| @@ -1,11 +1,12 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /** |
| 3 | 3 | * Improved Settings |
| 4 | 4 | * |
| 5 | - * @package WP_Improved_Settings | |
| 6 | - * @version 20221115 | |
| 5 | + * @package wpdeepl_WP_Improved_Settings | |
| 6 | + * @version 20251205 | |
| 7 | 7 | * |
| 8 | + * 20251205 Version 2.0 - Adaptée à l'API v2.0, PCP compliant | |
| 8 | 9 | * 20221115 esc all |
| 9 | 10 | * 20210111 ajout wpimpsettings_find_option_like |
| 10 | 11 | * 20200320 ajout des setting en tableau |
| 11 | 12 | * 20190705 footer actions prise en compte des méthodes |
| @@ -12,60 +13,95 @@ | ||
| 12 | 13 | * 201991125 plugin_text_domain supprimé |
| 13 | 14 | * 20191201 plugin paths |
| 14 | 15 | */ |
| 15 | 16 | |
| 16 | -namespace WP_Improved_Settings; | |
| 17 | +namespace wpdeepl_WP_Improved_Settings; | |
| 18 | +if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly | |
| 17 | 19 | |
| 18 | -if ( !function_exists( 'WP_Improved_Settings\zebench_get_plugin_paths' ) ) { | |
| 20 | +if ( !function_exists( 'wpdeepl_WP_Improved_Settings\zebench_get_plugin_paths' ) ) { | |
| 19 | 21 | function zebench_get_plugin_paths() { |
| 20 | - $array = apply_filters( 'zebench_get_plugin_paths', array() ); | |
| 22 | + $array = apply_filters( 'wpdeepl_zebench_get_plugin_paths', array() ); | |
| 21 | 23 | return $array; |
| 22 | 24 | } |
| 23 | 25 | } |
| 24 | 26 | |
| 25 | -if( !function_exists('WP_Improved_Settings\wpimpsettings_find_all_options_like') ){ | |
| 27 | +if( !function_exists('wpdeepl_WP_Improved_Settings\wpimpsettings_find_all_options_like') ){ | |
| 26 | 28 | function wpimpsettings_find_all_options_like( $string ) { |
| 27 | - // ugly hack to fetch plugin_name_index options | |
| 29 | + if ( ! current_user_can( 'manage_options' ) ) { | |
| 30 | + return array(); | |
| 31 | + } | |
| 28 | 32 | global $wpdb; |
| 29 | - $search = $wpdb->_real_escape( $string ); | |
| 30 | - $sql = "SELECT option_name, option_value FROM $wpdb->options WHERE option_name LIKE '%$search%'"; | |
| 33 | + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Prepared statement, admin-only utility function | |
| 34 | + $results = $wpdb->get_results( | |
| 35 | + $wpdb->prepare( | |
| 36 | + "SELECT option_name, option_value FROM $wpdb->options WHERE option_name LIKE %s", | |
| 37 | + '%' . $wpdb->esc_like( $string ) . '%' // Assainissement (esc_like) et wildcards injectés ici | |
| 38 | + ) | |
| 39 | + , ARRAY_A ); | |
| 31 | 40 | |
| 32 | - $results = $wpdb->get_results( $sql, ARRAY_A ); | |
| 33 | 41 | return $results; |
| 34 | 42 | } |
| 35 | 43 | } |
| 36 | - | |
| 37 | -if( !function_exists('WP_Improved_Settings\wpimpsettings_find_option_like') ){ | |
| 44 | +if( !function_exists('wpdeepl_WP_Improved_Settings\wpimpsettings_find_option_like') ){ | |
| 38 | 45 | function wpimpsettings_find_option_like( $string ) { |
| 39 | - // ugly hack to fetch plugin_name_index options | |
| 46 | + if ( ! current_user_can( 'manage_options' ) ) { | |
| 47 | + return array(); | |
| 48 | + } | |
| 40 | 49 | global $wpdb; |
| 41 | - $search = $wpdb->_real_escape( $string ); | |
| 42 | - $sql = "SELECT option_name, option_value FROM $wpdb->options WHERE option_name LIKE '$search%'"; | |
| 43 | - | |
| 44 | - $results = $wpdb->get_results( $sql, ARRAY_A ); | |
| 50 | + $sanitized_string = sanitize_key( $string ); | |
| 51 | + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Prepared statement, admin-only utility function | |
| 52 | + $results = $wpdb->get_results( | |
| 53 | + $wpdb->prepare( | |
| 54 | + "SELECT option_name, option_value FROM $wpdb->options WHERE option_name LIKE %s", | |
| 55 | + $wpdb->esc_like( $sanitized_string ) . '%' // [sanitized_string]% | |
| 56 | + ) | |
| 57 | + , ARRAY_A ); | |
| 58 | + | |
| 45 | 59 | $return = array(); |
| 46 | - if( $results ) foreach ( $results as $result ) { | |
| 47 | - $name = str_replace($string .'_', '', $result['option_name'] ); | |
| 48 | - $explode = explode('_', $name ); | |
| 49 | - | |
| 50 | - $value = $result['option_value']; | |
| 51 | - $return[$explode[0]][$explode[1]] = $value; | |
| 60 | + if( $results ) { | |
| 61 | + foreach ( $results as $result ) { | |
| 62 | + $name = str_replace( $sanitized_string . '_', '', $result['option_name'] ); | |
| 63 | + $explode = explode('_', $name ); | |
| 64 | + $value = $result['option_value']; | |
| 65 | + if ( ! empty( $explode[0] ) && ! empty( $explode[1] ) ) { | |
| 66 | + $return[ sanitize_key( $explode[0] ) ][ sanitize_key( $explode[1] ) ] = $value; | |
| 67 | + } | |
| 68 | + } | |
| 52 | 69 | } |
| 53 | 70 | return $return; |
| 54 | 71 | } |
| 55 | 72 | } |
| 56 | - | |
| 57 | -if ( !class_exists( 'WP_Improved_Settings\WP_Improved_Settings' ) ) { | |
| 58 | -class WP_Improved_Settings { | |
| 59 | - // loosely based on wc-dynamic-pricing-and-discounts/classes/rp-wcdpd-settings.class.php | |
| 60 | - public $settingsStructure = array(); | |
| 73 | +if ( !class_exists( 'wpdeepl_WP_Improved_Settings\wpdeepl_WP_Improved_Settings' ) ) { | |
| 74 | +class wpdeepl_WP_Improved_Settings { | |
| 75 | + /** | |
| 76 | + * Settings structure from configuration | |
| 77 | + * | |
| 78 | + * @var array | |
| 79 | + */ | |
| 80 | + protected $settingsStructure = array(); | |
| 81 | + | |
| 82 | + /** | |
| 83 | + * Extended actions for maintenance tasks | |
| 84 | + * | |
| 85 | + * @var array | |
| 86 | + */ | |
| 61 | 87 | public $extendedActions = array(); |
| 62 | 88 | |
| 89 | + /** | |
| 90 | + * Plugin paths cache | |
| 91 | + * | |
| 92 | + * @var array | |
| 93 | + */ | |
| 94 | + protected $plugins_paths = array(); | |
| 63 | 95 | |
| 64 | - public $plugins_paths = array(); | |
| 96 | + /** | |
| 97 | + * Settings API instance | |
| 98 | + * | |
| 99 | + * @var WC_Improved_Settings_API | |
| 100 | + */ | |
| 101 | + protected $WC_Improved_Settings_API; | |
| 65 | 102 | |
| 66 | - public $WC_Improved_Settings_API; | |
| 67 | - | |
| 103 | + // Configuration properties | |
| 68 | 104 | public $isMainMenu = false; |
| 69 | 105 | public $plugin_id; |
| 70 | 106 | public $menu_order = 20; |
| 71 | 107 | public $minimum_capability = 'manage_options'; |
| @@ -74,86 +110,19 @@ | ||
| 74 | 110 | public $parent_menu = ''; |
| 75 | 111 | public $post_type = false; |
| 76 | 112 | |
| 77 | 113 | |
| 78 | -/*Dashboard: 'index.php' | |
| 79 | -Posts: 'edit.php' | |
| 80 | -Media: 'upload.php' | |
| 81 | -Pages: 'edit.php?post_type=page' | |
| 82 | -Comments: 'edit-comments.php' | |
| 83 | -Custom Post Types: 'edit.php?post_type=your_post_type' | |
| 84 | -Appearance: 'themes.php' | |
| 85 | -Plugins: 'plugins.php' | |
| 86 | -Users: 'users.php' | |
| 87 | -Tools: 'tools.php' | |
| 88 | -Settings: 'options-general.php' | |
| 89 | -Network Settings: 'settings.php' | |
| 90 | -WooCommerce : 'woocommerce' | |
| 91 | -*/ | |
| 92 | - | |
| 93 | 114 | public function __construct() { |
| 94 | - // Register settings | |
| 95 | - | |
| 96 | 115 | add_action( 'admin_init', array( $this, 'loadSettings' ) ); |
| 97 | 116 | add_action( 'admin_init', array( $this, 'registerSettings' ) ); |
| 98 | 117 | |
| 99 | - $this->plugins_paths = apply_filters('zebench_plugins_paths', array() ); | |
| 118 | + $this->plugins_paths = apply_filters('wpdeepl_zebench_plugins_paths', array() ); | |
| 100 | 119 | |
| 101 | - // Add link to menu | |
| 120 | + add_action( 'admin_menu', array( $this, 'addToMenu' ), $this->menu_order ); | |
| 102 | 121 | |
| 103 | - global $wp_filter; | |
| 104 | - $real_order = $this->menu_order; | |
| 105 | - while( isset( $wp_filter['admin_menu']->callbacks[$real_order] ) ) { | |
| 106 | - $real_order++; | |
| 107 | - } | |
| 108 | - add_action( 'admin_menu', array( $this, 'addToMenu' ), $real_order ); | |
| 109 | - | |
| 110 | - // Pass configuration to Javascript | |
| 111 | - //add_action( 'admin_enqueue_scripts', array( $this, 'configuration_to_javascript' ), 999 ); | |
| 112 | - | |
| 113 | - // Enqueue templates to be rendered in footer | |
| 114 | - //add_action( 'admin_footer', array( $this, 'render_templates_in_footer' ) ); | |
| 115 | - | |
| 116 | - // Settings export call | |
| 117 | - if ( !empty( $_REQUEST['export_settings'] ) ) { | |
| 118 | - add_action( 'wp_loaded', array( $this, 'export' ) ); | |
| 119 | - } | |
| 120 | - | |
| 121 | - // Settings import call | |
| 122 | - if ( !empty( $_FILES[$this->option_page]['name']['import'] ) ) { | |
| 123 | - add_action( 'wp_loaded', array( $this, 'import' ) ); | |
| 124 | - } | |
| 125 | - | |
| 126 | - // Print settings import notice | |
| 127 | - if ( isset( $_REQUEST[$this->option_page .'_imported'] ) ) { | |
| 128 | - add_action( 'admin_notices', array( $this, 'print_import_notice' ) ); | |
| 129 | - } | |
| 130 | - | |
| 131 | - if ( !class_exists( 'WP_Improved_Settings\WC_Improved_Settings_API' )) { | |
| 122 | + if ( !class_exists( 'wpdeepl_WP_Improved_Settings\WC_Improved_Settings_API' )) { | |
| 132 | 123 | require_once( dirname( __FILE__ ) . '/wp-improved-settings-api.class.php' ); |
| 133 | 124 | } |
| 134 | - $this->WC_Improved_Settings_API = new WC_Improved_Settings_API( $this->getPluginID(), $this->getSettingsStructure() ); | |
| 135 | - | |
| 136 | - | |
| 137 | - $key_name = $this->plugin_id . '_options_save'; | |
| 138 | - if ( isset( $_REQUEST['save'] ) && isset( $_REQUEST[$key_name] ) && $_REQUEST[$key_name] ) { | |
| 139 | - $this->saveSettings(); | |
| 140 | -// echo " saving"; | |
| 141 | - if ( method_exists( $this, 'on_save' ) ) { | |
| 142 | -// echo "on save update"; | |
| 143 | - $this->on_save(); | |
| 144 | - } | |
| 145 | - | |
| 146 | - add_action( 'admin_notices', array( $this, 'print_saved_notice' ) ); | |
| 147 | - } | |
| 148 | - | |
| 149 | - add_action( 'admin_notices', array( $this, 'maybe_print_notices' ) ); | |
| 150 | - | |
| 151 | - // Migration notices | |
| 152 | - //add_action( 'admin_notices', array( $this, 'maybe_display_migration_notice' ), 1 ); | |
| 153 | - | |
| 154 | - // Delete migration notice | |
| 155 | - //$this->hide_migration_notice(); | |
| 156 | 125 | } |
| 157 | 126 | |
| 158 | 127 | function getPluginID() { |
| 159 | 128 | return $this->plugin_id; |
| @@ -166,17 +135,17 @@ | ||
| 166 | 135 | function getMinimumCapability() { |
| 167 | 136 | return $this->minimum_capability; |
| 168 | 137 | } |
| 169 | 138 | |
| 170 | - function saveSettings() { | |
| 171 | - $nonce = isset( $_REQUEST['_zenonce'] ) ? $_REQUEST['_zenonce'] : false; | |
| 172 | - if ( ! wp_verify_nonce( $nonce, 'zesave_settings' ) ) { | |
| 173 | - $error_msg = __( 'Unable to submit this form, please refresh and try again.' ); | |
| 174 | - return; | |
| 139 | + protected function saveSettings() { | |
| 140 | + // Vérification nonce (sera revérifiée dans l'API) | |
| 141 | + $nonce = isset( $_REQUEST['_wpdeepl_nonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpdeepl_nonce'] ) ) : false; | |
| 142 | + if ( ! wp_verify_nonce( $nonce, 'wpdeepl_save_settings' ) ) { | |
| 143 | + wp_die( esc_html__( 'Security check failed', 'wpdeepl' ) ); | |
| 175 | 144 | } |
| 176 | 145 | |
| 146 | + // L'API gère sa propre vérification nonce | |
| 177 | 147 | $this->WC_Improved_Settings_API->process_admin_options(); |
| 178 | - //$this->process_admin_options(); | |
| 179 | 148 | } |
| 180 | 149 | /* |
| 181 | 150 | function me() { |
| 182 | 151 | $this->loadSettings(); |
| @@ -188,16 +157,17 @@ | ||
| 188 | 157 | } |
| 189 | 158 | |
| 190 | 159 | function print_saved_notice() { |
| 191 | 160 | ?> |
| 192 | - <div id="message" class="updated notice is-dismissible"><p><strong><?php _e( 'Settings saved.' ); ?></strong></p></div> | |
| 161 | + <div id="message" class="updated notice is-dismissible"><p><strong><?php esc_html_e( 'Settings saved.', 'wpdeepl' ); ?></strong></p></div> | |
| 193 | 162 | <?php |
| 194 | 163 | } |
| 195 | 164 | |
| 196 | 165 | public function loadSettings() { |
| 166 | + $this->settingsStructure = $this->getSettingsStructure(); | |
| 167 | + $this->WC_Improved_Settings_API = new \wpdeepl_WP_Improved_Settings\WC_Improved_Settings_API( $this->getPluginID(), $this->settingsStructure ); | |
| 197 | 168 | // load settings into $this sttings ? |
| 198 | - $this->settingsStructure = $this->getSettingsStructure(); | |
| 199 | - //plouf( $this->settingsStructure ); die( 'oka6z4e4z64ze4' ); | |
| 169 | + //wpdeepl_debug_display( $this->settingsStructure ); die( 'oka6z4e4z64ze4' ); | |
| 200 | 170 | } |
| 201 | 171 | |
| 202 | 172 | /** |
| 203 | 173 | * Add Settings link to menu |
| @@ -223,27 +193,27 @@ | ||
| 223 | 193 | * @access public |
| 224 | 194 | * @return void |
| 225 | 195 | */ |
| 226 | 196 | public function settingsPage() { |
| 227 | - | |
| 228 | - | |
| 229 | 197 | // Get current tab |
| 230 | - $current_tab = ( isset( $_GET['tab'] ) ) ? htmlspecialchars( $_GET['tab'] ) : $this->defaultSettingsTab; | |
| 198 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- navigation tab, no data processing | |
| 199 | + $current_tab = ( isset( $_GET['tab'] ) ) ? sanitize_key( wp_unslash( $_GET['tab'] ) ) : $this->defaultSettingsTab; | |
| 231 | 200 | |
| 232 | -// plouf( $_POST ); | |
| 233 | - | |
| 234 | 201 | // Print header |
| 235 | 202 | $this->printHeader(); |
| 236 | 203 | |
| 237 | 204 | $this->printFields(); |
| 238 | 205 | |
| 206 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- extendedActions is not defined by user input. | |
| 239 | 207 | if ( count( $this->extendedActions ) ) foreach ( $this->extendedActions as $action => $function ) { |
| 208 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The action name is from the class definitions, not user input. | |
| 240 | 209 | if ( isset( $_REQUEST[$action] ) ) { |
| 241 | 210 | if ( function_exists( $function) ) { |
| 242 | 211 | $function(); |
| 243 | 212 | } |
| 244 | 213 | else { |
| 245 | - printf( __( 'Attention, fonction non définie %s' ), $function ); | |
| 214 | + /* translators: function does not exist */ | |
| 215 | + printf( esc_html__( 'Undefined function: %s', 'wpdeepl' ), esc_html( $function ) ); | |
| 246 | 216 | } |
| 247 | 217 | } |
| 248 | 218 | } |
| 249 | 219 | $this->printFooter(); |
| @@ -253,9 +223,27 @@ | ||
| 253 | 223 | // Check if current user can manage plugin settings |
| 254 | 224 | if ( !is_admin() ) { |
| 255 | 225 | return; |
| 256 | 226 | } |
| 227 | + | |
| 228 | + $key_value = false; | |
| 229 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- plugin_id is hardcoded. | |
| 230 | + if( isset( $_REQUEST[$this->plugin_id . '_options_save'] ) ) { | |
| 231 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- plugin_id is hardcoded. | |
| 232 | + $key_value = sanitize_text_field( wp_unslash( $_REQUEST[$this->plugin_id . '_options_save'] ) ); | |
| 233 | + } | |
| 234 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verified in saveSettings() | |
| 235 | + if ( isset( $_REQUEST['save'] ) && $key_value ) { | |
| 236 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verified in saveSettings() | |
| 237 | + $this->saveSettings(); | |
| 238 | + if ( method_exists( $this, 'on_save' ) ) { | |
| 239 | + $this->on_save(); | |
| 240 | + } | |
| 257 | 241 | |
| 242 | + add_action( 'admin_notices', array( $this, 'print_saved_notice' ) ); | |
| 243 | + } | |
| 244 | + add_action( 'admin_notices', array( $this, 'maybe_print_notices' ) ); | |
| 245 | + | |
| 258 | 246 | // Iterate over tabs |
| 259 | 247 | foreach ( $this->settingsStructure as $tab_key => $tab ) { |
| 260 | 248 | // Register tab |
| 261 | 249 | register_setting( |
| @@ -260,9 +248,12 @@ | ||
| 260 | 248 | // Register tab |
| 261 | 249 | register_setting( |
| 262 | 250 | $this->option_page .'_group_' . $tab_key, |
| 263 | 251 | $this->option_page, |
| 264 | - array( $this, 'validateSettings' ) | |
| 252 | + array( | |
| 253 | + 'type' => 'array', | |
| 254 | + 'sanitize_callback' => array( $this, 'sanitizeSettings' ), | |
| 255 | + ) | |
| 265 | 256 | ); |
| 266 | 257 | |
| 267 | 258 | // Iterate over sections |
| 268 | 259 | foreach ( $tab['sections'] as $section_key => $section ) { |
| @@ -295,15 +286,36 @@ | ||
| 295 | 286 | } |
| 296 | 287 | } |
| 297 | 288 | } |
| 298 | 289 | |
| 299 | - function validateSettings() { | |
| 300 | - return true; | |
| 290 | + /** | |
| 291 | + * Sanitize settings before saving | |
| 292 | + * | |
| 293 | + * @param mixed $input The input value to sanitize. | |
| 294 | + * @return mixed Sanitized value. | |
| 295 | + */ | |
| 296 | + public function sanitizeSettings( $input ) { | |
| 297 | + if ( ! is_array( $input ) ) { | |
| 298 | + return sanitize_text_field( $input ); | |
| 299 | + } | |
| 300 | + | |
| 301 | + $sanitized = array(); | |
| 302 | + foreach ( $input as $key => $value ) { | |
| 303 | + $sanitized_key = sanitize_key( $key ); | |
| 304 | + if ( is_array( $value ) ) { | |
| 305 | + $sanitized[ $sanitized_key ] = $this->sanitizeSettings( $value ); | |
| 306 | + } else { | |
| 307 | + $sanitized[ $sanitized_key ] = sanitize_text_field( $value ); | |
| 308 | + } | |
| 309 | + } | |
| 310 | + return $sanitized; | |
| 301 | 311 | } |
| 302 | 312 | |
| 303 | - function getActiveTab() { | |
| 313 | + protected function getActiveTab() { | |
| 314 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verified in saveSettings() | |
| 304 | 315 | if ( isset( $_GET[ 'tab' ] ) ) { |
| 305 | - $active_tab = htmlspecialchars( $_GET[ 'tab' ] ); | |
| 316 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- navigation tab, sanitized, no data processing | |
| 317 | + $active_tab = sanitize_key( wp_unslash( $_GET[ 'tab' ] ) ); | |
| 306 | 318 | } |
| 307 | 319 | elseif ( $this->defaultSettingsTab != '' ) { |
| 308 | 320 | $active_tab = $this->defaultSettingsTab; |
| 309 | 321 | } |
| @@ -331,9 +343,9 @@ | ||
| 331 | 343 | |
| 332 | 344 | $active_tab = $this->getActiveTab(); |
| 333 | 345 | |
| 334 | 346 | $parent_menu = $this->parent_menu; |
| 335 | - $parsed_url = parse_url( $parent_menu ); | |
| 347 | + $parsed_url = wp_parse_url( $parent_menu ); | |
| 336 | 348 | $extended_url = ''; |
| 337 | 349 | if ( isset( $parsed_url['query'] ) && strlen( $parsed_url['query'] ) ) { |
| 338 | 350 | $extended_url = '&' . $parsed_url['query']; |
| 339 | 351 | } |
| @@ -399,9 +411,10 @@ | ||
| 399 | 411 | } |
| 400 | 412 | $active_tab = $this->getActiveTab(); |
| 401 | 413 | $tab_data = $this->settingsStructure[$active_tab]; |
| 402 | 414 | |
| 403 | - //plouf($tab_data, " T AB DATA"); | |
| 415 | + | |
| 416 | + //wpdeepl_debug_display($tab_data, " T AB DATA"); | |
| 404 | 417 | |
| 405 | 418 | |
| 406 | 419 | foreach ( $tab_data['sections'] as $section_id => $section ) { |
| 407 | 420 | $defaults = array( |
| @@ -412,9 +425,9 @@ | ||
| 412 | 425 | 'html' => false, |
| 413 | 426 | ); |
| 414 | 427 | $section_data = wp_parse_args( $section, $defaults ); |
| 415 | 428 | |
| 416 | - //plouf( $section ); | |
| 429 | + //wpdeepl_debug_display( $section ); | |
| 417 | 430 | ?> |
| 418 | 431 | <h3 class="wc-settings-sub-title <?php echo esc_attr( $section_data['class'] ); ?>" id="<?php echo esc_attr( $section_id ); ?>"><?php echo wp_kses_post( $section_data['title'] ); ?></h3> |
| 419 | 432 | <?php if ( ! empty( $section_data['description'] ) ) : ?> |
| 420 | 433 | <p><?php echo wp_kses_post( $section_data['description'] ); ?></p> |
| @@ -432,9 +445,9 @@ | ||
| 432 | 445 | foreach ( $section_fields as $field ) { |
| 433 | 446 | $fields[] = $field; |
| 434 | 447 | } |
| 435 | 448 | |
| 436 | - //plouf($fields, "on a fields"); | |
| 449 | + //wpdeepl_debug_display($fields, "on a fields"); | |
| 437 | 450 | |
| 438 | 451 | $this->WC_Improved_Settings_API->generate_settings_html( $fields ); |
| 439 | 452 | ?> |
| 440 | 453 | </table> |
| @@ -439,10 +452,11 @@ | ||
| 439 | 452 | ?> |
| 440 | 453 | </table> |
| 441 | 454 | <?php |
| 442 | 455 | if ( isset( $section['html'] ) && $section['html'] ) { |
| 443 | - // not escaped | |
| 444 | - echo ( $section['html'] ); | |
| 456 | + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- HTML already escaped, we need to ouput raw HTML | |
| 457 | + //echo ( $section['html'] ); | |
| 458 | + echo wp_kses_post( $section['html'] ); | |
| 445 | 459 | } |
| 446 | 460 | ?> |
| 447 | 461 | |
| 448 | 462 | <?php if ( isset( $section['actions'] ) && $section['actions'] ) foreach ( $section['actions'] as $action ) { |
| @@ -455,10 +469,12 @@ | ||
| 455 | 469 | } |
| 456 | 470 | elseif ( function_exists( $action ) ) { |
| 457 | 471 | $action( $param ); |
| 458 | 472 | } |
| 473 | + | |
| 459 | 474 | else { |
| 460 | - printf( __( 'Attention, fonction non définie %s' ), $action ); | |
| 475 | + /* translators: name of the function not found */ | |
| 476 | + printf( esc_html__( 'Undefined function: %s', 'wpdeepl' ), esc_html( $action ) ); | |
| 461 | 477 | } |
| 462 | 478 | } |
| 463 | 479 | |
| 464 | 480 | ?> |
| @@ -466,15 +482,12 @@ | ||
| 466 | 482 | |
| 467 | 483 | <?php if ( count( $fields ) ) : ?> |
| 468 | 484 | |
| 469 | 485 | <p class="submit"> |
| 470 | - <?php wp_nonce_field('zesave_settings', '_zenonce' ); ?> | |
| 486 | + <?php wp_nonce_field('wpdeepl_save_settings', '_wpdeepl_nonce' ); ?> | |
| 471 | 487 | <?php if ( empty( $GLOBALS['hide_save_button'] ) ) : ?> |
| 472 | - <button name="save" class="button-primary" type="submit" value="<?php esc_attr_e( 'Update' ); ?>"><?php _e( 'Update' ); ?></button> | |
| 488 | + <button name="save" class="button-primary" type="submit" value="<?php esc_attr_e( 'Update', 'wpdeepl' ); ?>"><?php esc_html_e( 'Update', 'wpdeepl' ); ?></button> | |
| 473 | 489 | <?php endif; ?> |
| 474 | - <?php | |
| 475 | - // wp_nonce_field( 'woocommerce-settings' ); | |
| 476 | - ?> | |
| 477 | 490 | </p> |
| 478 | 491 | <?php endif; ?> |
| 479 | 492 | |
| 480 | 493 | <?php |
| @@ -491,18 +504,18 @@ | ||
| 491 | 504 | <p><?php echo wp_kses_post( $tab_data['description'] ); ?></p> |
| 492 | 505 | <?php endif; |
| 493 | 506 | } |
| 494 | 507 | |
| 495 | - function tabFooter( $tab_id, $tab_data ) { | |
| 508 | + protected function tabFooter( $tab_id, $tab_data ) { | |
| 496 | 509 | if ( isset( $tab_data['footer'] ) ) { |
| 497 | 510 | if ( isset( $tab_data['footer']['html'] ) ) foreach ( $tab_data['footer']['html'] as $raw_html ) { |
| 498 | - // not escaped | |
| 499 | - echo ( $raw_html ); | |
| 511 | + // HTML déjà échappé dans la configuration | |
| 512 | + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 513 | + echo $raw_html; | |
| 500 | 514 | } |
| 501 | 515 | if ( isset( $tab_data['footer']['actions'] ) ) { |
| 502 | 516 | echo '<hr />'; |
| 503 | 517 | foreach ( $tab_data['footer']['actions'] as $action ) { |
| 504 | - // echo " ACTION = $action"; | |
| 505 | 518 | $param = false; |
| 506 | 519 | |
| 507 | 520 | if ( is_array( $action ) ) { |
| 508 | 521 | list($object, $method) = $action; |
| @@ -513,11 +526,11 @@ | ||
| 513 | 526 | elseif ( function_exists( $action ) ) { |
| 514 | 527 | $action( $param ); |
| 515 | 528 | } |
| 516 | 529 | else { |
| 517 | - printf( __( 'Attention, fonction non définie %s' ), $action ); | |
| 530 | + /* translators: name of the function not found */ | |
| 531 | + printf( esc_html__( 'Undefined function: %s', 'wpdeepl' ), esc_html( $action ) ); | |
| 518 | 532 | } |
| 519 | - //plouf($action, "action"); | |
| 520 | 533 | } |
| 521 | 534 | } |
| 522 | 535 | } |
| 523 | 536 | } |
| @@ -539,9 +552,9 @@ | ||
| 539 | 552 | } |
| 540 | 553 | |
| 541 | 554 | |
| 542 | 555 | public function showServerInfo() { |
| 543 | - echo '<h2>' . __('Server information', '' ) . '</h2>'; | |
| 556 | + echo '<h2>' . esc_html__('Server information', 'wpdeepl' ) . '</h2>'; | |
| 544 | 557 | |
| 545 | 558 | if( function_exists('ini_get_all' ) ) { |
| 546 | 559 | |
| 547 | 560 | $ini_values = ini_get_all(); |
| @@ -562,9 +575,9 @@ | ||
| 562 | 575 | $timeout = round($timeout /1000,1); |
| 563 | 576 | } |
| 564 | 577 | |
| 565 | 578 | $informations = array( |
| 566 | - 'Server time' => date('d/m/Y H:i:s'), | |
| 579 | + 'Server time' => gmdate('d/m/Y H:i:s'), | |
| 567 | 580 | 'Real path' => get_home_path(), |
| 568 | 581 | 'PHP version' => phpversion(), |
| 569 | 582 | 'Timeout' => $timeout .' s', |
| 570 | 583 | 'Memory usage' => $memory_usage, |
| @@ -580,9 +593,9 @@ | ||
| 580 | 593 | } |
| 581 | 594 | } |
| 582 | 595 | |
| 583 | 596 | foreach ($informations as $label => $value) { |
| 584 | - printf( "<p><strong>%s</strong> %s</p>", $label, $value ); | |
| 597 | + printf( "<p><strong>%s</strong> %s</p>", esc_html( $label ), esc_html( $value ) ); | |
| 585 | 598 | } |
| 586 | 599 | |
| 587 | 600 | |
| 588 | 601 | } |
| @@ -593,20 +606,12 @@ | ||
| 593 | 606 | |
| 594 | 607 | if ( !is_admin() ) { |
| 595 | 608 | return false; |
| 596 | 609 | } |
| 597 | - /*$current_plugin_page = $_REQUEST['page']; | |
| 598 | - | |
| 599 | - plouf($this->plugin_paths); | |
| 600 | - if ( !isset( $this->plugin_paths[$current_plugin_page] ) ) { | |
| 601 | - echo "no path"; | |
| 602 | - return false; | |
| 603 | - } | |
| 604 | - $path = $this->plugin_paths[$current_plugin_page];*/ | |
| 605 | 610 | $path = $this->log_folder; |
| 606 | 611 | |
| 607 | 612 | $logs = glob( trailingslashit( $path ) . '*.log'); |
| 608 | - //plouf($logs, "LOGS"); | |
| 613 | + //wpdeepl_debug_display($logs, "LOGS"); | |
| 609 | 614 | if ($logs) foreach ($logs as $log_file) { |
| 610 | 615 | $file_name = basename( $log_file ); |
| 611 | 616 | $contents = file_get_contents( $log_file ); |
| 612 | 617 | if (preg_match('#(\d+)-(\d+)-(\w+)\.log#', $file_name, $match)) { |
| @@ -612,11 +617,12 @@ | ||
| 612 | 617 | if (preg_match('#(\d+)-(\d+)-(\w+)\.log#', $file_name, $match)) { |
| 613 | 618 | $date = $match[2] . '/' . $match[1]; |
| 614 | 619 | echo '<h3>'; |
| 615 | 620 | printf( |
| 616 | - __("Fichier '%s' pour %s" ), | |
| 617 | - $match[3], | |
| 618 | - $date | |
| 621 | + /* translators: 1. file name 2. month */ | |
| 622 | + esc_html__("File '%1\$s' for %2\$s", 'wpdeepl' ), | |
| 623 | + esc_html( $match[3] ), | |
| 624 | + esc_html( $date ) | |
| 619 | 625 | ); |
| 620 | 626 | echo '</h3>'; |
| 621 | 627 | $lines = explode( "\n", $contents); |
| 622 | 628 | foreach ( $lines as $line ) { |
| @@ -625,12 +631,12 @@ | ||
| 625 | 631 | $line = preg_replace( '#"body":"<!DOCTYPE.*?","headers#ism', '"body":"PROBLEME COTE INSURED (disponible dans les logs complets)", "headers', $line); |
| 626 | 632 | if ( stripos( $line, '<!DOCTYPE html>' ) ) { |
| 627 | 633 | continue; |
| 628 | 634 | } |
| 629 | - // not escaped | |
| 630 | - echo "<br /><br />" . ( $line ) . "\n"; | |
| 635 | + // Contenu log potentiellement dangereux - échapper | |
| 636 | + echo "<br /><br />" . esc_html( $line ) . "\n"; | |
| 631 | 637 | } |
| 632 | - //plouf($contents); | |
| 638 | + //wpdeepl_debug_display($contents); | |
| 633 | 639 | |
| 634 | 640 | } |
| 635 | 641 | } |
| 636 | 642 | |
| @@ -635,5 +641,5 @@ | ||
| 635 | 641 | } |
| 636 | 642 | |
| 637 | 643 | } |
| 638 | 644 | } |
| 639 | -} | |
| 645 | +} | |
