sendpulse-web-push / settings.php

settings.php in SendPulse Free Web Push trunk, at settings.php

131 lines 6.5 KB

Raw Download Zip

1	<?php
2	// Exit if accessed directly.
3	if (!defined('ABSPATH')) {
4	exit;
5	}
6
7	use \SendpulseWebPush\SendpulseWebPush;
8
9	function sendpulse_config() {
10	$currenturl = isset($_SERVER['REQUEST_URI'])
11	? esc_url_raw(wp_unslash($_SERVER['REQUEST_URI']))
12	: '';
13	$request_method = isset($_SERVER['REQUEST_METHOD'])
14	? sanitize_text_field(wp_unslash($_SERVER['REQUEST_METHOD']))
15	: '';
16	$sendpulse_settings_nonce = isset($_POST['_sendpulse_settings_nonce'])
17	? sanitize_text_field(wp_unslash($_POST['_sendpulse_settings_nonce']))
18	: '';
19	// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Raw script is parsed only; extracted values are sanitized before saving.
20	$sendpulse_script_input = isset($_POST['sendpulse_script'])
21	? wp_unslash($_POST['sendpulse_script'])
22	: '';
23	// phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
24
25	// Check if there is a legacy field with the full script
26	$legacy_script = html_entity_decode(get_option('sendpulse_code', ''));
27
28	if (!empty($legacy_script)) {
29	// If the legacy field exists, extract components and migrate them to new options
30	// phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript -- Regex parses user-provided SendPulse script snippet; no script is printed here.
31	if (preg_match('/<script\s+charset="([^"]+)"\s+src="([^"]+\/)([^\/]+)"\s(\w+="[^"]+"\s)(async)?\s><\/script>/', $legacy_script, $matches)) {
32	$push_url = isset($matches[2]) ? $matches[2] : '';
33	$script_id = isset($matches[3]) ? $matches[3] : '';
34	$script_params = isset($matches[5]) ? trim($matches[5]) : '';
35
36	// Save components in the new fields
37	update_option('sendpulse_push_url', $push_url);
38	update_option('sendpulse_script_id', $script_id);
39	update_option('sendpulse_script_params', $script_params);
40
41	// Delete the legacy field since the data is now migrated
42	delete_option('sendpulse_code');
43
44	echo "<p class=\"success\">".esc_html__('Legacy script migrated successfully.', 'sendpulse-web-push')."</p>";
45	}
46	}
47
48	// Retrieve the saved values (which could have been migrated)
49	$push_url = get_option('sendpulse_push_url', '');
50	$script_id = get_option('sendpulse_script_id', '');
51	$script_params = get_option('sendpulse_script_params', '');
52
53	// Handle form submissions
54	if ('POST' === $request_method) {
55
56	// Verify nonce
57	if (!empty($sendpulse_settings_nonce) && wp_verify_nonce($sendpulse_settings_nonce, 'sendpulse_settings_nonce')) {
58
59	// Reset button clicked: clear all saved values
60	if (isset($_POST['sendpulse_reset'])) {
61	delete_option('sendpulse_push_url');
62	delete_option('sendpulse_script_id');
63	delete_option('sendpulse_script_params');
64	echo "<p class=\"success\">".esc_html__('Values have been reset.', 'sendpulse-web-push')."</p>";
65	}
66
67	// If new script is submitted
68	if (!empty($sendpulse_script_input)) {
69	$script_input = $sendpulse_script_input;
70
71	// Extract components using regex
72	// phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript -- Regex parses user-provided SendPulse script snippet; no script is printed here.
73	if (preg_match('/<script\s+charset="([^"]+)"\s+src="([^"]+\/)([^\/]+)"\s(\w+="[^"]+"\s)(async)?\s><\/script>/', $script_input, $matches)) {
74	// Extract components and sanitize them individually
75
76	$push_url = isset($matches[2]) ? esc_url($matches[2]) : ''; // Base URL
77	$script_id = isset($matches[3]) ? esc_html($matches[3]) : ''; // Script ID
78	$script_params = isset($matches[5]) ? esc_html($matches[5]) : '';
79
80	// Save the extracted components
81	update_option('sendpulse_push_url', $push_url);
82	update_option('sendpulse_script_id', $script_id);
83	update_option('sendpulse_script_params', $script_params);
84
85	echo "<p class=\"success\">".esc_html__('Script successfully saved.', 'sendpulse-web-push')."</p>";
86	} else {
87	echo "<p class=\"error\">".esc_html__('Invalid script format.', 'sendpulse-web-push')."</p>";
88	}
89	}
90
91	}
92	}
93
94	// Display the saved script or the input form based on whether values exist
95	?>
96	<div class="wrap">
97
98	<?php if (!empty($push_url) && !empty($script_id)): ?>
99	<!-- Display the saved script -->
100	<div>
101	<h2><?php esc_html_e('Your current integration script:', 'sendpulse-web-push'); ?></h2>
102	<span style="background-color: white; padding: 5px; border: #000; color: #646970;">
103	<script charset="UTF-8" src="<?php echo esc_url($push_url . $script_id); ?>" <?php echo esc_attr($script_params); ?>> </script>
104	</span>
105	</div>
106
107	<div>
108	<h2><?php esc_html_e('Remove current WebPush script:', 'sendpulse-web-push'); ?></h2>
109	<p><?php esc_html_e('Use this button only in case you need to change WebPush Script provided by SendPulse', 'sendpulse-web-push'); ?></p>
110	<!-- Button to reset (delete) the saved script values -->
111	<form method="post" action="<?php echo esc_url($currenturl); ?>">
112	<?php wp_nonce_field('sendpulse_settings_nonce', '_sendpulse_settings_nonce'); ?>
113	<input type="hidden" name="sendpulse_reset" value="1" />
114	<?php submit_button(__('Remove', 'sendpulse-web-push'), 'delete'); ?>
115	</form>
116
117	</div>
118	<?php else: ?>
119	<h2><?php esc_html_e('Insert integration code', 'sendpulse-web-push'); ?></h2>
120	<h3><?php esc_html_e('The code you put in here will be inserted into the <head> tag on every page.', 'sendpulse-web-push'); ?></h3>
121	<!-- Show text area for input if no script is saved -->
122	<form method="post" action="<?php echo esc_url($currenturl); ?>">
123	<?php wp_nonce_field('sendpulse_settings_nonce', '_sendpulse_settings_nonce'); ?>
124	<textarea name="sendpulse_script" style="width:80%; min-width:600px; height:100px;"></textarea>
125	<?php submit_button(__('Save Script', 'sendpulse-web-push')); ?>
126	</form>
127	<?php endif; ?>
128	</div>
129	<?php
130	}
131