← All changes | addons/builder/Builder.php +14 -38 5.0.33 → 5.1.1 View file →

		@@ -1,9 +1,8 @@
1	1	<?php
2	2
3	3	namespace ULTP;
4	4
5		-use ULTP\Includes\Durbin\Xpo;
6	5
7	6	defined( 'ABSPATH' ) || exit;
8	7
9	8	class Builder {
		@@ -19,9 +18,8 @@
19	18	add_action( 'add_meta_boxes', array( $this, 'init_metabox_callback' ) );
20	19	add_action( 'save_post', array( $this, 'metabox_save_data' ) );
21	20	add_action( 'save_post', array( $this, 'metabox_save_video_data' ) );
22	21	add_action( 'delete_post', array( $this, 'delete_option_meta_action' ) );
23		- add_action( 'load-post-new.php', array( $this, 'disable_new_post_templates' ) );
24	22	}
25	23
26	24	public function checkfor_header_footer() {
27	25	$this->theme_name = get_template();
		@@ -107,11 +105,10 @@
107	105	wp_enqueue_style( 'wp-block-library' ); // Gutenberg CSS issue Bricks Builder frontend
108	106	}
109	107	}
110	108	?>
111		- <header id="ultp-header-template" class="<?php esc_html_e( 'ultp-builderid-' . $this->header_id ); ?>">
112		- <?php echo ultimate_post()->get_post_content($this->header_id); //phpcs:ignore
113		- ?>
	109	+ <header id="ultp-header-template" class="<?php echo esc_attr( 'ultp-builderid-' . $this->header_id ); ?>">
	110	+ <?php ultimate_post()->get_post_content( $this->header_id ); ?>
114	111	</header>
115	112	<?php
116	113	}
117	114	}
		@@ -118,11 +115,10 @@
118	115	public function ultp_footer_builder_template() {
119	116	if ( $this->footer_id ) {
120	117
121	118	?>
122		- <footer id="ultp-footer-template" class="<?php esc_html_e( 'ultp-builderid-' . $this->footer_id ); ?>" role="contentinfo">
123		- <?php echo ultimate_post()->get_post_content($this->footer_id) //phpcs:ignore
124		- ?>
	119	+ <footer id="ultp-footer-template" class="<?php echo esc_attr( 'ultp-builderid-' . $this->footer_id ); ?>" role="contentinfo">
	120	+ <?php ultimate_post()->get_post_content( $this->footer_id ); ?>
125	121	</footer>
126	122	<?php
127	123	if ( ! $this->is_block_theme ) {
128	124	if ( $this->theme_name == 'astra' || $this->theme_name == 'generatepress' ) { // Astra theme issue
		@@ -143,26 +139,8 @@
143	139	}
144	140	}
145	141	}
146	142
147		- public function disable_new_post_templates() {
148		- if ( get_current_screen()->post_type == 'ultp_builder' && ( ! defined( 'ULTP_PRO_VER' ) ) ) {
149		- $post_count = wp_count_posts( 'ultp_builder' );
150		- $post_count = $post_count->publish + $post_count->draft;
151		- if ( $post_count > 0 ) {
152		- wp_die(
153		- 'You are not allowed to do that! Only one template can be created in the free version. Please <a target="_blank" href="' . esc_url(
154		- Xpo::generate_utm_link(
155		- array(
156		- 'utmKey' => 'post_type_page',
157		- )
158		- )
159		- ) . '">Upgrade Pro.</a>'
160		- );
161		- }
162		- }
163		- }
164		-
165	143	public function delete_option_meta_action( $post_id ) {
166	144	if ( get_post_type( $post_id ) != 'ultp_builder' ) {
167	145	return;
168	146	}
		@@ -248,13 +226,13 @@
248	226	}
249	227	if ( ! isset( $_POST['feature-video'] ) ) {
250	228	return;
251	229	}
252		- update_post_meta( $post_id, '__builder_feature_video', sanitize_text_field( $_POST['feature-video'] ) );
	230	+ update_post_meta( $post_id, '__builder_feature_video', sanitize_text_field( $_POST['feature-video'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- update_post_meta() unslashes; unslashing here would strip backslashes twice.
253	231	if ( ! isset( $_POST['video-caption'] ) ) {
254	232	return;
255	233	}
256		- update_post_meta( $post_id, '__builder_feature_caption', sanitize_text_field( $_POST['video-caption'] ) );
	234	+ update_post_meta( $post_id, '__builder_feature_caption', sanitize_text_field( $_POST['video-caption'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- update_post_meta() unslashes; unslashing here would strip backslashes twice.
257	235	}
258	236
259	237
260	238	function container_width_callback( $post ) {
		@@ -264,9 +242,9 @@
264	242	$widget = get_post_meta( $post->ID, '__builder_widget_area', true );
265	243	$p_type = get_post_meta( $post->ID, '__ultp_builder_type', true );
266	244	$p_type = $p_type ? $p_type : 'archive';
267	245
268		- $widget_area = wp_get_sidebars_widgets();
	246	+ $widget_area = wp_get_sidebars_widgets(); // phpcs:ignore Generic.PHP.ForbiddenFunctions.Found -- Needs every sidebar ID incl. the sidebars_widgets filter; no public equivalent.
269	247	if ( isset( $widget_area['wp_inactive_widgets'] ) ) {
270	248	unset( $widget_area['wp_inactive_widgets'] );
271	249	}
272	250	if ( isset( $widget_area['array_version'] ) ) {
		@@ -273,11 +251,9 @@
273	251	unset( $widget_area['array_version'] );
274	252	}
275	253	?>
276	254
277		- <input type="hidden" name="postx-type" value="<?php echo esc_attr(isset($_GET['postx_type']) ? sanitize_text_field($_GET['postx_type']) : $p_type); // @codingStandardsIgnoreLine
278		- ?>
279		- " />
	255	+ <input type="hidden" name="postx-type" value="<?php echo esc_attr( isset( $_GET['postx_type'] ) ? sanitize_text_field( wp_unslash( $_GET['postx_type'] ) ) : $p_type ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only: pre-fills the builder type on the new-template screen; the save handler checks its own nonce. ?>" />
280	256	<p>
281	257	<label><?php echo esc_html__( 'Container Width', 'ultimate-post' ); ?></label>
282	258	<input type="number" style="width:100%" name="container-width" value="<?php echo esc_attr( $width ? $width : 1140 ); ?>" />
283	259	</p>
		@@ -305,12 +281,12 @@
305	281	// For Featured Video
306	282	if ( isset( $_POST['video_meta_box_nonce'] ) ) {
307	283	if ( wp_verify_nonce( sanitize_key( wp_unslash( $_POST['video_meta_box_nonce'] ) ), 'video_meta_box' ) ) {
308	284	if ( isset( $_POST['feature-video'] ) ) {
309		- update_post_meta( $post_id, '__builder_feature_video', sanitize_text_field( $_POST['feature-video'] ) );
	285	+ update_post_meta( $post_id, '__builder_feature_video', sanitize_text_field( $_POST['feature-video'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- update_post_meta() unslashes; unslashing here would strip backslashes twice.
310	286	}
311	287	if ( ! isset( $_POST['video-caption'] ) ) {
312		- update_post_meta( $post_id, '__builder_feature_caption', sanitize_text_field( $_POST['video-caption'] ) );
	288	+ update_post_meta( $post_id, '__builder_feature_caption', sanitize_text_field( $_POST['video-caption'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- update_post_meta() unslashes; unslashing here would strip backslashes twice.
313	289	}
314	290	}
315	291	}
316	292
		@@ -321,15 +297,15 @@
321	297	if ( ! wp_verify_nonce( sanitize_key( wp_unslash( $_POST['container_meta_box_nonce'] ) ), 'container_meta_box' ) ) {
322	298	return;
323	299	}
324	300	if ( isset( $_POST['container-width'] ) ) {
325		- update_post_meta( $post_id, '__container_width', sanitize_text_field( $_POST['container-width'] ) );
	301	+ update_post_meta( $post_id, '__container_width', sanitize_text_field( $_POST['container-width'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- update_post_meta() unslashes; unslashing here would strip backslashes twice.
326	302	}
327	303	if ( isset( $_POST['builder-sidebar'] ) ) {
328		- update_post_meta( $post_id, '__builder_sidebar', sanitize_text_field( $_POST['builder-sidebar'] ) );
	304	+ update_post_meta( $post_id, '__builder_sidebar', sanitize_text_field( $_POST['builder-sidebar'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- update_post_meta() unslashes; unslashing here would strip backslashes twice.
329	305	}
330	306	if ( isset( $_POST['builder-widget-area'] ) ) {
331		- update_post_meta( $post_id, '__builder_widget_area', sanitize_text_field( $_POST['builder-widget-area'] ) );
	307	+ update_post_meta( $post_id, '__builder_widget_area', sanitize_text_field( $_POST['builder-widget-area'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- update_post_meta() unslashes; unslashing here would strip backslashes twice.
332	308	}
333	309
334	310	// Save Conditions Data
335	311	if ( get_post_type( $post_id ) == 'ultp_builder' ) {
		@@ -334,9 +310,9 @@
334	310	// Save Conditions Data
335	311	if ( get_post_type( $post_id ) == 'ultp_builder' ) {
336	312	if ( get_post_type( $post_id ) == 'ultp_builder' ) {
337	313	$settings = get_option( 'ultp_builder_conditions', array() );
338		- $p_type = isset( $_POST['postx-type'] ) ? sanitize_text_field( $_POST['postx-type'] ) : 'singular';
	314	+ $p_type = isset( $_POST['postx-type'] ) ? sanitize_text_field( wp_unslash( $_POST['postx-type'] ) ) : 'singular';
339	315	$up_meta = '';
340	316	switch ( $p_type ) {
341	317	case 'singular':
342	318	if ( isset( $settings['singular'] ) ) {