| @@ -1,18 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | - | |
| 2 | +if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly | |
| 3 | 3 | function wpdeepl_test_admin() { |
| 4 | - | |
| 5 | - | |
| 6 | 4 | return; |
| 7 | - $glossary_id = 'da005df2-fb26-4165-8310-b07c9cc1b492'; | |
| 8 | - $list = deepl_listGlossaryEntries( $glossary_id, 'tsv' ); | |
| 9 | - plouf( $list ); | |
| 10 | - die('okazeaze6a8z4e6e4az4'); | |
| 11 | - | |
| 12 | - //deepl_deleteGlosssary( ); | |
| 13 | - | |
| 14 | - | |
| 15 | 5 | } |
| 16 | 6 | |
| 17 | 7 | |
| 18 | 8 | |
| @@ -17,15 +7,15 @@ | ||
| 17 | 7 | |
| 18 | 8 | |
| 19 | 9 | |
| 20 | 10 | |
| 21 | -function deepl_language_selector( | |
| 11 | +function wpdeepl_language_selector( | |
| 22 | 12 | $type = 'target', |
| 23 | 13 | $css_id = 'deepl_language_selector', |
| 24 | 14 | $selected = false, |
| 25 | 15 | $not_selected = false, |
| 26 | 16 | $forbid_auto = false |
| 27 | - ) { | |
| 17 | +) { | |
| 28 | 18 | $languages = DeepLConfiguration::DefaultsAllLanguages(); |
| 29 | 19 | |
| 30 | 20 | $wp_locale = get_locale(); |
| 31 | 21 | |
| @@ -30,59 +20,66 @@ | ||
| 30 | 20 | $wp_locale = get_locale(); |
| 31 | 21 | |
| 32 | 22 | $default_target_language = DeepLConfiguration::getDefaultTargetLanguage(); |
| 33 | 23 | |
| 34 | - if ( $type == 'target' && $selected == false ) { | |
| 24 | + if ( 'target' === $type && false === $selected ) { | |
| 35 | 25 | $selected = $default_target_language; |
| 36 | - //plouf( $languages ); | |
| 37 | 26 | } |
| 38 | 27 | |
| 39 | 28 | $html = ""; |
| 40 | 29 | |
| 41 | - $html .= "\n" . '<select id="' . $css_id . '" name="' . $css_id . '" class="deepl_translate_form">'; | |
| 30 | + // 1. Sécurisation des attributs ID et NAME | |
| 31 | + $html .= "\n" . '<select id="' . esc_attr( $css_id ) . '" name="' . esc_attr( $css_id ) . '" class="deepl_translate_form">'; | |
| 42 | 32 | |
| 43 | - if ( $type == 'source' ) { | |
| 44 | - if( !$forbid_auto ) { | |
| 45 | - if( !defined('WPDEEPLPRO_NAME') || !DeepLConfiguration::usingGlossaries() ) { | |
| 46 | - $html .= ' | |
| 47 | - <option value="auto">' . __( 'Automatic', 'wpdeepl' ) . '</option>'; | |
| 33 | + if ( 'source' === $type ) { | |
| 34 | + if( ! $forbid_auto ) { | |
| 35 | + // 2. Sécurisation des textes traduits | |
| 36 | + if( ! defined('WPDEEPLPRO_NAME') || ! DeepLConfiguration::usingGlossaries() ) { | |
| 37 | + $html .= ' | |
| 38 | + <option value="auto">' . esc_html__( 'Automatic', 'wpdeepl' ) . '</option>'; | |
| 48 | 39 | } |
| 49 | - | |
| 50 | 40 | else { |
| 51 | 41 | $html .= ' |
| 52 | - <option value="auto">' . __( 'Automatic (no glossary)', 'wpdeepl' ) . '</option>'; | |
| 53 | - | |
| 42 | + <option value="auto">' . esc_html__( 'Automatic (no glossary)', 'wpdeepl' ) . '</option>'; | |
| 54 | 43 | } |
| 55 | 44 | } |
| 56 | 45 | } |
| 57 | 46 | |
| 58 | - | |
| 59 | 47 | $languages_to_display = DeepLConfiguration::getDisplayedLanguages(); |
| 60 | 48 | |
| 61 | 49 | foreach ( $languages as $ln_id => $language ) { |
| 62 | 50 | |
| 63 | - if ( $languages_to_display && !in_array( $ln_id, $languages_to_display ) ) { | |
| 51 | + if ( $languages_to_display && ! in_array( $ln_id, $languages_to_display, true ) ) { | |
| 64 | 52 | continue; |
| 65 | 53 | } |
| 54 | + | |
| 66 | 55 | if ( |
| 67 | 56 | $default_target_language |
| 68 | 57 | && $ln_id == $default_target_language |
| 69 | - && $type == 'source' | |
| 58 | + && 'source' === $type | |
| 70 | 59 | ) { |
| 71 | 60 | //continue; |
| 72 | 61 | } |
| 73 | 62 | |
| 63 | + // 3. Sécurisation de la valeur de l'option | |
| 74 | 64 | $html .= ' |
| 75 | - <option value="' . $ln_id .'"'; | |
| 65 | + <option value="' . esc_attr( $ln_id ) .'"'; | |
| 76 | 66 | |
| 77 | 67 | if ( $ln_id == $selected && $ln_id != $not_selected ) { |
| 78 | 68 | $html .= ' selected="selected"'; |
| 79 | 69 | } |
| 70 | + | |
| 80 | 71 | $label = ( $wp_locale && isset( $language['labels'][$wp_locale] )) ? $language['labels'][$wp_locale] : $language['labels']['fr_FR']; |
| 81 | - $html .= '>' . $label. '</option>'; | |
| 72 | + | |
| 73 | + // 4. Sécurisation impérative du label affiché (FAIL fréquent du PCP ici) | |
| 74 | + $html .= '>' . esc_html( $label ) . '</option>'; | |
| 82 | 75 | } |
| 83 | - if ( $type == 'target' ) $html .= ' | |
| 84 | - <option value="notranslation">' . __( 'Dont\'t translate', 'wpdeepl' ) . '</option>'; | |
| 76 | + | |
| 77 | + if ( 'target' === $type ) { | |
| 78 | + // Correction typo + escaping | |
| 79 | + $html .= ' | |
| 80 | + <option value="notranslation">' . esc_html__( "Don't translate", 'wpdeepl' ) . '</option>'; | |
| 81 | + } | |
| 85 | 82 | |
| 86 | 83 | $html .="\n</select>"; |
| 87 | 84 | |
| 88 | 85 | return $html; |
| @@ -88,12 +85,13 @@ | ||
| 88 | 85 | return $html; |
| 89 | 86 | } |
| 90 | 87 | |
| 91 | 88 | function wpdeepl_show_clear_logs_button() { |
| 92 | - echo ' | |
| 89 | + ?> | |
| 93 | 90 | <p class="submit"> |
| 94 | - <button name="clear_logs" class="button-primary" type="submit" value="clear_logs">' . __('Clear logs', 'wpdeepl') .'</button> | |
| 95 | - </p>'; | |
| 91 | + <button name="clear_logs" class="button-primary" type="submit" value="clear_logs"><?php esc_html_e('Clear logs', 'wpdeepl'); ?></button> | |
| 92 | + </p> | |
| 93 | + <?php | |
| 96 | 94 | } |
| 97 | 95 | |
| 98 | 96 | |
| 99 | 97 | |
| @@ -99,17 +97,19 @@ | ||
| 99 | 97 | |
| 100 | 98 | function wpdeepl_clear_logs() { |
| 101 | 99 | $log_files = glob( trailingslashit( WPDEEPL_FILES ) .'*.log'); |
| 102 | 100 | if ($log_files) foreach ( $log_files as $log_file) { |
| 103 | - unlink($log_file); | |
| 101 | + wp_delete_file($log_file); | |
| 104 | 102 | } |
| 105 | - echo '<div class="notice notice-success"><p>' . __('Log files deleted', 'wpdeepl') . '</p></div>'; | |
| 103 | + ?> | |
| 104 | + <div class="notice notice-success"><p><?php esc_html_e('Log files deleted', 'wpdeepl'); ?></p></div> | |
| 105 | + <?php | |
| 106 | 106 | } |
| 107 | 107 | function wpdeepl_log( $bits, $type ) { |
| 108 | - $log_lines = array_merge(array('date' => date('d/m/Y H:i:s')), $bits); | |
| 108 | + $log_lines = array_merge(array('date' => gmdate('d/m/Y H:i:s')), $bits); | |
| 109 | 109 | $log_line = serialize($log_lines) . "\n"; |
| 110 | 110 | $type = html_entity_decode( $type ); |
| 111 | - $log_file = trailingslashit( WPDEEPL_FILES ) . date( 'Y-m' ) . '-' . $type . '.log'; | |
| 111 | + $log_file = trailingslashit( WPDEEPL_FILES ) . gmdate( 'Y-m' ) . '-' . $type . '.log'; | |
| 112 | 112 | file_put_contents( $log_file, $log_line, FILE_APPEND ); |
| 113 | 113 | } |
| 114 | 114 | |
| 115 | 115 | |
| @@ -117,9 +117,10 @@ | ||
| 117 | 117 | if ( !current_user_can( 'manage_options' ) ) { |
| 118 | 118 | return false; |
| 119 | 119 | } |
| 120 | 120 | |
| 121 | - if( !wp_verify_nonce( $_GET[ 'nonce' ], 'prune_logs' ) ) { | |
| 121 | + $nonce_value = filter_input( INPUT_GET, 'nonce', FILTER_SANITIZE_FULL_SPECIAL_CHARS ); | |
| 122 | + if ( ! $nonce_value || ! wp_verify_nonce( $nonce_value, 'prune_logs' ) ) { | |
| 122 | 123 | return false; |
| 123 | 124 | } |
| 124 | 125 | |
| 125 | 126 | $logs = glob( trailingslashit( WPDEEPL_FILES ) . '*.log'); |
| @@ -135,9 +136,9 @@ | ||
| 135 | 136 | $first_day_time = $first_day_of_the_month->getTimestamp(); |
| 136 | 137 | |
| 137 | 138 | if ( $log_time < $first_day_time ) { |
| 138 | 139 | //echo " <br />SUPPRESSION $log_file : " . date('Y-m-d H:i:s', $log_time) . " < " . date('Y-m-d H:i:s', $first_day_time ); |
| 139 | - unlink( $log_file ); | |
| 140 | + wp_delete_file( $log_file ); | |
| 140 | 141 | } |
| 141 | 142 | } |
| 142 | 143 | } |
| 143 | 144 | } |
| @@ -145,9 +146,11 @@ | ||
| 145 | 146 | |
| 146 | 147 | function wpdeepl_display_logs() { |
| 147 | 148 | |
| 148 | 149 | |
| 149 | - echo '<h3 class="wc-settings-sub-title" id="logs">' . __('Logs','wpdeepl') . '</h3>'; | |
| 150 | + ?> | |
| 151 | + <h3 class="wc-settings-sub-title" id="logs"><?php esc_html_e('Logs','wpdeepl'); ?></h3> | |
| 152 | + <?php | |
| 150 | 153 | |
| 151 | 154 | $log_files = glob( trailingslashit( WPDEEPL_FILES ) .'*.log'); |
| 152 | 155 | if ($log_files) { |
| 153 | 156 | foreach ($log_files as $log_file) { |
| @@ -154,19 +157,24 @@ | ||
| 154 | 157 | $file_name = basename( $log_file ); |
| 155 | 158 | $contents = file_get_contents( $log_file ); |
| 156 | 159 | if (preg_match('#(\d+)-(\d+)-(\w+)\.log#', $file_name, $match)) { |
| 157 | 160 | $date = $match[2] . '/' . $match[1]; |
| 158 | - echo '<h3>'; | |
| 159 | - printf( | |
| 160 | - __("File '%s' for %s", 'wpdeepl' ), | |
| 161 | - $match[3], | |
| 162 | - $date | |
| 161 | + ?> | |
| 162 | + <h3><?php | |
| 163 | + echo esc_html( | |
| 164 | + sprintf( | |
| 165 | + /* translators: 1. file name 2. month */ | |
| 166 | + __("File '%1\$s' for %2\$s", 'wpdeepl' ), | |
| 167 | + $match[3], | |
| 168 | + $date | |
| 169 | + ) | |
| 163 | 170 | ); |
| 164 | - echo '</h3>'; | |
| 171 | + ?> | |
| 172 | + </h3><?php | |
| 165 | 173 | |
| 166 | 174 | $lines = explode("\n", $contents); |
| 167 | 175 | foreach ($lines as $line) { |
| 168 | - plouf(unserialize($line)); | |
| 176 | + wpdeepl_debug_display(unserialize($line)); | |
| 169 | 177 | } |
| 170 | 178 | |
| 171 | 179 | } |
| 172 | 180 | |
| @@ -172,8 +180,8 @@ | ||
| 172 | 180 | |
| 173 | 181 | } |
| 174 | 182 | } |
| 175 | 183 | else { |
| 176 | - _e( 'No log files', 'wpdeepl' ); | |
| 184 | + esc_html_e( 'No log files', 'wpdeepl' ); | |
| 177 | 185 | } |
| 178 | 186 | } |
| 179 | 187 | |
