Skip to content
This repository was archived by the owner on Dec 20, 2024. It is now read-only.

Commit 3b50ee5

Browse files
author
Alexandre Germain
committed
Prepare security improvements with wp_filesystem API
1 parent b5adc18 commit 3b50ee5

20 files changed

+58
-43
lines changed

‎class/class-admin.php

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,9 @@
1717
use \ithoughts\v5_0\Toolbox as TB;
1818

1919
if ( ! defined( 'ABSPATH' ) ) {
20-
exit; // Exit if accessed directly.
20+
// Exit if accessed directly.
21+
status_header( 403 );
22+
wp_die( 'Forbidden' );
2123
}
2224

2325

@@ -83,15 +85,15 @@ public function set_version() {
8385
if ( $backbone->get_option( 'version' ) === -1 ) {
8486
$backbone->set_option( 'version',$this->current_version );
8587
} elseif ( $this->is_under_versionned() ) {
86-
$backbone->log( \ithoughts\v5_0\LogLevel::Warn, "Plugin settings are under versionned. Installed version is {$plugindata['Version']}, and config is {$backbone->get_option( 'version' )}" );
88+
$backbone->log( \ithoughts\v5_0\LogLevel::WARN, "Plugin settings are under versionned. Installed version is {$plugindata['Version']}, and config is {$backbone->get_option( 'version' )}" );
8789
// Create the updater.
8890
require_once( $backbone->get_base_class_path() . '/class-updater.php' );
8991
$this->updater = new Updater( $backbone->get_option( 'version' ), $this->current_version, $this );
9092

9193
// Do we need to apply a particular update process?
9294
if ( $this->updater->requires_update() ) {
9395
// If an update is required, apply it.
94-
$backbone->log( \ithoughts\v5_0\LogLevel::Info, "An update process is available to step to {$plugindata['Version']}." );
96+
$backbone->log( \ithoughts\v5_0\LogLevel::INFO, "An update process is available to step to {$plugindata['Version']}." );
9597
// Show the update message.
9698
$this->updater->add_admin_notice();
9799
} else {
@@ -831,7 +833,7 @@ public function get_tinymce_tooltip_form_ajax() {
831833
case 'tooltip':{
832834
$data['tooltip_content'] = inner_attr(
833835
isset( $data['tooltip_content'] ) ? $data['tooltip_content'] : ''
834-
, false);
836+
, false);
835837
} break;
836838

837839
case 'mediatip':{
@@ -1365,7 +1367,8 @@ public function get_tinymce_list_form_ajax() {
13651367
*/
13661368
public function theme_editor() {
13671369
if ( ! current_user_can( 'edit_theme_options' ) ) {
1368-
// TODO Throw 403.
1370+
status_header( 403 );
1371+
wp_die( 'Forbidden' );
13691372
}
13701373
$backbone = \ithoughts\tooltip_glossary\Backbone::get_instance();
13711374
$action = 'load';
@@ -1397,7 +1400,7 @@ public function theme_editor() {
13971400
?><div class="notice notice-error"><p><?php
13981401
esc_html_e( 'Error while generating the theme editor: ', 'ithoughts-tooltip-glossary' );
13991402
echo esc_html( $themedata['error'] );
1400-
echo esc_html( $ret['error'] ); ?></p></div><?php
1403+
echo esc_html( $ret['error'] ); ?></p></div><?php
14011404
}
14021405

14031406
/* Add required scripts for WordPress Spoilers (AKA PostBox) */
@@ -1464,8 +1467,8 @@ public function theme_editor() {
14641467
),
14651468
)
14661469
),
1467-
);
1468-
require $backbone->get_base_path() . '/templates/dist/customizing_form.php';
1470+
);
1471+
require $backbone->get_base_path() . '/templates/dist/customizing_form.php';
14691472
}
14701473

14711474
/**
@@ -1508,6 +1511,19 @@ private function loadtheme( $themename = null ) {
15081511
);
15091512
}
15101513

1514+
1515+
/*$url = wp_nonce_url("itg-load-theme?theme_name=$themename",'itg-load-theme');
1516+
if (false === ($creds = request_filesystem_credentials($url, '', false, false, null) ) ) {
1517+
return; // stop processing here.
1518+
} else {
1519+
if ( ! \WP_Filesystem($creds) ) {
1520+
request_filesystem_credentials($url, '', true, false, null);
1521+
return;
1522+
}
1523+
}*/
1524+
1525+
1526+
15111527
$content = file_get_contents( $theme_infos['absdir'] . '/' . $file );
15121528

15131529
$match_head_regex = "/^\\.qtip-$reformated_theme_name\\s*{[\\n\\s]*/";
@@ -1634,7 +1650,7 @@ private function less_auto_indent( $content ) {
16341650
if ( strlen( $line ) > 0 ) {
16351651
$indented .= str_repeat( $indent, $indent_level ) . $line . PHP_EOL;
16361652
} else { $indented .= PHP_EOL;
1637-
}
1653+
}
16381654
$indent_level += preg_match( '/\{(\s*(\\/\\*.*\\*\\/)*)*$/',$line );
16391655
}
16401656
return preg_replace( "/[\n\r\s]*$/",'',$indented );

‎class/class-autolink.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
namespace ithoughts\tooltip_glossary;
1414

1515
if ( ! defined( 'ABSPATH' ) ) {
16-
exit; // Exit if accessed directly
16+
status_header( 403 );wp_die("Forbidden");// Exit if accessed directly
1717
}
1818

1919
if ( ! class_exists( __NAMESPACE__ . '\\AutoLink' ) ) {

‎class/class-backbone.php

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
use \ithoughts\v5_0\LogLevel as LogLevel;
1818

1919
if ( ! defined( 'ABSPATH' ) ) {
20-
exit; // Exit if accessed directly
20+
status_header( 403 );wp_die("Forbidden");// Exit if accessed directly
2121
}
2222

2323

@@ -149,15 +149,15 @@ function __construct( $plugin_base ) {
149149
),
150150
),
151151
'verbosity' => array(
152-
'default' => LogLevel::Error,
152+
'default' => LogLevel::ERROR,
153153
'serversideOverride' => false,// If required once, required everywhere
154154
'cliensideOverride' => false,// Not a js data
155155
'accepted' => array(
156-
LogLevel::Silent,
157-
LogLevel::Error,
158-
LogLevel::Warn,
159-
LogLevel::Info,
160-
LogLevel::Silly,
156+
LogLevel::SILENT,
157+
LogLevel::ERROR,
158+
LogLevel::WARN,
159+
LogLevel::INFO,
160+
LogLevel::SILLY,
161161
),
162162
),
163163
'anim_in' => array(
@@ -233,7 +233,7 @@ function __construct( $plugin_base ) {
233233
if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
234234
$tail = ' in DEBUG mode';
235235
}
236-
$this->log( LogLevel::Silly, "Loaded plugin iThoughts Tooltip Glossary v{$this->get_option('version')}$tail." );
236+
$this->log( LogLevel::SILLY, "Loaded plugin iThoughts Tooltip Glossary v{$this->get_option('version')}$tail." );
237237

238238
$this->register_post_types();
239239
$this->register_taxonmies();

‎class/class-filters.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
namespace ithoughts\tooltip_glossary;
2121

2222
if ( ! defined( 'ABSPATH' ) ) {
23-
exit; // Exit if accessed directly
23+
status_header( 403 );wp_die("Forbidden");// Exit if accessed directly
2424
}
2525

2626
if ( ! class_exists( __NAMESPACE__ . '\\Filters' ) ) {

‎class/class-micropost.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
namespace ithoughts\tooltip_glossary;
1414

1515
if ( ! defined( 'ABSPATH' ) ) {
16-
exit; // Exit if accessed directly
16+
status_header( 403 );wp_die("Forbidden");// Exit if accessed directly
1717
}
1818
if ( ! class_exists( __NAMESPACE__ . '\\MicroPost' ) ) {
1919
$backbone = Backbone::get_instance();

‎class/class-posttypes.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
namespace ithoughts\tooltip_glossary;
1414

1515
if ( ! defined( 'ABSPATH' ) ) {
16-
exit; // Exit if accessed directly
16+
status_header( 403 );wp_die("Forbidden");// Exit if accessed directly
1717
}
1818

1919
if ( ! class_exists( __NAMESPACE__ . '\\PostTypes' ) ) {

‎class/class-randomterm.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
namespace ithoughts\tooltip_glossary\widgets;
1414

1515
if ( ! defined( 'ABSPATH' ) ) {
16-
exit; // Exit if accessed directly
16+
status_header( 403 );wp_die("Forbidden");// Exit if accessed directly
1717
}
1818

1919

‎class/class-taxonomies.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
namespace ithoughts\tooltip_glossary;
1414

1515
if ( ! defined( 'ABSPATH' ) ) {
16-
exit; // Exit if accessed directly
16+
status_header( 403 );wp_die("Forbidden");// Exit if accessed directly
1717
}
1818

1919
if ( ! class_exists( __NAMESPACE__ . '\\Taxonomies' ) ) {

‎class/class-updater.php

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
namespace ithoughts\tooltip_glossary;
1414

1515
if ( ! defined( 'ABSPATH' ) ) {
16-
exit; // Exit if accessed directly
16+
status_header( 403 );wp_die("Forbidden");// Exit if accessed directly
1717
}
1818

1919

@@ -152,7 +152,7 @@ public function updater() {
152152

153153
if ( $this->parentC->is_under_versionned() ) {
154154
$backbone = \ithoughts\tooltip_glossary\Backbone::get_instance();
155-
$backbone->log( \ithoughts\v5_0\LogLevel::Info, "Access to the update page (version from $this->from to $this->to) received, prepare update." );
155+
$backbone->log( \ithoughts\v5_0\LogLevel::INFO, "Access to the update page (version from $this->from to $this->to) received, prepare update." );
156156
$updater_script = $backbone->get_resource( 'ithoughts_tooltip_glossary-updater' );
157157
if ( isset( $updater_script ) ) {
158158
$updater_script->set_localize_data('iThoughtsTooltipGlossaryUpdater', array(
@@ -184,7 +184,7 @@ public function updater() {
184184
</div>
185185
<?php
186186
} else {
187-
\ithoughts\tooltip_glossary\Backbone::get_instance()->log( \ithoughts\v5_0\LogLevel::Error, "Access to the update page (version from $this->from to $this->to) received, but nothing to do." );
187+
\ithoughts\tooltip_glossary\Backbone::get_instance()->log( \ithoughts\v5_0\LogLevel::ERROR, "Access to the update page (version from $this->from to $this->to) received, but nothing to do." );
188188
?>
189189
<div class="wrap">
190190
<div id="ithoughts-tooltip-glossary-options" class="meta-box meta-box-50 metabox-holder">
@@ -462,7 +462,7 @@ function applyUpdates() {
462462
break;
463463

464464
case 2:{
465-
\ithoughts\tooltip_glossary\Backbone::get_instance()->log( \ithoughts\v5_0\LogLevel::Silly, "Doing update to $this->to" );
465+
\ithoughts\tooltip_glossary\Backbone::get_instance()->log( \ithoughts\v5_0\LogLevel::SILLY, "Doing update to $this->to" );
466466
$verbose = array();
467467
$maxCount = 20;
468468
$postTypes = get_post_types( '', 'names' );
@@ -546,14 +546,14 @@ function applyUpdates() {
546546

547547
if ( $post->post_content != $postUpdateArray ['post_content'] ) {
548548
clean_post_cache( $post->ID );
549-
\ithoughts\tooltip_glossary\Backbone::get_instance()->log( \ithoughts\v5_0\LogLevel::Info, "Updated post $post->ID: \"$post->post_title\":", $counters );
549+
\ithoughts\tooltip_glossary\Backbone::get_instance()->log( \ithoughts\v5_0\LogLevel::INFO, "Updated post $post->ID: \"$post->post_title\":", $counters );
550550
$verbose[] = array(
551551
'type' => 'info',
552552
'text' => "In $post->post_title ($post->ID), replaced {$counters['tooltip']} tooltips, {$counters['glossary']} glossaries, and {$counters['mediatip']} mediatips.",
553553
);
554554
wp_update_post( $postUpdateArray );
555555
} else {
556-
\ithoughts\tooltip_glossary\Backbone::get_instance()->log( \ithoughts\v5_0\LogLevel::Silly, "Post $post->ID: \"$post->post_title\" was not modified" );
556+
\ithoughts\tooltip_glossary\Backbone::get_instance()->log( \ithoughts\v5_0\LogLevel::SILLY, "Post $post->ID: \"$post->post_title\" was not modified" );
557557
}
558558
wp_cache_delete( $post->ID, 'posts' );
559559
wp_cache_delete( $post->ID, 'post_meta' );
@@ -582,7 +582,7 @@ function applyUpdates() {
582582
} break;
583583
}// End switch().
584584

585-
\ithoughts\tooltip_glossary\Backbone::get_instance()->log( \ithoughts\v5_0\LogLevel::Info, 'Ended update step with data: ', $data );
585+
\ithoughts\tooltip_glossary\Backbone::get_instance()->log( \ithoughts\v5_0\LogLevel::INFO, 'Ended update step with data: ', $data );
586586

587587
if ( $data['maxAdvancement'] > -1 ) {
588588
if ( $return['progression'] >= $data['maxAdvancement'] ) {

‎class/shortcode/class-atoz.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
namespace ithoughts\tooltip_glossary\shortcode;
2121

2222
if ( ! defined( 'ABSPATH' ) ) {
23-
exit; // Exit if accessed directly
23+
status_header( 403 );wp_die("Forbidden");// Exit if accessed directly
2424
}
2525

2626
if ( ! class_exists( __NAMESPACE__ . '\\AtoZ' ) ) {

0 commit comments

Comments
 (0)