← All changes | includes/ultimate-post-kit-metabox.php +16 -6 4.1.16 → 4.5.6 View file →

		@@ -1,5 +1,10 @@
1	1	<?php
	2	+
	3	+if (!defined('ABSPATH')) {
	4	+ exit; // Exit if accessed directly.
	5	+}
	6	+
2	7	if (!class_exists('Ultimate_Post_Kit_Metabox')) {
3	8	class Ultimate_Post_Kit_Metabox {
4	9	public $enabled_video_features;
5	10	public $enabled_audio_features;
		@@ -50,9 +55,9 @@
50	55
51	56
52	57
53	58
54		- echo $this->get_control_output($display_content);
	59	+ $this->get_control_output($display_content); // Method escapes and echoes internally via wp_kses().
55	60	}
56	61	public function get_control_output($output) {
57	62	$tags = [
58	63	'div' => ['class' => []],
		@@ -69,24 +74,29 @@
69	74	if (!$this->is_secured_nonce('upk_additional_features_nonce_action', 'upk_additional_features_nonce_field', $post_id)) {
70	75	return $post_id;
71	76	}
72	77
73		- $video_link = isset($_POST['_upk_video_link_meta_key']) ? sanitize_text_field($_POST['_upk_video_link_meta_key']) : '';
	78	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce verified in is_secured_nonce() above before any $_POST is read.
	79	+ $video_link = isset($_POST['_upk_video_link_meta_key']) ? sanitize_text_field(wp_unslash($_POST['_upk_video_link_meta_key'])) : '';
74	80	update_post_meta($post_id, '_upk_video_link_meta_key', $video_link);
75	81
76		- $audio_link = isset($_POST['_upk_audio_link_meta_key']) ? sanitize_text_field($_POST['_upk_audio_link_meta_key']) : '';
	82	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce verified in is_secured_nonce() above before any $_POST is read.
	83	+ $audio_link = isset($_POST['_upk_audio_link_meta_key']) ? sanitize_text_field(wp_unslash($_POST['_upk_audio_link_meta_key'])) : '';
77	84	update_post_meta($post_id, '_upk_audio_link_meta_key', $audio_link);
78	85
79		- $audio_title = isset($_POST['_upk_audio_title_meta_key']) ? sanitize_text_field($_POST['_upk_audio_title_meta_key']) : '';
	86	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce verified in is_secured_nonce() above before any $_POST is read.
	87	+ $audio_title = isset($_POST['_upk_audio_title_meta_key']) ? sanitize_text_field(wp_unslash($_POST['_upk_audio_title_meta_key'])) : '';
80	88	update_post_meta($post_id, '_upk_audio_title_meta_key', $audio_title);
81	89
82		- $artist_name = isset($_POST['_upk_artist_name_meta_key']) ? sanitize_text_field($_POST['_upk_artist_name_meta_key']) : '';
	90	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce verified in is_secured_nonce() above before any $_POST is read.
	91	+ $artist_name = isset($_POST['_upk_artist_name_meta_key']) ? sanitize_text_field(wp_unslash($_POST['_upk_artist_name_meta_key'])) : '';
83	92	update_post_meta($post_id, '_upk_artist_name_meta_key', $artist_name);
84	93	}
85	94
86	95
87	96	protected function is_secured_nonce($action, $nonce_field, $post_id) {
88		- $nonce = isset($_POST[$nonce_field]) ? sanitize_text_field($_POST[$nonce_field]) : '';
	97	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- reading the nonce value itself; it is validated with wp_verify_nonce() immediately below.
	98	+ $nonce = isset($_POST[$nonce_field]) ? sanitize_text_field(wp_unslash($_POST[$nonce_field])) : '';
89	99	if ($nonce == '') {
90	100	return false;
91	101	} elseif (!wp_verify_nonce($nonce, $action)) {
92	102	return false;