| @@ -160,19 +160,10 @@ | ||
| 160 | 160 | return $result; |
| 161 | 161 | } |
| 162 | 162 | |
| 163 | 163 | public function twitter( $name ) { |
| 164 | - // Self-contained X (formerly Twitter) follow link. The old markup relied on | |
| 165 | - // Twitter's platform.twitter.com/widgets.js to turn a `.twitter-follow-button` | |
| 166 | - // anchor into a logo button; that widget was retired after the X rebrand, so it | |
| 167 | - // rendered as bare text with no logo. Inline the X mark as SVG instead — no | |
| 168 | - // external script, works offline, and shows the correct current brand. | |
| 169 | - // Styling lives in the .tcmp-x-follow rules in assets/css/style.css. | |
| 170 | 164 | ?> |
| 171 | - <a href="https://x.com/<?php echo esc_attr( $name ); ?>" target="_blank" rel="noopener noreferrer" class="tcmp-x-follow"> | |
| 172 | - <svg viewBox="0 0 24 24" width="16" height="16" fill="currentColor" aria-hidden="true" focusable="false"><path d="M18.244 2.25h3.308l-7.227 8.26 8.502 11.24H16.17l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231zm-1.161 17.52h1.833L7.084 4.126H5.117z"/></svg> | |
| 173 | - <span>Follow @<?php echo esc_html( $name ); ?></span> | |
| 174 | - </a> | |
| 165 | + <a href="https://twitter.com/<?php echo esc_attr( $name ); ?>" class="twitter-follow-button" data-show-count="false" data-dnt="true">Follow @<?php echo esc_attr( $name ); ?></a> | |
| 175 | 166 | <?php |
| 176 | 167 | } |
| 177 | 168 | |
| 178 | 169 | public function sort( $is_associative, $a1, $a2 = null, $a3 = null, $a4 = null, $a5 = null ) { |
| @@ -380,11 +371,11 @@ | ||
| 380 | 371 | function qs( $name, $default = '' ) { |
| 381 | 372 | global $tcmp_allowed_html_tags; |
| 382 | 373 | $result = $default; |
| 383 | 374 | if ( isset( $_POST[ $name ] ) ) { |
| 384 | - $result = $this->sanitize_post_or_get( $_POST[ $name ], $name ); | |
| 375 | + $result = $this->sanitize_post_or_get( $_POST[ $name ] ); | |
| 385 | 376 | } elseif ( isset( $_GET[ $name ] ) ) { |
| 386 | - $result = $this->sanitize_post_or_get( $_GET[ $name ], $name ); | |
| 377 | + $result = $this->sanitize_post_or_get( $_GET[ $name ] ); | |
| 387 | 378 | } |
| 388 | 379 | |
| 389 | 380 | if ( is_string( $result ) ) { |
| 390 | 381 | //The superglobals $_GET and $_REQUEST are already decoded. |
| @@ -395,14 +386,10 @@ | ||
| 395 | 386 | } |
| 396 | 387 | return $result; |
| 397 | 388 | } |
| 398 | 389 | |
| 399 | - private function sanitize_post_or_get( $array, $name = '' ) { | |
| 390 | + private function sanitize_post_or_get( $array ) { | |
| 400 | 391 | global $tcmp_allowed_html_tags; |
| 401 | - // The snippet "code" fields hold raw tracking markup on purpose; they are | |
| 402 | - // sanitized on output via TCMP_Manager::esc_js_code(). Everything else is | |
| 403 | - // treated as plain text so that qs() is safe by default (see F-06). | |
| 404 | - $is_code = ( 'code' === $name || 'tcmp_code' === $name ); | |
| 405 | 392 | if ( is_array( $array ) ) { |
| 406 | 393 | foreach ( $array as $k => &$v ) { |
| 407 | 394 | if ( 'code' == $k ) { |
| 408 | 395 | $v = wp_kses( $v, $tcmp_allowed_html_tags ); |
| @@ -409,11 +396,8 @@ | ||
| 409 | 396 | } elseif ( is_string( $v ) ) { |
| 410 | 397 | $v = sanitize_text_field( $v ); |
| 411 | 398 | } |
| 412 | 399 | } |
| 413 | - unset( $v ); | |
| 414 | - } elseif ( is_string( $array ) && ! $is_code ) { | |
| 415 | - $array = sanitize_text_field( $array ); | |
| 416 | 400 | } |
| 417 | 401 | return $array; |
| 418 | 402 | } |
| 419 | 403 | |
| @@ -419,9 +403,9 @@ | ||
| 419 | 403 | |
| 420 | 404 | var $_taxonomyType; |
| 421 | 405 | |
| 422 | 406 | function query( $query, $options = null ) { |
| 423 | - global $tcmp; | |
| 407 | + global $tcmp, $wpdb; | |
| 424 | 408 | |
| 425 | 409 | $parent = ''; |
| 426 | 410 | $defaults = array( |
| 427 | 411 | 'post_type' => '', |
| @@ -456,29 +440,12 @@ | ||
| 456 | 440 | $name = 'post_title'; |
| 457 | 441 | $function = ''; |
| 458 | 442 | switch ( $query ) { |
| 459 | 443 | case TCMP_QUERY_POSTS_OF_TYPE: |
| 460 | - // get_posts() instead of a direct $wpdb query: it goes | |
| 461 | - // through WordPress's object cache and avoids the | |
| 462 | - // DirectDatabaseQuery / NoCaching warnings. The WP_Post | |
| 463 | - // objects it returns expose the same ID and post_title | |
| 464 | - // fields the loop below reads, and get_posts() already | |
| 465 | - // sets no_found_rows, so this is no heavier than the | |
| 466 | - // two-column SELECT it replaces. The empty-type check keeps | |
| 467 | - // the old semantics: the previous `post_type = ''` SELECT | |
| 468 | - // matched nothing, whereas get_posts() would silently fall | |
| 469 | - // back to listing ordinary posts. | |
| 470 | - if ( '' !== (string) $options['type'] ) { | |
| 471 | - $q = get_posts( | |
| 472 | - array( | |
| 473 | - 'post_type' => $options['type'], | |
| 474 | - 'post_status' => 'publish', | |
| 475 | - 'posts_per_page' => -1, | |
| 476 | - 'orderby' => 'title', | |
| 477 | - 'order' => 'ASC', | |
| 478 | - ) | |
| 479 | - ); | |
| 480 | - } | |
| 444 | + //$options=array('posts_per_page'=>-1, 'post_type'=>$args['post_type']); | |
| 445 | + //$q=get_posts($options); | |
| 446 | + $sql = 'SELECT ID, post_title FROM ' . $wpdb->prefix . "posts WHERE post_status='publish' AND post_type='" . $options['type'] . "' ORDER BY post_title"; | |
| 447 | + $q = $wpdb->get_results( $sql ); | |
| 481 | 448 | $function = 'get_permalink'; |
| 482 | 449 | break; |
| 483 | 450 | case TCMP_QUERY_CATEGORIES: |
| 484 | 451 | break; |
| @@ -1646,8 +1613,13 @@ | ||
| 1646 | 1613 | } |
| 1647 | 1614 | return $data; |
| 1648 | 1615 | } |
| 1649 | 1616 | |
| 1617 | + function isAdminUser() { | |
| 1618 | + //https://wordpress.org/support/topic/how-to-check-admin-right-without-include-pluggablephp | |
| 1619 | + return true; | |
| 1620 | + } | |
| 1621 | + | |
| 1650 | 1622 | function isPluginPage() { |
| 1651 | 1623 | global $tcmp; |
| 1652 | 1624 | $page = tcmp_sqs( 'page' ); |
| 1653 | 1625 | $result = ( $this->starts_with( $page, TCMP_PLUGIN_SLUG ) ); |
| @@ -1998,17 +1970,19 @@ | ||
| 1998 | 1970 | return ''; |
| 1999 | 1971 | } |
| 2000 | 1972 | |
| 2001 | 1973 | public function getVisitorIpAddress() { |
| 2002 | - // Only REMOTE_ADDR is set by the web server and cannot be spoofed by the | |
| 2003 | - // client. HTTP_CLIENT_IP / HTTP_X_FORWARDED_FOR are attacker-controllable | |
| 2004 | - // request headers and must never be trusted for a security decision, so | |
| 2005 | - // they are intentionally NOT consulted here. Also calls the real instance | |
| 2006 | - // method $this->validate_ip() (the previous global validate_ip() call | |
| 2007 | - // would have fatal-errored). (See F-12.) | |
| 2008 | 1974 | $ip = ''; |
| 2009 | - if ( ! empty( $_SERVER['REMOTE_ADDR'] ) ) { | |
| 2010 | - $ip = $this->validate_ip( sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) ); | |
| 1975 | + if ( ! empty( $_SERVER['HTTP_CLIENT_IP'] ) ) { | |
| 1976 | + $ip = validate_ip( $_SERVER['HTTP_CLIENT_IP'] ); | |
| 1977 | + } | |
| 1978 | + | |
| 1979 | + if ( '' == $ip && ! empty( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) { | |
| 1980 | + $ip = validate_ip( $_SERVER['HTTP_X_FORWARDED_FOR'] ); | |
| 1981 | + } | |
| 1982 | + | |
| 1983 | + if ( '' == $ip ) { | |
| 1984 | + $ip = validate_ip( $_SERVER['REMOTE_ADDR'] ); | |
| 2011 | 1985 | } |
| 2012 | 1986 | return $ip; |
| 2013 | 1987 | } |
| 2014 | 1988 | |
