← All changes | admin/views/tool-import-export.php +20 -19 18.2 → 28.5 View file →

		@@ -19,31 +19,32 @@
19	19	*
20	20	* In case of POST the user is on the Yoast SEO import page and in case of the GET the user sees a notice from
21	21	* Yoast SEO that we can import stuff for that plugin.
22	22	*/
23		-if ( filter_input( INPUT_POST, 'import' ) || filter_input( INPUT_GET, 'import' ) ) {
24		- check_admin_referer( 'wpseo-import' );
25		-
26		- $yoast_seo_post_wpseo = filter_input( INPUT_POST, 'wpseo', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY );
27		- $yoast_seo_action = 'import';
28		-}
29		-elseif ( filter_input( INPUT_POST, 'import_external' ) ) {
	23	+// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Reason: We are only comparing the variable so no need to sanitize.
	24	+if ( isset( $_POST['import_external'] ) && wp_unslash( $_POST['import_external'] ) === __( 'Import', 'wordpress-seo' ) ) {
30	25	check_admin_referer( 'wpseo-import-plugins' );
31		-
32		- $yoast_seo_class = filter_input( INPUT_POST, 'import_external_plugin' );
33		- if ( class_exists( $yoast_seo_class ) ) {
34		- $yoast_seo_import = new WPSEO_Import_Plugin( new $yoast_seo_class(), 'import' );
	26	+ if ( isset( $_POST['import_external_plugin'] ) && is_string( $_POST['import_external_plugin'] ) ) {
	27	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Reason: We are using the variable as a class name.
	28	+ $yoast_seo_class = wp_unslash( $_POST['import_external_plugin'] );
	29	+ if ( class_exists( $yoast_seo_class ) ) {
	30	+ $yoast_seo_import = new WPSEO_Import_Plugin( new $yoast_seo_class(), 'import' );
	31	+ }
35	32	}
36	33	}
37		-elseif ( filter_input( INPUT_POST, 'clean_external' ) ) {
	34	+// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Reason: We are only comparing the variable so no need to sanitize.
	35	+elseif ( isset( $_POST['clean_external'] ) && wp_unslash( $_POST['clean_external'] ) === __( 'Clean up', 'wordpress-seo' ) ) {
38	36	check_admin_referer( 'wpseo-clean-plugins' );
39		-
40		- $yoast_seo_class = filter_input( INPUT_POST, 'clean_external_plugin' );
41		- if ( class_exists( $yoast_seo_class ) ) {
42		- $yoast_seo_import = new WPSEO_Import_Plugin( new $yoast_seo_class(), 'cleanup' );
	37	+ if ( isset( $_POST['clean_external_plugin'] ) && is_string( $_POST['clean_external_plugin'] ) ) {
	38	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Reason: We are using the variable as a class name.
	39	+ $yoast_seo_class = wp_unslash( $_POST['clean_external_plugin'] );
	40	+ if ( class_exists( $yoast_seo_class ) ) {
	41	+ $yoast_seo_import = new WPSEO_Import_Plugin( new $yoast_seo_class(), 'cleanup' );
	42	+ }
43	43	}
44	44	}
45		-elseif ( filter_input( INPUT_POST, 'settings_import' ) ) {
	45	+// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Reason: We are only comparing to an empty string.
	46	+elseif ( isset( $_POST['settings_import'] ) && wp_unslash( $_POST['settings_import'] ) !== '' ) {
46	47	$yoast_seo_import = new WPSEO_Import_Settings();
47	48	$yoast_seo_import->import();
48	49	}
49	50
		@@ -49,9 +50,9 @@
49	50
50	51	/**
51	52	* Allow custom import actions.
52	53	*
53		- * @api WPSEO_Import_Status $yoast_seo_import Contains info about the handled import.
	54	+ * @param WPSEO_Import_Status $yoast_seo_import Contains info about the handled import.
54	55	*/
55	56	$yoast_seo_import = apply_filters( 'wpseo_handle_import', $yoast_seo_import );
56	57
57	58	if ( $yoast_seo_import ) {
		@@ -63,9 +64,9 @@
63	64
64	65	/**
65	66	* Allow customization of import/export message.
66	67	*
67		- * @api string $yoast_seo_msg The message.
	68	+ * @param string $yoast_seo_msg The message.
68	69	*/
69	70	$yoast_seo_msg = apply_filters( 'wpseo_import_message', $yoast_seo_message );
70	71
71	72	if ( ! empty( $yoast_seo_msg ) ) {