← All changes | WPDataAccess/Settings/WPDA_Settings_Drives.php +75 -35 5.5.76 → 5.5.85 View file →

		@@ -1,6 +1,7 @@
1	1	<?php
2	2
	3	+// phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing -- verified on settings page
3	4	namespace WPDataAccess\Settings {
4	5
5	6	use WPDataAccess\Drive\WPDA_Drives;
6	7	use WPDataAccess\Drive\WPDA_Dropbox;
		@@ -13,8 +14,9 @@
13	14
14	15	class WPDA_Settings_Drives extends WPDA_Settings {
15	16
16	17	private $drives = null;
	18	+ private $canSftp = false;
17	19
18	20	private function get_drive( $drive_type ) {
19	21
20	22	if ( is_array( $this->drives ) ) {
		@@ -31,10 +33,10 @@
31	33	}
32	34
33	35	private function save_local_drive() {
34	36
35		- $local_file_system = trim( sanitize_text_field( wp_unslash( $_POST['local_file_system'] ) ) ); // input var okay.
36		- $local_enabled = isset( $_POST['local_enabled'] ) && 'on' === $_POST['local_enabled'];
	37	+ $local_file_system = trim( sanitize_text_field( wp_unslash( $_POST['local_file_system'] ) ) ); // phpcs:ignore
	38	+ $local_enabled = isset( $_POST['local_enabled'] ) && 'on' === $_POST['local_enabled']; // phpcs:ignore
37	39
38	40	if ( '' === $local_file_system ) {
39	41	WPDA_Drives::delete_drive( 'local' );
40	42	} else {
		@@ -61,8 +63,9 @@
61	63	}
62	64
63	65	private function save_ftp_server( $index ) {
64	66
	67	+ // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotValidated
65	68	$ftp_server_name = trim( sanitize_text_field( wp_unslash( $_POST['ftp_server_name'][ $index ] ) ) );
66	69	$ftp_enabled = isset( $_POST['ftp_enabled'] ) && 'on' === $_POST['ftp_enabled'][ $index ];
67	70	$ftp_host = sanitize_text_field( wp_unslash( $_POST['ftp_host'][ $index ] ) );
68	71	$ftp_username = sanitize_text_field( wp_unslash( $_POST['ftp_username'][ $index ] ) );
		@@ -71,8 +74,9 @@
71	74	$ftp_ssl = isset( $_POST['ftp_ssl'] ) && 'on' === $_POST['ftp_ssl'][ $index ];
72	75	$ftp_passive = isset( $_POST['ftp_passive'] ) && 'on' === $_POST['ftp_passive'][ $index ];
73	76	$ftp_timeout = sanitize_text_field( wp_unslash( $_POST['ftp_timeout'][ $index ] ) );
74	77	$ftp_directory = sanitize_text_field( wp_unslash( $_POST['ftp_directory'][ $index ] ) );
	78	+ // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotValidated
75	79
76	80	$ftp_drive = new WPDA_Ftp( $ftp_server_name );
77	81	if (
78	82	! $ftp_drive->authorize(
		@@ -102,8 +106,9 @@
102	106	}
103	107
104	108	private function save_sftp_server( $index ) {
105	109
	110	+ // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotValidated
106	111	$sftp_server_name = trim( sanitize_text_field( wp_unslash( $_POST['sftp_server_name'][ $index ] ) ) );
107	112	$sftp_enabled = isset( $_POST['sftp_enabled'] ) && 'on' === $_POST['sftp_enabled'][ $index ];
108	113	$sftp_host = sanitize_text_field( wp_unslash( $_POST['sftp_host'][ $index ] ) );
109	114	$sftp_username = sanitize_text_field( wp_unslash( $_POST['sftp_username'][ $index ] ) );
		@@ -110,8 +115,9 @@
110	115	$sftp_password = sanitize_text_field( wp_unslash( $_POST['sftp_password'][ $index ] ) );
111	116	$sftp_port = sanitize_text_field( wp_unslash( $_POST['sftp_port'][ $index ] ) );
112	117	$sftp_timeout = sanitize_text_field( wp_unslash( $_POST['sftp_timeout'][ $index ] ) );
113	118	$sftp_directory = sanitize_text_field( wp_unslash( $_POST['sftp_directory'][ $index ] ) );
	119	+ // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotValidated
114	120
115	121	$ftp_drive = new WPDA_Sftp( $sftp_server_name );
116	122	if (
117	123	! $ftp_drive->authorize(
		@@ -139,9 +145,9 @@
139	145	}
140	146
141	147	private function save_dropbox() {
142	148
143		- $dropbox_authorization = trim( sanitize_text_field( wp_unslash( $_POST['dropbox_authorization'] ) ) ); // input var okay.
	149	+ $dropbox_authorization = trim( sanitize_text_field( wp_unslash( $_POST['dropbox_authorization'] ) ) ); // phpcs:ignore
144	150
145	151	if ( '' !== trim( $dropbox_authorization ) ) {
146	152	$dropbox_drive = new WPDA_Dropbox();
147	153	$response = $dropbox_drive->authorize( $dropbox_authorization );
		@@ -169,9 +175,9 @@
169	175	}
170	176
171	177	private function update_dropbox() {
172	178
173		- $dropbox_enabled = isset( $_POST['dropbox_enabled'] ) && 'on' === $_POST['dropbox_enabled'];
	179	+ $dropbox_enabled = isset( $_POST['dropbox_enabled'] ) && 'on' === $_POST['dropbox_enabled']; // phpcs:ignore
174	180
175	181	$dropbox_drive = WPDA_Drives::get_drive( 'dropbox' );
176	182	if ( false !== $dropbox_drive ) {
177	183	$dropbox_drive->toggle( $dropbox_enabled );
		@@ -180,9 +186,9 @@
180	186	}
181	187
182	188	private function save_google_drive() {
183	189
184		- $google_drive_authorization = trim( sanitize_text_field( wp_unslash( $_POST['google_drive_authorization'] ) ) ); // input var okay.
	190	+ $google_drive_authorization = trim( sanitize_text_field( wp_unslash( $_POST['google_drive_authorization'] ) ) ); // phpcs:ignore
185	191
186	192	if ( '' !== trim( $google_drive_authorization ) ) {
187	193	$google_drive_drive = new WPDA_Google_Drive();
188	194	$response = $google_drive_drive->authorize( $google_drive_authorization );
		@@ -210,9 +216,9 @@
210	216	}
211	217
212	218	private function update_google_drive() {
213	219
214		- $google_drive_enabled = isset( $_POST['google_drive_enabled'] ) && 'on' === $_POST['google_drive_enabled'];
	220	+ $google_drive_enabled = isset( $_POST['google_drive_enabled'] ) && 'on' === $_POST['google_drive_enabled']; // phpcs:ignore -- verified
215	221
216	222	$google_drive_drive = WPDA_Drives::get_drive( 'google_drive' );
217	223	if ( false !== $google_drive_drive ) {
218	224	$google_drive_drive->toggle( $google_drive_enabled );
		@@ -221,8 +227,12 @@
221	227	}
222	228
223	229	protected function add_content() {
224	230
	231	+ if ( function_exists('ftp_ssl_connect') ) {
	232	+ $this->canSftp = true;
	233	+ }
	234	+
225	235	if ( isset( $_POST['action'] ) ) {
226	236	$action = sanitize_text_field( wp_unslash( $_POST['action'] ) ); // input var okay.
227	237
228	238	// Security check.
		@@ -227,9 +237,9 @@
227	237
228	238	// Security check.
229	239	$wp_nonce = isset( $_POST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ) : ''; // input var okay.
230	240	if ( ! wp_verify_nonce( $wp_nonce, 'wpda-drives-settings-' . WPDA::get_current_user_login() ) ) {
231		- wp_die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	241	+ wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
232	242	}
233	243
234	244	if ( 'save' === $action ) {
235	245	if ( isset( $_POST['local_file_system'] ) ) {
		@@ -347,9 +357,9 @@
347	357	</div>
348	358
349	359	<div>
350	360	<label style="display:block">Enter full local path:</label>
351		- <input type="text" name="local_file_system" style="width: 240px" value="<?php echo isset( $local_drive['drive']['path'] ) ? $local_drive['drive']['path'] : ''; ?>" />
	361	+ <input type="text" name="local_file_system" style="width: 240px" value="<?php echo isset( $local_drive['drive']['path'] ) ? $local_drive['drive']['path'] : ''; // phpcs:ignore WordPress.Security.EscapeOutput ?>" />
352	362	<div>&nbsp;</div>
353	363	<div>
354	364	Verify that the folder exists and that the server has permission to write files to it.
355	365	</div>
		@@ -358,9 +368,9 @@
358	368	<input
359	369	type="checkbox"
360	370	name="local_enabled"
361	371	<?php echo isset( $local_drive['enabled'] ) && $local_drive['enabled'] ? 'checked' : ''; ?>
362		- /> <?php echo __( 'Activate', 'wp-data-access' ); ?>
	372	+ /> <?php esc_html_e( 'Activate', 'wp-data-access' ); ?>
363	373	</label>
364	374	</div>
365	375	</div>
366	376	</td>
		@@ -505,9 +515,9 @@
505	515	<input
506	516	type="checkbox"
507	517	name="dropbox_enabled"
508	518	<?php echo isset( $dropbox_drive['enabled'] ) && $dropbox_drive['enabled'] ? 'checked' : ''; ?>
509		- /> <?php echo __( 'Activate', 'wp-data-access' ); ?>
	519	+ /> <?php esc_html_e( 'Activate', 'wp-data-access' ); ?>
510	520	</label>
511	521	<input type="hidden" name="dropbox_authorized" />
512	522	<?php
513	523	} else {
		@@ -601,9 +611,9 @@
601	611	<input
602	612	type="checkbox"
603	613	name="google_drive_enabled"
604	614	<?php echo isset( $google_drive_drive['enabled'] ) && $google_drive_drive['enabled'] ? 'checked' : ''; ?>
605		- /> <?php echo __( 'Activate', 'wp-data-access' ); ?>
	615	+ /> <?php esc_html_e( 'Activate', 'wp-data-access' ); ?>
606	616	</label>
607	617	<input type="hidden" name="google_drive_authorized" />
608	618	<?php
609	619	} else {
		@@ -651,18 +661,18 @@
651	661	<input type="hidden" name="action" value="save"/>
652	662	<input type="hidden" name="deleted_drives" id="deleted_drives" />
653	663	<button type="submit" class="button button-primary">
654	664	<i class="fas fa-check wpda_icon_on_button"></i>
655		- <?php echo __( 'Save Drive Settings', 'wp-data-access' ); ?>
	665	+ <?php esc_html_e( 'Save Drive Settings', 'wp-data-access' ); ?>
656	666	</button>
657	667	<a href="javascript:void(0)"
658		- onclick="if (confirm('<?php echo __( 'Reset to defaults?', 'wp-data-access' ); ?>')) {
	668	+ onclick="if (confirm('<?php esc_html_e( 'Reset to defaults?', 'wp-data-access' ); ?>')) {
659	669	jQuery('input[name=\'action\']').val('setdefaults');
660	670	jQuery('#wpda_settings_drives').trigger('submit');
661	671	}"
662	672	class="button button-secondary">
663	673	<i class="fas fa-times-circle wpda_icon_on_button"></i>
664		- <?php echo __( 'Reset Drive Settings To Defaults', 'wp-data-access' ); ?>
	674	+ <?php esc_html_e( 'Reset Drive Settings To Defaults', 'wp-data-access' ); ?>
665	675	</a>
666	676	</div>
667	677
668	678	<?php wp_nonce_field( 'wpda-drives-settings-' . WPDA::get_current_user_login(), '_wpnonce', false ); ?>
		@@ -816,8 +826,41 @@
816	826	);
817	827	}
818	828	}
819	829
	830	+ function ftpOnClick(event) {
	831	+ if (
	832	+ jQuery(event.target)
	833	+ .closest('fieldset')
	834	+ .find('.form-control-details:visible')
	835	+ .length === 0
	836	+ ) {
	837	+ jQuery(event.target)
	838	+ .attr('title', 'Hide FTP Server details');
	839	+ jQuery(event.target)
	840	+ .removeClass('dashicons-visibility')
	841	+ .addClass('dashicons-hidden');
	842	+ jQuery(event.target)
	843	+ .closest('fieldset')
	844	+ .find('.form-control-details')
	845	+ .css('display', 'block');
	846	+ jQuery(event.target)
	847	+ .closest('fieldset')
	848	+ .find('a.form-control-details')
	849	+ .css('display', 'flex');
	850	+ } else {
	851	+ jQuery(event.target)
	852	+ .attr('title', 'Show FTP Server details');
	853	+ jQuery(event.target)
	854	+ .removeClass('dashicons-hidden')
	855	+ .addClass('dashicons-visibility');
	856	+ jQuery(event.target)
	857	+ .closest('fieldset')
	858	+ .find('.form-control-details')
	859	+ .hide();
	860	+ }
	861	+ }
	862	+
820	863	function ftpContainer(
821	864	isNew,
822	865	driveName = '',
823	866	isChecked = false,
		@@ -829,8 +872,21 @@
829	872	passive = false,
830	873	timeout = 90,
831	874	directory = '/'
832	875	) {
	876	+ const canSftp = <?php echo $this->canSftp ? 'true' : 'false'; ?>;
	877	+ if (!canSftp) {
	878	+ ssl = false;
	879	+ }
	880	+ const sftpMessage = !canSftp
	881	+ ? `<div class="form-control form-control-details">
	882	+ <label></label>
	883	+ <span style="line-height:1.6;margin-bottom:10px;">
	884	+ <span class="dashicons dashicons-warning"></span> This server does not support SSL, ftp_ssl_connect is currently not available. (<a href="https://www.php.net/manual/en/function.ftp-ssl-connect.php" target="_blank">Read More...</a>)
	885	+ </span>
	886	+ </div>`
	887	+ : "";
	888	+
833	889	jQuery("#ftp_container").append(`
834	890	<fieldset class="wpda_fieldset${isNew ? ' wpda-is-new' : ''}">
835	891
836	892	<div class="form-control">
		@@ -848,9 +904,9 @@
848	904	</label>
849	905
850	906	<div>
851	907	<a href="javascript:void(0)"
852		- onclick="jQuery(this).closest('fieldset').find('.form-control-details').show(); jQuery(this).closest('fieldset').find('.form-control-details').css('display', 'block'); jQuery(this).closest('fieldset').find('a.form-control-details').css('display', 'flex'); jQuery(this).closest('fieldset').find('.form-control-icons').hide();"
	908	+ onclick="ftpOnClick(event)"
853	909	style="text-decoration:none;${isNew ? 'display:none;' : ''}"
854	910	class="wpda_tooltip form-control-icons"
855	911	title="Show FTP Server details">
856	912	<span class="dashicons dashicons-visibility" style="font-size:18px;"></span>
		@@ -856,16 +912,8 @@
856	912	<span class="dashicons dashicons-visibility" style="font-size:18px;"></span>
857	913	</a>
858	914
859	915	<a href="javascript:void(0)"
860		- onclick="jQuery(this).closest('fieldset').find('.form-control-details').hide(); jQuery(this).closest('fieldset').find('.form-control-icons').show();"
861		- style="text-decoration:none;${isNew ? 'display:none;' : ''}"
862		- class="wpda_tooltip form-control-details"
863		- title="Show FTP Server details">
864		- <span class="dashicons dashicons-hidden" style="font-size:18px;"></span>
865		- </a>
866		-
867		- <a href="javascript:void(0)"
868	916	onclick="if (confirm('Are you sure you want to delete this FTP Server? This action cannot be undone!')) { jQuery(this).closest('fieldset').remove(); deleteDrive('${driveName}'); }"
869	917	style="text-decoration:none;"
870	918	class="wpda_tooltip"
871	919	title="Delete FTP Server">
		@@ -898,9 +946,9 @@
898	946	<div class="form-control form-control-details">
899	947	<div></div>
900	948	<div>
901	949	<label>
902		- <input type="checkbox" name="ftp_ssl[]" ${ssl ? 'checked' : ''} />
	950	+ <input type="checkbox" name="ftp_ssl[]" ${ssl ? 'checked' : ''} <?php echo $this->canSftp ? '' : 'disabled="disabled"'; ?> />
903	951	SSL
904	952	</label>
905	953	&nbsp;
906	954	<label>
		@@ -908,8 +956,9 @@
908	956	Passive
909	957	</label>
910	958	</div>
911	959	</div>
	960	+ ${sftpMessage}
912	961
913	962	<div class="form-control form-control-details">
914	963	<label>Timeout</label>
915	964	<input type="number" name="ftp_timeout[]" value="${timeout}" />
		@@ -918,9 +967,8 @@
918	967	<div class="form-control form-control-details">
919	968	<label>Directory</label>
920	969	<input type="text" name="ftp_directory[]" value="${directory}" />
921	970	</div>
922		-
923	971	</fieldset>
924	972	`);
925	973	}
926	974
		@@ -953,9 +1001,9 @@
953	1001	</label>
954	1002
955	1003	<div>
956	1004	<a href="javascript:void(0)"
957		- onclick="jQuery(this).closest('fieldset').find('.form-control-details').show(); jQuery(this).closest('fieldset').find('.form-control-details').css('display', 'block'); jQuery(this).closest('fieldset').find('a.form-control-details').css('display', 'flex'); jQuery(this).closest('fieldset').find('.form-control-icons').hide();"
	1005	+ onclick="ftpOnClick(event)"
958	1006	style="text-decoration:none;${isNew ? 'display:none;' : ''}"
959	1007	class="wpda_tooltip form-control-icons"
960	1008	title="Show FTP Server details">
961	1009	<span class="dashicons dashicons-visibility" style="font-size:18px;"></span>
		@@ -961,16 +1009,8 @@
961	1009	<span class="dashicons dashicons-visibility" style="font-size:18px;"></span>
962	1010	</a>
963	1011
964	1012	<a href="javascript:void(0)"
965		- onclick="jQuery(this).closest('fieldset').find('.form-control-details').hide(); jQuery(this).closest('fieldset').find('.form-control-icons').show();"
966		- style="text-decoration:none;${isNew ? 'display:none;' : ''}"
967		- class="wpda_tooltip form-control-details"
968		- title="Show FTP Server details">
969		- <span class="dashicons dashicons-hidden" style="font-size:18px;"></span>
970		- </a>
971		-
972		- <a href="javascript:void(0)"
973	1013	onclick="if (confirm('Are you sure you want to delete this SFTP Server? This action cannot be undone!')) { jQuery(this).closest('fieldset').remove(); deleteDrive('${driveName}'); }"
974	1014	style="text-decoration:none;"
975	1015	class="wpda_tooltip"
976	1016	title="Delete SFTP Server">
		@@ -1019,5 +1059,5 @@
1019	1059	}
1020	1060
1021	1061	}
1022	1062
1023		-}
	1063	+}// phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing