| 1 |
<?php |
| 2 |
|
| 3 |
namespace SimpleAnalytics\Support; |
| 4 |
|
| 5 |
use SimpleAnalytics\SettingName; |
| 6 |
|
| 7 |
class OnloadCallback |
| 8 |
{ |
| 9 |
public static function sanitize($value): string |
| 10 |
{ |
| 11 |
if (! current_user_can('unfiltered_html')) { |
| 12 |
$current = get_option(SettingName::ONLOAD_CALLBACK, ''); |
| 13 |
return is_string($current) ? $current : ''; |
| 14 |
} |
| 15 |
|
| 16 |
$value = sanitize_text_field($value); |
| 17 |
// This private option is not registered as an editable setting. It |
| 18 |
// records that a user allowed to save JavaScript saved this exact code. |
| 19 |
update_option(SettingName::ONLOAD_CALLBACK_HASH, hash_hmac('sha256', $value, wp_salt('auth'))); |
| 20 |
return $value; |
| 21 |
} |
| 22 |
|
| 23 |
public static function get(): ?string |
| 24 |
{ |
| 25 |
$value = get_option(SettingName::ONLOAD_CALLBACK, ''); |
| 26 |
$hash = get_option(SettingName::ONLOAD_CALLBACK_HASH, ''); |
| 27 |
|
| 28 |
// Older releases accepted callback text without the capability check. |
| 29 |
// Keep it inert until an authorized administrator saves it again. |
| 30 |
if (! is_string($value) || $value === '' || ! is_string($hash)) return null; |
| 31 |
return hash_equals($hash, hash_hmac('sha256', $value, wp_salt('auth'))) ? $value : null; |
| 32 |
} |
| 33 |
} |
| 34 |
|
