| 1 |
<?php |
| 2 |
|
| 3 |
namespace SlimStat\Components; |
| 4 |
|
| 5 |
// don't load directly. |
| 6 |
if (! defined('ABSPATH')) { |
| 7 |
header('Status: 403 Forbidden'); |
| 8 |
header('HTTP/1.1 403 Forbidden'); |
| 9 |
exit; |
| 10 |
} |
| 11 |
|
| 12 |
|
| 13 |
class View |
| 14 |
{ |
| 15 |
/** |
| 16 |
* Allowed variable names for extraction. |
| 17 |
* Only these keys will be extracted from $args to prevent variable injection. |
| 18 |
* |
| 19 |
* @var array |
| 20 |
*/ |
| 21 |
private static $allowed_keys = [ |
| 22 |
'data', |
| 23 |
'prevData', |
| 24 |
'chartLabels', |
| 25 |
'translations', |
| 26 |
'args', |
| 27 |
'totals', |
| 28 |
'is_pro', |
| 29 |
'report_id', |
| 30 |
'settings', |
| 31 |
'options', |
| 32 |
'items', |
| 33 |
'title', |
| 34 |
'description', |
| 35 |
'content', |
| 36 |
'filters', |
| 37 |
'columns', |
| 38 |
'rows', |
| 39 |
'pagination', |
| 40 |
'chart_args', |
| 41 |
'chart_data', |
| 42 |
'chart_type', |
| 43 |
'granularity', |
| 44 |
'visitors', |
| 45 |
'pageviews', |
| 46 |
'events', |
| 47 |
'countries', |
| 48 |
'cities', |
| 49 |
'browsers', |
| 50 |
'platforms', |
| 51 |
'screen_sizes', |
| 52 |
'languages', |
| 53 |
'referrers', |
| 54 |
'search_terms', |
| 55 |
'resources', |
| 56 |
'outbound', |
| 57 |
'downloads', |
| 58 |
'notices', |
| 59 |
'message', |
| 60 |
'type', |
| 61 |
'class', |
| 62 |
'notification', |
| 63 |
'notifications', |
| 64 |
'tab', |
| 65 |
]; |
| 66 |
|
| 67 |
/** |
| 68 |
* Load a view file and pass data to it. |
| 69 |
* |
| 70 |
* @param string|array $view The view path inside views directory |
| 71 |
* @param array $args An associative array of data to pass to the view. |
| 72 |
* @param bool $return Return the template if requested |
| 73 |
* @param string $baseDir The base directory to load the view, defaults to SLIMSTAT_DIR |
| 74 |
* |
| 75 |
* @throws Exception if the view file cannot be found. |
| 76 |
*/ |
| 77 |
public static function load($view, $args = [], $return = false, $baseDir = null) |
| 78 |
{ |
| 79 |
// Default to SLIMSTAT_DIR |
| 80 |
$baseDir = empty($baseDir) ? SLIMSTAT_DIR : $baseDir; |
| 81 |
|
| 82 |
try { |
| 83 |
$viewList = is_array($view) ? $view : [$view]; |
| 84 |
|
| 85 |
foreach ($viewList as $view) { |
| 86 |
$viewPath = sprintf('%s/views/%s.php', $baseDir, $view); |
| 87 |
|
| 88 |
if (!file_exists($viewPath)) { |
| 89 |
throw new \Exception(esc_html__('View file not found: ' . $viewPath, 'wp-slimstat')); |
| 90 |
} |
| 91 |
|
| 92 |
// Make $view_args available to templates (safer than extract) |
| 93 |
$view_args = $args; |
| 94 |
|
| 95 |
// For backward compatibility, extract only allowed keys |
| 96 |
// This prevents variable injection attacks while maintaining existing functionality |
| 97 |
if (!empty($args) && is_array($args)) { |
| 98 |
$safe_args = array_intersect_key($args, array_flip(self::$allowed_keys)); |
| 99 |
// phpcs:ignore WordPress.PHP.DontExtract.extract_extract -- Intentionally limited to allowed keys only |
| 100 |
extract($safe_args, EXTR_SKIP); |
| 101 |
} |
| 102 |
|
| 103 |
// Return the template if requested |
| 104 |
if ($return) { |
| 105 |
ob_start(); |
| 106 |
include $viewPath; |
| 107 |
return ob_get_clean(); |
| 108 |
} |
| 109 |
|
| 110 |
include $viewPath; |
| 111 |
} |
| 112 |
} catch (\Exception $exception) { |
| 113 |
\wp_slimstat::log($exception->getMessage(), 'error'); |
| 114 |
} |
| 115 |
|
| 116 |
return null; |
| 117 |
} |
| 118 |
} |
| 119 |
|
