← All changes
|
includes/controls/select-input/dynamic-select-input-module.php
+8
-5
3.0.7
→
3.1.4
View file →
| @@ -42,9 +42,9 @@ | ||
| 42 | 42 | /** |
| 43 | 43 | * get Ajax Data |
| 44 | 44 | */ |
| 45 | 45 | public function getSelectInputData() { |
| 46 | - $nonce = isset($_POST['security']) ? sanitize_text_field($_POST['security']) : ''; | |
| 46 | + $nonce = isset($_POST['security']) ? sanitize_text_field(wp_unslash($_POST['security'])) : ''; | |
| 47 | 47 | |
| 48 | 48 | try { |
| 49 | 49 | if (!wp_verify_nonce($nonce, 'usk_dynamic_select')) { |
| 50 | 50 | throw new Exception('Invalid request'); |
| @@ -53,9 +53,9 @@ | ||
| 53 | 53 | if (!current_user_can('edit_posts')) { |
| 54 | 54 | throw new Exception('Unauthorized request'); |
| 55 | 55 | } |
| 56 | 56 | |
| 57 | - $query = isset($_POST['query']) ? sanitize_text_field($_POST['query']) : ''; | |
| 57 | + $query = isset($_POST['query']) ? sanitize_text_field(wp_unslash($_POST['query'])) : ''; | |
| 58 | 58 | |
| 59 | 59 | switch ($query) { |
| 60 | 60 | case 'posts': |
| 61 | 61 | $data = $this->getPosts(); |
| @@ -101,9 +101,10 @@ | ||
| 101 | 101 | * Get Post Type |
| 102 | 102 | * @return string |
| 103 | 103 | */ |
| 104 | 104 | protected function getPostType() { |
| 105 | - return isset($_POST['post_type']) ? sanitize_text_field($_POST['post_type']) : ''; | |
| 105 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Only reached from getSelectInputData(), which verifies the usk_dynamic_select nonce first. | |
| 106 | + return isset($_POST['post_type']) ? sanitize_text_field(wp_unslash($_POST['post_type'])) : ''; | |
| 106 | 107 | } |
| 107 | 108 | |
| 108 | 109 | /** |
| 109 | 110 | * @return string[]|\WP_Post_Type[] |
| @@ -115,9 +116,10 @@ | ||
| 115 | 116 | /** |
| 116 | 117 | * @return string |
| 117 | 118 | */ |
| 118 | 119 | protected function getSearchQuery() { |
| 119 | - return isset($_POST['search_text']) ? sanitize_text_field($_POST['search_text']) : ''; | |
| 120 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Only reached from getSelectInputData(), which verifies the usk_dynamic_select nonce first. | |
| 121 | + return isset($_POST['search_text']) ? sanitize_text_field(wp_unslash($_POST['search_text'])) : ''; | |
| 120 | 122 | } |
| 121 | 123 | |
| 122 | 124 | /** |
| 123 | 125 | * @return array|mixed |
| @@ -123,9 +125,10 @@ | ||
| 123 | 125 | * @return array|mixed |
| 124 | 126 | */ |
| 125 | 127 | protected function getselecedIds() { |
| 126 | 128 | |
| 127 | - return isset($_POST['ids']) ? sanitize_text_field($_POST['ids']) : []; | |
| 129 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Only reached from getSelectInputData(), which verifies the usk_dynamic_select nonce first. | |
| 130 | + return isset($_POST['ids']) ? sanitize_text_field(wp_unslash($_POST['ids'])) : []; | |
| 128 | 131 | } |
| 129 | 132 | |
| 130 | 133 | |
| 131 | 134 | /** |