← All changes | includes/notice/class-notice.php +67 -9 5.0.35 → 5.1.0 View file →

		@@ -95,10 +95,11 @@
95	95	*/
96	96	public static function get_hellobar_config() {
97	97	return array(
98	98	// Final hours sale.
99		- 'ultp_helloBar_summer_sale_2026_v1' => Xpo::get_transient_without_cache( 'ultp_helloBar_summer_sale_2026_v1' ),
	99	+ 'ultp_helloBar_summer_sale_2026_v1' => Xpo::get_transient_without_cache( 'ultp_helloBar_summer_sale_2026_v1' ),
100	100	'ultp_helloBar_summer_sale_2026_v1_2' => Xpo::get_transient_without_cache( 'ultp_helloBar_summer_sale_2026_v1_2' ),
	101	+ 'ultp_helloBar_base_price_2026' => Xpo::get_transient_without_cache( 'ultp_helloBar_base_price_2026' ),
101	102	);
102	103	}
103	104
104	105	/**
		@@ -111,10 +112,17 @@
111	112	$request_params = $request->get_params();
112	113	$type = isset( $request_params['type'] ) ? $request_params['type'] : '';
113	114	$id = isset( $request_params['id'] ) ? $request_params['id'] : '';
114	115
115		- if ( 'hello_bar' === $type && ! empty( $id ) ) {
116		- Xpo::set_transient_without_cache( $id, 'hide', 1296000 );
	116	+ // Guideline 11 — a dismissal must stick. This previously expired after 15
	117	+ // days (1296000s), so a dismissed sale bar came back on its own. Passing 0
	118	+ // stores it with no timeout, which Xpo::get_transient_without_cache() reads
	119	+ // back indefinitely.
	120	+ //
	121	+ // $id names the option that gets written, so it is checked against the
	122	+ // known hellobar keys rather than trusted from the request.
	123	+ if ( 'hello_bar' === $type && ! empty( $id ) && array_key_exists( $id, self::get_hellobar_config() ) ) {
	124	+ Xpo::set_transient_without_cache( $id, 'hide', 0 );
117	125	}
118	126
119	127	return new \WP_REST_Response(
120	128	array(
		@@ -131,9 +139,9 @@
131	139	* @return void
132	140	*/
133	141	public function set_dismiss_notice_callback() {
134	142
135		- if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['wpnonce'] ?? '' ) ), 'ultp-nonce' ) ) {
	143	+ if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['wpnonce'] ?? '' ) ), 'ultp-admin-nonce' ) ) {
136	144	return;
137	145	}
138	146
139	147	$durbin_key = sanitize_text_field( wp_unslash( $_GET['ultp_durbin_key'] ?? '' ) );
		@@ -192,9 +200,9 @@
192	200	*
193	201	* @return void
194	202	*/
195	203	public function ultp_dashboard_banner_notice( $return_bool = false ) {
196		- $ultp_db_nonce = wp_create_nonce( 'ultp-nonce' );
	204	+ $ultp_db_nonce = wp_create_nonce( 'ultp-admin-nonce' );
197	205	$banner_notices = array(
198	206	// FLash sale.
199	207	array(
200	208	'key' => 'ultp_banner_flash_sale_2026_1',
		@@ -561,8 +569,15 @@
561	569	*/
562	570	public function ultp_dashboard_durbin_notice_callback() {
563	571	$durbin_key = 'ultp_durbin_dc1';
564	572
	573	+ // Guideline 11 — the consent notice is allowed on PostX's own screens and,
	574	+ // as is standard immediately after activation, on plugins.php. Nowhere else.
	575	+ global $pagenow;
	576	+ if ( ! $this->is_postx_screen() && 'plugins.php' !== $pagenow ) {
	577	+ return;
	578	+ }
	579	+
565	580	if (
566	581	isset( $_GET['ultp_durbin_key'] ) || // phpcs:ignore
567	582	'off' === Xpo::get_transient_without_cache( 'ultp_durbin_notice_' . $durbin_key )
568	583	) {
		@@ -572,9 +587,9 @@
572	587	if ( ! $this->notice_js_css_applied ) {
573	588	$this->notice_js_css_applied = true;
574	589	}
575	590
576		- $ultp_db_nonce = wp_create_nonce( 'ultp-nonce' );
	591	+ $ultp_db_nonce = wp_create_nonce( 'ultp-admin-nonce' );
577	592
578	593	?>
579	594	<style>
580	595	.ultp-consent-box {
		@@ -726,13 +741,13 @@
726	741	),
727	742
728	743	);
729	744
730		- $ultp_db_nonce = wp_create_nonce( 'ultp-nonce' );
	745	+ $ultp_db_nonce = wp_create_nonce( 'ultp-admin-nonce' );
731	746
732	747	foreach ( $content_notices as $key => $notice ) {
733	748	$notice_key = isset( $notice['key'] ) ? $notice['key'] : $this->notice_version;
734		- if ( isset( $_GET['ultp_notice'] ) && $notice_key === $_GET['ultp_notice'] ) {
	749	+ if ( isset( $_GET['ultp_notice'] ) && $notice_key === sanitize_text_field( wp_unslash( $_GET['ultp_notice'] ) ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only; hides the notice on this page view.
735	750	continue;
736	751	} else {
737	752	$border_color = $notice['border_color'];
738	753
		@@ -925,9 +940,34 @@
925	940	* Handle Plugin Notice for all plugins
926	941	*
927	942	* @return bool
928	943	*/
	944	+ /**
	945	+ * Whether the current admin screen belongs to PostX.
	946	+ *
	947	+ * Guideline 11 limits promotional UI to the plugin's own screens. Every PostX
	948	+ * screen carries `ultp` in its screen id — `toplevel_page_ultp-settings`,
	949	+ * `postx_page_ultp-setup-wizard`, and the `ultp_builder` / `ultp_templates` /
	950	+ * `ultp_custom_font` post-type screens.
	951	+ *
	952	+ * @return BOOL True when the current screen is a PostX screen.
	953	+ */
	954	+ public function is_postx_screen() {
	955	+ if ( ! function_exists( 'get_current_screen' ) ) {
	956	+ return false;
	957	+ }
	958	+ $screen = get_current_screen();
	959	+ return $screen && false !== strpos( $screen->id, 'ultp' );
	960	+ }
	961	+
929	962	public function is_available_for_notice() {
	963	+ // Guideline 11 — sale banners and upgrade prompts belong on PostX's own
	964	+ // screens, not on core screens or other plugins' pages.
	965	+ if ( ! $this->is_postx_screen() ) {
	966	+ return false;
	967	+ }
	968	+
	969	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Shared across WPXPO plugins (ProductX, WholesaleX, …); renaming breaks them.
930	970	$active_notices = apply_filters( 'xpo_active_notice_lists', array() );
931	971	if ( empty( $active_notices ) ) {
932	972	return true;
933	973	}
		@@ -935,9 +975,9 @@
935	975	return array_key_first( $active_notices ) === $this->plugin_notice_priority_key;
936	976	}
937	977
938	978	public function ultp_dashboard_image_banner_notice( $return_bool = false ) {
939		- $ultp_db_nonce = wp_create_nonce( 'ultp-nonce' );
	979	+ $ultp_db_nonce = wp_create_nonce( 'ultp-admin-nonce' );
940	980	$banner_notices = array(
941	981	array(
942	982	'key' => 'ultp_summer_sale_2612',
943	983	'start' => '2026-07-20 00:00 Asia/Dhaka', // format YY-MM-DD always set time 00:00 and zone Asia/Dhaka
		@@ -961,8 +1001,26 @@
961	1001	'utmKey' => 'sub_menu_offer',
962	1002	)
963	1003	),
964	1004	'close_color' => '#000000',
	1005	+ 'visibility' => ! Xpo::is_lc_active(),
	1006	+ ),
	1007	+ array(
	1008	+ 'key' => 'ultp_preco_sale_campaign_262_1',
	1009	+ 'start' => '2026-08-23 00:00 Asia/Dhaka', // format YY-MM-DD always set time 00:00 and zone Asia/Dhaka
	1010	+ 'end' => '2026-08-29 23:59 Asia/Dhaka', // format YY-MM-DD always set time 23:59 and zone Asia/Dhaka
	1011	+ 'banner_src' => ULTP_URL . 'assets/img/dashboard_banner/preco_banner_insider_deal.png',
	1012	+ 'url' => 'https://www.wpxpo.com/product/wowrecommend/?utm_source=db-postx-notice&utm_medium=insider-deal&utm_campaign=postx-dashboard/#pricing',
	1013	+ 'close_color' => '#ffffff',
	1014	+ 'visibility' => ! Xpo::is_lc_active(),
	1015	+ ),
	1016	+ array(
	1017	+ 'key' => 'ultp_preco_sale_campaign_262_2',
	1018	+ 'start' => '2026-08-30 00:00 Asia/Dhaka', // format YY-MM-DD always set time 00:00 and zone Asia/Dhaka.
	1019	+ 'end' => '2026-09-19 23:59 Asia/Dhaka', // format YY-MM-DD always set time 23:59 and zone Asia/Dhaka.
	1020	+ 'banner_src' => ULTP_URL . 'assets/img/dashboard_banner/preco_banner_early_bird.png',
	1021	+ 'url' => 'https://www.wpxpo.com/product/wowrecommend/?utm_source=db-postx-notice&utm_medium=early-bird&utm_campaign=postx-dashboard/#pricing',
	1022	+ 'close_color' => '#ffffff',
965	1023	'visibility' => ! Xpo::is_lc_active(),
966	1024	),
967	1025	);
968	1026