← All changes | admin/class-my-yoast-proxy.php +23 -14 18.4 → 28.5 View file →

		@@ -17,9 +17,9 @@
17	17	* The page identifier used in WordPress to register the MyYoast proxy page.
18	18	*
19	19	* @var string
20	20	*/
21		- const PAGE_IDENTIFIER = 'wpseo_myyoast_proxy';
	21	+ public const PAGE_IDENTIFIER = 'wpseo_myyoast_proxy';
22	22
23	23	/**
24	24	* The cache control's max age. Used in the header of a successful proxy response.
25	25	*
		@@ -24,9 +24,9 @@
24	24	* The cache control's max age. Used in the header of a successful proxy response.
25	25	*
26	26	* @var int
27	27	*/
28		- const CACHE_CONTROL_MAX_AGE = DAY_IN_SECONDS;
	28	+ public const CACHE_CONTROL_MAX_AGE = DAY_IN_SECONDS;
29	29
30	30	/**
31	31	* Registers the hooks when the user is on the right page.
32	32	*
		@@ -65,9 +65,9 @@
65	65	public function handle_proxy_page() {
66	66	$this->render_proxy_page();
67	67
68	68	// Prevent the WordPress UI from loading.
69		- exit;
	69	+ exit();
70	70	}
71	71
72	72	/**
73	73	* Renders the requested proxy page.
		@@ -89,10 +89,9 @@
89	89	$this->set_header( 'Cache-Control: max-age=' . self::CACHE_CONTROL_MAX_AGE );
90	90
91	91	try {
92	92	echo $this->get_remote_url_body( $proxy_options['url'] );
93		- }
94		- catch ( Exception $e ) {
	93	+ } catch ( Exception $e ) {
95	94	/*
96	95	* Reset the file headers because the loading failed.
97	96	*
98	97	* Note: Due to supporting PHP 5.2 `header_remove` can not be used here.
		@@ -162,9 +161,11 @@
162	161	*
163	162	* @return bool True when the page request parameter equals the proxy page.
164	163	*/
165	164	protected function is_proxy_page() {
166		- return filter_input( INPUT_GET, 'page' ) === self::PAGE_IDENTIFIER;
	165	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
	166	+ $page = isset( $_GET['page'] ) && is_string( $_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : '';
	167	+ return $page === self::PAGE_IDENTIFIER;
167	168	}
168	169
169	170	/**
170	171	* Returns the proxy file from the HTTP request parameters.
		@@ -170,12 +171,17 @@
170	171	* Returns the proxy file from the HTTP request parameters.
171	172	*
172	173	* @codeCoverageIgnore
173	174	*
174		- * @return string The sanitized file request parameter.
	175	+ * @return string The sanitized file request parameter or an empty string if it does not exist.
175	176	*/
176	177	protected function get_proxy_file() {
177		- return filter_input( INPUT_GET, 'file', FILTER_SANITIZE_STRING );
	178	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
	179	+ if ( isset( $_GET['file'] ) && is_string( $_GET['file'] ) ) {
	180	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
	181	+ return sanitize_text_field( wp_unslash( $_GET['file'] ) );
	182	+ }
	183	+ return '';
178	184	}
179	185
180	186	/**
181	187	* Returns the plugin version from the HTTP request parameters.
		@@ -181,16 +187,19 @@
181	187	* Returns the plugin version from the HTTP request parameters.
182	188	*
183	189	* @codeCoverageIgnore
184	190	*
185		- * @return string The sanitized plugin_version request parameter.
	191	+ * @return string The sanitized plugin_version request parameter or an empty string if it does not exist.
186	192	*/
187	193	protected function get_plugin_version() {
188		- $plugin_version = filter_input( INPUT_GET, 'plugin_version', FILTER_SANITIZE_STRING );
189		- // Replace slashes to secure against requiring a file from another path.
190		- $plugin_version = str_replace( [ '/', '\\' ], '_', $plugin_version );
191		-
192		- return $plugin_version;
	194	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
	195	+ if ( isset( $_GET['plugin_version'] ) && is_string( $_GET['plugin_version'] ) ) {
	196	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
	197	+ $plugin_version = sanitize_text_field( wp_unslash( $_GET['plugin_version'] ) );
	198	+ // Replace slashes to secure against requiring a file from another path.
	199	+ return str_replace( [ '/', '\\' ], '_', $plugin_version );
	200	+ }
	201	+ return '';
193	202	}
194	203
195	204	/**
196	205	* Sets the HTTP header.