wp-insert / includes / modules / core / misc / module.php

module.php in Wp-Insert 2.6.0, at includes/modules/core/misc/module.php

121 lines 4.2 KB

Raw Download Zip

1	<?php
2	/* Begin AJAX Capability Guard */
3	add_action( 'check_ajax_referer', 'wp_insert_ajax_capability_guard', 10, 1 );
4	function wp_insert_ajax_capability_guard( $handlerAction ) {
5	$adminOnlyActions = [ 'wp-insert', 'wp-insert-admin-notice', 'wp-insert-adstxt-adsense-admin-notice' ];
6	if ( in_array( $handlerAction, $adminOnlyActions, true ) && ! current_user_can( 'manage_options' ) ) {
7	wp_die( -1, 403 );
8	}
9	if ( ( 'wp-insert-gutenberg' === $handlerAction ) && ! current_user_can( 'edit_posts' ) ) {
10	wp_die( -1, 403 );
11	}
12	}
13	/* End AJAX Capability Guard */
14
15	/* Begin Output Helpers */
16	/**
17	* Echo markup built by smartlogixControls (or other plugin-internal builders).
18	*
19	* The builder escapes every user-supplied value as it assembles each control
20	* (see smartlogixControls::get_control()), so the assembled string is already
21	* safe; escaping it again here would corrupt the form markup. This helper marks
22	* those call sites explicitly instead of scattering phpcs ignores.
23	*
24	* Never pass unvalidated request data to this function.
25	*
26	* @param string $html Pre-escaped markup.
27	*/
28	function wp_insert_echo_html( $html ) {
29	echo $html; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Documented contract: caller passes builder-escaped markup.
30	}
31
32	/**
33	* Echo advertisement / embed code exactly as the site administrator stored it.
34	*
35	* Ad code is raw third-party HTML, JavaScript and iframes by definition — the
36	* plugin's entire purpose is to emit it verbatim, so it cannot be escaped.
37	* Storage is restricted to users with `manage_options`, and users without
38	* `unfiltered_html` have their input filtered through wp_kses_post() on save
39	* (see wp_insert_sanitize_ad_field()).
40	*
41	* @param string $adCode Ad code to output.
42	*/
43	function wp_insert_echo_ad_code( $adCode ) {
44	echo $adCode; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Ad code is intentionally raw; capability-gated and kses-filtered on save.
45	}
46	/* End Output Helpers */
47
48	/* Begin Ad Unit Types */
49	function wp_insert_get_ad_unit_types() {
50	return [ 'inpostads', 'adwidgets', 'shortcodeads', 'inthemeads', 'pagelevelads' ];
51	}
52
53	function wp_insert_get_ad_code_fields() {
54	return [ 'primary_ad_code', 'secondary_ad_code', 'tertiary_ad_code', 'geo_group1_adcode', 'geo_group2_adcode' ];
55	}
56
57	/**
58	* Sanitize a single ad unit field on save.
59	*
60	* Ad code fields are stored raw (slashed, matching the legacy storage format the
61	* render pipeline expects) for users with the `unfiltered_html` capability; other
62	* users get wp_kses_post filtering. All remaining fields receive standard
63	* WordPress sanitization.
64	*
65	* @param string $field Field name (without prefixes).
66	* @param string\|array $value Raw (slashed) request value.
67	* @return string\|array
68	*/
69	function wp_insert_sanitize_ad_field( $field, $value ) {
70	if ( in_array( $field, wp_insert_get_ad_code_fields(), true ) ) {
71	if ( current_user_can( 'unfiltered_html' ) ) {
72	return $value;
73	}
74	return wp_slash( wp_kses_post( wp_unslash( $value ) ) );
75	}
76	if ( is_array( $value ) ) {
77	return array_map( 'sanitize_text_field', $value );
78	}
79	if ( ( 'styles' === $field ) \|\| ( 'notes' === $field ) \|\| ( '_styles' === substr( $field, -7 ) ) ) {
80	return sanitize_textarea_field( $value );
81	}
82	return sanitize_text_field( $value );
83	}
84	/* End Ad Unit Types */
85
86	/* Begin Version Upgrade */
87	add_action( 'init', 'wp_insert_upgrade_version', 0 );
88	function wp_insert_upgrade_version() {
89	$databaseVersion = get_option( 'wp_insert_version' );
90	if ( $databaseVersion != WP_INSERT_VERSION ) {
91	do_action( 'wp_insert_upgrade_database' );
92	update_option( 'wp_insert_version', WP_INSERT_VERSION );
93	}
94	}
95	/* End Version Upgrade */
96
97	/* Begin Misc Functions */
98	function wp_insert_add_ordinal_number_suffix( $num ) {
99	if ( ! in_array( ( $num % 100 ), [ 11, 12, 13 ] ) ) {
100	switch ( $num % 10 ) {
101	case 1:
102	return $num . 'st';
103	case 2:
104	return $num . 'nd';
105	case 3:
106	return $num . 'rd';
107	}
108	}
109	return $num . 'th';
110	}
111
112	function wp_insert_get_domain_name_from_url( $url ) {
113	$pieces = wp_parse_url( $url );
114	$domain = isset( $pieces['host'] ) ? $pieces['host'] : '';
115	if ( preg_match( '/(?P<domain>[a-z0-9][a-z0-9\-]{1,63}\.[a-z\.]{2,6})$/i', $domain, $regs ) ) {
116	return $regs['domain'];
117	}
118	return false;
119	}
120	/* End Misc Functions */
121