| @@ -1,58 +1,33 @@ | ||
| 1 | 1 | <?php |
| 2 | -/** | |
| 3 | - * Manages functionality for the Stream Admin pages on both | |
| 4 | - * single and multi-sites. | |
| 5 | - * | |
| 6 | - * @package WP_Stream | |
| 7 | - */ | |
| 8 | - | |
| 9 | 2 | namespace WP_Stream; |
| 10 | 3 | |
| 11 | -/** | |
| 12 | - * Class - Network | |
| 13 | - */ | |
| 14 | 4 | class Network { |
| 15 | 5 | /** |
| 16 | - * Holds instance of plugin object | |
| 6 | + * Hold Plugin class | |
| 17 | 7 | * |
| 18 | 8 | * @var Plugin |
| 19 | 9 | */ |
| 20 | 10 | public $plugin; |
| 21 | 11 | |
| 22 | - /** | |
| 23 | - * Network page slug | |
| 24 | - * | |
| 25 | - * @var string | |
| 26 | - */ | |
| 27 | 12 | public $network_settings_page_slug = 'wp_stream_network_settings'; |
| 28 | 13 | |
| 29 | - /** | |
| 30 | - * The option name for the network settings. | |
| 31 | - * | |
| 32 | - * @var string | |
| 33 | - */ | |
| 34 | - public $network_settings_option = 'wp_stream_network'; | |
| 14 | + public $default_settings_page_slug = 'wp_stream_default_settings'; | |
| 35 | 15 | |
| 36 | - /** | |
| 37 | - * Class constructor | |
| 38 | - * | |
| 39 | - * @param Plugin $plugin Instance of plugin object. | |
| 40 | - */ | |
| 41 | 16 | public function __construct( $plugin ) { |
| 42 | 17 | $this->plugin = $plugin; |
| 43 | 18 | |
| 44 | - // Always add default site_id/blog_id params when multisite. | |
| 19 | + // Always add default site_id/blog_id params when multisite | |
| 45 | 20 | if ( is_multisite() ) { |
| 46 | 21 | add_filter( 'wp_stream_query_args', array( $this, 'network_query_args' ) ); |
| 47 | 22 | } |
| 48 | 23 | |
| 49 | - // Bail early if not network-activated. | |
| 24 | + // Bail early if not network-activated | |
| 50 | 25 | if ( ! $this->is_network_activated() ) { |
| 51 | 26 | return; |
| 52 | 27 | } |
| 53 | 28 | |
| 54 | - // Actions. | |
| 29 | + // Actions | |
| 55 | 30 | add_action( 'init', array( $this, 'ajax_network_admin' ) ); |
| 56 | 31 | add_action( 'network_admin_menu', array( $this->plugin->admin, 'register_menu' ) ); |
| 57 | 32 | add_action( 'network_admin_menu', array( $this, 'admin_menu_screens' ) ); |
| 58 | 33 | add_action( 'admin_menu', array( $this, 'admin_menu_screens' ) ); |
| @@ -60,9 +35,9 @@ | ||
| 60 | 35 | add_action( 'network_admin_notices', array( $this->plugin->admin, 'admin_notices' ) ); |
| 61 | 36 | add_action( 'wpmuadminedit', array( $this, 'network_options_action' ) ); |
| 62 | 37 | add_action( 'update_site_option_' . $this->plugin->settings->network_options_key, array( $this, 'updated_option_ttl_remove_records' ), 10, 3 ); |
| 63 | 38 | |
| 64 | - // Filters. | |
| 39 | + // Filters | |
| 65 | 40 | add_filter( 'wp_stream_blog_id_logged', array( $this, 'blog_id_logged' ) ); |
| 66 | 41 | add_filter( 'wp_stream_admin_page_title', array( $this, 'network_admin_page_title' ) ); |
| 67 | 42 | add_filter( 'wp_stream_list_table_screen_id', array( $this, 'list_table_screen_id' ) ); |
| 68 | 43 | add_filter( 'wp_stream_list_table_filters', array( $this, 'list_table_filters' ) ); |
| @@ -83,21 +58,14 @@ | ||
| 83 | 58 | * |
| 84 | 59 | * @see https://core.trac.wordpress.org/ticket/22589 |
| 85 | 60 | */ |
| 86 | 61 | public function ajax_network_admin() { |
| 87 | - $http_referer = isset( $_SERVER['HTTP_REFERER'] ) ? esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : ''; | |
| 88 | - | |
| 89 | - // Prefer filterable `wp_doing_ajax()` (WP 4.7+); the plugin supports 4.6. | |
| 90 | - $doing_ajax = function_exists( 'wp_doing_ajax' ) | |
| 91 | - ? wp_doing_ajax() | |
| 92 | - : ( defined( 'DOING_AJAX' ) && DOING_AJAX ); | |
| 93 | - | |
| 94 | 62 | if ( |
| 95 | - $doing_ajax | |
| 63 | + defined( 'DOING_AJAX' ) | |
| 96 | 64 | && |
| 97 | - 0 === stripos( $http_referer, network_admin_url() ) | |
| 65 | + DOING_AJAX | |
| 98 | 66 | && |
| 99 | - $this->can_view_network_records() | |
| 67 | + preg_match( '#^' . network_admin_url() . '#i', $_SERVER['HTTP_REFERER'] ) | |
| 100 | 68 | ) { |
| 101 | 69 | define( 'WP_NETWORK_ADMIN', true ); |
| 102 | 70 | return WP_NETWORK_ADMIN; |
| 103 | 71 | } |
| @@ -105,36 +73,8 @@ | ||
| 105 | 73 | return false; |
| 106 | 74 | } |
| 107 | 75 | |
| 108 | 76 | /** |
| 109 | - * Whether the current user is allowed to read records across the whole | |
| 110 | - * network (and to be treated as being in the Network Admin). | |
| 111 | - * | |
| 112 | - * The Referer prefix checked in ajax_network_admin() is caller-controlled, | |
| 113 | - * so it can only ever be a UI hint about where a request came from -- never | |
| 114 | - * a source of authority. Network-wide record access additionally requires a | |
| 115 | - * real network capability, otherwise a site-level Stream viewer could spoof | |
| 116 | - * the header to lift the per-blog restriction applied in | |
| 117 | - * network_query_args() or to have their actions logged against blog_id 0. | |
| 118 | - * | |
| 119 | - * @return bool | |
| 120 | - */ | |
| 121 | - public function can_view_network_records() { | |
| 122 | - if ( ! is_multisite() ) { | |
| 123 | - return false; | |
| 124 | - } | |
| 125 | - | |
| 126 | - // WP-CLI runs with shell-level access and usually with no logged-in | |
| 127 | - // user, so capability checks would fail for a legitimate operator and | |
| 128 | - // break `wp stream query --blog_id=N`. It sits outside this boundary. | |
| 129 | - if ( defined( 'WP_CLI' ) && WP_CLI ) { | |
| 130 | - return true; | |
| 131 | - } | |
| 132 | - | |
| 133 | - return current_user_can( 'manage_network_options' ); | |
| 134 | - } | |
| 135 | - | |
| 136 | - /** | |
| 137 | 77 | * Builds a stdClass object used when displaying actions done in network administration |
| 138 | 78 | * |
| 139 | 79 | * @return object |
| 140 | 80 | */ |
| @@ -160,9 +100,9 @@ | ||
| 160 | 100 | * if Stream has been network-activated. |
| 161 | 101 | * |
| 162 | 102 | * @action admin_bar_menu |
| 163 | 103 | * |
| 164 | - * @param object $admin_bar Admin bar object. | |
| 104 | + * @param object $admin_bar | |
| 165 | 105 | * |
| 166 | 106 | * @return void |
| 167 | 107 | */ |
| 168 | 108 | public function network_admin_bar_menu( $admin_bar ) { |
| @@ -187,9 +127,9 @@ | ||
| 187 | 127 | ); |
| 188 | 128 | } |
| 189 | 129 | |
| 190 | 130 | /** |
| 191 | - * Add Network Settings and Default Settings menu pages | |
| 131 | + * Add Network Settings and Default Settings menu items | |
| 192 | 132 | * |
| 193 | 133 | * @return array |
| 194 | 134 | */ |
| 195 | 135 | public function admin_menu_screens() { |
| @@ -212,11 +152,11 @@ | ||
| 212 | 152 | |
| 213 | 153 | /** |
| 214 | 154 | * Remove records when records TTL is shortened |
| 215 | 155 | * |
| 216 | - * @param string $option_key Unused. | |
| 217 | - * @param array $new_value New value. | |
| 218 | - * @param array $old_value Old value. | |
| 156 | + * @param string $option_key | |
| 157 | + * @param array $old_value | |
| 158 | + * @param array $new_value | |
| 219 | 159 | * |
| 220 | 160 | * @action update_option_wp_stream |
| 221 | 161 | * @return void |
| 222 | 162 | */ |
| @@ -227,9 +167,9 @@ | ||
| 227 | 167 | |
| 228 | 168 | /** |
| 229 | 169 | * Adjust the action of the settings form when in the Network Admin |
| 230 | 170 | * |
| 231 | - * @param string $action Query string. | |
| 171 | + * @param $action | |
| 232 | 172 | * |
| 233 | 173 | * @return string |
| 234 | 174 | */ |
| 235 | 175 | public function settings_form_action( $action ) { |
| @@ -248,9 +188,9 @@ | ||
| 248 | 188 | |
| 249 | 189 | /** |
| 250 | 190 | * Add a description to each of the Settings pages in the Network Admin |
| 251 | 191 | * |
| 252 | - * @param string $description Description of the current page. | |
| 192 | + * @param $description | |
| 253 | 193 | * |
| 254 | 194 | * @return string |
| 255 | 195 | */ |
| 256 | 196 | public function settings_form_description( $description ) { |
| @@ -259,10 +199,15 @@ | ||
| 259 | 199 | } |
| 260 | 200 | |
| 261 | 201 | $current_page = wp_stream_filter_input( INPUT_GET, 'page' ); |
| 262 | 202 | |
| 263 | - if ( $this->network_settings_page_slug === $current_page ) { | |
| 264 | - $description = __( 'These settings apply to all sites on the network.', 'stream' ); | |
| 203 | + switch ( $current_page ) { | |
| 204 | + case $this->network_settings_page_slug: | |
| 205 | + $description = __( 'These settings apply to all sites on the network.', 'stream' ); | |
| 206 | + break; | |
| 207 | + case $this->default_settings_page_slug: | |
| 208 | + $description = __( 'These default settings will apply to new sites created on the network. These settings do not alter existing sites.', 'stream' ); | |
| 209 | + break; | |
| 265 | 210 | } |
| 266 | 211 | |
| 267 | 212 | return $description; |
| 268 | 213 | } |
| @@ -269,9 +214,9 @@ | ||
| 269 | 214 | |
| 270 | 215 | /** |
| 271 | 216 | * Adjusts the settings fields displayed in various network admin screens |
| 272 | 217 | * |
| 273 | - * @param array $fields Page settings fields. | |
| 218 | + * @param $fields | |
| 274 | 219 | * |
| 275 | 220 | * @return mixed |
| 276 | 221 | */ |
| 277 | 222 | public function get_network_admin_fields( $fields ) { |
| @@ -308,9 +253,9 @@ | ||
| 308 | 253 | ), |
| 309 | 254 | ) |
| 310 | 255 | ); |
| 311 | 256 | |
| 312 | - // Remove settings based on context. | |
| 257 | + // Remove settings based on context | |
| 313 | 258 | if ( $this->plugin->settings->network_options_key === $this->plugin->settings->option_key ) { |
| 314 | 259 | $hidden_options = $network_hidden_options; |
| 315 | 260 | } else { |
| 316 | 261 | $hidden_options = $stream_hidden_options; |
| @@ -327,9 +272,9 @@ | ||
| 327 | 272 | } |
| 328 | 273 | } |
| 329 | 274 | } |
| 330 | 275 | |
| 331 | - // Add settings based on context. | |
| 276 | + // Add settings based on context | |
| 332 | 277 | if ( $this->plugin->settings->network_options_key === $this->plugin->settings->option_key ) { |
| 333 | 278 | $new_fields['general']['fields'][] = array( |
| 334 | 279 | 'name' => 'site_access', |
| 335 | 280 | 'title' => __( 'Site Access', 'stream' ), |
| @@ -341,9 +286,9 @@ | ||
| 341 | 286 | |
| 342 | 287 | $fields = array_merge_recursive( $new_fields, $fields ); |
| 343 | 288 | } |
| 344 | 289 | |
| 345 | - // Remove empty settings sections. | |
| 290 | + // Remove empty settings sections | |
| 346 | 291 | foreach ( $fields as $section_key => $section ) { |
| 347 | 292 | if ( empty( $section['fields'] ) ) { |
| 348 | 293 | unset( $fields[ $section_key ] ); |
| 349 | 294 | } |
| @@ -356,10 +301,8 @@ | ||
| 356 | 301 | * Get translations of serialized Stream Network settings |
| 357 | 302 | * |
| 358 | 303 | * @filter wp_stream_serialized_labels |
| 359 | 304 | * |
| 360 | - * @param array $labels Setting labels. | |
| 361 | - * | |
| 362 | 305 | * @return array Multidimensional array of fields |
| 363 | 306 | */ |
| 364 | 307 | public function get_settings_translations( $labels ) { |
| 365 | 308 | $network_key = $this->plugin->settings->network_options_key; |
| @@ -380,50 +323,46 @@ | ||
| 380 | 323 | /** |
| 381 | 324 | * Wrapper for the settings API to work on the network settings page |
| 382 | 325 | */ |
| 383 | 326 | public function network_options_action() { |
| 327 | + $allowed_referers = array( | |
| 328 | + $this->network_settings_page_slug, | |
| 329 | + $this->default_settings_page_slug, | |
| 330 | + ); | |
| 384 | 331 | |
| 385 | - // Check the nonce. | |
| 386 | - if ( | |
| 387 | - empty( $_POST['_wpnonce'] ) | |
| 388 | - || | |
| 389 | - ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ), sprintf( '%s-options', $this->network_settings_option ) ) | |
| 390 | - ) { | |
| 332 | + if ( ! isset( $_GET['action'] ) || ! in_array( $_GET['action'], $allowed_referers, true ) ) { // CSRF okay | |
| 391 | 333 | return; |
| 392 | 334 | } |
| 393 | 335 | |
| 394 | - // Check the user capability. | |
| 395 | - if ( ! current_user_can( $this->plugin->admin->settings_cap ) ) { | |
| 396 | - return; | |
| 397 | - } | |
| 336 | + $options = isset( $_POST['option_page'] ) ? explode( ',', stripslashes( $_POST['option_page'] ) ) : null; // CSRF okay | |
| 398 | 337 | |
| 399 | - // Check the action. | |
| 400 | - $action = isset( $_GET['action'] ) ? sanitize_key( wp_unslash( $_GET['action'] ) ) : ''; | |
| 401 | - if ( $this->network_settings_page_slug !== $action ) { | |
| 402 | - return; | |
| 403 | - } | |
| 338 | + if ( $options ) { | |
| 404 | 339 | |
| 405 | - $option = ! empty( $_POST['option_page'] ) ? sanitize_key( wp_unslash( $_POST['option_page'] ) ) : false; | |
| 340 | + foreach ( $options as $option ) { | |
| 341 | + $option = trim( $option ); | |
| 342 | + $value = null; | |
| 343 | + $sections = $this->plugin->settings->get_fields(); | |
| 406 | 344 | |
| 407 | - if ( $option && $this->network_settings_option === $option ) { | |
| 345 | + foreach ( $sections as $section_name => $section ) { | |
| 346 | + foreach ( $section['fields'] as $field_idx => $field ) { | |
| 347 | + $option_key = $section_name . '_' . $field['name']; | |
| 408 | 348 | |
| 409 | - $value = array(); | |
| 410 | - $posted_options = isset( $_POST[ $option ] ) && is_array( $_POST[ $option ] ) ? wp_unslash( $_POST[ $option ] ) : array(); | |
| 411 | - $sections = $this->plugin->settings->get_fields(); | |
| 349 | + // @codingStandardsIgnoreStart | |
| 350 | + if ( isset( $_POST[ $option ][ $option_key ] ) ) { | |
| 351 | + $value[ $option_key ] = $_POST[ $option ][ $option_key ]; | |
| 352 | + } else { | |
| 353 | + $value[ $option_key ] = false; | |
| 354 | + } | |
| 355 | + // @codingStandardsIgnoreEnd | |
| 356 | + } | |
| 357 | + } | |
| 412 | 358 | |
| 413 | - foreach ( $sections as $section_name => $section ) { | |
| 414 | - foreach ( $section['fields'] as $field_idx => $field ) { | |
| 415 | - $option_key = $section_name . '_' . $field['name']; | |
| 359 | + if ( ! is_array( $value ) ) { | |
| 360 | + $value = trim( $value ); | |
| 361 | + } | |
| 416 | 362 | |
| 417 | - if ( isset( $posted_options[ $option_key ] ) ) { | |
| 418 | - $value[ $option_key ] = $this->plugin->settings->sanitize_setting_by_field_type( $posted_options[ $option_key ], $field['type'] ); | |
| 419 | - } else { | |
| 420 | - $value[ $option_key ] = false; | |
| 421 | - } | |
| 422 | - } | |
| 363 | + update_site_option( $option, $value ); | |
| 423 | 364 | } |
| 424 | - | |
| 425 | - update_site_option( $this->network_settings_option, $value ); | |
| 426 | 365 | } |
| 427 | 366 | |
| 428 | 367 | if ( ! count( get_settings_errors() ) ) { |
| 429 | 368 | add_settings_error( 'general', 'settings_updated', __( 'Settings saved.', 'stream' ), 'updated' ); |
| @@ -432,9 +371,9 @@ | ||
| 432 | 371 | set_transient( 'settings_errors', get_settings_errors(), 30 ); |
| 433 | 372 | |
| 434 | 373 | $go_back = add_query_arg( 'settings-updated', 'true', wp_get_referer() ); |
| 435 | 374 | |
| 436 | - wp_safe_redirect( $go_back ); | |
| 375 | + wp_redirect( $go_back ); | |
| 437 | 376 | |
| 438 | 377 | exit; |
| 439 | 378 | } |
| 440 | 379 | |
| @@ -442,9 +381,9 @@ | ||
| 442 | 381 | * Add the Site filter to the Network records screen |
| 443 | 382 | * |
| 444 | 383 | * @filter wp_stream_list_table_filters |
| 445 | 384 | * |
| 446 | - * @param array $filters Filters. | |
| 385 | + * @param $filters | |
| 447 | 386 | * |
| 448 | 387 | * @return array |
| 449 | 388 | */ |
| 450 | 389 | public function list_table_filters( $filters ) { |
| @@ -453,9 +392,9 @@ | ||
| 453 | 392 | } |
| 454 | 393 | |
| 455 | 394 | $blogs = array(); |
| 456 | 395 | |
| 457 | - // Display network blog as the first option. | |
| 396 | + // Display network blog as the first option | |
| 458 | 397 | $network_blog = $this->get_network_blog(); |
| 459 | 398 | |
| 460 | 399 | $blogs[ $network_blog->blog_id ] = array( |
| 461 | 400 | 'label' => $network_blog->blogname, |
| @@ -461,9 +400,9 @@ | ||
| 461 | 400 | 'label' => $network_blog->blogname, |
| 462 | 401 | 'disabled' => '', |
| 463 | 402 | ); |
| 464 | 403 | |
| 465 | - // Add all sites. | |
| 404 | + // add all sites | |
| 466 | 405 | foreach ( wp_stream_get_sites() as $blog ) { |
| 467 | 406 | $blog_data = get_blog_details( $blog->blog_id ); |
| 468 | 407 | |
| 469 | 408 | $blogs[ $blog->blog_id ] = array( |
| @@ -482,9 +421,9 @@ | ||
| 482 | 421 | |
| 483 | 422 | /** |
| 484 | 423 | * Add the Site toggle to screen options in network admin |
| 485 | 424 | * |
| 486 | - * @param array $filters Filters. | |
| 425 | + * @param $filters | |
| 487 | 426 | * |
| 488 | 427 | * @return array |
| 489 | 428 | */ |
| 490 | 429 | public function toggle_filters( $filters ) { |
| @@ -497,9 +436,9 @@ | ||
| 497 | 436 | |
| 498 | 437 | /** |
| 499 | 438 | * Add the network suffix to the $screen_id when in the network admin |
| 500 | 439 | * |
| 501 | - * @param int $screen_id Screen ID. | |
| 440 | + * @param $screen_id | |
| 502 | 441 | * |
| 503 | 442 | * @return string |
| 504 | 443 | */ |
| 505 | 444 | public function list_table_screen_id( $screen_id ) { |
| @@ -514,10 +453,8 @@ | ||
| 514 | 453 | |
| 515 | 454 | /** |
| 516 | 455 | * Set blog_id for network admin activity |
| 517 | 456 | * |
| 518 | - * @param int $blog_id Blog ID. | |
| 519 | - * | |
| 520 | 457 | * @return int |
| 521 | 458 | */ |
| 522 | 459 | public function blog_id_logged( $blog_id ) { |
| 523 | 460 | return is_network_admin() ? 0 : $blog_id; |
| @@ -527,27 +464,14 @@ | ||
| 527 | 464 | * Customize query args on multisite installs |
| 528 | 465 | * |
| 529 | 466 | * @filter wp_stream_query_args |
| 530 | 467 | * |
| 531 | - * @param array $args Site arguments. | |
| 468 | + * @param array $args | |
| 532 | 469 | * |
| 533 | 470 | * @return array |
| 534 | 471 | */ |
| 535 | 472 | public function network_query_args( $args ) { |
| 536 | 473 | $args['site_id'] = is_numeric( $args['site_id'] ) ? $args['site_id'] : get_current_site()->id; |
| 537 | - | |
| 538 | - // Only users with a network capability may choose which blog to read | |
| 539 | - // from. For everyone else the requested blog_id is ignored entirely and | |
| 540 | - // forced to the current blog: a numeric type check is not an | |
| 541 | - // authorization check, and the Stream tables are shared across the | |
| 542 | - // whole network, so honouring an arbitrary ?blog_id= would let a | |
| 543 | - // site-level viewer read another site's activity. | |
| 544 | - if ( ! $this->can_view_network_records() ) { | |
| 545 | - $args['blog_id'] = get_current_blog_id(); | |
| 546 | - | |
| 547 | - return $args; | |
| 548 | - } | |
| 549 | - | |
| 550 | 474 | $args['blog_id'] = is_numeric( $args['blog_id'] ) ? $args['blog_id'] : ( is_network_admin() ? null : get_current_blog_id() ); |
| 551 | 475 | |
| 552 | 476 | return $args; |
| 553 | 477 | } |
| @@ -556,15 +480,15 @@ | ||
| 556 | 480 | * Add site count to the page title in the network admin |
| 557 | 481 | * |
| 558 | 482 | * @filter wp_stream_admin_page_title |
| 559 | 483 | * |
| 560 | - * @param string $page_title Page title. | |
| 484 | + * @param string $page_title | |
| 561 | 485 | * |
| 562 | 486 | * @return string |
| 563 | 487 | */ |
| 564 | 488 | public function network_admin_page_title( $page_title ) { |
| 565 | 489 | if ( is_network_admin() ) { |
| 566 | - /* translators: %d: number of sites on the network (e.g. "42") */ | |
| 490 | + // translators: Placeholder refers to a number of sites on the network (e.g. "42") | |
| 567 | 491 | $site_count = sprintf( _n( '%d site', '%d sites', get_blog_count(), 'stream' ), number_format( get_blog_count() ) ); |
| 568 | 492 | $page_title = sprintf( '%s (%s)', $page_title, $site_count ); |
| 569 | 493 | } |
| 570 | 494 | |
| @@ -573,9 +497,9 @@ | ||
| 573 | 497 | |
| 574 | 498 | /** |
| 575 | 499 | * Add the Site column to the network stream records |
| 576 | 500 | * |
| 577 | - * @param array $columns Columns data. | |
| 501 | + * @param $columns | |
| 578 | 502 | * |
| 579 | 503 | * @return mixed |
| 580 | 504 | */ |
| 581 | 505 | public function network_admin_columns( $columns ) { |
| @@ -594,9 +518,9 @@ | ||
| 594 | 518 | |
| 595 | 519 | /** |
| 596 | 520 | * Prevent the Blogs connector from loading when not in Network Admin |
| 597 | 521 | * |
| 598 | - * @param array $connectors Connectors. | |
| 522 | + * @param $connectors | |
| 599 | 523 | * |
| 600 | 524 | * @return mixed |
| 601 | 525 | */ |
| 602 | 526 | public function hide_blogs_connector( $connectors ) { |
