← All changes | admin/class-yoast-network-admin.php +16 -6 18.4 → 28.5 View file →

		@@ -14,9 +14,9 @@
14	14	* Action identifier for updating plugin network options.
15	15	*
16	16	* @var string
17	17	*/
18		- const UPDATE_OPTIONS_ACTION = 'yoast_handle_network_options';
	18	+ public const UPDATE_OPTIONS_ACTION = 'yoast_handle_network_options';
19	19
20	20	/**
21	21	* Action identifier for restoring a site.
22	22	*
		@@ -21,9 +21,9 @@
21	21	* Action identifier for restoring a site.
22	22	*
23	23	* @var string
24	24	*/
25		- const RESTORE_SITE_ACTION = 'yoast_restore_site';
	25	+ public const RESTORE_SITE_ACTION = 'yoast_restore_site';
26	26
27	27	/**
28	28	* Gets the available sites as choices, e.g. for a dropdown.
29	29	*
		@@ -99,10 +99,20 @@
99	99	*
100	100	* @return void
101	101	*/
102	102	public function handle_update_options_request() {
103		- $option_group = filter_input( INPUT_POST, 'network_option_group', FILTER_SANITIZE_STRING );
	103	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Reason: Nonce verification will happen in verify_request below.
	104	+ if ( ! isset( $_POST['network_option_group'] ) || ! is_string( $_POST['network_option_group'] ) ) {
	105	+ return;
	106	+ }
104	107
	108	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Reason: Nonce verification will happen in verify_request below.
	109	+ $option_group = sanitize_text_field( wp_unslash( $_POST['network_option_group'] ) );
	110	+
	111	+ if ( empty( $option_group ) ) {
	112	+ return;
	113	+ }
	114	+
105	115	$this->verify_request( "{$option_group}-network-options" );
106	116
107	117	$whitelist_options = Yoast_Network_Settings_API::get()->get_whitelist_options( $option_group );
108	118
		@@ -116,9 +126,9 @@
116	126	// phpcs:disable WordPress.Security.NonceVerification -- Nonce verified via `verify_request()` above.
117	127	foreach ( $whitelist_options as $option_name ) {
118	128	$value = null;
119	129	if ( isset( $_POST[ $option_name ] ) ) {
120		- // Adding sanitize_text_field around this will break the saving of settings because it expects a string: https://github.com/Yoast/wordpress-seo/issues/12440.
	130	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Reason: Adding sanitize_text_field around this will break the saving of settings because it expects a string: https://github.com/Yoast/wordpress-seo/issues/12440.
121	131	$value = wp_unslash( $_POST[ $option_name ] );
122	132	}
123	133
124	134	WPSEO_Options::update_site_option( $option_name, $value );
		@@ -199,9 +209,9 @@
199	209	];
200	210	$asset_manager->localize_script(
201	211	'network-admin',
202	212	'wpseoNetworkAdminGlobalL10n',
203		- $translations
	213	+ $translations,
204	214	);
205	215	}
206	216
207	217	/**
		@@ -318,7 +328,7 @@
318	328	$sendback = add_query_arg( $query_args, $sendback );
319	329	}
320	330
321	331	wp_safe_redirect( $sendback );
322		- exit;
	332	+ exit();
323	333	}
324	334	}