Skip to content

Commit c2eb22b

Browse files
Akash-Raj-STAkash-Raj-ST
committed
fix(phpcs): Add sanitization for required input data.
1 parent cc92392 commit c2eb22b

5 files changed

Lines changed: 23 additions & 18 deletions

File tree

‎src/inc/api/class-part.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ public function maybe_process_update() {
158158
if ( ! isset( $_POST['_wpnonce'] ) ) {
159159
return false;
160160
}
161-
$wpnonce = ( isset( $_POST['submit'] ) && isset( $_POST['_wpnonce'] ) ) ? filter_input( INPUT_POST, '_wpnonce' ) : null;
161+
$wpnonce = ( isset( $_POST['submit'] ) && isset( $_POST['_wpnonce'] ) ) ? sanitize_text_field( $_POST['_wpnonce'] ) : null;
162162

163163
// Only allow class to be used by panel OR encrypted pwds never updated after insert.
164164
if ( empty( $wpnonce ) || wp_verify_nonce( $wpnonce ) ) {
@@ -251,15 +251,15 @@ public function input_value( $type, $established_data, $use_data_value = false )
251251
* @return bool|string
252252
*/
253253
public function run_save_process() {
254-
$nonce = ( isset( $_POST['submit'] ) && isset( $_POST['_wpnonce'] ) ) ? filter_input( INPUT_POST, '_wpnonce' ) : null;
254+
$nonce = ( isset( $_POST['submit'] ) && isset( $_POST['_wpnonce'] ) ) ? sanitize_text_field( $_POST['_wpnonce'] ) : null;
255255
$page_slug_as_action = $this->section->panel->page->slug;
256256
if ( empty( $nonce ) || false === wp_verify_nonce( $nonce, $page_slug_as_action ) ) {
257257
return false; // Only run logic if asked to run & auth'd by nonce.
258258
}
259259

260260
$type = ( ! empty( $this->field_type ) ) ? $this->field_type : $this->input_type;
261261

262-
$field_input = isset( $_POST[ $this->id ] ) ? filter_input( INPUT_POST, $this->id ) : false;
262+
$field_input = isset( $_POST[ $this->id ] ) ? sanitize_text_field( $_POST[ $this->id ] ) : false;
263263

264264
$sanitize_input = $this->sanitize_data_input( $type, $this->id, $field_input );
265265

@@ -311,7 +311,7 @@ protected function sanitize_data_input( $input_type, $id, $value ) {
311311
if ( ! isset( $_POST['_wpnonce'] ) ) {
312312
return false;
313313
}
314-
$wpnonce = ( isset( $_POST['submit'] ) && isset( $_POST['_wpnonce'] ) ) ? filter_input( INPUT_POST, '_wpnonce' ) : null;
314+
$wpnonce = ( isset( $_POST['submit'] ) && isset( $_POST['_wpnonce'] ) ) ? sanitize_text_field( $_POST['_wpnonce'] ) : null;
315315

316316
// Only allow class to be used by panel OR encrypted pwds never updated after insert.
317317
if ( empty( $wpnonce ) || wp_verify_nonce( $wpnonce ) ) {
@@ -320,7 +320,7 @@ protected function sanitize_data_input( $input_type, $id, $value ) {
320320

321321
switch ( $input_type ) {
322322
case 'password':
323-
$hidden_pwd_field = isset( $_POST[ 'stored_' . $id ] ) ? filter_input( INPUT_POST, 'stored_' . $id ) : null;
323+
$hidden_pwd_field = isset( $_POST[ 'stored_' . $id ] ) ? sanitize_text_field( $_POST[ 'stored_' . $id ] ) : null;
324324

325325
if ( $hidden_pwd_field === $value && ! empty( $value ) ) {
326326
return '### wpop-encrypted-pwd-field-val-unchanged ###';

‎src/inc/api/class-update.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
*/
1616
class Update {
1717
/**
18-
* Update constructor.
18+
* Save data wrapper for nonce check.
1919
*
2020
* @param string $page_slug Page URL.
2121
* @param string $type Type.
@@ -31,7 +31,7 @@ public function get_save_data( $page_slug, $type, $key, $value, $obj_id = null,
3131
if ( ! isset( $_POST['_wpnonce'] ) ) {
3232
return false;
3333
}
34-
$wpnonce = isset( $_POST['_wpnonce'] ) ? filter_input( INPUT_POST, '_wpnonce' ) : null;
34+
$wpnonce = isset( $_POST['_wpnonce'] ) ? sanitize_text_field( $_POST['_wpnonce'] ) : null;
3535

3636
// Only allow class to be used by panel OR encrypted pwds never updated after insert.
3737
if ( ! wp_verify_nonce( $wpnonce, $page_slug ) || '### wpop-encrypted-pwd-field-val-unchanged ###' === $value ) {

‎src/inc/class-page.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -239,8 +239,12 @@ public function build_parts() {
239239
/**
240240
* Print WordPress Notices with Panel Information
241241
*/
242-
if ( ! empty( filter_input( INPUT_GET, 'submit' ) ) ) {
243-
$this->echo_notifications();
242+
if ( isset( $_GET['submit'] ) && isset( $_GET['_wpnonce'] ) ) {
243+
$nonce = sanitize_text_field( $_GET['_wpnonce'] );
244+
245+
if ( wp_verify_nonce( $nonce, $this->slug ) ) {
246+
$this->echo_notifications();
247+
}
244248
}
245249

246250
$this->page_header();

‎src/inc/fields/class-multiselect.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,14 +77,15 @@ public function __construct( &$section, $i, $m ) {
7777
* @return bool|string
7878
*/
7979
public function run_save_process() {
80-
$nonce = ( isset( $_POST['submit'] ) && isset( $_POST['_wpnonce'] ) ) ? filter_input( INPUT_POST, '_wpnonce' ) : null;
80+
$nonce = ( isset( $_POST['submit'] ) && isset( $_POST['_wpnonce'] ) ) ? sanitize_text_field( $_POST['_wpnonce'] ) : null;
8181
if ( empty( $nonce ) || false === wp_verify_nonce( $nonce, $this->section->panel->page->slug ) ) {
8282
return false; // Only run logic if asked to run & auth'd by nonce.
8383
}
8484

8585
$type = ( ! empty( $this->field_type ) ) ? $this->field_type : $this->input_type;
8686

87-
$field_input = isset( $_POST[ $this->id ] ) ? filter_input( INPUT_POST, $this->id, FILTER_DEFAULT, FILTER_REQUIRE_ARRAY ) : false;
87+
// Sanitized in the next line.
88+
$field_input = isset( $_POST[ $this->id ] ) ? filter_input( INPUT_POST, $this->id, FILTER_DEFAULT, FILTER_REQUIRE_ARRAY ) : false; // phpcs:ignore WordPressVIPMinimum.Security.PHPFilterFunctions.RestrictedFilter
8889

8990
$sanitize_input = $this->sanitize_data_input( $type, $this->id, $field_input );
9091

‎src/inc/page-parts/class-panel.php‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -214,10 +214,10 @@ public function __toString() {
214214
public function detect_data_api_and_permissions() {
215215
$api = null;
216216

217-
$page = array_key_exists( 'page', $_GET ) ? filter_input( INPUT_GET, 'page' ) : null;
218-
$post = array_key_exists( 'post', $_GET ) ? filter_input( INPUT_GET, 'post' ) : null;
219-
$user = array_key_exists( 'user', $_GET ) ? filter_input( INPUT_GET, 'user' ) : null;
220-
$term = array_key_exists( 'term', $_GET ) ? filter_input( INPUT_GET, 'term' ) : null;
217+
$page = array_key_exists( 'page', $_GET ) ? filter_input( INPUT_GET, 'page', FILTER_VALIDATE_INT ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
218+
$post = array_key_exists( 'post', $_GET ) ? filter_input( INPUT_GET, 'post', FILTER_VALIDATE_INT ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
219+
$user = array_key_exists( 'user', $_GET ) ? filter_input( INPUT_GET, 'user', FILTER_VALIDATE_INT ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
220+
$term = array_key_exists( 'term', $_GET ) ? filter_input( INPUT_GET, 'term', FILTER_VALIDATE_INT ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
221221

222222
if ( ! empty( $page ) ) {
223223
if ( isset( $post ) && absint( $post ) ) {
@@ -281,11 +281,11 @@ public function detect_data_api_and_permissions() {
281281
public function maybe_capture_wp_object_id() {
282282
switch ( $this->api ) {
283283
case 'post':
284-
return array_key_exists( 'post', $_GET ) ? filter_input( INPUT_GET, 'post' ) : null;
284+
return array_key_exists( 'post', $_GET ) ? filter_input( INPUT_GET, 'post', FILTER_VALIDATE_INT ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
285285
case 'user':
286-
return array_key_exists( 'user', $_GET ) ? filter_input( INPUT_GET, 'user' ) : null;
286+
return array_key_exists( 'user', $_GET ) ? filter_input( INPUT_GET, 'user', FILTER_VALIDATE_INT ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
287287
case 'term':
288-
return array_key_exists( 'term', $_GET ) ? filter_input( INPUT_GET, 'term' ) : null;
288+
return array_key_exists( 'term', $_GET ) ? filter_input( INPUT_GET, 'term', FILTER_VALIDATE_INT ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
289289
default:
290290
return null;
291291
}

0 commit comments

Comments
 (0)