| @@ -46,8 +46,15 @@ | ||
| 46 | 46 | */ |
| 47 | 47 | protected static $config_args; |
| 48 | 48 | |
| 49 | 49 | /** |
| 50 | + * Holds nonce. | |
| 51 | + * | |
| 52 | + * @var $nonce | |
| 53 | + */ | |
| 54 | + protected static $nonce; | |
| 55 | + | |
| 56 | + /** | |
| 50 | 57 | * Constructor. |
| 51 | 58 | * |
| 52 | 59 | * @param array $options Plugin options. |
| 53 | 60 | * @param string $config_path Path to config file. |
| @@ -58,8 +65,9 @@ | ||
| 58 | 65 | self::$options = $options; |
| 59 | 66 | self::$config_path = $config_path; |
| 60 | 67 | $this->defined_constants = $defined_constants; |
| 61 | 68 | self::$config_args = [ 'normalize' => true ]; |
| 69 | + static::$nonce = wp_create_nonce( 'wp-debugging' ); | |
| 62 | 70 | |
| 63 | 71 | if ( false === strpos( file_get_contents( self::$config_path ), "/* That's all, stop editing!" ) ) { |
| 64 | 72 | if ( 1 === preg_match( '@\$table_prefix = (.*);@', file_get_contents( self::$config_path ), $matches ) ) { |
| 65 | 73 | self::$config_args = array_merge( |
| @@ -118,11 +126,9 @@ | ||
| 118 | 126 | * @return void |
| 119 | 127 | */ |
| 120 | 128 | public function update_settings() { |
| 121 | 129 | // Exit if improper privileges. |
| 122 | - if ( ! current_user_can( 'manage_options' ) | |
| 123 | - || ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_POST['_wpnonce'] ) ), 'wp_debugging-options' ) ) | |
| 124 | - ) { | |
| 130 | + if ( ! current_user_can( 'manage_options' ) || ! wp_verify_nonce( static::$nonce, 'wp-debugging' ) ) { | |
| 125 | 131 | return; |
| 126 | 132 | } |
| 127 | 133 | |
| 128 | 134 | if ( isset( $_POST['option_page'] ) && |
| @@ -258,16 +264,17 @@ | ||
| 258 | 264 | * @return void |
| 259 | 265 | */ |
| 260 | 266 | private function redirect_on_save() { |
| 261 | 267 | $update = false; |
| 268 | + if ( ! wp_verify_nonce( static::$nonce, 'wp-debugging' ) ) { | |
| 269 | + return; | |
| 270 | + } | |
| 262 | 271 | |
| 263 | - // phpcs:disable WordPress.Security.NonceVerification.Missing | |
| 264 | 272 | if ( ( isset( $_POST['action'] ) && 'update' === $_POST['action'] ) && |
| 265 | 273 | ( isset( $_POST['option_page'] ) && 'wp_debugging' === $_POST['option_page'] ) |
| 266 | 274 | ) { |
| 267 | 275 | $update = true; |
| 268 | 276 | } |
| 269 | - // phpcs:enable | |
| 270 | 277 | |
| 271 | 278 | $redirect_url = is_multisite() ? network_admin_url( 'settings.php' ) : admin_url( 'tools.php' ); |
| 272 | 279 | |
| 273 | 280 | if ( $update ) { |
| @@ -288,9 +295,11 @@ | ||
| 288 | 295 | * |
| 289 | 296 | * @return void |
| 290 | 297 | */ |
| 291 | 298 | private function saved_settings_notice() { |
| 292 | - // phpcs:disable WordPress.Security.NonceVerification.Recommended | |
| 299 | + if ( ! wp_verify_nonce( static::$nonce, 'wp-debugging' ) ) { | |
| 300 | + return; | |
| 301 | + } | |
| 293 | 302 | if ( ( isset( $_GET['updated'] ) && '1' === $_GET['updated'] ) || |
| 294 | 303 | ( isset( $_GET['settings-updated'] ) && '1' === $_GET['settings-updated'] ) |
| 295 | 304 | ) { |
| 296 | 305 | echo '<div class="updated"><p>'; |
| @@ -296,9 +305,8 @@ | ||
| 296 | 305 | echo '<div class="updated"><p>'; |
| 297 | 306 | esc_html_e( 'Saved.', 'wp-debugging' ); |
| 298 | 307 | echo '</p></div>'; |
| 299 | 308 | } |
| 300 | - // phpcs:enable | |
| 301 | 309 | } |
| 302 | 310 | |
| 303 | 311 | /** |
| 304 | 312 | * Register settings. |
