| @@ -18,9 +18,9 @@ | ||
| 18 | 18 | { |
| 19 | 19 | $this->resetter = new DB_Resetter(); |
| 20 | 20 | $this->version = $version; |
| 21 | 21 | |
| 22 | - $this->set_request($_REQUEST); | |
| 22 | + $this->set_request($_REQUEST); //phpcs:ignore | |
| 23 | 23 | $this->set_view_variables(); |
| 24 | 24 | } |
| 25 | 25 | |
| 26 | 26 | private function set_request(array $request) |
| @@ -125,8 +125,10 @@ | ||
| 125 | 125 | |
| 126 | 126 | // auto download / install / activate WPR plugin |
| 127 | 127 | function install_wpr() |
| 128 | 128 | { |
| 129 | + check_ajax_referer('install_wpr'); | |
| 130 | + | |
| 129 | 131 | if (false === current_user_can('administrator')) { |
| 130 | 132 | wp_die('Sorry, you have to be an admin to run this action.'); |
| 131 | 133 | } |
| 132 | 134 | |
| @@ -147,9 +149,9 @@ | ||
| 147 | 149 | } |
| 148 | 150 | </style>'; |
| 149 | 151 | |
| 150 | 152 | echo '<div style="margin: 20px; color:#444;">'; |
| 151 | - echo 'If things are not done in a minute <a target="_parent" href="' . admin_url('plugin-install.php?s=wp-reset&tab=search&type=term') . '">install the plugin manually via Plugins page</a><br><br>'; | |
| 153 | + echo 'If things are not done in a minute <a target="_parent" href="' . esc_url(admin_url('plugin-install.php?s=wp-reset&tab=search&type=term')) . '">install the plugin manually via Plugins page</a><br><br>'; | |
| 152 | 154 | echo 'Starting ...<br><br>'; |
| 153 | 155 | |
| 154 | 156 | wp_cache_flush(); |
| 155 | 157 | $upgrader = new Plugin_Upgrader(); |
| @@ -174,9 +176,9 @@ | ||
| 174 | 176 | echo '<script>setTimeout(function() { top.location = "tools.php?page=wp-reset"; }, 1000);</script>'; |
| 175 | 177 | echo '<br>If you are not redirected in a few seconds - <a href="tools.php?page=wp-reset" target="_parent">click here</a>.'; |
| 176 | 178 | } |
| 177 | 179 | } else { |
| 178 | - echo 'Could not install WP Reset. You\'ll have to <a target="_parent" href="' . admin_url('plugin-install.php?s=wp-reset&tab=search&type=term') . '">download and install manually</a>.'; | |
| 180 | + echo 'Could not install WP Reset. You\'ll have to <a target="_parent" href="' . esc_url(admin_url('plugin-install.php?s=wp-reset&tab=search&type=term')) . '">download and install manually</a>.'; | |
| 179 | 181 | } |
| 180 | 182 | |
| 181 | 183 | echo '</div>'; |
| 182 | 184 | } // install_wpr |
| @@ -219,9 +221,9 @@ | ||
| 219 | 221 | |
| 220 | 222 | private function handle_after_reset() |
| 221 | 223 | { |
| 222 | 224 | if (empty($this->request['db-reset-reactivate-theme-data'])) { |
| 223 | - wp_redirect(admin_url()); | |
| 225 | + wp_safe_redirect(admin_url()); | |
| 224 | 226 | exit; |
| 225 | 227 | } |
| 226 | 228 | |
| 227 | 229 | $this->notice_success = __('The selected tables were reset', 'wordpress-database-reset'); |
| @@ -338,9 +340,9 @@ | ||
| 338 | 340 | return array( |
| 339 | 341 | 'confirmAlert' => __('Are you sure you want to continue? There is NO UNDO!', 'wordpress-database-reset'), |
| 340 | 342 | 'selectTable' => __('Select Tables', 'wordpress-database-reset'), |
| 341 | 343 | 'selectOneTable' => __('Please select at least one table to reset.', 'wordpress-database-reset'), |
| 342 | - 'wprInstallUrl' => add_query_arg(array('action' => 'install_wpr'), admin_url('admin.php')), | |
| 344 | + 'wprInstallUrl' => add_query_arg(array('action' => 'install_wpr', '_wpnonce' => wp_create_nonce('install_wpr')), admin_url('admin.php')), | |
| 343 | 345 | 'wprDialogTitle' => '<img alt="WP Reset" title="WP Reset" src="' . plugins_url('assets/images/wp-reset-logo.png', DB_RESET_FILE) . '">', |
| 344 | 346 | ); |
| 345 | 347 | } |
| 346 | 348 | } |
