| @@ -1,7 +1,7 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | -// phpcs:ignore Standard.Category.SniffName.ErrorCode | |
| 3 | +// phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing -- verified on page | |
| 4 | 4 | namespace WPDataAccess\Dashboard; |
| 5 | 5 | |
| 6 | 6 | use WPDataAccess\WPDA; |
| 7 | 7 | /** |
| @@ -193,10 +193,11 @@ | ||
| 193 | 193 | echo esc_attr( $this->widget_id ); |
| 194 | 194 | ?>"> |
| 195 | 195 | jQuery(function() { |
| 196 | 196 | var widget = `<?php |
| 197 | + // phpcs:disable WordPress.Security.EscapeOutput | |
| 197 | 198 | echo $this->html(); |
| 198 | - // phpcs:ignore WordPress.Security.EscapeOutput | |
| 199 | + // phpcs:enable WordPress.Security.EscapeOutput | |
| 199 | 200 | ?>`; |
| 200 | 201 | |
| 201 | 202 | jQuery("#wpda-dashboard-column-<?php |
| 202 | 203 | echo esc_attr( $this->column ); |
| @@ -231,8 +232,9 @@ | ||
| 231 | 232 | $layout = ''; |
| 232 | 233 | $setting = ''; |
| 233 | 234 | $refresh = ( $this->can_refresh ? "<i class='fas fa-sync-alt wpda-widget-refresh wpda_tooltip' title='Refresh'></i> " : '' ); |
| 234 | 235 | $close = ( !$this->is_locked ? '<i class="fas fa-window-close wpda-widget-close wpda_tooltip" title="Close"></i>' : '' ); |
| 236 | + // phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed | |
| 235 | 237 | $widget = <<<EOF |
| 236 | 238 | <div id="wpda-widget-{$this->widget_id}" data-id="{$this->widget_id}" class="wpda-widget ui-widget"> |
| 237 | 239 | <div class="wpda-widget-content"> |
| 238 | 240 | <div class="ui-widget-header"> |
| @@ -261,14 +263,14 @@ | ||
| 261 | 263 | * @return bool |
| 262 | 264 | */ |
| 263 | 265 | protected static function check_cors( $widget ) { |
| 264 | 266 | if ( isset( $_POST['wpda_caller'] ) && 'embedded' === $_POST['wpda_caller'] ) { |
| 265 | - // phpcs:ignore WordPress.Security.NonceVerification | |
| 266 | 267 | $share = ( isset( $widget['widgetShare'] ) ? $widget['widgetShare'] : null ); |
| 267 | 268 | if ( 'block' === $share['embed'] ) { |
| 268 | 269 | WPDA::sent_header( 'application/json', '*' ); |
| 270 | + // phpcs:disable WordPress.Security.EscapeOutput | |
| 269 | 271 | echo static::msg( 'ERROR', 'No access' ); |
| 270 | - // phpcs:ignore WordPress.Security.EscapeOutput | |
| 272 | + // phpcs:enable WordPress.Security.EscapeOutput | |
| 271 | 273 | wp_die(); |
| 272 | 274 | } else { |
| 273 | 275 | if ( '*' === $share['embed'] ) { |
| 274 | 276 | WPDA::sent_header( 'application/json', '*' ); |
| @@ -296,10 +298,11 @@ | ||
| 296 | 298 | * |
| 297 | 299 | * @return void |
| 298 | 300 | */ |
| 299 | 301 | public function add() { |
| 302 | + // phpcs:disable WordPress.Security.EscapeOutput | |
| 300 | 303 | echo $this->container(); |
| 301 | - // phpcs:ignore WordPress.Security.EscapeOutput | |
| 304 | + // phpcs:enable WordPress.Security.EscapeOutput | |
| 302 | 305 | ?> |
| 303 | 306 | <script type="application/javascript"> |
| 304 | 307 | jQuery(function() { |
| 305 | 308 | increaseWidgetSequenceNr(); |
| @@ -323,10 +326,11 @@ | ||
| 323 | 326 | public static function ajax_widget() { |
| 324 | 327 | $wp_nonce = ( isset( $_POST['wp_nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['wp_nonce'] ) ) : '' ); |
| 325 | 328 | if ( !wp_verify_nonce( $wp_nonce, static::WIDGET_ADD . WPDA::get_current_user_login() ) ) { |
| 326 | 329 | WPDA::sent_header( 'application/json' ); |
| 330 | + // phpcs:disable WordPress.Security.EscapeOutput | |
| 327 | 331 | echo static::msg( 'ERROR', 'Token expired, please refresh page' ); |
| 328 | - // phpcs:ignore WordPress.Security.EscapeOutput | |
| 332 | + // phpcs:enable WordPress.Security.EscapeOutput | |
| 329 | 333 | wp_die(); |
| 330 | 334 | } |
| 331 | 335 | static::widget(); |
| 332 | 336 | } |
| @@ -346,10 +350,11 @@ | ||
| 346 | 350 | public static function ajax_refresh() { |
| 347 | 351 | $wp_nonce = ( isset( $_POST['wp_nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['wp_nonce'] ) ) : '' ); |
| 348 | 352 | if ( !wp_verify_nonce( $wp_nonce, static::WIDGET_REFRESH . WPDA::get_current_user_login() ) ) { |
| 349 | 353 | WPDA::sent_header( 'application/json' ); |
| 354 | + // phpcs:disable WordPress.Security.EscapeOutput | |
| 350 | 355 | echo static::msg( 'ERROR', 'Token expired, please refresh page' ); |
| 351 | - // phpcs:ignore WordPress.Security.EscapeOutput | |
| 356 | + // phpcs:enable WordPress.Security.EscapeOutput | |
| 352 | 357 | wp_die(); |
| 353 | 358 | } |
| 354 | 359 | static::refresh(); |
| 355 | 360 | } |
| @@ -362,9 +367,9 @@ | ||
| 362 | 367 | * @return mixed |
| 363 | 368 | */ |
| 364 | 369 | protected static function msg( $status, $msg ) { |
| 365 | 370 | $error = array( |
| 366 | - 'status' => $status, | |
| 371 | + 'status' => esc_attr( $status ), | |
| 367 | 372 | 'msg' => $msg, |
| 368 | 373 | ); |
| 369 | 374 | return wp_json_encode( $error ); |
| 370 | 375 | } |
| @@ -369,4 +374,6 @@ | ||
| 369 | 374 | return wp_json_encode( $error ); |
| 370 | 375 | } |
| 371 | 376 | |
| 372 | 377 | } |
| 378 | + | |
| 379 | +// phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing | |
