← All changes | src/Settings.php +26 -16 trunk → 2.11.4 View file →

		@@ -46,8 +46,15 @@
46	46	*/
47	47	protected static $config_args;
48	48
49	49	/**
	50	+ * Holds nonce.
	51	+ *
	52	+ * @var $nonce
	53	+ */
	54	+ protected static $nonce;
	55	+
	56	+ /**
50	57	* Constructor.
51	58	*
52	59	* @param array $options Plugin options.
53	60	* @param string $config_path Path to config file.
		@@ -58,11 +65,12 @@
58	65	self::$options = $options;
59	66	self::$config_path = $config_path;
60	67	$this->defined_constants = $defined_constants;
61	68	self::$config_args = [ 'normalize' => true ];
	69	+ static::$nonce = wp_create_nonce( 'wp-debugging' );
62	70
63	71	if ( false === strpos( file_get_contents( self::$config_path ), "/* That's all, stop editing!" ) ) {
64		- if ( 1 === preg_match( '@\$table_prefix(.*;)@', file_get_contents( self::$config_path ), $matches ) ) {
	72	+ if ( 1 === preg_match( '@\$table_prefix = (.*);@', file_get_contents( self::$config_path ), $matches ) ) {
65	73	self::$config_args = array_merge(
66	74	self::$config_args,
67	75	[
68	76	'anchor' => "$matches[0]",
		@@ -118,11 +126,9 @@
118	126	* @return void
119	127	*/
120	128	public function update_settings() {
121	129	// Exit if improper privileges.
122		- if ( ! current_user_can( 'manage_options' )
123		- || ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_POST['_wpnonce'] ) ), 'wp_debugging-options' ) )
124		- ) {
	130	+ if ( ! current_user_can( 'manage_options' ) || ! wp_verify_nonce( static::$nonce, 'wp-debugging' ) ) {
125	131	return;
126	132	}
127	133
128	134	if ( isset( $_POST['option_page'] ) &&
		@@ -135,9 +141,9 @@
135	141	$options = $this->sanitize( $options );
136	142	$this->update_constants( self::$options, $options );
137	143	$filtered_options = array_filter(
138	144	self::$options,
139		- static function ( $e ) {
	145	+ function ( $e ) {
140	146	return '1' !== $e;
141	147	}
142	148	);
143	149	$options = array_merge( $filtered_options, $options );
		@@ -148,15 +154,15 @@
148	154
149	155	/**
150	156	* Update constants in wp-config.php.
151	157	*
152		- * @param array $old Current value of self::$options.
153		- * @param mixed $updated New value of $options.
	158	+ * @param array $old Current value of self::$options.
	159	+ * @param mixed $new New value of $options.
154	160	* @return void
155	161	*/
156		- private function update_constants( $old, $updated ) {
157		- $remove = array_diff_assoc( $old, $updated );
158		- $add = array_diff_assoc( $updated, $old );
	162	+ private function update_constants( $old, $new ) {
	163	+ $remove = array_diff_assoc( $old, $new );
	164	+ $add = array_diff_assoc( $new, $old );
159	165
160	166	if ( ! empty( $add ) ) {
161	167	$this->add_constants( $add );
162	168	}
		@@ -188,8 +194,9 @@
188	194
189	195	return $added;
190	196	} catch ( \Exception $e ) {
191	197	$messsage = 'Caught Exception: \Fragen\WP_Debugging\Settings::add_constants() - ' . $e->getMessage();
	198	+ // error_log( $messsage );
192	199	wp_die( esc_html( $messsage ) );
193	200	}
194	201	}
195	202
		@@ -245,8 +252,9 @@
245	252	$config_transformer->remove( 'constant', strtoupper( $constant ) );
246	253	}
247	254	} catch ( \Exception $e ) {
248	255	$messsage = 'Caught Exception: \Fragen\WP_Debugging\Settings::remove_constants() - ' . $e->getMessage();
	256	+ // error_log( $messsage );
249	257	wp_die( esc_html( $messsage ) );
250	258	}
251	259	}
252	260
		@@ -256,16 +264,17 @@
256	264	* @return void
257	265	*/
258	266	private function redirect_on_save() {
259	267	$update = false;
	268	+ if ( ! wp_verify_nonce( static::$nonce, 'wp-debugging' ) ) {
	269	+ return;
	270	+ }
260	271
261		- // phpcs:disable WordPress.Security.NonceVerification.Missing
262	272	if ( ( isset( $_POST['action'] ) && 'update' === $_POST['action'] ) &&
263	273	( isset( $_POST['option_page'] ) && 'wp_debugging' === $_POST['option_page'] )
264	274	) {
265	275	$update = true;
266	276	}
267		- // phpcs:enable
268	277
269	278	$redirect_url = is_multisite() ? network_admin_url( 'settings.php' ) : admin_url( 'tools.php' );
270	279
271	280	if ( $update ) {
		@@ -286,9 +295,11 @@
286	295	*
287	296	* @return void
288	297	*/
289	298	private function saved_settings_notice() {
290		- // phpcs:disable WordPress.Security.NonceVerification.Recommended
	299	+ if ( ! wp_verify_nonce( static::$nonce, 'wp-debugging' ) ) {
	300	+ return;
	301	+ }
291	302	if ( ( isset( $_GET['updated'] ) && '1' === $_GET['updated'] ) ||
292	303	( isset( $_GET['settings-updated'] ) && '1' === $_GET['settings-updated'] )
293	304	) {
294	305	echo '<div class="updated"><p>';
		@@ -294,9 +305,8 @@
294	305	echo '<div class="updated"><p>';
295	306	esc_html_e( 'Saved.', 'wp-debugging' );
296	307	echo '</p></div>';
297	308	}
298		- // phpcs:enable
299	309	}
300	310
301	311	/**
302	312	* Register settings.
		@@ -409,9 +419,9 @@
409	419	$action = is_multisite() ? 'edit.php?action=wp-debugging' : 'options.php'; ?>
410	420	<div class="wrap">
411	421	<h1><?php esc_html_e( 'WP Debugging', 'wp-debugging' ); ?></h1>
412	422	<div class="updated fade">
413		- <p><?php echo wp_kses_post( __( '<strong>Please note:</strong> Your <code>wp-config.php</code> file must be writable by the filesystem. Any errors will result in a PHP Exception being thrown. Debug constants as documented in <a href="https://wordpress.org/documentation/article/debugging-in-wordpress/">Debugging in WordPress</a>.', 'wp-debugging' ) ); ?></p>
	423	+ <p><?php echo wp_kses_post( __( '<strong>Please note:</strong> Your <code>wp-config.php</code> file must be writable by the filesystem. Any errors will result in a PHP Exception being thrown. Debug constants per <a href="https://codex.wordpress.org/Debugging_in_WordPress">Debugging in WordPress</a>.', 'wp-debugging' ) ); ?></p>
414	424	</div>
415	425	<div>
416	426	<form method="post" action="<?php echo esc_attr( $action ); ?>">
417	427	<?php settings_fields( 'wp_debugging' ); ?>
		@@ -451,9 +461,9 @@
451	461	?>
452	462	<style> .form-table th { display:none; } </style>
453	463	<label for="<?php echo esc_attr( $args['id'] ); ?>">
454	464	<input type="checkbox" name="wp-debugging[<?php echo esc_attr( $args['id'] ); ?>]" value="1" <?php checked( '1', $checked ); ?> >
455		- <?php echo esc_html( $args['title'] ); ?>
	465	+ <?php esc_html_e( $args['title'] ); ?>
456	466	</label>
457	467	<?php
458	468	}
459	469