Skip to content
GitLab
Menu
Projects
Groups
Snippets
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
les
gancio
Commits
7acd34f4
Verified
Commit
7acd34f4
authored
Jul 04, 2021
by
les
Browse files
[WPGancio] Sanitize / validate input/output
parent
8e53a1f2
Changes
2
Hide whitespace changes
Inline
Side-by-side
wp-plugin/oauth.php
View file @
7acd34f4
...
...
@@ -4,16 +4,15 @@ defined( 'ABSPATH' ) or die( 'Nope, not accessing this' );
// eventorganizer / triggered after an event has been updated
// http://codex.wp-event-organiser.com/hook-eventorganiser_save_event.html
add_action
(
'eventorganiser_save_event'
,
'wpgancio_save_event'
,
15
);
add_action
(
'wp_trash_post'
,
'delete_post'
,
15
);
add_action
(
'wp_trash_post'
,
'
wpgancio_
delete_post'
,
15
);
function
delete_post
(
$post_id
)
{
function
wpgancio_
delete_post
(
$post_id
)
{
$post
=
get_post
(
$post_id
);
$instance_url
=
get_option
(
'wpgancio_instance_url'
);
if
(
$post
->
post_type
==
'event'
)
{
$gancio_id
=
get_post_meta
(
$post_id
,
'gancio_id'
,
TRUE
);
$gancio_id
=
get_post_meta
(
$post_id
,
'
wpgancio_
gancio_id'
,
TRUE
);
if
(
$gancio_id
)
{
$body
[
'id'
]
=
$gancio_id
;
$http
=
_wp_http_get_object
();
$response
=
$http
->
request
(
"${instance_url}/api/event/${gancio_id}"
,
array
(
'method'
=>
'DELETE'
,
...
...
@@ -28,7 +27,7 @@ function wpgancio_save_event ($post_id) {
$event
=
get_post
(
$post_id
);
function
tagName
(
$tag
)
{
return
$tag
->
name
;
return
sanitize_title
(
$tag
->
name
)
;
}
$tmp_tags
=
get_the_terms
(
$event
,
'event-tag'
);
...
...
@@ -39,9 +38,9 @@ function wpgancio_save_event ($post_id) {
return
;
}
$gancio_id
=
get_post_meta
(
$post_id
,
'gancio_id'
,
TRUE
);
$gancio_id
=
get_post_meta
(
$post_id
,
'
wpgancio_
gancio_id'
,
TRUE
);
//
image_path
//
when
$date
=
eo_get_schedule_start
(
'U'
,
$post_id
);
// get place details
...
...
@@ -62,7 +61,7 @@ function wpgancio_save_event ($post_id) {
// add image if specified
$image_url
=
get_the_post_thumbnail_url
(
$post_id
);
if
(
$image_url
)
{
$body
[
'image_url'
]
=
$image_url
;
$body
[
'image_url'
]
=
esc_url
(
$image_url
)
;
}
// update
...
...
@@ -84,10 +83,10 @@ function wpgancio_save_event ($post_id) {
}
if
(
is_wp_error
(
$response
)
)
{
$error_message
=
$response
->
get_error_message
();
$error_message
=
esc_html
(
$response
->
get_error_message
()
)
;
echo
"<div class='error notice'><p>${error_message}</p></div>"
;
return
;
}
$data
=
json_decode
(
wp_remote_retrieve_body
(
$response
));
update_post_meta
(
$post_id
,
'gancio_id'
,
$data
->
id
);
update_post_meta
(
$post_id
,
'
wpgancio_
gancio_id'
,
intval
(
$data
->
id
)
)
;
}
wp-plugin/settings.php
View file @
7acd34f4
...
...
@@ -22,7 +22,7 @@ function wpgancio_update_options ($old_value, $instance_url) {
$redirect_uri
=
get_site_url
(
null
,
'/wp-admin/options-general.php?page=wpgancio'
);
$query
=
join
(
'&'
,
array
(
'response_type=code'
,
'redirect_uri='
.
esc_
htm
l
(
$redirect_uri
),
'redirect_uri='
.
esc_
ur
l
(
$redirect_uri
),
'scope=event:write'
,
'client_id='
.
get_option
(
'wpgancio_client_id'
),
));
...
...
@@ -53,8 +53,8 @@ function wpgancio_instance_url_validate ($instance_url) {
$response
->
get_error_message
());
}
else
{
$data
=
json_decode
(
wp_remote_retrieve_body
(
$response
),
true
);
update_option
(
'wpgancio_client_secret'
,
$data
[
'client_secret'
]);
update_option
(
'wpgancio_client_id'
,
$data
[
'client_id'
]);
update_option
(
'wpgancio_client_secret'
,
sanitize_key
(
$data
[
'client_secret'
])
)
;
update_option
(
'wpgancio_client_id'
,
sanitize_key
(
$data
[
'client_id'
])
)
;
return
$instance_url
;
}
}
...
...
@@ -88,7 +88,7 @@ function wpgancio_instance_url_cb( $args ) {
name=
"wpgancio_instance_url"
>
<p
class=
"description"
>
<?php
esc_html
_e
(
'Insert your gancio instance URL'
,
'wpgancio'
);
?>
<?php
esc_html
(
'Insert your gancio instance URL'
,
'wpgancio'
);
?>
</p>
<?php
...
...
@@ -104,9 +104,7 @@ function wpgancio_options_page_html() {
if
(
!
current_user_can
(
'manage_options'
)
)
{
return
;
}
// show error/update messages
//settings_errors( 'wpgancio_messages' );
$code
=
$_GET
[
'code'
];
$code
=
sanitize_key
(
$_GET
[
'code'
]);
if
(
$code
)
{
update_option
(
'wpgancio_code'
,
$code
);
$instance_url
=
get_option
(
'wpgancio_instance_url'
);
...
...
@@ -127,8 +125,8 @@ function wpgancio_options_page_html() {
settings_errors
(
'wpgancio_messages'
);
}
else
{
$data
=
json_decode
(
wp_remote_retrieve_body
(
$response
),
true
);
update_option
(
'wpgancio_token'
,
$data
[
'access_token'
]);
update_option
(
'wpgancio_refresh'
,
$data
[
'refresh_token'
]);
update_option
(
'wpgancio_token'
,
sanitize_key
(
$data
[
'access_token'
])
)
;
update_option
(
'wpgancio_refresh'
,
sanitize_key
(
$data
[
'refresh_token'
])
)
;
add_settings_error
(
'wpgancio_messages'
,
'wpgancio_messages'
,
'Association completed!'
,
'success'
);
settings_errors
(
'wpgancio_messages'
);
}
...
...
@@ -141,11 +139,14 @@ function wpgancio_options_page_html() {
<h1>
<?php
echo
esc_html
(
get_admin_page_title
()
);
?>
</h1>
<form
action=
"options.php"
method=
"post"
>
<?php
// output security fields for the registered setting "wpgancio"
settings_fields
(
'wpgancio'
);
// output setting sections and their fields
// (sections are registered for "wpgancio", each field is registered to a specific section)
do_settings_sections
(
'wpgancio'
);
// output save settings button
submit_button
(
'Save Settings'
);
?>
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment