| @@ -26,13 +26,13 @@ | ||
| 26 | 26 | */ |
| 27 | 27 | public $network_settings_page_slug = 'wp_stream_network_settings'; |
| 28 | 28 | |
| 29 | 29 | /** |
| 30 | - * The option name for the network settings. | |
| 30 | + * Default setting page slug | |
| 31 | 31 | * |
| 32 | 32 | * @var string |
| 33 | 33 | */ |
| 34 | - public $network_settings_option = 'wp_stream_network'; | |
| 34 | + public $default_settings_page_slug = 'wp_stream_default_settings'; | |
| 35 | 35 | |
| 36 | 36 | /** |
| 37 | 37 | * Class constructor |
| 38 | 38 | * |
| @@ -83,16 +83,14 @@ | ||
| 83 | 83 | * |
| 84 | 84 | * @see https://core.trac.wordpress.org/ticket/22589 |
| 85 | 85 | */ |
| 86 | 86 | public function ajax_network_admin() { |
| 87 | - $http_referer = isset( $_SERVER['HTTP_REFERER'] ) ? esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : ''; | |
| 88 | - | |
| 89 | 87 | if ( |
| 90 | 88 | defined( 'DOING_AJAX' ) |
| 91 | 89 | && |
| 92 | 90 | DOING_AJAX |
| 93 | 91 | && |
| 94 | - 0 === stripos( $http_referer, network_admin_url() ) | |
| 92 | + preg_match( '#^' . network_admin_url() . '#i', $_SERVER['HTTP_REFERER'] ) | |
| 95 | 93 | ) { |
| 96 | 94 | define( 'WP_NETWORK_ADMIN', true ); |
| 97 | 95 | return WP_NETWORK_ADMIN; |
| 98 | 96 | } |
| @@ -226,10 +224,15 @@ | ||
| 226 | 224 | } |
| 227 | 225 | |
| 228 | 226 | $current_page = wp_stream_filter_input( INPUT_GET, 'page' ); |
| 229 | 227 | |
| 230 | - if ( $this->network_settings_page_slug === $current_page ) { | |
| 231 | - $description = __( 'These settings apply to all sites on the network.', 'stream' ); | |
| 228 | + switch ( $current_page ) { | |
| 229 | + case $this->network_settings_page_slug: | |
| 230 | + $description = __( 'These settings apply to all sites on the network.', 'stream' ); | |
| 231 | + break; | |
| 232 | + case $this->default_settings_page_slug: | |
| 233 | + $description = __( 'These default settings will apply to new sites created on the network. These settings do not alter existing sites.', 'stream' ); | |
| 234 | + break; | |
| 232 | 235 | } |
| 233 | 236 | |
| 234 | 237 | return $description; |
| 235 | 238 | } |
| @@ -347,50 +350,48 @@ | ||
| 347 | 350 | /** |
| 348 | 351 | * Wrapper for the settings API to work on the network settings page |
| 349 | 352 | */ |
| 350 | 353 | public function network_options_action() { |
| 354 | + $allowed_referers = array( | |
| 355 | + $this->network_settings_page_slug, | |
| 356 | + $this->default_settings_page_slug, | |
| 357 | + ); | |
| 351 | 358 | |
| 352 | - // Check the nonce. | |
| 353 | - if ( | |
| 354 | - empty( $_POST['_wpnonce'] ) | |
| 355 | - || | |
| 356 | - ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ), sprintf( '%s-options', $this->network_settings_option ) ) | |
| 357 | - ) { | |
| 359 | + // @codingStandardsIgnoreLine | |
| 360 | + if ( ! isset( $_GET['action'] ) || ! in_array( $_GET['action'], $allowed_referers, true ) ) { | |
| 358 | 361 | return; |
| 359 | 362 | } |
| 360 | 363 | |
| 361 | - // Check the user capability. | |
| 362 | - if ( ! current_user_can( $this->plugin->admin->settings_cap ) ) { | |
| 363 | - return; | |
| 364 | - } | |
| 364 | + // @codingStandardsIgnoreLine | |
| 365 | + $options = isset( $_POST['option_page'] ) ? explode( ',', stripslashes( $_POST['option_page'] ) ) : null; | |
| 365 | 366 | |
| 366 | - // Check the action. | |
| 367 | - $action = isset( $_GET['action'] ) ? sanitize_key( wp_unslash( $_GET['action'] ) ) : ''; | |
| 368 | - if ( $this->network_settings_page_slug !== $action ) { | |
| 369 | - return; | |
| 370 | - } | |
| 367 | + if ( $options ) { | |
| 371 | 368 | |
| 372 | - $option = ! empty( $_POST['option_page'] ) ? sanitize_key( wp_unslash( $_POST['option_page'] ) ) : false; | |
| 369 | + foreach ( $options as $option ) { | |
| 370 | + $option = trim( $option ); | |
| 371 | + $value = null; | |
| 372 | + $sections = $this->plugin->settings->get_fields(); | |
| 373 | 373 | |
| 374 | - if ( $option && $this->network_settings_option === $option ) { | |
| 374 | + foreach ( $sections as $section_name => $section ) { | |
| 375 | + foreach ( $section['fields'] as $field_idx => $field ) { | |
| 376 | + $option_key = $section_name . '_' . $field['name']; | |
| 375 | 377 | |
| 376 | - $value = array(); | |
| 377 | - $posted_options = isset( $_POST[ $option ] ) && is_array( $_POST[ $option ] ) ? wp_unslash( $_POST[ $option ] ) : array(); | |
| 378 | - $sections = $this->plugin->settings->get_fields(); | |
| 378 | + // @codingStandardsIgnoreStart | |
| 379 | + if ( isset( $_POST[ $option ][ $option_key ] ) ) { | |
| 380 | + $value[ $option_key ] = $_POST[ $option ][ $option_key ]; | |
| 381 | + } else { | |
| 382 | + $value[ $option_key ] = false; | |
| 383 | + } | |
| 384 | + // @codingStandardsIgnoreEnd | |
| 385 | + } | |
| 386 | + } | |
| 379 | 387 | |
| 380 | - foreach ( $sections as $section_name => $section ) { | |
| 381 | - foreach ( $section['fields'] as $field_idx => $field ) { | |
| 382 | - $option_key = $section_name . '_' . $field['name']; | |
| 388 | + if ( ! is_array( $value ) ) { | |
| 389 | + $value = trim( $value ); | |
| 390 | + } | |
| 383 | 391 | |
| 384 | - if ( isset( $posted_options[ $option_key ] ) ) { | |
| 385 | - $value[ $option_key ] = $this->plugin->settings->sanitize_setting_by_field_type( $posted_options[ $option_key ], $field['type'] ); | |
| 386 | - } else { | |
| 387 | - $value[ $option_key ] = false; | |
| 388 | - } | |
| 389 | - } | |
| 392 | + update_site_option( $option, $value ); | |
| 390 | 393 | } |
| 391 | - | |
| 392 | - update_site_option( $this->network_settings_option, $value ); | |
| 393 | 394 | } |
| 394 | 395 | |
| 395 | 396 | if ( ! count( get_settings_errors() ) ) { |
| 396 | 397 | add_settings_error( 'general', 'settings_updated', __( 'Settings saved.', 'stream' ), 'updated' ); |
