Skip to content

Commit f61e8a6

Browse files
lloclloc
authored
Merge pull request #388 from lloc/raise-coverage
Ignore some escaping errors
2 parents 7d34be3 + cd2d4fe commit f61e8a6

23 files changed

+182
-226
lines changed

‎MultisiteLanguageSwitcher.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ function get_the_msls( $attr ): string {
7676
* @param string[] $arr
7777
*/
7878
function the_msls( array $arr = array() ): void {
79+
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
7980
echo get_the_msls( $arr );
8081
}
8182

‎includes/Component/Wrapper.php

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<?php
2+
3+
namespace lloc\Msls\Component;
4+
5+
class Wrapper {
6+
7+
protected string $element;
8+
9+
protected string $content;
10+
11+
public function __construct( string $element, string $content ) {
12+
$this->element = $element;
13+
$this->content = $content;
14+
}
15+
16+
public function render(): string {
17+
return sprintf( '<%1$s>%2$s</%1$s>', esc_html( $this->element ), wp_kses_post( $this->content ) );
18+
}
19+
}

‎includes/ContentImport/ContentImporter.php

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
use lloc\Msls\MslsMain;
1010
use lloc\Msls\MslsOptionsPost;
1111
use lloc\Msls\MslsRegistryInstance;
12+
use lloc\Msls\MslsRequest;
1213

1314
/**
1415
* Class ContentImporter
@@ -166,11 +167,12 @@ protected function pre_flight_check( array $data = array() ) {
166167
* @return array|bool
167168
*/
168169
public function parse_sources() {
169-
if ( ! isset( $_POST['msls_import'] ) ) {
170+
if ( ! MslsRequest::has_var( 'msls_import' ) ) {
170171
return false;
171172
}
172173

173-
$import_data = array_filter( explode( '|', trim( $_POST['msls_import'] ) ), 'is_numeric' );
174+
$msls_import = MslsRequest::get_var( 'msls_import' );
175+
$import_data = array_filter( explode( '|', trim( $msls_import ) ), 'is_numeric' );
174176

175177
if ( count( $import_data ) !== 2 ) {
176178
return false;
@@ -195,8 +197,9 @@ protected function get_the_blog_post_ID( $blog_id ) {
195197
return $id;
196198
}
197199

198-
if ( isset( $_REQUEST['post'] ) && filter_var( $_REQUEST['post'], FILTER_VALIDATE_INT ) ) {
199-
return (int) $_REQUEST['post'];
200+
$request = MslsRequest::get_request( array( 'post' ) );
201+
if ( ! empty( $request['post'] ) ) {
202+
return (int) $request['post'];
200203
}
201204

202205
$data = array(

‎includes/ContentImport/Importers/WithRequestPostAttributes.php

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@
1010

1111
namespace lloc\Msls\ContentImport\Importers;
1212

13+
use lloc\Msls\MslsRequest;
14+
1315
/**
1416
* Trait WithRequestPostAttributes
1517
*
@@ -24,14 +26,11 @@ trait WithRequestPostAttributes {
2426
* @param string $default The default post type to return if none is specified in the `$_REQUEST` super-global.
2527
*
2628
* @return string Either the post type read from the `$_REQUEST` super-global, or the default value.
27-
* @since TBD
28-
*
29+
\ *
2930
*/
3031
protected function read_post_type_from_request( $default = 'post' ) {
31-
if ( ! isset( $_REQUEST['post_type'] ) ) {
32-
return $default;
33-
}
32+
$request = MslsRequest::get_request( array( 'post_type' ), $default );
3433

35-
return filter_var( $_REQUEST['post_type'], FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ?: 'post';
34+
return $request['post_type'];
3635
}
3736
}

‎includes/ContentImport/LogWriters/AdminNoticeLogger.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ public function show_last_log( $echo = true ): ?string {
141141
}
142142

143143
if ( $echo ) {
144-
echo $html;
144+
echo wp_kses_post( $html );
145145
}
146146

147147
// we've shown it, no reason to keep it

‎includes/ContentImport/MetaBox.php

Lines changed: 63 additions & 141 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
namespace lloc\Msls\ContentImport;
44

5-
use lloc\Msls\ContentImport\Importers\ImportersFactory;
5+
use lloc\Msls\Component\Wrapper;
66
use lloc\Msls\ContentImport\Importers\Map;
77
use lloc\Msls\MslsBlogCollection;
88
use lloc\Msls\MslsFields;
@@ -43,44 +43,50 @@ function ( $lang ) use ( $mydata ) {
4343

4444
/* translators: %s: language name */
4545
$label_template = __( 'Import content from %s', 'multisite-language-switcher' );
46-
$output = '<fieldset>';
47-
$output .= '<legend>'
48-
. esc_html__(
49-
'Warning! This will override and replace all the post content with the content from the source post!',
50-
'multisite-language-switcher'
51-
)
52-
. '</legend>';
46+
47+
$warning = esc_html__(
48+
'Warning! This will override and replace all the post content with the content from the source post!',
49+
'multisite-language-switcher'
50+
);
51+
52+
$legend = ( new Wrapper( 'legend', $warning ) )->render();
53+
54+
$output = '';
5355
foreach ( $languages as $language => $label ) {
5456
$id = $mydata->{$language};
5557
$blog = $blogs->get_blog_id( $language );
5658
$label = sprintf( $label_template, $label );
59+
5760
if ( null === $id && $has_input && $input_lang === $language ) {
5861
$id = $input_id;
5962
$blog = $blogs->get_blog_id( $language );
6063
}
64+
6165
if ( null !== $id ) {
6266
$this->data = array(
6367
'msls_import' => "{$blog}|{$id}",
6468
);
65-
$output .= sprintf(
69+
70+
$output .= sprintf(
6671
'<a class="button button-primary thickbox" href="%s" title="%s">%s</a>',
6772
$this->inline_thickbox_url( $this->data ),
6873
$label,
6974
$label
7075
);
7176
}
7277
}
73-
$output .= '</fieldset>';
78+
79+
$output = ( new Wrapper( 'fieldset', $legend . $output ) )->render();
7480
} else {
75-
$output = '<p>' .
76-
esc_html__(
77-
'No translated versions linked to this post: import content functionality is disabled.',
78-
'multisite-language-switcher'
79-
)
80-
. '</p>';
81+
$warning = esc_html__(
82+
'No translated versions linked to this post: import content functionality is disabled.',
83+
'multisite-language-switcher'
84+
);
85+
86+
$output = ( new Wrapper( 'p', $warning ) )->render();
8187
}
8288

83-
echo $output;
89+
echo wp_kses_post( $output );
8490
}
8591

8692
protected function inline_thickbox_url( array $data = array() ): string {
@@ -100,6 +106,7 @@ protected function inline_thickbox_url( array $data = array() ): string {
100106
}
101107

102108
public function print_modal_html(): void {
109+
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
103110
echo $this->inline_thickbox_html( true, $this->data );
104111
}
105112

@@ -112,145 +119,60 @@ protected function inline_thickbox_html( $echo = true, array $data = array() ):
112119

113120
ob_start();
114121
?>
115-
<div style="display: none;" id="msls-import-dialog-
116-
<?php
117-
echo esc_attr( $slug )
118-
?>
119-
">
120-
<h3>
121-
<?php
122-
esc_html_e( 'Select what should be imported and how', 'multisite-language-switcher' )
123-
?>
124-
</h3>
125-
126-
<form action="
127-
<?php
128-
echo add_query_arg( array() )
129-
?>
130-
" method="post">
131-
132-
<?php
133-
wp_nonce_field( MslsPlugin::path(), 'msls_noncename' );
134-
?>
135-
136-
<?php
137-
foreach ( $data as $key => $value ) :
138-
?>
139-
<input type="hidden" name="
140-
<?php
141-
echo esc_attr( $key )
142-
?>
143-
" value="
144-
<?php
145-
echo esc_attr( $value )
146-
?>
147-
">
148-
<?php
149-
endforeach;
150-
?>
151-
152-
<?php
153-
/** @var ImportersFactory $factory */
154-
foreach ( Map::instance()->factories() as $slug => $factory ) :
155-
?>
156-
<?php
157-
$details = $factory->details()
158-
?>
159-
<h4>
160-
<?php
161-
echo esc_html( $details->name )
162-
?>
163-
</h4>
164-
<?php
165-
if ( empty( $details->importers ) ) :
166-
?>
122+
<div style="display: none;" id="msls-import-dialog-<?php echo esc_attr( $slug ); ?>">
123+
<h3><?php esc_html_e( 'Select what should be imported and how', 'multisite-language-switcher' ); ?></h3>
124+
<form action="<?php echo esc_url( add_query_arg( array() ) ); ?>" method="post">
125+
<?php wp_nonce_field( MslsPlugin::path(), 'msls_noncename' ); ?>
126+
<?php foreach ( $data as $key => $value ) : ?>
127+
<input type="hidden" name="<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $value ); ?>">
128+
<?php endforeach; ?>
129+
<?php foreach ( Map::instance()->factories() as $slug => $factory ) : ?>
130+
<?php $details = $factory->details(); ?>
131+
<h4><?php echo esc_html( $details->name ); ?></h4>
132+
<?php if ( empty( $details->importers ) ) : ?>
167133
<p>
168134
<?php
169135
esc_html_e(
170136
'No importers available for this type of content.',
171137
'multisite-language-switcher'
172-
)
138+
);
173139
?>
174-
</p>
175-
<?php
176-
else :
177-
?>
178-
<ul>
179-
<li>
180-
<label>
181-
<input type="radio" name="msls_importers[
182-
<?php
183-
echo esc_attr( $details->slug )
184-
?>
185-
]">
186-
<?php
187-
esc_html_e(
188-
'Off - Do not import this type of content in the destination post.',
189-
'multisite-language-switcher'
190-
)
191-
?>
192-
</label>
193-
</li>
194-
<?php
195-
foreach ( $details->importers as $importer_slug => $importer_info ) :
196-
?>
197-
<li>
198-
<label>
199-
<input type="radio" name="msls_importers[
200-
<?php
201-
echo esc_attr( $details->slug )
202-
?>
203-
]"
204-
value="
205-
<?php
206-
echo esc_attr( $importer_slug )
207-
?>
208-
"
209-
<?php
210-
checked( $details->selected, $importer_slug )
211-
?>
212-
>
213-
<?php
214-
echo( esc_html(
215-
sprintf(
216-
'%s - %s',
217-
$importer_info->name,
218-
$importer_info->description
219-
)
220-
) )
221-
?>
222-
</label>
223-
</li>
140+
</p>
141+
<?php else : ?>
142+
<ul>
143+
<li>
144+
<label>
145+
<input type="radio" name="msls_importers[<?php echo esc_attr( $details->slug ); ?>]">
224146
<?php
225-
endforeach;
226-
?>
227-
</ul>
228-
<?php
229-
endif;
230-
?>
231-
<?php
232-
endforeach;
233-
?>
234-
147+
esc_html_e(
148+
'Off - Do not import this type of content in the destination post.',
149+
'multisite-language-switcher'
150+
);
151+
?>
152+
</label>
153+
</li>
154+
<?php foreach ( $details->importers as $importer_slug => $importer_info ) : ?>
155+
<li>
156+
<label>
157+
<input type="radio" name="msls_importers[<?php echo esc_attr( $details->slug ); ?>]" value="<?php echo esc_attr( $importer_slug ); ?>" <?php checked( $details->selected, $importer_slug ); ?>>
158+
<?php echo( esc_html( sprintf( '%s - %s', $importer_info->name, $importer_info->description ) ) ); ?>
159+
</label>
160+
</li>
161+
<?php endforeach; ?>
162+
</ul>
163+
<?php endif; ?>
164+
<?php endforeach; ?>
235165
<div>
236-
<input
237-
type="submit"
238-
class="button button-primary"
239-
value="
240-
<?php
241-
esc_html_e( 'Import Content', 'multisite-language-switcher' )
242-
?>
243-
"
244-
>
166+
<input type="submit" class="button button-primary" value="<?php esc_html_e( 'Import Content', 'multisite-language-switcher' ); ?>">
245167
</div>
246168
</form>
247169
</div>
248-
249170
<?php
171+
250172
$html = ob_get_clean();
251173

252174
if ( $echo ) {
253-
echo $html;
175+
echo wp_kses_post( $html );
254176
}
255177

256178
return $html;

0 commit comments

Comments
 (0)