| @@ -24,9 +24,9 @@ | ||
| 24 | 24 | } |
| 25 | 25 | } |
| 26 | 26 | |
| 27 | 27 | function removeAdminNotices() { |
| 28 | - if (array_key_exists('page', $_REQUEST) && $_REQUEST['page'] == $this->bvinfo->plugname) { | |
| 28 | + if (array_key_exists('page', $_REQUEST) && $_REQUEST['page'] == $this->bvinfo->plugname) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 29 | 29 | remove_all_actions('admin_notices'); |
| 30 | 30 | remove_all_actions('all_admin_notices'); |
| 31 | 31 | } |
| 32 | 32 | } |
| @@ -33,32 +33,37 @@ | ||
| 33 | 33 | |
| 34 | 34 | public function initHandler() { |
| 35 | 35 | if (!current_user_can('activate_plugins')) |
| 36 | 36 | return; |
| 37 | + $bvnonce = isset($_REQUEST['bvnonce']) ? sanitize_text_field(wp_unslash($_REQUEST['bvnonce'])) : ''; | |
| 38 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- using custom sanitization | |
| 39 | + $blogvaultkey = isset($_REQUEST['blogvaultkey']) ? WPRAccount::sanitizeKey(wp_unslash($_REQUEST['blogvaultkey'])) : ''; | |
| 40 | + $page = isset($_REQUEST['page']) ? sanitize_text_field(wp_unslash($_REQUEST['page'])) : ''; | |
| 37 | 41 | |
| 38 | - if (array_key_exists('bvnonce', $_REQUEST) && | |
| 39 | - wp_verify_nonce($_REQUEST['bvnonce'], "bvnonce") && | |
| 40 | - array_key_exists('blogvaultkey', $_REQUEST) && | |
| 41 | - (strlen(WPRAccount::sanitizeKey($_REQUEST['blogvaultkey'])) == 64) && | |
| 42 | - (array_key_exists('page', $_REQUEST) && | |
| 43 | - $_REQUEST['page'] == $this->bvinfo->plugname)) { | |
| 44 | - $keys = str_split($_REQUEST['blogvaultkey'], 32); | |
| 42 | + if ($bvnonce && wp_verify_nonce($bvnonce, "bvnonce") && | |
| 43 | + $blogvaultkey && strlen($blogvaultkey) == 64 && | |
| 44 | + ($page && $page === $this->bvinfo->plugname)) { | |
| 45 | + $keys = str_split($blogvaultkey, 32); | |
| 45 | 46 | WPRAccount::addAccount($this->settings, $keys[0], $keys[1]); |
| 47 | + | |
| 46 | 48 | if (array_key_exists('redirect', $_REQUEST)) { |
| 47 | - $location = $_REQUEST['redirect']; | |
| 49 | + $location = esc_url_raw(wp_unslash($_REQUEST['redirect'])); | |
| 48 | 50 | wp_redirect($this->bvinfo->appUrl()."/dash/redir?q=".urlencode($location)); |
| 49 | 51 | exit(); |
| 50 | 52 | } |
| 51 | 53 | } |
| 54 | + | |
| 52 | 55 | if ($this->bvinfo->isActivateRedirectSet()) { |
| 53 | 56 | $this->settings->updateOption($this->bvinfo->plug_redirect, 'no'); |
| 54 | 57 | ##ACTIVATEREDIRECTCODE## |
| 55 | - wp_redirect($this->mainUrl()); | |
| 58 | + if (!wp_doing_ajax()) { | |
| 59 | + wp_redirect($this->mainUrl()); | |
| 60 | + } | |
| 56 | 61 | } |
| 57 | 62 | } |
| 58 | 63 | |
| 59 | 64 | public function wprsecAdminMenu($hook) { |
| 60 | - if ($hook === 'toplevel_page_wpremote' || preg_match("/wpr_add_account$/", $hook) || preg_match("/wpr_account_details$/", $hook)) { | |
| 65 | + if ($hook === 'toplevel_page_wpremote' || WPRHelper::safePregMatch("/wpr_add_account$/", $hook) || WPRHelper::safePregMatch("/wpr_account_details$/", $hook)) { | |
| 61 | 66 | wp_enqueue_style( 'bootstrap', plugins_url('css/bootstrap.min.css', __FILE__)); |
| 62 | 67 | wp_enqueue_style( 'bvplugin', plugins_url('css/bvplugin.min.css', __FILE__)); |
| 63 | 68 | } |
| 64 | 69 | } |
| @@ -63,10 +68,10 @@ | ||
| 63 | 68 | } |
| 64 | 69 | } |
| 65 | 70 | |
| 66 | 71 | public function menu() { |
| 67 | - $brand = $this->bvinfo->getBrandInfo(); | |
| 68 | - if (!is_array($brand) || (!array_key_exists('hide', $brand) && !array_key_exists('hide_from_menu', $brand))) { | |
| 72 | + $brand = $this->bvinfo->getPluginWhitelabelInfo(); | |
| 73 | + if (!array_key_exists('hide', $brand) && !array_key_exists('hide_from_menu', $brand)) { | |
| 69 | 74 | $bname = $this->bvinfo->getBrandName(); |
| 70 | 75 | $icon = $this->bvinfo->getBrandIcon(); |
| 71 | 76 | add_menu_page($bname, $bname, 'manage_options', $this->bvinfo->plugname, |
| 72 | 77 | array($this, 'adminPage'), plugins_url($icon, __FILE__ )); |
| @@ -73,13 +78,17 @@ | ||
| 73 | 78 | } |
| 74 | 79 | } |
| 75 | 80 | |
| 76 | 81 | public function hidePluginUpdate($plugins) { |
| 77 | - $brand = $this->bvinfo->getBrandInfo(); | |
| 78 | - $bvslug = $this->bvinfo->slug; | |
| 79 | - if (isset($plugins->response[$bvslug]) && is_array($brand)) { | |
| 80 | - if (array_key_exists('hide_from_menu', $brand) || array_key_exists('hide', $brand)) { | |
| 81 | - unset($plugins->response[$bvslug]); | |
| 82 | + if (!$this->bvinfo->canWhiteLabel()) { | |
| 83 | + return $plugins; | |
| 84 | + } | |
| 85 | + $whitelabel_infos = $this->bvinfo->getPluginsWhitelabelInfos(); | |
| 86 | + foreach ($whitelabel_infos as $slug => $brand) { | |
| 87 | + if ($this->bvinfo->canWhiteLabel($slug) && isset($plugins->response[$slug]) && is_array($brand)) { | |
| 88 | + if (array_key_exists('hide_from_menu', $brand) || array_key_exists('hide', $brand)) { | |
| 89 | + unset($plugins->response[$slug]); | |
| 90 | + } | |
| 82 | 91 | } |
| 83 | 92 | } |
| 84 | 93 | return $plugins; |
| 85 | 94 | } |
| @@ -84,12 +93,13 @@ | ||
| 84 | 93 | return $plugins; |
| 85 | 94 | } |
| 86 | 95 | |
| 87 | 96 | public function hidePluginDetails($plugin_metas, $slug) { |
| 88 | - $brand = $this->bvinfo->getBrandInfo(); | |
| 89 | - $bvslug = $this->bvinfo->slug; | |
| 90 | - | |
| 91 | - if ($slug === $bvslug && is_array($brand) && array_key_exists('hide_plugin_details', $brand)){ | |
| 97 | + if (!is_array($plugin_metas) || !$this->bvinfo->canWhiteLabel($slug)) { | |
| 98 | + return $plugin_metas; | |
| 99 | + } | |
| 100 | + $whitelabel_info = $this->bvinfo->getPluginWhitelabelInfo($slug); | |
| 101 | + if (array_key_exists('hide_plugin_details', $whitelabel_info)) { | |
| 92 | 102 | foreach ($plugin_metas as $pluginKey => $pluginValue) { |
| 93 | 103 | if (strpos($pluginValue, sprintf('>%s<', translate('View details')))) { |
| 94 | 104 | unset($plugin_metas[$pluginKey]); |
| 95 | 105 | break; |
| @@ -99,31 +109,33 @@ | ||
| 99 | 109 | return $plugin_metas; |
| 100 | 110 | } |
| 101 | 111 | |
| 102 | 112 | public function handlePluginHealthInfo($plugins) { |
| 103 | - $brand = $this->bvinfo->getBrandInfo(); | |
| 104 | - $title = $this->bvinfo->title; | |
| 105 | 113 | if (!isset($plugins["wp-plugins-active"]) || |
| 106 | - !isset($plugins["wp-plugins-active"]["fields"]) || | |
| 107 | - !isset($plugins["wp-plugins-active"]["fields"][$title])) { | |
| 114 | + !isset($plugins["wp-plugins-active"]["fields"]) || !$this->bvinfo->canWhiteLabel()) { | |
| 108 | 115 | return $plugins; |
| 109 | 116 | } |
| 110 | - if (is_array($brand)) { | |
| 111 | - if (array_key_exists('hide', $brand)) { | |
| 112 | - unset($plugins["wp-plugins-active"]["fields"][$title]); | |
| 113 | - } else { | |
| 114 | - $plugin = $plugins["wp-plugins-active"]["fields"][$title]; | |
| 115 | - $author = $this->bvinfo->author; | |
| 116 | - if (array_key_exists('name', $brand)) { | |
| 117 | - $plugin["label"] = $brand['name']; | |
| 117 | + | |
| 118 | + $whitelabel_infos_by_title = $this->bvinfo->getPluginsWhitelabelInfoByTitle(); | |
| 119 | + | |
| 120 | + foreach ($whitelabel_infos_by_title as $title => $brand) { | |
| 121 | + if (is_array($brand) && array_key_exists('slug', $brand) && $this->bvinfo->canWhiteLabel($brand["slug"])) { | |
| 122 | + if (array_key_exists('hide', $brand)) { | |
| 123 | + unset($plugins["wp-plugins-active"]["fields"][$title]); | |
| 124 | + } else { | |
| 125 | + $plugin = $plugins["wp-plugins-active"]["fields"][$title]; | |
| 126 | + $author = $brand['default_author']; | |
| 127 | + if (array_key_exists('name', $brand)) { | |
| 128 | + $plugin["label"] = $brand['name']; | |
| 129 | + } | |
| 130 | + if (array_key_exists('author', $brand)) { | |
| 131 | + $plugin["value"] = str_replace($author, $brand['author'], $plugin["value"]); | |
| 132 | + } | |
| 133 | + if (array_key_exists('description', $brand)) { | |
| 134 | + $plugin["debug"] = str_replace($author, $brand['author'], $plugin["debug"]); | |
| 135 | + } | |
| 136 | + $plugins["wp-plugins-active"]["fields"][$title] = $plugin; | |
| 118 | 137 | } |
| 119 | - if (array_key_exists('author', $brand)) { | |
| 120 | - $plugin["value"] = str_replace($author, $brand['author'], $plugin["value"]); | |
| 121 | - } | |
| 122 | - if (array_key_exists('description', $brand)) { | |
| 123 | - $plugin["debug"] = str_replace($author, $brand['author'], $plugin["debug"]); | |
| 124 | - } | |
| 125 | - $plugins["wp-plugins-active"]["fields"][$title] = $plugin; | |
| 126 | 138 | } |
| 127 | 139 | } |
| 128 | 140 | return $plugins; |
| 129 | 141 | } |
| @@ -129,11 +141,11 @@ | ||
| 129 | 141 | } |
| 130 | 142 | |
| 131 | 143 | public function settingsLink($links, $file) { |
| 132 | 144 | #XNOTE: Fix this |
| 133 | - if ( $file == plugin_basename( dirname(__FILE__).'/blogvault.php' ) ) { | |
| 134 | - $brand = $this->bvinfo->getBrandInfo(); | |
| 135 | - if (!$brand || !array_key_exists('hide_plugin_details', $brand)) { | |
| 145 | + if ( $file == plugin_basename( dirname(__FILE__).'/plugin.php' ) ) { | |
| 146 | + $brand = $this->bvinfo->getPluginWhitelabelInfo(); | |
| 147 | + if (!array_key_exists('hide_plugin_details', $brand)) { | |
| 136 | 148 | $links[] = '<a href="'.$this->mainUrl().'">'.__( 'Settings' ).'</a>'; |
| 137 | 149 | } |
| 138 | 150 | } |
| 139 | 151 | return $links; |
| @@ -139,10 +151,10 @@ | ||
| 139 | 151 | return $links; |
| 140 | 152 | } |
| 141 | 153 | |
| 142 | 154 | public function getPluginLogo() { |
| 143 | - $brand = $this->bvinfo->getBrandInfo(); | |
| 144 | - if (is_array($brand) && array_key_exists('logo', $brand)) { | |
| 155 | + $brand = $this->bvinfo->getPluginWhitelabelInfo(); | |
| 156 | + if (array_key_exists('logo', $brand)) { | |
| 145 | 157 | return $brand['logo']; |
| 146 | 158 | } |
| 147 | 159 | return $this->bvinfo->logo; |
| 148 | 160 | } |
| @@ -147,10 +159,10 @@ | ||
| 147 | 159 | return $this->bvinfo->logo; |
| 148 | 160 | } |
| 149 | 161 | |
| 150 | 162 | public function getWebPage() { |
| 151 | - $brand = $this->bvinfo->getBrandInfo(); | |
| 152 | - if (is_array($brand) && array_key_exists('webpage', $brand)) { | |
| 163 | + $brand = $this->bvinfo->getPluginWhitelabelInfo(); | |
| 164 | + if (array_key_exists('webpage', $brand)) { | |
| 153 | 165 | return $brand['webpage']; |
| 154 | 166 | } |
| 155 | 167 | return $this->bvinfo->webpage; |
| 156 | 168 | } |
| @@ -159,8 +171,9 @@ | ||
| 159 | 171 | require_once dirname( __FILE__ ) . '/recover.php'; |
| 160 | 172 | $bvnonce = wp_create_nonce("bvnonce"); |
| 161 | 173 | $public = WPRAccount::getApiPublicKey($this->settings); |
| 162 | 174 | $secret = WPRRecover::defaultSecret($this->settings); |
| 175 | + $server_ip = isset($_SERVER["SERVER_ADDR"]) ? sanitize_text_field(wp_unslash($_SERVER["SERVER_ADDR"])) : null; | |
| 163 | 176 | $tags = "<input type='hidden' name='url' value='".esc_attr($this->siteinfo->wpurl())."'/>\n". |
| 164 | 177 | "<input type='hidden' name='homeurl' value='".esc_attr($this->siteinfo->homeurl())."'/>\n". |
| 165 | 178 | "<input type='hidden' name='siteurl' value='".esc_attr($this->siteinfo->siteurl())."'/>\n". |
| 166 | 179 | "<input type='hidden' name='dbsig' value='".esc_attr($this->siteinfo->dbsig(false))."'/>\n". |
| @@ -166,9 +179,9 @@ | ||
| 166 | 179 | "<input type='hidden' name='dbsig' value='".esc_attr($this->siteinfo->dbsig(false))."'/>\n". |
| 167 | 180 | "<input type='hidden' name='plug' value='".esc_attr($this->bvinfo->plugname)."'/>\n". |
| 168 | 181 | "<input type='hidden' name='adminurl' value='".esc_attr($this->mainUrl())."'/>\n". |
| 169 | 182 | "<input type='hidden' name='bvversion' value='".esc_attr($this->bvinfo->version)."'/>\n". |
| 170 | - "<input type='hidden' name='serverip' value='".esc_attr($_SERVER["SERVER_ADDR"])."'/>\n". | |
| 183 | + "<input type='hidden' name='serverip' value='".esc_attr($server_ip)."'/>\n". | |
| 171 | 184 | "<input type='hidden' name='abspath' value='".esc_attr(ABSPATH)."'/>\n". |
| 172 | 185 | "<input type='hidden' name='secret' value='".esc_attr($secret)."'/>\n". |
| 173 | 186 | "<input type='hidden' name='public' value='".esc_attr($public)."'/>\n". |
| 174 | 187 | "<input type='hidden' name='bvnonce' value='".esc_attr($bvnonce)."'/>\n"; |
| @@ -195,13 +208,17 @@ | ||
| 195 | 208 | require_once dirname( __FILE__ ) . "/admin/account_details.php"; |
| 196 | 209 | } |
| 197 | 210 | |
| 198 | 211 | public function adminPage() { |
| 199 | - if (isset($_REQUEST['bvnonce']) && wp_verify_nonce( $_REQUEST['bvnonce'], 'bvnonce' )) { | |
| 212 | + $bvnonce = isset($_REQUEST['bvnonce']) ? sanitize_text_field(wp_unslash($_REQUEST['bvnonce'])) : ''; | |
| 213 | + if ($bvnonce && wp_verify_nonce($bvnonce, 'bvnonce')) { | |
| 200 | 214 | $info = array(); |
| 201 | 215 | $this->siteinfo->basic($info); |
| 202 | - $this->bvapi->pingbv('/bvapi/disconnect', $info, $_REQUEST['pubkey']); | |
| 203 | - WPRAccount::remove($this->settings, $_REQUEST['pubkey']); | |
| 216 | + if (!empty($_REQUEST['pubkey'])) { | |
| 217 | + $pubkey = WPRAccount::sanitizeKey(wp_unslash($_REQUEST['pubkey'])); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 218 | + $this->bvapi->pingbv('/bvapi/disconnect', $info, $pubkey); | |
| 219 | + WPRAccount::remove($this->settings, $pubkey); | |
| 220 | + } | |
| 204 | 221 | } |
| 205 | 222 | if (WPRAccount::isConfigured($this->settings)) { |
| 206 | 223 | if (!isset($_REQUEST['add_account'])) { |
| 207 | 224 | $this->showAccountDetailsPage(); |
| @@ -212,17 +229,17 @@ | ||
| 212 | 229 | $this->showAddAccountPage(); |
| 213 | 230 | } |
| 214 | 231 | } |
| 215 | 232 | |
| 216 | - public function initBranding($plugins) { | |
| 217 | - $slug = $this->bvinfo->slug; | |
| 218 | - | |
| 219 | - if (!is_array($plugins) || !isset($slug, $plugins)) { | |
| 233 | + public function initWhitelabel($plugins) { | |
| 234 | + if (!is_array($plugins) || !$this->bvinfo->canWhiteLabel()) { | |
| 220 | 235 | return $plugins; |
| 221 | 236 | } |
| 222 | - | |
| 223 | - $brand = $this->bvinfo->getBrandInfo(); | |
| 224 | - if (is_array($brand)) { | |
| 237 | + $whitelabel_infos = $this->bvinfo->getPluginsWhitelabelInfos(); | |
| 238 | + foreach ($whitelabel_infos as $slug => $brand) { | |
| 239 | + if (!isset($slug) || !$this->bvinfo->canWhiteLabel($slug) || !array_key_exists($slug, $plugins) || !is_array($brand)) { | |
| 240 | + continue; | |
| 241 | + } | |
| 225 | 242 | if (array_key_exists('hide', $brand)) { |
| 226 | 243 | unset($plugins[$slug]); |
| 227 | 244 | } else { |
| 228 | 245 | if (array_key_exists('name', $brand)) { |
