← All changes | classes/Visualizer/Module/Chart.php +115 -63 4.0.5 → 4.0.8 View file →

		@@ -107,11 +107,10 @@
107	107	*/
108	108	public function setJsonSchedule() {
109	109	check_ajax_referer( Visualizer_Plugin::ACTION_JSON_SET_SCHEDULE . Visualizer_Plugin::VERSION, 'security' );
110	110
111		- $chart_id = filter_input(
112		- INPUT_POST,
113		- 'chart',
	111	+ $chart_id = isset( $_POST['chart'] ) ? filter_var(
	112	+ $_POST['chart'],
114	113	FILTER_VALIDATE_INT,
115	114	array(
116	115	'options' => array(
117	116	'min_range' => 1,
		@@ -116,14 +115,18 @@
116	115	'options' => array(
117	116	'min_range' => 1,
118	117	),
119	118	)
120		- );
	119	+ ) : false;
121	120
122	121	if ( ! $chart_id ) {
123	122	wp_send_json_error();
124	123	}
125	124
	125	+ if ( ! self::can_edit_chart( $chart_id ) ) {
	126	+ wp_send_json_error( array( 'msg' => esc_html__( 'You do not have permission to perform this action.', 'visualizer' ) ), 403 );
	127	+ }
	128	+
126	129	$time = filter_input(
127	130	INPUT_POST,
128	131	'time',
129	132	FILTER_VALIDATE_INT,
		@@ -203,9 +206,10 @@
203	206	$params = wp_parse_args( $_POST['params'] );
204	207
205	208	$chart_id = $params['chart'];
206	209
207		- if ( empty( $chart_id ) ) {
	210	+ $chart = $chart_id ? get_post( $chart_id ) : null;
	211	+ if ( ! $chart || Visualizer_Plugin::CPT_VISUALIZER !== $chart->post_type || ! current_user_can( 'edit_post', $chart_id ) ) {
208	212	wp_die();
209	213	}
210	214
211	215	$source = new Visualizer_Source_Json( $params );
		@@ -230,12 +234,12 @@
230	234	public function setJsonData() {
231	235	check_ajax_referer( Visualizer_Plugin::ACTION_JSON_SET_DATA . Visualizer_Plugin::VERSION, 'security' );
232	236
233	237	$params = $_POST;
234		- $chart_id = $_GET['chart'];
	238	+ $chart_id = isset( $_GET['chart'] ) ? absint( $_GET['chart'] ) : 0;
235	239
236		- if ( empty( $chart_id ) ) {
237		- wp_die();
	240	+ if ( ! self::can_edit_chart( $chart_id ) ) {
	241	+ wp_die( esc_html__( 'You do not have permission to perform this action.', 'visualizer' ), '', array( 'response' => 403 ) );
238	242	}
239	243
240	244	$chart = get_post( $chart_id );
241	245
		@@ -317,8 +321,14 @@
317	321	*
318	322	* @access public
319	323	*/
320	324	public function getCharts() {
	325	+ check_ajax_referer( Visualizer_Plugin::ACTION_GET_CHARTS, 'nonce' );
	326	+
	327	+ if ( ! current_user_can( 'edit_posts' ) ) {
	328	+ wp_send_json_error( array( 'msg' => esc_html__( 'You do not have permission to perform this action.', 'visualizer' ) ), 403 );
	329	+ }
	330	+
321	331	$query_args = array(
322	332	'post_type' => Visualizer_Plugin::CPT_VISUALIZER,
323	333	'posts_per_page' => 9,
324	334	'paged' => filter_input(
		@@ -332,8 +342,11 @@
332	342	),
333	343	)
334	344	),
335	345	);
	346	+ if ( ! current_user_can( 'edit_others_posts' ) ) {
	347	+ $query_args['author'] = get_current_user_id();
	348	+ }
336	349	$filter = filter_input( INPUT_GET, 's', FILTER_SANITIZE_STRING );
337	350	if ( empty( $filter ) ) {
338	351	// 'filter' is from the modal from the add media button.
339	352	$filter = filter_input( INPUT_GET, 'filter', FILTER_SANITIZE_STRING );
		@@ -452,16 +465,14 @@
452	465	* @access public
453	466	*/
454	467	public function deleteChart() {
455	468	$is_post = $_SERVER['REQUEST_METHOD'] === 'POST';
456		- $input_method = $is_post ? INPUT_POST : INPUT_GET;
	469	+ $input = $is_post ? $_POST : $_GET;
457	470	$chart_id = $success = false;
458		- $nonce = wp_verify_nonce( filter_input( $input_method, 'nonce' ) );
459		- $capable = current_user_can( 'delete_posts' );
460		- if ( $nonce && $capable ) {
461		- $chart_id = filter_input(
462		- $input_method,
463		- 'chart',
	471	+ $nonce = isset( $input['nonce'] ) && wp_verify_nonce( $input['nonce'] );
	472	+ if ( $nonce ) {
	473	+ $chart_id = isset( $input['chart'] ) ? filter_var(
	474	+ $input['chart'],
464	475	FILTER_VALIDATE_INT,
465	476	array(
466	477	'options' => array(
467	478	'min_range' => 1,
		@@ -466,12 +477,17 @@
466	477	'options' => array(
467	478	'min_range' => 1,
468	479	),
469	480	)
470		- );
	481	+ ) : false;
471	482	if ( $chart_id ) {
472	483	$chart = get_post( $chart_id );
473		- $success = $chart && $chart->post_type === Visualizer_Plugin::CPT_VISUALIZER;
	484	+ $success = $chart
	485	+ && $chart->post_type === Visualizer_Plugin::CPT_VISUALIZER
	486	+ && (
	487	+ current_user_can( 'delete_post', $chart_id )
	488	+ || ( (int) $chart->post_author === get_current_user_id() && current_user_can( 'delete_posts' ) )
	489	+ );
474	490	}
475	491	}
476	492	if ( $success ) {
477	493	global $sitepress;
		@@ -552,8 +568,11 @@
552	568	if ( ! empty( $_POST ) ) {
553	569	$_POST = map_deep( $_POST, 'wp_strip_all_tags' );
554	570	}
555	571	$chart = $chart_id ? get_post( $chart_id ) : null;
	572	+ if ( $chart && ! self::can_edit_chart( $chart_id ) ) {
	573	+ wp_die( esc_html__( 'You do not have permission to access this page.', 'visualizer' ), '', array( 'response' => 403 ) );
	574	+ }
556	575	if ( ! $chart_id || ! $chart || $chart->post_type !== Visualizer_Plugin::CPT_VISUALIZER ) {
557	576	if ( empty( $_GET['lang'] ) || empty( $_GET['parent_chart_id'] ) ) {
558	577	$this->deleteOldCharts();
559	578	$default_type = isset( $_GET['type'] ) && ! empty( $_GET['type'] ) ? $_GET['type'] : 'line';
		@@ -590,9 +609,9 @@
590	609	}
591	610	} else {
592	611	$parent_chart_id = filter_var( $_GET['parent_chart_id'], FILTER_VALIDATE_INT );
593	612	$success = false;
594		- if ( $parent_chart_id ) {
	613	+ if ( $parent_chart_id && self::can_edit_chart( $parent_chart_id ) ) {
595	614	$parent_chart = get_post( $parent_chart_id );
596	615	$success = $parent_chart && $parent_chart->post_type === Visualizer_Plugin::CPT_VISUALIZER;
597	616	}
598	617	if ( $success ) {
		@@ -612,9 +631,9 @@
612	631	$post_meta = get_post_meta( $parent_chart_id );
613	632	$chart_id = $new_chart_id;
614	633	foreach ( $post_meta as $key => $value ) {
615	634	if ( strpos( $key, 'visualizer-' ) !== false ) {
616		- add_post_meta( $new_chart_id, $key, maybe_unserialize( $value[0] ) );
	635	+ add_post_meta( $new_chart_id, $key, self::maybe_decode_content( $value[0] ) );
617	636	}
618	637	}
619	638	}
620	639	}
		@@ -798,16 +817,16 @@
798	817	/**
799	818	* Handle data and settings page
800	819	*/
801	820	private function _handleDataAndSettingsPage() {
802		- if ( isset( $_POST['map_api_key'] ) ) {
803		- update_option( 'visualizer-map-api-key', $_POST['map_api_key'] );
804		- }
805		-
806	821	if ( $_SERVER['REQUEST_METHOD'] === 'POST' && isset( $_GET['nonce'] ) && wp_verify_nonce( $_GET['nonce'] ) ) {
807	822	$is_canceled = isset( $_POST['cancel'] ) && 1 === intval( $_POST['cancel'] );
808	823	$is_newly_created = $this->_chart->post_status === 'auto-draft';
809	824
	825	+ if ( isset( $_POST['map_api_key'] ) && current_user_can( 'manage_options' ) ) {
	826	+ update_option( 'visualizer-map-api-key', sanitize_text_field( wp_unslash( $_POST['map_api_key'] ) ) );
	827	+ }
	828	+
810	829	if ( $is_newly_created && ! $is_canceled ) {
811	830	$this->_chart->post_status = 'publish';
812	831
813	832	// ensure that a revision is not created. If a revision is created it will have the proper data and the parent of the revision will have default data.
		@@ -822,8 +841,9 @@
822	841	$existing = get_post_meta( $this->_chart->ID, Visualizer_Plugin::CF_SETTINGS, true );
823	842	if ( isset( $existing['colors'] ) && is_array( $existing['colors'] ) && ! isset( $post_settings['colors'] ) ) {
824	843	$post_settings['colors'] = $existing['colors'];
825	844	}
	845	+ $post_settings = $this->sanitizeSettings( $post_settings );
826	846	update_post_meta( $this->_chart->ID, Visualizer_Plugin::CF_SETTINGS, $post_settings );
827	847
828	848	// we will keep a parameter called 'internal_title' that will be set to the given title or, if empty, the chart ID
829	849	// this will help in searching with the chart id.
		@@ -1014,8 +1034,35 @@
1014	1034	wp_iframe( array( $render, 'render' ) );
1015	1035	}
1016	1036
1017	1037	/**
	1038	+ * Sanitize settings data from the request.
	1039	+ *
	1040	+ * @param array<string, mixed> $post_data The POST data to sanitize.
	1041	+ * @return array<string, mixed> The sanitized settings data.
	1042	+ */
	1043	+ private function sanitizeSettings( $post_data ): array {
	1044	+ $chart_img = '';
	1045	+ if ( isset( $post_data['chart-img'] ) ) {
	1046	+ $chart_img = wp_unslash( $post_data['chart-img'] );
	1047	+ unset( $post_data['chart-img'] );
	1048	+ }
	1049	+
	1050	+ $post_data = map_deep(
	1051	+ $post_data,
	1052	+ 'sanitize_textarea_field'
	1053	+ );
	1054	+
	1055	+ // The value is a client-side canvas export; keep it only when it is a
	1056	+ // base64 image data URI so nothing else is ever stored unsanitized.
	1057	+ if ( is_string( $chart_img ) && preg_match( '#^data:image/(png|jpeg|webp);base64,[A-Za-z0-9+/ ]+=*$#', $chart_img ) ) {
	1058	+ $post_data['chart-img'] = $chart_img;
	1059	+ }
	1060	+
	1061	+ return $post_data;
	1062	+ }
	1063	+
	1064	+ /**
1018	1065	* Renders flattr script in the iframe <head>
1019	1066	*
1020	1067	* @since 1.4.2
1021	1068	* @action admin_head
		@@ -1036,9 +1083,9 @@
1036	1083	*
1037	1084	* Used as a fallback when the URL path has no recognisable file extension
1038	1085	* (e.g. SharePoint, signed S3 URLs, or "download?id=…" endpoints).
1039	1086	*
1040		- * Uses wp_safe_remote_get() to block requests to private/loopback addresses,
	1087	+ * Uses the shared remote-fetch policy to block non-public destinations,
1041	1088	* and streams the response to a temp file so no body data is held in memory
1042	1089	* regardless of whether the server honours the Range header.
1043	1090	*
1044	1091	* The check relies on the ZIP magic number (PK\x03\x04) that every XLSX
		@@ -1055,16 +1102,17 @@
1055	1102	if ( ! $tmpfile ) {
1056	1103	return false;
1057	1104	}
1058	1105
1059		- $response = wp_safe_remote_get(
	1106	+ $response = Visualizer_Remote_Fetch::request(
1060	1107	$url,
1061	1108	array(
1062		- 'timeout' => 10,
1063		- 'user-agent' => 'WordPress/' . get_bloginfo( 'version' ),
1064		- 'headers' => array( 'Range' => 'bytes=0-3' ),
1065		- 'stream' => true,
1066		- 'filename' => $tmpfile,
	1109	+ 'timeout' => 10,
	1110	+ 'user-agent' => 'WordPress/' . get_bloginfo( 'version' ),
	1111	+ 'headers' => array( 'Range' => 'bytes=0-3' ),
	1112	+ 'stream' => true,
	1113	+ 'filename' => $tmpfile,
	1114	+ 'limit_response_size' => 4,
1067	1115	)
1068	1116	);
1069	1117
1070	1118	if ( is_wp_error( $response ) ) {
		@@ -1229,14 +1277,15 @@
1229	1277	public function uploadData() {
1230	1278	// if this is being called internally from pro and VISUALIZER_DO_NOT_DIE is set.
1231	1279	// otherwise, assume this is a normal web request.
1232	1280	$can_die = ! ( defined( 'VISUALIZER_DO_NOT_DIE' ) && VISUALIZER_DO_NOT_DIE );
	1281	+ // $can_die also gates the capability checks below, so VISUALIZER_DO_NOT_DIE must stay internal-only (never set from request input or globally).
1233	1282
1234		- // validate nonce
	1283	+ // validate nonce; capability check applies to web requests only, not trusted internal calls.
1235	1284	if (
1236	1285	! isset( $_GET['nonce'] ) ||
1237	1286	! wp_verify_nonce( $_GET['nonce'], 'visualizer-upload-data' ) ||
1238		- ! current_user_can( 'edit_posts' )
	1287	+ ( $can_die && ! current_user_can( 'edit_posts' ) )
1239	1288	) {
1240	1289	if ( ! $can_die ) {
1241	1290	return;
1242	1291	}
		@@ -1251,9 +1300,9 @@
1251	1300	if (
1252	1301	! $chart_id ||
1253	1302	! $chart ||
1254	1303	$chart->post_type !== Visualizer_Plugin::CPT_VISUALIZER ||
1255		- ! current_user_can( 'edit_post', $chart_id )
	1304	+ ( $can_die && ! current_user_can( 'edit_post', $chart_id ) )
1256	1305	) {
1257	1306	if ( ! $can_die ) {
1258	1307	return;
1259	1308	}
		@@ -1335,10 +1384,10 @@
1335	1384	if ( $source ) {
1336	1385	if ( $source->fetch() ) {
1337	1386	$content = $source->getData( get_post_meta( $chart_id, Visualizer_Plugin::CF_EDITABLE_TABLE, true ) );
1338	1387	$populate = true;
1339		- if ( is_string( $content ) && is_array( unserialize( $content ) ) ) {
1340		- $json = unserialize( $content );
	1388	+ $json = self::decode_content( $content );
	1389	+ if ( is_array( $json ) ) {
1341	1390	// if source exists, so should data. if source exists but data is blank, do not populate the chart.
1342	1391	// if we populate the data even if it is empty, the chart will show "Table has no columns".
1343	1392	if ( array_key_exists( 'source', $json ) && ! empty( $json['source'] ) && ( ! array_key_exists( 'data', $json ) || empty( $json['data'] ) ) ) {
1344	1393	do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Not populating chart data as source exists (%s) but data is empty!', $json['source'] ), 'warn', __FILE__, __LINE__ );
		@@ -1402,12 +1451,11 @@
1402	1451	*/
1403	1452	public function cloneChart() {
1404	1453	$chart_id = $success = false;
1405	1454	$nonce = isset( $_GET['nonce'] ) && wp_verify_nonce( $_GET['nonce'], Visualizer_Plugin::ACTION_CLONE_CHART );
1406		- $capable = current_user_can( 'edit_posts' );
1407		- if ( $nonce && $capable ) {
	1455	+ if ( $nonce ) {
1408	1456	$chart_id = isset( $_GET['chart'] ) ? filter_var( $_GET['chart'], FILTER_VALIDATE_INT ) : '';
1409		- if ( $chart_id ) {
	1457	+ if ( $chart_id && self::can_edit_chart( $chart_id ) ) {
1410	1458	$chart = get_post( $chart_id );
1411	1459	$success = $chart && $chart->post_type === Visualizer_Plugin::CPT_VISUALIZER;
1412	1460	}
1413	1461	}
		@@ -1427,9 +1475,9 @@
1427	1475	} else {
1428	1476	$post_meta = get_post_meta( $chart_id );
1429	1477	foreach ( $post_meta as $key => $value ) {
1430	1478	if ( strpos( $key, 'visualizer-' ) !== false ) {
1431		- add_post_meta( $new_chart_id, $key, maybe_unserialize( $value[0] ) );
	1479	+ add_post_meta( $new_chart_id, $key, self::maybe_decode_content( $value[0] ) );
1432	1480	}
1433	1481	}
1434	1482	$redirect = esc_url(
1435	1483	add_query_arg(
		@@ -1461,24 +1509,21 @@
1461	1509	* @access public
1462	1510	*/
1463	1511	public function exportData() {
1464	1512	check_ajax_referer( Visualizer_Plugin::ACTION_EXPORT_DATA . Visualizer_Plugin::VERSION, 'security' );
1465		- $capable = current_user_can( 'edit_posts' );
1466		- if ( $capable ) {
1467		- $chart_id = isset( $_GET['chart'] ) ? filter_var(
1468		- $_GET['chart'],
1469		- FILTER_VALIDATE_INT,
1470		- array(
1471		- 'options' => array(
1472		- 'min_range' => 1,
1473		- ),
1474		- )
1475		- ) : '';
1476		- if ( $chart_id ) {
1477		- $data = $this->_getDataAs( $chart_id, 'csv' );
1478		- if ( $data ) {
1479		- echo wp_send_json_success( $data );
1480		- }
	1513	+ $chart_id = isset( $_GET['chart'] ) ? filter_var(
	1514	+ $_GET['chart'],
	1515	+ FILTER_VALIDATE_INT,
	1516	+ array(
	1517	+ 'options' => array(
	1518	+ 'min_range' => 1,
	1519	+ ),
	1520	+ )
	1521	+ ) : '';
	1522	+ if ( $chart_id && self::can_edit_chart( $chart_id ) ) {
	1523	+ $data = $this->_getDataAs( $chart_id, 'csv' );
	1524	+ if ( $data ) {
	1525	+ echo wp_send_json_success( $data );
1481	1526	}
1482	1527	}
1483	1528
1484	1529	( defined( 'WP_TESTS_DOMAIN' ) && function_exists( 'tests_add_filter' ) ) ? wp_die() : exit();
		@@ -1658,11 +1703,10 @@
1658	1703	*/
1659	1704	public function saveFilter() {
1660	1705	check_ajax_referer( Visualizer_Plugin::ACTION_SAVE_FILTER_QUERY . Visualizer_Plugin::VERSION, 'security' );
1661	1706
1662		- $chart_id = filter_input(
1663		- INPUT_GET,
1664		- 'chart',
	1707	+ $chart_id = isset( $_GET['chart'] ) ? filter_var(
	1708	+ $_GET['chart'],
1665	1709	FILTER_VALIDATE_INT,
1666	1710	array(
1667	1711	'options' => array(
1668	1712	'min_range' => 1,
		@@ -1667,10 +1711,14 @@
1667	1711	'options' => array(
1668	1712	'min_range' => 1,
1669	1713	),
1670	1714	)
1671		- );
	1715	+ ) : false;
1672	1716
	1717	+ if ( ! self::can_edit_chart( $chart_id ) ) {
	1718	+ wp_send_json_error( array( 'msg' => esc_html__( 'You do not have permission to perform this action.', 'visualizer' ) ), 403 );
	1719	+ }
	1720	+
1673	1721	$hours = filter_input(
1674	1722	INPUT_POST,
1675	1723	'refresh',
1676	1724	FILTER_VALIDATE_FLOAT,
		@@ -1698,9 +1746,9 @@
1698	1746	*
1699	1747	* @param string $base64_img Chart image.
1700	1748	* @param int $chart_id Chart ID.
1701	1749	* @param bool $save_attachment Save attachment.
1702		- * @return attachment ID
	1750	+ * @return int Attachment ID, or 0 when no attachment was saved.
1703	1751	*/
1704	1752	public function save_chart_image( $base64_img, $chart_id, $save_attachment = true ) {
1705	1753	// Delete old chart image.
1706	1754	$old_attachment_id = get_post_meta( $chart_id, Visualizer_Plugin::CF_CHART_IMAGE, true );
		@@ -1715,11 +1763,15 @@
1715	1763	// Upload dir.
1716	1764	$upload_dir = wp_upload_dir();
1717	1765	$upload_path = str_replace( '/', DIRECTORY_SEPARATOR, $upload_dir['path'] ) . DIRECTORY_SEPARATOR;
1718	1766
1719		- $img = str_replace( 'data:image/png;base64,', '', $base64_img );
1720		- $img = str_replace( ' ', '+', $img );
1721		- $decoded = base64_decode( $img );
	1767	+ $img = str_replace( 'data:image/png;base64,', '', (string) $base64_img );
	1768	+ $img = str_replace( ' ', '+', $img );
	1769	+ $decoded = base64_decode( $img, true );
	1770	+ // The value comes from an untrusted request; only write real PNG bytes to uploads.
	1771	+ if ( false === $decoded || 0 !== strncmp( $decoded, "\x89PNG\r\n\x1a\n", 8 ) ) {
	1772	+ return 0;
	1773	+ }
1722	1774	$filename = 'visualization-' . $chart_id . '.png';
1723	1775	$file_type = 'image/png';
1724	1776	$hashed_filename = $filename;
1725	1777