches
237		- if (isset($_GET['action']) && $_GET['action'] === 'berq_request_cache' && wp_verify_nonce($_GET['_wpnonce'], 'berq_request_cache_action')) {
	234	+ if (isset($_GET['action']) && $_GET['action'] === 'berq_request_cache' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'berq_request_cache_action')) {
238	235
239		- $page_url = $_GET['uri'];
	236	+ $page_url = esc_url_raw(wp_unslash($_GET['uri'] ?? ''));
240	237	$slug = bwp_url_into_path($page_url);
241	238
242	239	if (is_admin()) {
243	240	set_transient('berq_force_cache_notice', $page_url, 60);
		@@ -254,9 +251,9 @@
254	251
255	252	function handle_flush_cdn_action()
256	253	{
257	254	// Check if the user has the necessary nonce and the action matches
258		- if (isset($_GET['action']) && $_GET['action'] === 'berq_flush_cdn' && wp_verify_nonce($_GET['_wpnonce'], 'berq_flush_cdn_action')) {
	255	+ if (isset($_GET['action']) && $_GET['action'] === 'berq_flush_cdn' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'berq_flush_cdn_action')) {
259	256
260	257	$cache = berqCache::getInstance();
261	258	$cache->flush_cdn();
262	259
		@@ -270,9 +267,9 @@
270	267
271	268	function handle_berq_flush_site_action()
272	269	{
273	270	// Check if the user has the necessary nonce and the action matches
274		- if (isset($_GET['action']) && isset($_GET['site_id']) && $_GET['action'] === 'berq_flush_site' && wp_verify_nonce($_GET['_wpnonce'], 'berq_flush_site_action')) {
	271	+ if (isset($_GET['action']) && isset($_GET['site_id']) && $_GET['action'] === 'berq_flush_site' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'berq_flush_site_action')) {
275	272
276	273	$site_id = (int) sanitize_text_field($_GET['site_id']);
277	274	$cache = berqCache::getInstance();
278	275
		@@ -295,9 +292,9 @@
295	292
296	293	function handle_flush_criticalcss_action()
297	294	{
298	295	// Check if the user has the necessary nonce and the action matches
299		- if (isset($_GET['action']) && $_GET['action'] === 'berq_flush_criticalcss' && wp_verify_nonce($_GET['_wpnonce'], 'berq_flush_criticalcss_action')) {
	296	+ if (isset($_GET['action']) && $_GET['action'] === 'berq_flush_criticalcss' && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'] ?? '')), 'berq_flush_criticalcss_action')) {
300	297
301	298	$parsed_url = wp_parse_url(home_url());
302	299	$domain = $parsed_url['host'];
303	300