PluginProbe
Stream – Activity Log & Audit Trail / 3.4.2
Stream – Activity Log & Audit Trail v3.4.2
4.4.0 4.3.0 4.2.2 4.2.1 trunk 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 3.0.0 3.0.1 3.0.2 3.0.3 3.0.4 3.0.5 3.0.6 3.0.7 3.1 3.1.1 3.10.0 3.2.0 3.2.1 3.2.2 3.2.3 All 50 releases
← All changes | classes/class-admin.php +81 -114 3.10.03.4.2 View file →
@@ -1,10 +1,5 @@
1 1 <?php
2 -/**
3 - * Centralized manager for WordPress backend functionality.
4 - *
5 - * @package WP_Stream
6 - */
7 2
8 3 namespace WP_Stream;
9 4
10 5 use DateTime;
@@ -12,15 +7,12 @@
12 7 use DateInterval;
13 8 use \WP_CLI;
14 9 use \WP_Roles;
15 10
16 -/**
17 - * Class - Admin
18 - */
19 11 class Admin {
20 12
21 13 /**
22 - * Holds Instance of plugin object
14 + * Hold Plugin class
23 15 *
24 16 * @var Plugin
25 17 */
26 18 public $plugin;
@@ -125,9 +117,9 @@
125 117
126 118 /**
127 119 * Class constructor.
128 120 *
129 - * @param Plugin $plugin Instance of plugin object.
121 + * @param Plugin $plugin The main Plugin class.
130 122 */
131 123 public function __construct( $plugin ) {
132 124 $this->plugin = $plugin;
133 125
@@ -190,8 +182,11 @@
190 182 'wp_ajax_reset',
191 183 )
192 184 );
193 185
186 + // Uninstall Streams and Deactivate plugin.
187 + $uninstall = $this->plugin->db->driver->purge_storage( $this->plugin );
188 +
194 189 // Auto purge setup.
195 190 add_action( 'wp_loaded', array( $this, 'purge_schedule_setup' ) );
196 191 add_action(
197 192 'wp_stream_auto_purge',
@@ -246,9 +241,9 @@
246 241 * @param bool $is_error If the message is error_level (true) or warning (false).
247 242 */
248 243 public function notice( $message, $is_error = true ) {
249 244 if ( defined( 'WP_CLI' ) && WP_CLI ) {
250 - $message = wp_strip_all_tags( $message );
245 + $message = strip_tags( $message );
251 246
252 247 if ( $is_error ) {
253 248 WP_CLI::warning( $message );
254 249 } else {
@@ -384,9 +379,9 @@
384 379 * Enqueue scripts/styles for admin screen
385 380 *
386 381 * @action admin_enqueue_scripts
387 382 *
388 - * @param string $hook Current hook.
383 + * @param string $hook
389 384 *
390 385 * @return void
391 386 */
392 387 public function admin_enqueue_scripts( $hook ) {
@@ -397,23 +392,11 @@
397 392 $locale = strtolower( substr( get_locale(), 0, 2 ) );
398 393 $file_tmpl = 'ui/lib/timeago/locales/jquery.timeago.%s.js';
399 394
400 395 if ( file_exists( $this->plugin->locations['dir'] . sprintf( $file_tmpl, $locale ) ) ) {
401 - wp_register_script(
402 - 'wp-stream-timeago-locale',
403 - $this->plugin->locations['url'] . sprintf( $file_tmpl, $locale ),
404 - array( 'wp-stream-timeago' ),
405 - '1',
406 - false
407 - );
396 + wp_register_script( 'wp-stream-timeago-locale', $this->plugin->locations['url'] . sprintf( $file_tmpl, $locale ), array( 'wp-stream-timeago' ), '1' );
408 397 } else {
409 - wp_register_script(
410 - 'wp-stream-timeago-locale',
411 - $this->plugin->locations['url'] . sprintf( $file_tmpl, 'en' ),
412 - array( 'wp-stream-timeago' ),
413 - '1',
414 - false
415 - );
398 + wp_register_script( 'wp-stream-timeago-locale', $this->plugin->locations['url'] . sprintf( $file_tmpl, 'en' ), array( 'wp-stream-timeago' ), '1' );
416 399 }
417 400
418 401 $min = wp_stream_min_suffix();
419 402 wp_enqueue_style( 'wp-stream-admin', $this->plugin->locations['url'] . 'ui/css/admin.' . $min . 'css', array(), $this->plugin->get_version() );
@@ -433,10 +416,9 @@
433 416 array(
434 417 'jquery',
435 418 'wp-stream-select2',
436 419 ),
437 - $this->plugin->get_version(),
438 - false
420 + $this->plugin->get_version()
439 421 );
440 422 wp_enqueue_script(
441 423 'wp-stream-admin-exclude',
442 424 $this->plugin->locations['url'] . 'ui/js/exclude.' . $min . 'js',
@@ -443,10 +425,9 @@
443 425 array(
444 426 'jquery',
445 427 'wp-stream-select2',
446 428 ),
447 - $this->plugin->get_version(),
448 - false
429 + $this->plugin->get_version()
449 430 );
450 431 wp_enqueue_script(
451 432 'wp-stream-live-updates',
452 433 $this->plugin->locations['url'] . 'ui/js/live-updates.' . $min . 'js',
@@ -453,10 +434,9 @@
453 434 array(
454 435 'jquery',
455 436 'heartbeat',
456 437 ),
457 - $this->plugin->get_version(),
458 - false
438 + $this->plugin->get_version()
459 439 );
460 440
461 441 wp_localize_script(
462 442 'wp-stream-admin',
@@ -464,8 +444,9 @@
464 444 array(
465 445 'i18n' => array(
466 446 'confirm_purge' => esc_html__( 'Are you sure you want to delete all Stream activity records from the database? This cannot be undone.', 'stream' ),
467 447 'confirm_defaults' => esc_html__( 'Are you sure you want to reset all site settings to default? This cannot be undone.', 'stream' ),
448 + 'confirm_uninstall' => esc_html__( 'Are you sure you want to uninstall and deactivate Stream? This will delete all Stream tables from the database and cannot be undone.', 'stream' ),
468 449 ),
469 450 'locale' => esc_js( $locale ),
470 451 'gmt_offset' => get_option( 'gmt_offset' ),
471 452 )
@@ -470,21 +451,21 @@
470 451 'gmt_offset' => get_option( 'gmt_offset' ),
471 452 )
472 453 );
473 454
474 - $order_types = array( 'asc', 'desc' );
475 -
476 455 wp_localize_script(
477 456 'wp-stream-live-updates',
478 457 'wp_stream_live_updates',
479 458 array(
480 459 'current_screen' => $hook,
481 - 'current_page' => isset( $_GET['paged'] ) ? absint( wp_unslash( $_GET['paged'] ) ) : '1', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
482 - 'current_order' => isset( $_GET['order'] ) && in_array( strtolower( $_GET['order'] ), $order_types, true ) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
483 - ? esc_js( $_GET['order'] ) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
484 - : 'desc',
485 - 'current_query' => wp_stream_json_encode( $_GET ), // phpcs:ignore WordPress.Security.NonceVerification.Recommended
486 - 'current_query_count' => count( $_GET ), // phpcs:ignore WordPress.Security.NonceVerification.Recommended
460 + 'current_page' => isset( $_GET['paged'] ) ? esc_js( $_GET['paged'] ) : '1', // WPCS: CSRF ok.
461 + // input var okay, CSRF okay
462 + 'current_order' => isset( $_GET['order'] ) ? esc_js( $_GET['order'] ) : 'desc', // WPCS: CSRF ok.
463 + // input var okay, CSRF okay
464 + 'current_query' => wp_stream_json_encode( $_GET ), // WPCS: CSRF ok.
465 + // input var okay, CSRF okay
466 + 'current_query_count' => count( $_GET ), // WPCS: CSRF ok.
467 + // input var okay, CSRF okay
487 468 )
488 469 );
489 470 }
490 471
@@ -501,16 +482,9 @@
501 482 * @return int
502 483 */
503 484 $bulk_actions_threshold = apply_filters( 'wp_stream_bulk_actions_threshold', 100 );
504 485
505 - wp_enqueue_script(
506 - 'wp-stream-global',
507 - $this->plugin->locations['url'] . 'ui/js/global.' . $min . 'js',
508 - array( 'jquery' ),
509 - $this->plugin->get_version(),
510 - false
511 - );
512 -
486 + wp_enqueue_script( 'wp-stream-global', $this->plugin->locations['url'] . 'ui/js/global.' . $min . 'js', array( 'jquery' ), $this->plugin->get_version() );
513 487 wp_localize_script(
514 488 'wp-stream-global',
515 489 'wp_stream_global',
516 490 array(
@@ -515,9 +489,9 @@
515 489 'wp_stream_global',
516 490 array(
517 491 'bulk_actions' => array(
518 492 'i18n' => array(
519 - /* translators: %s: a number of items (e.g. "1,742") */
493 + // translators: Placeholder refers to a number of items (e.g. "1,742")
520 494 'confirm_action' => sprintf( esc_html__( 'Are you sure you want to perform bulk actions on over %s items? This process could take a while to complete.', 'stream' ), number_format( absint( $bulk_actions_threshold ) ) ),
521 495 ),
522 496 'threshold' => absint( $bulk_actions_threshold ),
523 497 ),
@@ -531,19 +505,14 @@
531 505 *
532 506 * @return bool
533 507 */
534 508 public function is_stream_screen() {
535 - if ( ! is_admin() ) {
536 - return false;
537 - }
538 -
539 - $page = wp_stream_filter_input( INPUT_GET, 'page' );
540 - if ( is_string( $page ) && false !== strpos( $page, $this->records_page_slug ) ) {
509 + if ( is_admin() && false !== strpos( wp_stream_filter_input( INPUT_GET, 'page' ), $this->records_page_slug ) ) {
541 510 return true;
542 511 }
543 512
544 513 $screen = get_current_screen();
545 - if ( Alerts::POST_TYPE === $screen->post_type ) {
514 + if ( is_admin() && Alerts::POST_TYPE === $screen->post_type ) {
546 515 return true;
547 516 }
548 517
549 518 return false;
@@ -551,9 +520,9 @@
551 520
552 521 /**
553 522 * Add a specific body class to all Stream admin screens
554 523 *
555 - * @param string $classes CSS classes to output to body.
524 + * @param string $classes CSS classes to output to body
556 525 *
557 526 * @filter admin_body_class
558 527 *
559 528 * @return string
@@ -563,10 +532,10 @@
563 532
564 533 if ( $this->is_stream_screen() ) {
565 534 $stream_classes[] = $this->admin_body_class;
566 535
567 - if ( isset( $_GET['page'] ) ) { // // phpcs:ignore WordPress.Security.NonceVerification.Recommended
568 - $stream_classes[] = sanitize_key( $_GET['page'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
536 + if ( isset( $_GET['page'] ) ) { // CSRF okay
537 + $stream_classes[] = sanitize_key( $_GET['page'] ); // input var okay, CSRF okay
569 538 }
570 539 }
571 540
572 541 /**
@@ -591,9 +560,9 @@
591 560 $min = wp_stream_min_suffix();
592 561 wp_register_style( 'wp-stream-datepicker', $this->plugin->locations['url'] . 'ui/css/datepicker.' . $min . 'css', array(), $this->plugin->get_version() );
593 562 wp_register_style( 'wp-stream-icons', $this->plugin->locations['url'] . 'ui/stream-icons/style.css', array(), $this->plugin->get_version() );
594 563
595 - // Make sure we're working off a clean version.
564 + // Make sure we're working off a clean version
596 565 if ( ! file_exists( ABSPATH . WPINC . '/version.php' ) ) {
597 566 return;
598 567 }
599 568 include ABSPATH . WPINC . '/version.php';
@@ -676,9 +645,9 @@
676 645 if ( defined( 'WP_STREAM_TESTS' ) && WP_STREAM_TESTS ) {
677 646 return true;
678 647 }
679 648
680 - wp_safe_redirect(
649 + wp_redirect(
681 650 add_query_arg(
682 651 array(
683 652 'page' => is_network_admin() ? $this->network->network_settings_page_slug : $this->settings_page_slug,
684 653 'message' => 'data_erased',
@@ -689,13 +658,8 @@
689 658
690 659 exit;
691 660 }
692 661
693 - /**
694 - * Clears stream records from the database.
695 - *
696 - * @return void
697 - */
698 662 private function erase_stream_records() {
699 663 global $wpdb;
700 664
701 665 $where = '';
@@ -712,13 +676,8 @@
712 676 WHERE 1=1 {$where};" // @codingStandardsIgnoreLine $where already prepared
713 677 );
714 678 }
715 679
716 - /**
717 - * Schedules a purge of records.
718 - *
719 - * @return void
720 - */
721 680 public function purge_schedule_setup() {
722 681 if ( ! wp_next_scheduled( 'wp_stream_auto_purge' ) ) {
723 682 wp_schedule_event( time(), 'twicedaily', 'wp_stream_auto_purge' );
724 683 }
@@ -723,17 +682,12 @@
723 682 wp_schedule_event( time(), 'twicedaily', 'wp_stream_auto_purge' );
724 683 }
725 684 }
726 685
727 - /**
728 - * Executes a scheduled purge
729 - *
730 - * @return void
731 - */
732 686 public function purge_scheduled_action() {
733 687 global $wpdb;
734 688
735 - // Don't purge when in Network Admin unless Stream is network activated.
689 + // Don't purge when in Network Admin unless Stream is network activated
736 690 if (
737 691 is_multisite()
738 692 &&
739 693 is_network_admin()
@@ -742,13 +696,12 @@
742 696 ) {
743 697 return;
744 698 }
745 699
746 - $defaults = $this->plugin->settings->get_defaults();
747 700 if ( is_multisite() && $this->plugin->is_network_activated() ) {
748 - $options = (array) get_site_option( 'wp_stream_network', $defaults );
701 + $options = (array) get_site_option( 'wp_stream_network', array() );
749 702 } else {
750 - $options = (array) get_option( 'wp_stream', $defaults );
703 + $options = (array) get_option( 'wp_stream', array() );
751 704 }
752 705
753 706 if ( ! empty( $options['general_keep_records_indefinitely'] ) || ! isset( $options['general_records_ttl'] ) ) {
754 707 return;
@@ -761,9 +714,9 @@
761 714 $date->sub( DateInterval::createFromDateString( "$days days" ) );
762 715
763 716 $where = $wpdb->prepare( ' AND `stream`.`created` < %s', $date->format( 'Y-m-d H:i:s' ) );
764 717
765 - // Multisite but NOT network activated, only purge the current blog.
718 + // Multisite but NOT network activated, only purge the current blog
766 719 if ( is_multisite() && ! $this->plugin->is_network_activated() ) {
767 720 $where .= $wpdb->prepare( ' AND `blog_id` = %d', get_current_blog_id() );
768 721 }
769 722
@@ -776,15 +729,13 @@
776 729 );
777 730 }
778 731
779 732 /**
780 - * Returns the admin action links.
733 + * @param array $links
734 + * @param string $file
781 735 *
782 736 * @filter plugin_action_links
783 737 *
784 - * @param array $links Action links.
785 - * @param string $file Plugin file.
786 - *
787 738 * @return array
788 739 */
789 740 public function plugin_action_links( $links, $file ) {
790 741 if ( plugin_basename( $this->plugin->locations['dir'] . 'stream.php' ) !== $file ) {
@@ -790,9 +741,9 @@
790 741 if ( plugin_basename( $this->plugin->locations['dir'] . 'stream.php' ) !== $file ) {
791 742 return $links;
792 743 }
793 744
794 - // Also don't show links in Network Admin if Stream isn't network enabled.
745 + // Also don't show links in Network Admin if Stream isn't network enabled
795 746 if ( is_network_admin() && is_multisite() && ! $this->plugin->is_network_activated() ) {
796 747 return $links;
797 748 }
798 749
@@ -813,8 +764,20 @@
813 764 }
814 765
815 766 $links[] = sprintf( '<a href="%s">%s</a>', esc_url( $admin_page_url ), esc_html__( 'Settings', 'default' ) );
816 767
768 + if ( ! defined( 'DISALLOW_FILE_MODS' ) || false === DISALLOW_FILE_MODS ) {
769 + $url = add_query_arg(
770 + array(
771 + 'action' => 'wp_stream_uninstall',
772 + 'wp_stream_nonce' => wp_create_nonce( 'stream_nonce' ),
773 + ),
774 + admin_url( 'admin-ajax.php' )
775 + );
776 +
777 + $links[] = sprintf( '<span id="wp_stream_uninstall" class="delete"><a href="%s">%s</a></span>', esc_url( $url ), esc_html__( 'Uninstall', 'stream' ) );
778 + }
779 +
817 780 return $links;
818 781 }
819 782
820 783 /**
@@ -904,9 +867,9 @@
904 867
905 868 /**
906 869 * Check if a particular role has access
907 870 *
908 - * @param string $role User role.
871 + * @param string $role
909 872 *
910 873 * @return bool
911 874 */
912 875 private function role_can_view( $role ) {
@@ -919,12 +882,12 @@
919 882
920 883 /**
921 884 * Filter user caps to dynamically grant our view cap based on allowed roles
922 885 *
923 - * @param array $allcaps All capabilities.
924 - * @param array $caps Required caps.
925 - * @param array $args Unused.
926 - * @param WP_User $user User.
886 + * @param $allcaps
887 + * @param $caps
888 + * @param $args
889 + * @param $user
927 890 *
928 891 * @filter user_has_cap
929 892 *
930 893 * @return array
@@ -969,11 +932,11 @@
969 932 * Filter role caps to dynamically grant our view cap based on allowed roles
970 933 *
971 934 * @filter role_has_cap
972 935 *
973 - * @param array $allcaps All capabilities.
974 - * @param string $cap Require cap.
975 - * @param string $role User role.
936 + * @param $allcaps
937 + * @param $cap
938 + * @param $role
976 939 *
977 940 * @return array
978 941 */
979 942 public function filter_role_caps( $allcaps, $cap, $role ) {
@@ -986,10 +949,8 @@
986 949 return $allcaps;
987 950 }
988 951
989 952 /**
990 - * Ajax callback for return a user list.
991 - *
992 953 * @action wp_ajax_wp_stream_filters
993 954 */
994 955 public function ajax_filters() {
995 956 if ( ! defined( 'DOING_AJAX' ) || ! current_user_can( $this->plugin->admin->settings_cap ) ) {
@@ -1023,9 +984,9 @@
1023 984 if ( count( $users ) > $this->preload_users_max ) {
1024 985 $users = array_slice( $users, 0, $this->preload_users_max );
1025 986 }
1026 987
1027 - // Get gravatar / roles for final result set.
988 + // Get gravatar / roles for final result set
1028 989 $results = $this->get_users_record_meta( $users );
1029 990
1030 991 break;
1031 992 }
@@ -1030,20 +991,14 @@
1030 991 break;
1031 992 }
1032 993
1033 994 if ( isset( $results ) ) {
1034 - echo wp_stream_json_encode( $results ); // xss ok.
995 + echo wp_stream_json_encode( $results ); // xss ok
1035 996 }
1036 997
1037 998 die();
1038 999 }
1039 1000
1040 - /**
1041 - * Return relevant user meta data.
1042 - *
1043 - * @param array $authors Author data.
1044 - * @return array
1045 - */
1046 1001 public function get_users_record_meta( $authors ) {
1047 1002 $authors_records = array();
1048 1003
1049 1004 foreach ( $authors as $user_id => $args ) {
@@ -1063,15 +1018,19 @@
1063 1018
1064 1019 /**
1065 1020 * Get user meta in a way that is also safe for VIP
1066 1021 *
1067 - * @param int $user_id User ID.
1068 - * @param string $meta_key Meta key.
1069 - * @param bool $single Return first found meta value connected to the meta key (optional).
1022 + * @param int $user_id
1023 + * @param string $meta_key
1024 + * @param bool $single (optional)
1070 1025 *
1071 1026 * @return mixed
1072 1027 */
1073 1028 public function get_user_meta( $user_id, $meta_key, $single = true ) {
1029 + if ( wp_stream_is_vip() && function_exists( 'get_user_attribute' ) ) {
1030 + return get_user_attribute( $user_id, $meta_key );
1031 + }
1032 +
1074 1033 return get_user_meta( $user_id, $meta_key, $single );
1075 1034 }
1076 1035
1077 1036 /**
@@ -1076,16 +1035,20 @@
1076 1035
1077 1036 /**
1078 1037 * Update user meta in a way that is also safe for VIP
1079 1038 *
1080 - * @param int $user_id User ID.
1081 - * @param string $meta_key Meta key.
1082 - * @param mixed $meta_value Meta value.
1083 - * @param mixed $prev_value Previous meta value being overwritten (optional).
1039 + * @param int $user_id
1040 + * @param string $meta_key
1041 + * @param mixed $meta_value
1042 + * @param mixed $prev_value (optional)
1084 1043 *
1085 1044 * @return int|bool
1086 1045 */
1087 1046 public function update_user_meta( $user_id, $meta_key, $meta_value, $prev_value = '' ) {
1047 + if ( wp_stream_is_vip() && function_exists( 'update_user_attribute' ) ) {
1048 + return update_user_attribute( $user_id, $meta_key, $meta_value );
1049 + }
1050 +
1088 1051 return update_user_meta( $user_id, $meta_key, $meta_value, $prev_value );
1089 1052 }
1090 1053
1091 1054 /**
@@ -1090,14 +1053,18 @@
1090 1053
1091 1054 /**
1092 1055 * Delete user meta in a way that is also safe for VIP
1093 1056 *
1094 - * @param int $user_id User ID.
1095 - * @param string $meta_key Meta key.
1096 - * @param mixed $meta_value Meta value (optional).
1057 + * @param int $user_id
1058 + * @param string $meta_key
1059 + * @param mixed $meta_value (optional)
1097 1060 *
1098 1061 * @return bool
1099 1062 */
1100 1063 public function delete_user_meta( $user_id, $meta_key, $meta_value = '' ) {
1064 + if ( wp_stream_is_vip() && function_exists( 'delete_user_attribute' ) ) {
1065 + return delete_user_attribute( $user_id, $meta_key, $meta_value );
1066 + }
1067 +
1101 1068 return delete_user_meta( $user_id, $meta_key, $meta_value );
1102 1069 }
1103 1070 }