sliderberg / sliderberg.php

sliderberg.php in Slider Block by Sliderberg – Slider & Carousel Plugin for Block Editor 1.0.5, at sliderberg.php

300 lines 9.8 KB

Raw Download Zip

1	<?php
2	/**
3	* Plugin Name: Sliderberg
4	* Plugin URI: https://sliderberg.com/
5	* Description: Slider Block For the Block Editor (Gutenberg). Slide Anything With Ease.
6	* Version: 1.0.5
7	* Author: DotCamp
8	* Author URI: https://dotcamp.com/
9	* License: GPL v2 or later
10	* License URI: https://www.gnu.org/licenses/gpl-2.0.html
11	* Text Domain: sliderberg
12	* Domain Path: /languages
13	*/
14
15	// If this file is called directly, abort.
16	if (!defined('WPINC')) {
17	die;
18	}
19
20	// Define plugin constants
21	define('SLIDERBERG_VERSION', '1.0.5');
22	define('SLIDERBERG_PLUGIN_DIR', plugin_dir_path(__FILE__));
23	define('SLIDERBERG_PLUGIN_URL', plugin_dir_url(__FILE__));
24
25	if ( ! function_exists( 'sli_fs' ) ) {
26	// Create a helper function for easy SDK access.
27	function sli_fs() {
28	global $sli_fs;
29
30	if ( ! isset( $sli_fs ) ) {
31	// Include Freemius SDK.
32	require_once dirname( __FILE__ ) . '/vendor/freemius/start.php';
33	$sli_fs = fs_dynamic_init( array(
34	'id' => '19340',
35	'slug' => 'sliderberg',
36	'type' => 'plugin',
37	'public_key' => 'pk_f6a90542b187793a33ebb75752ce7', // This is a public key, safe to expose
38	'is_premium' => false,
39	'has_addons' => false,
40	'has_paid_plans' => false,
41	'menu' => array(
42	'slug' => 'sliderberg-welcome',
43	'contact' => false,
44	),
45	) );
46	}
47
48	return $sli_fs;
49	}
50
51	// Init Freemius.
52	sli_fs();
53	// Signal that SDK was initiated.
54	do_action( 'sli_fs_loaded' );
55	}
56
57	// Include security utilities
58	require_once SLIDERBERG_PLUGIN_DIR . 'includes/security.php';
59
60	// Include admin welcome page
61	require_once SLIDERBERG_PLUGIN_DIR . 'includes/admin-welcome.php';
62
63	// Include slider and slide renderer
64	require_once SLIDERBERG_PLUGIN_DIR . 'includes/slider-renderer.php';
65	require_once SLIDERBERG_PLUGIN_DIR . 'includes/slide-renderer.php';
66
67	// Include review handler
68	require_once SLIDERBERG_PLUGIN_DIR . 'includes/class-review-handler.php';
69
70	/**
71	* Registers the block using the metadata loaded from the `block.json` file.
72	* Behind the scenes, it registers also all assets so they can be enqueued
73	* through the block editor in the corresponding context.
74	*
75	* @see https://developer.wordpress.org/reference/functions/register_block_type/
76	*/
77	function sliderberg_init() {
78
79	// Register slider block with PHP rendering
80	sliderberg_register_slider_block();
81
82	// Register slide block with PHP rendering
83	sliderberg_register_slide_block();
84
85	// Register block styles
86	wp_register_style(
87	'sliderberg-style',
88	SLIDERBERG_PLUGIN_URL . 'build/style-index.css',
89	array(),
90	SLIDERBERG_VERSION
91	);
92
93	// Register editor styles
94	wp_register_style(
95	'sliderberg-editor',
96	SLIDERBERG_PLUGIN_URL . 'build/index.css',
97	array(),
98	SLIDERBERG_VERSION
99	);
100
101	// Register view script
102	wp_register_script(
103	'sliderberg-view',
104	SLIDERBERG_PLUGIN_URL . 'build/view.js',
105	array(),
106	SLIDERBERG_VERSION,
107	true
108	);
109	}
110	add_action('init', 'sliderberg_init');
111
112	// Initialize review handler
113	add_action('init', function() {
114	new \SliderBerg\Review_Handler();
115	});
116
117	// Load plugin text domain
118	add_action('plugins_loaded', function() {
119	load_plugin_textdomain('sliderberg', false, dirname(plugin_basename(__FILE__)) . '/languages');
120	});
121
122	// Enqueue editor assets
123	function sliderberg_editor_assets() {
124	wp_enqueue_script(
125	'sliderberg-editor',
126	SLIDERBERG_PLUGIN_URL . 'build/index.js',
127	array('wp-blocks', 'wp-element', 'wp-editor'),
128	SLIDERBERG_VERSION,
129	true
130	);
131
132	// Get valid transition effects through filter
133	$valid_effects = apply_filters('sliderberg_valid_transition_effects', array('slide', 'fade', 'zoom'));
134
135	// Localize script data
136	wp_localize_script('sliderberg-editor', 'sliderbergData', array(
137	'validTransitionEffects' => $valid_effects
138	));
139
140	// Enqueue the custom editor-only JS for slide visibility
141	wp_enqueue_script(
142	'sliderberg-editor-js',
143	SLIDERBERG_PLUGIN_URL . 'build/editor.js',
144	array(),
145	SLIDERBERG_VERSION,
146	true
147	);
148	}
149	add_action('enqueue_block_editor_assets', 'sliderberg_editor_assets');
150
151	// Enqueue frontend assets
152	function sliderberg_frontend_assets() {
153	// Only enqueue if we have sliderberg blocks on the page
154	if (has_block('sliderberg/sliderberg')) {
155	wp_enqueue_style('sliderberg-style');
156	wp_enqueue_script('sliderberg-view');
157
158	// Pro add-ons can enqueue wp-hooks here to enable frontend filters:
159	// wp_enqueue_script('wp-hooks');
160	}
161	}
162	add_action('wp_enqueue_scripts', 'sliderberg_frontend_assets');
163
164	/**
165	* Handle plugin installation via AJAX
166	*/
167	function sliderberg_install_plugin() {
168	// Check if request is AJAX
169	if (!wp_doing_ajax()) {
170	wp_die('Invalid request', 'Invalid Request', array('response' => 400));
171	}
172
173	// Validate request origin
174	if (!sliderberg_validate_ajax_origin()) {
175	wp_send_json_error(array('message' => 'Invalid request origin'));
176	}
177
178	// Check rate limiting
179	if (!sliderberg_check_rate_limit('install_plugin', 3, 300)) {
180	wp_send_json_error(array('message' => 'Too many requests. Please try again later.'));
181	}
182
183	// Check nonce
184	if (!check_ajax_referer('sliderberg_plugin_action', '_ajax_nonce', false)) {
185	wp_send_json_error(array('message' => 'Security check failed'));
186	}
187
188	// Check user capabilities
189	if (!current_user_can('install_plugins')) {
190	wp_send_json_error(array('message' => 'You do not have permission to install plugins'));
191	}
192
193	// Get plugin slug with strict validation
194	$plugin = isset($_POST['plugin']) ? sanitize_text_field(wp_unslash($_POST['plugin'])) : '';
195
196	// Validate plugin slug format (alphanumeric and hyphens only)
197	if (!preg_match('/^[a-z0-9\-]+$/', $plugin)) {
198	wp_send_json_error(array('message' => 'Invalid plugin slug format'));
199	}
200
201	if (empty($plugin) \|\| strlen($plugin) > 50) {
202	wp_send_json_error(array('message' => 'Plugin slug is required and must be less than 50 characters'));
203	}
204
205	// Validate plugin is in whitelist
206	if (!sliderberg_is_allowed_plugin($plugin)) {
207	wp_send_json_error(array('message' => 'Plugin not allowed'));
208	}
209
210	// Include required files
211	require_once ABSPATH . 'wp-admin/includes/plugin-install.php';
212	require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
213	require_once ABSPATH . 'wp-admin/includes/plugin.php';
214
215	// Get plugin info
216	$api = plugins_api('plugin_information', array('slug' => $plugin));
217	if (is_wp_error($api)) {
218	wp_send_json_error(array('message' => $api->get_error_message()));
219	}
220
221	// Install plugin
222	$upgrader = new Plugin_Upgrader(new Automatic_Upgrader_Skin());
223	$result = $upgrader->install($api->download_link);
224
225	if (is_wp_error($result)) {
226	wp_send_json_error(array('message' => $result->get_error_message()));
227	}
228
229	wp_send_json_success();
230	}
231	add_action('wp_ajax_sliderberg_install_plugin', 'sliderberg_install_plugin');
232
233	/**
234	* Handle plugin activation via AJAX
235	*/
236	function sliderberg_activate_plugin() {
237	// Check if request is AJAX
238	if (!wp_doing_ajax()) {
239	wp_die('Invalid request', 'Invalid Request', array('response' => 400));
240	}
241
242	// Validate request origin
243	if (!sliderberg_validate_ajax_origin()) {
244	wp_send_json_error(array('message' => 'Invalid request origin'));
245	}
246
247	// Check rate limiting
248	if (!sliderberg_check_rate_limit('activate_plugin', 5, 300)) {
249	wp_send_json_error(array('message' => 'Too many requests. Please try again later.'));
250	}
251
252	// Check nonce
253	if (!check_ajax_referer('sliderberg_plugin_action', '_ajax_nonce', false)) {
254	wp_send_json_error(array('message' => 'Security check failed'));
255	}
256
257	// Check user capabilities
258	if (!current_user_can('activate_plugins')) {
259	wp_send_json_error(array('message' => 'You do not have permission to activate plugins'));
260	}
261
262	// Get plugin slug with strict validation
263	$plugin = isset($_POST['plugin']) ? sanitize_text_field(wp_unslash($_POST['plugin'])) : '';
264
265	// Validate plugin slug format (alphanumeric and hyphens only)
266	if (!preg_match('/^[a-z0-9\-]+$/', $plugin)) {
267	wp_send_json_error(array('message' => 'Invalid plugin slug format'));
268	}
269
270	if (empty($plugin) \|\| strlen($plugin) > 50) {
271	wp_send_json_error(array('message' => 'Plugin slug is required and must be less than 50 characters'));
272	}
273
274	// Validate plugin is in whitelist
275	if (!sliderberg_is_allowed_plugin($plugin)) {
276	wp_send_json_error(array('message' => 'Plugin not allowed'));
277	}
278
279	// Validate plugin path to prevent directory traversal
280	$plugin_file = $plugin . '/' . $plugin . '.php';
281	if (strpos($plugin_file, '..') !== false \|\| strpos($plugin_file, './') !== false \|\| strpos($plugin_file, '\\') !== false) {
282	wp_send_json_error(array('message' => 'Invalid plugin path'));
283	}
284
285	// Additional check: verify the plugin file exists in the correct location
286	$full_plugin_path = WP_PLUGIN_DIR . '/' . $plugin_file;
287	if (!file_exists($full_plugin_path)) {
288	wp_send_json_error(array('message' => 'Plugin file not found'));
289	}
290
291	// Activate plugin
292	$result = activate_plugin($plugin . '/' . $plugin . '.php');
293
294	if (is_wp_error($result)) {
295	wp_send_json_error(array('message' => $result->get_error_message()));
296	}
297
298	wp_send_json_success();
299	}
300	add_action('wp_ajax_sliderberg_activate_plugin', 'sliderberg_activate_plugin');