← All changes | classes/Importer.php +53 -61 5.0.21 → 5.1.1 View file →

		@@ -9,9 +9,8 @@
9	9
10	10	namespace ULTP;
11	11
12	12	use ULTP\Includes\Durbin\DurbinClient;
13		-use ULTP\Includes\Durbin\Xpo;
14	13
15	14	defined( 'ABSPATH' ) || exit;
16	15
17	16	/**
		@@ -108,9 +107,9 @@
108	107	public function install_required_plugin_callback() {
109	108	if ( ! current_user_can( 'install_plugins' ) ) {
110	109	return wp_send_json_success( 'You are not allowed to install plugin' );
111	110	}
112		- if ( ! wp_verify_nonce( sanitize_key( wp_unslash( $_REQUEST['wpnonce'] ) ), 'ultp-nonce' ) ) {
	111	+ if ( ! isset( $_REQUEST['wpnonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_REQUEST['wpnonce'] ) ), 'ultp-admin-nonce' ) ) {
113	112	return '';
114	113	}
115	114	if ( ! current_user_can( 'install_plugins' ) ) {
116	115	return wp_send_json_success( 'You are not allowed to install plugin' );
		@@ -128,12 +127,12 @@
128	127
129	128	$msg = '';
130	129
131	130	$all_plugins = get_plugins();
132		- $plugin = ultimate_post()->ultp_rest_sanitize_params( json_decode( stripslashes( $_POST['plugin'] ) ) );
	131	+ $plugin = isset( $_POST['plugin'] ) ? ultimate_post()->ultp_rest_sanitize_params( json_decode( wp_unslash( $_POST['plugin'] ) ) ) : null; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- JSON object; ->path must match an installed plugin key or is used as a WordPress.org slug.
133	132
134	133	if ( $plugin && isset( $all_plugins ) && is_array( $all_plugins ) && array_key_exists( $plugin->path, $all_plugins ) ) {
135		- $activated_plugins = apply_filters( 'active_plugins', get_option( 'active_plugins' ) );
	134	+ $activated_plugins = apply_filters( 'active_plugins', get_option( 'active_plugins' ) ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Core option filter.
136	135	if ( is_array( $activated_plugins ) && in_array( $plugin->path, $activated_plugins ) ) {
137	136	$msg = '_already_installed_activated';
138	137	} else {
139	138	$activate = activate_plugin( $plugin->path, '', false );
		@@ -207,12 +206,14 @@
207	206	$api_endpoint . '/wp-json/importer/site_all_posts',
208	207	array(
209	208	'method' => 'POST',
210	209	'timeout' => 120,
211		- 'body' => array(
212		- 'type' => 'site_posts',
213		- 'license' => Xpo::get_lc_key(),
214		- 'ultp_ver' => ULTP_VER,
	210	+ 'body' => ultimate_post()->get_template_request_body(
	211	+ array(
	212	+ 'type' => 'site_posts',
	213	+ 'ultp_ver' => ULTP_VER,
	214	+ ),
	215	+ 'starter_posts'
215	216	),
216	217	)
217	218	);
218	219	if ( is_wp_error( $response ) ) {
		@@ -281,11 +282,13 @@
281	282	$api_endpoint . '/wp-json/importer/single',
282	283	array(
283	284	'method' => 'POST',
284	285	'timeout' => 120,
285		- 'body' => array(
286		- 'license' => Xpo::get_lc_key(),
287		- 'ultp_ver' => ULTP_VER,
	286	+ 'body' => ultimate_post()->get_template_request_body(
	287	+ array(
	288	+ 'ultp_ver' => ULTP_VER,
	289	+ ),
	290	+ 'starter_content'
288	291	),
289	292	)
290	293	);
291	294
		@@ -563,26 +566,26 @@
563	566	}
564	567	}
565	568	$wow_optin_template_import_status = 'successfully working';
566	569
567		- $activated_plugins = $installed_plugin == 'yes' ? apply_filters( 'active_plugins', get_option( 'active_plugins' ) ) : array();
568		- if ( in_array( 'optin/optin.php', $activated_plugins ) && $wow_optin_template_id && $installed_plugin == 'yes' ) {
569		- try {
570		- if ( class_exists( '\OPTN\Includes\Db', true ) && method_exists( '\OPTN\Includes\Db', 'get_instance' ) ) {
571		- $db_instance = \OPTN\Includes\Db::get_instance();
572		- if ( is_object( $db_instance ) && is_callable( array( $db_instance, 'activate_recipe' ) ) ) {
573		- $db_instance->activate_recipe(
574		- $wow_optin_template_id,
575		- array(
576		- 'disable_others' => true,
577		- )
578		- );
579		- }
580		- }
581		- } catch ( \Throwable $e ) {
582		- $wow_optin_template_import_status = 'have any problem to import Optin template.';
583		- }
584		- }
	570	+ // $activated_plugins = $installed_plugin == 'yes' ? apply_filters( 'active_plugins', get_option( 'active_plugins' ) ) : array();
	571	+ // if ( in_array( 'optin/optin.php', $activated_plugins ) && $wow_optin_template_id && $installed_plugin == 'yes' ) {
	572	+ // try {
	573	+ // if ( class_exists( '\OPTN\Includes\Db', true ) && method_exists( '\OPTN\Includes\Db', 'get_instance' ) ) {
	574	+ // $db_instance = \OPTN\Includes\Db::get_instance();
	575	+ // if ( is_object( $db_instance ) && is_callable( array( $db_instance, 'activate_recipe' ) ) ) {
	576	+ // $db_instance->activate_recipe(
	577	+ // $wow_optin_template_id,
	578	+ // array(
	579	+ // 'disable_others' => true,
	580	+ // )
	581	+ // );
	582	+ // }
	583	+ // }
	584	+ // } catch ( \Throwable $e ) {
	585	+ // $wow_optin_template_import_status = 'have any problem to import Optin template.';
	586	+ // }
	587	+ // }
585	588	// $wow_optin_template_import_status
586	589	return rest_ensure_response(
587	590	array(
588	591	'success' => true,
		@@ -689,10 +692,10 @@
689	692	$deleted_posts = array();
690	693	if ( $deletePrevious == 'yes' ) {
691	694	$site_logo = get_option( 'site_logo', '' );
692	695	global $wpdb;
693		- $post_ids = $wpdb->get_col( $wpdb->prepare( "SELECT post_id FROM {$wpdb->postmeta} WHERE meta_key='__ultp_starter_pack_post'" ) );
694		- $terms = $wpdb->get_col( $wpdb->prepare( "SELECT term_id FROM {$wpdb->termmeta} WHERE meta_key='__ultp_starter_pack_term'" ) );
	696	+ $post_ids = $wpdb->get_col( $wpdb->prepare( "SELECT post_id FROM {$wpdb->postmeta} WHERE meta_key = %s", '__ultp_starter_pack_post' ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- One-off cleanup before import; must read live data.
	697	+ $terms = $wpdb->get_col( $wpdb->prepare( "SELECT term_id FROM {$wpdb->termmeta} WHERE meta_key = %s", '__ultp_starter_pack_term' ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- One-off cleanup before import; must read live data.
695	698
696	699	if ( isset( $post_ids ) && is_array( $post_ids ) ) {
697	700	foreach ( $post_ids as $post_id ) {
698	701	if ( get_post_type( $post_id ) == 'ultp_builder' ) {
		@@ -753,13 +756,15 @@
753	756	'message' => __( 'Invalid API endpoint. Only trusted domains are allowed.', 'ultimate-post' ),
754	757	)
755	758	);
756	759	}
757		- $import_single = array(
758		- 'id' => $id,
759		- 'type' => 'single',
760		- 'license' => Xpo::get_lc_key(),
761		- 'ultp_ver' => ULTP_VER,
	760	+ $import_single = ultimate_post()->get_template_request_body(
	761	+ array(
	762	+ 'id' => $id,
	763	+ 'type' => 'single',
	764	+ 'ultp_ver' => ULTP_VER,
	765	+ ),
	766	+ 'single_page'
762	767	);
763	768	$response = wp_safe_remote_post(
764	769	$api_endpoint . '/wp-json/importer/single',
765	770	array(
		@@ -767,12 +772,20 @@
767	772	'timeout' => 120,
768	773	'body' => $import_single,
769	774	)
770	775	);
771		- $response_data = json_decode( $response['body'] );
772		- if ( ! $response_data->success ) {
773		- wp_send_json(
	776	+ if ( is_wp_error( $response ) ) {
	777	+ return rest_ensure_response(
774	778	array(
	779	+ 'success' => false,
	780	+ 'response_data' => $response,
	781	+ )
	782	+ );
	783	+ }
	784	+ $response_data = json_decode( wp_remote_retrieve_body( $response ) );
	785	+ if ( empty( $response_data->success ) || ! isset( $response_data->content[0] ) ) {
	786	+ return rest_ensure_response(
	787	+ array(
775	788	'success' => false,
776	789	)
777	790	);
778	791	}
		@@ -910,28 +923,7 @@
910	923	* @param string $url The URL to validate.
911	924	* @return bool True if allowed, false otherwise.
912	925	*/
913	926	private function is_allowed_api_endpoint( $url ) {
914		- $allowed_domains = array(
915		- 'starter.postx.io',
916		- 'postxkit.wpxpo.com',
917		- );
918		-
919		- $parsed_url = wp_parse_url( $url );
920		- if ( ! $parsed_url || empty( $parsed_url['host'] ) ) {
921		- return false;
922		- }
923		-
924		- $host = strtolower( $parsed_url['host'] );
925		-
926		- foreach ( $allowed_domains as $domain ) {
927		- $domain = strtolower( $domain );
928		-
929		- // Exact match OR valid subdomain
930		- if ( $host === $domain || substr( $host, - ( strlen( $domain ) + 1 ) ) === '.' . $domain ) {
931		- return true;
932		- }
933		- }
934		-
935		- return false;
	927	+ return ultimate_post()->is_allowed_template_endpoint( $url );
936	928	}
937	929	}