From 46a67d18ecb42b041c45c5c4b328e434de6de669 Mon Sep 17 00:00:00 2001
From: Justin Foell <630830+jrfoell@users.noreply.github.com>
Date: Fri, 30 Sep 2022 13:47:48 -0500
Subject: [PATCH] Reset filter, renamed is_options_page() function, changed
option_page to option_group
---
src/WPStrava/Auth.php | 8 +++---
src/WPStrava/Settings.php | 49 ++++++++++++++++++------------------
templates/admin-settings.php | 2 +-
3 files changed, 29 insertions(+), 30 deletions(-)
diff --git a/src/WPStrava/Auth.php b/src/WPStrava/Auth.php
index ce6838d..db3cb8e 100644
--- a/src/WPStrava/Auth.php
+++ b/src/WPStrava/Auth.php
@@ -47,7 +47,7 @@ abstract class WPStrava_Auth {
'filter' => FILTER_SANITIZE_NUMBER_INT,
'flags' => FILTER_REQUIRE_SCALAR,
),
- 'strava_client_secret' => FILTER_SANITIZE_STRING,
+ 'strava_client_secret' => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
);
$input = filter_input_array( INPUT_POST, $input_args );
@@ -57,7 +57,7 @@ abstract class WPStrava_Auth {
}
// Redirect only if all the right options are in place.
- if ( $settings->is_settings_updated( $value ) && $settings->is_option_page() ) {
+ if ( $settings->is_settings_updated( $value ) && $settings->is_options_page() ) {
// Only re-auth if client ID and secret were saved.
if ( ! empty( $input['strava_client_id'] ) && ! empty( $input['strava_client_secret'] ) ) {
wp_redirect( $this->get_authorize_url( $input['strava_client_id'] ) );
@@ -71,8 +71,8 @@ abstract class WPStrava_Auth {
$settings = WPStrava::get_instance()->settings;
$input_args = array(
- 'settings-updated' => FILTER_SANITIZE_STRING,
- 'code' => FILTER_SANITIZE_STRING,
+ 'settings-updated' => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
+ 'code' => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
);
$input = filter_input_array( INPUT_GET, $input_args );
diff --git a/src/WPStrava/Settings.php b/src/WPStrava/Settings.php
index 3149cf4..704f687 100644
--- a/src/WPStrava/Settings.php
+++ b/src/WPStrava/Settings.php
@@ -12,7 +12,7 @@ class WPStrava_Settings {
private $ids = array();
private $page_name = 'wp-strava-options';
- private $option_page = 'wp-strava-settings-group';
+ private $option_group = 'wp-strava-settings-group';
private $adding_athlete = true;
/**
@@ -58,21 +58,21 @@ class WPStrava_Settings {
$ids = $this->get_ids();
if ( $this->ids_empty( $ids ) ) {
- register_setting( $this->option_page, 'strava_client_id', array( $this, 'sanitize_client_id' ) );
- register_setting( $this->option_page, 'strava_client_secret', array( $this, 'sanitize_client_secret' ) );
- register_setting( $this->option_page, 'strava_nickname', array( $this, 'sanitize_nickname' ) );
+ register_setting( $this->option_group, 'strava_client_id', array( $this, 'sanitize_client_id' ) );
+ register_setting( $this->option_group, 'strava_client_secret', array( $this, 'sanitize_client_secret' ) );
+ register_setting( $this->option_group, 'strava_nickname', array( $this, 'sanitize_nickname' ) );
add_settings_field( 'strava_client_id', __( 'Strava Client ID', 'wp-strava' ), array( $this, 'print_client_input' ), 'wp-strava', 'strava_api' );
add_settings_field( 'strava_client_secret', __( 'Strava Client Secret', 'wp-strava' ), array( $this, 'print_secret_input' ), 'wp-strava', 'strava_api' );
add_settings_field( 'strava_nickname', __( 'Strava Nickname', 'wp-strava' ), array( $this, 'print_nickname_input' ), 'wp-strava', 'strava_api' );
} else {
- register_setting( $this->option_page, 'strava_id', array( $this, 'sanitize_id' ) );
+ register_setting( $this->option_group, 'strava_id', array( $this, 'sanitize_id' ) );
add_settings_field( 'strava_id', __( 'Saved ID', 'wp-strava' ), array( $this, 'print_id_input' ), 'wp-strava', 'strava_api' );
// Add additional fields
- register_setting( $this->option_page, 'strava_client_id', array( $this, 'sanitize_client_id' ) );
- register_setting( $this->option_page, 'strava_client_secret', array( $this, 'sanitize_client_secret' ) );
- register_setting( $this->option_page, 'strava_nickname', array( $this, 'sanitize_nickname' ) );
+ register_setting( $this->option_group, 'strava_client_id', array( $this, 'sanitize_client_id' ) );
+ register_setting( $this->option_group, 'strava_client_secret', array( $this, 'sanitize_client_secret' ) );
+ register_setting( $this->option_group, 'strava_nickname', array( $this, 'sanitize_nickname' ) );
add_settings_field( 'strava_client_id', __( 'Additional Athlete Client ID', 'wp-strava' ), array( $this, 'print_client_input' ), 'wp-strava', 'strava_api' );
add_settings_field( 'strava_client_secret', __( 'Additional Athlete Client Secret', 'wp-strava' ), array( $this, 'print_secret_input' ), 'wp-strava', 'strava_api' );
@@ -82,37 +82,37 @@ class WPStrava_Settings {
// Google Maps API.
add_settings_section( 'strava_maps', __( 'Maps', 'wp-strava' ), null, 'wp-strava' );
- register_setting( $this->option_page, 'strava_map_type', array( $this, 'sanitize_map_type' ) );
+ register_setting( $this->option_group, 'strava_map_type', array( $this, 'sanitize_map_type' ) );
add_settings_field( 'strava_map_type', __( 'Map Type', 'wp-strava' ), array( $this, 'print_map_type_input' ), 'wp-strava', 'strava_maps' );
- register_setting( $this->option_page, 'strava_gmaps_key', array( $this, 'sanitize_gmaps_key' ) );
+ register_setting( $this->option_group, 'strava_gmaps_key', array( $this, 'sanitize_gmaps_key' ) );
add_settings_field( 'strava_gmaps_key', __( 'Google Static Maps API Key', 'wp-strava' ), array( $this, 'print_gmaps_key_input' ), 'wp-strava', 'strava_maps' );
- register_setting( $this->option_page, 'strava_mapbox_token', array( $this, 'sanitize_mapbox_token' ) );
+ register_setting( $this->option_group, 'strava_mapbox_token', array( $this, 'sanitize_mapbox_token' ) );
add_settings_field( 'strava_mapbox_token', __( 'Mapbox Public Token', 'wp-strava' ), array( $this, 'print_mapbox_token_input' ), 'wp-strava', 'strava_maps' );
// System of Measurement.
- register_setting( $this->option_page, 'strava_som', array( $this, 'sanitize_som' ) );
+ register_setting( $this->option_group, 'strava_som', array( $this, 'sanitize_som' ) );
add_settings_section( 'strava_options', __( 'Options', 'wp-strava' ), null, 'wp-strava' );
add_settings_field( 'strava_som', __( 'System of Measurement', 'wp-strava' ), array( $this, 'print_som_input' ), 'wp-strava', 'strava_options' );
// Hide Options.
- register_setting( $this->option_page, 'strava_hide_time', array( $this, 'sanitize_hide_time' ) );
+ register_setting( $this->option_group, 'strava_hide_time', array( $this, 'sanitize_hide_time' ) );
add_settings_field( 'strava_hide_time', __( 'Time', 'wp-strava' ), array( $this, 'print_hide_time_input' ), 'wp-strava', 'strava_options' );
- register_setting( $this->option_page, 'strava_hide_elevation', array( $this, 'sanitize_hide_elevation' ) );
+ register_setting( $this->option_group, 'strava_hide_elevation', array( $this, 'sanitize_hide_elevation' ) );
add_settings_field( 'strava_hide_elevation', __( 'Elevation', 'wp-strava' ), array( $this, 'print_hide_elevation_input' ), 'wp-strava', 'strava_options' );
// No Activity Links.
- register_setting( $this->option_page, 'strava_no_link', array( $this, 'sanitize_no_link' ) );
+ register_setting( $this->option_group, 'strava_no_link', array( $this, 'sanitize_no_link' ) );
add_settings_field( 'strava_no_link', __( 'Links', 'wp-strava' ), array( $this, 'print_no_link_input' ), 'wp-strava', 'strava_options' );
// Cache lifetime.
- register_setting( $this->option_page, 'strava_cache_time', array( $this, 'sanitize_cache_time' ) );
+ register_setting( $this->option_group, 'strava_cache_time', array( $this, 'sanitize_cache_time' ) );
add_settings_section( 'strava_cache', __( 'Cache', 'wp-strava' ), null, 'wp-strava' );
add_settings_field( 'strava_cache_time', __( 'Cache time', 'wp-strava' ), array( $this, 'print_cache_input' ), 'wp-strava', 'strava_cache' );
// Clear cache.
- register_setting( $this->option_page, 'strava_cache_clear', array( $this, 'sanitize_cache_clear' ) );
+ register_setting( $this->option_group, 'strava_cache_clear', array( $this, 'sanitize_cache_clear' ) );
add_settings_field( 'strava_cache_clear', __( 'Clear cache', 'wp-strava' ), array( $this, 'print_clear_input' ), 'wp-strava', 'strava_cache' );
if ( WPSTRAVA_DEBUG ) {
@@ -691,7 +691,7 @@ class WPStrava_Settings {
*/
public function print_debug_info() {
// phpcs:ignore Squiz.PHP.EmbeddedPhp, WordPress.PHP.DevelopmentFunctions -- Formatting & debug OK.
- ?>
* @since 2.0.0
*/
- public function is_option_page() {
- // phpcs:ignore WordPress.Security.NonceVerification -- Comparison only.
- return htmlspecialchars( $_POST['options_page'], ENT_QUOTES, get_bloginfo( 'charset' ) ) === $this->option_page;
+ public function is_options_page() {
+ $screen = get_current_screen();
+ return isset( $screen->id ) && 'options' === $screen->id;
}
/**
@@ -904,8 +904,7 @@ class WPStrava_Settings {
* @since 2.0.0
*/
public function is_settings_page() {
- // phpcs:ignore WordPress.Security.NonceVerification -- Comparison only.
- return htmlspecialchars( $_GET['page'], ENT_QUOTES, get_bloginfo( 'charset' ) ) === $this->page_name;
+ return filter_input( INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) === $this->page_name;
}
/**
@@ -928,7 +927,7 @@ class WPStrava_Settings {
*/
private function is_adding_athlete() {
return filter_input( INPUT_POST, 'strava_client_id', FILTER_SANITIZE_NUMBER_INT ) &&
- htmlspecialchars( $_POST['strava_client_secret'], ENT_QUOTES, get_bloginfo( 'charset' ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Comparison only.
+ filter_input( INPUT_POST, 'strava_client_secret', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
}
/**
diff --git a/templates/admin-settings.php b/templates/admin-settings.php
index 6d732fc..5cd3e8b 100644
--- a/templates/admin-settings.php
+++ b/templates/admin-settings.php
@@ -3,7 +3,7 @@