Skip to content

Commit 7b5a0cf

Browse files
pattonwebzpattonwebz
authored
Merge pull request #1228 from equalizedigital/release/1.31.1
Release v1.31.1
2 parents 0dd142c + 22ba636 commit 7b5a0cf

76 files changed

Lines changed: 2162 additions & 1515 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎accessibility-checker.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
* Plugin Name: Accessibility Checker
1111
* Plugin URI: https://a11ychecker.com
1212
* Description: Audit and check your website for accessibility before you hit publish. In-post accessibility scanner and guidance.
13-
* Version: 1.31.0
13+
* Version: 1.31.1
1414
* Requires PHP: 7.4
1515
* Author: Equalize Digital
1616
* Author URI: https://equalizedigital.com
@@ -36,7 +36,7 @@
3636

3737
// Current plugin version.
3838
if ( ! defined( 'EDAC_VERSION' ) ) {
39-
define( 'EDAC_VERSION', '1.31.0' );
39+
define( 'EDAC_VERSION', '1.31.1' );
4040
}
4141

4242
// Current database version.

‎admin/class-ajax.php‎

Lines changed: 56 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -47,28 +47,26 @@ public function init_hooks() {
4747
* - '-1' means that nonce could not be varified
4848
* - '-2' means that the post ID was not specified
4949
* - '-3' means that there isn't any summary data to return
50+
* - '-5' means that the user does not have permission to view this information for this post
5051
*/
5152
public function summary() {
5253

5354
// nonce security.
5455
if ( ! isset( $_REQUEST['nonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_REQUEST['nonce'] ) ), 'ajax-nonce' ) ) {
55-
56-
$error = new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) );
57-
wp_send_json_error( $error );
58-
56+
wp_send_json_error( new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) ) );
5957
}
6058

6159
if ( ! isset( $_REQUEST['post_id'] ) ) {
60+
wp_send_json_error( new \WP_Error( '-2', __( 'The post ID was not set', 'accessibility-checker' ) ) );
61+
}
6262

63-
$error = new \WP_Error( '-2', __( 'The post ID was not set', 'accessibility-checker' ) );
64-
wp_send_json_error( $error );
65-
63+
if ( ! current_user_can( 'edit_post', (int) $_REQUEST['post_id'] ) ) {
64+
wp_send_json_error( new \WP_Error( '-5', __( 'You do not have permission to view this information for this post.', 'accessibility-checker' ) ) );
6665
}
6766

6867
$html = [];
6968
$html['content'] = '';
7069

71-
7270
$post_id = (int) $_REQUEST['post_id'];
7371
$summary = ( new Summary_Generator( $post_id ) )->generate_summary();
7472
$simplified_summary_text = '';
@@ -126,25 +124,25 @@ public function summary() {
126124
'edac-summary-errors',
127125
$summary['errors'],
128126
/* translators: %s: Number of errors */
129-
sprintf( _n( '%s Error', '%s Errors', $summary['errors'], 'accessibility-checker' ), $summary['errors'] )
127+
sprintf( _n( '%s Error', '%s Errors', $summary['errors'], 'accessibility-checker' ), $summary['errors'] )
130128
) . '
131129
' . edac_generate_summary_stat(
132130
'edac-summary-contrast',
133131
$summary['contrast_errors'],
134132
/* translators: %s: Number of contrast errors */
135-
sprintf( _n( '%s Contrast Error', '%s Contrast Errors', $summary['contrast_errors'], 'accessibility-checker' ), $summary['contrast_errors'] )
133+
sprintf( _n( '%s Contrast Error', '%s Contrast Errors', $summary['contrast_errors'], 'accessibility-checker' ), $summary['contrast_errors'] )
136134
) . '
137135
' . edac_generate_summary_stat(
138136
'edac-summary-warnings',
139137
$summary['warnings'],
140138
/* translators: %s: Number of warnings */
141-
sprintf( _n( '%s Warning', '%s Warnings', $summary['warnings'], 'accessibility-checker' ), $summary['warnings'] )
139+
sprintf( _n( '%s Warning', '%s Warnings', $summary['warnings'], 'accessibility-checker' ), $summary['warnings'] )
142140
) . '
143141
' . edac_generate_summary_stat(
144142
'edac-summary-ignored',
145143
$summary['ignored'],
146144
/* translators: %s: Number of ignored items */
147-
sprintf( _n( '%s Ignored Item', '%s Ignored Items', $summary['ignored'], 'accessibility-checker' ), $summary['ignored'] )
145+
sprintf( _n( '%s Ignored Item', '%s Ignored Items', $summary['ignored'], 'accessibility-checker' ), $summary['ignored'] )
148146
) . '
149147
150148
</ul>
@@ -181,10 +179,7 @@ public function summary() {
181179
$html['content'] .= '</small></div>' . PHP_EOL;
182180

183181
if ( ! $html ) {
184-
185-
$error = new \WP_Error( '-3', __( 'No summary to return', 'accessibility-checker' ) );
186-
wp_send_json_error( $error );
187-
182+
wp_send_json_error( new \WP_Error( '-3', __( 'No summary to return', 'accessibility-checker' ) ) );
188183
}
189184

190185
wp_send_json_success( wp_json_encode( $html ) );
@@ -199,22 +194,20 @@ public function summary() {
199194
* - '-2' means that the post ID was not specified
200195
* - '-3' means that the table name is not valid
201196
* - '-4' means that there isn't any details to return
197+
* - '-5' means that the user does not have permission to view this information for this post
202198
*/
203199
public function details() {
204200

205-
// nonce security.
206201
if ( ! isset( $_REQUEST['nonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_REQUEST['nonce'] ) ), 'ajax-nonce' ) ) {
207-
208-
$error = new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) );
209-
wp_send_json_error( $error );
210-
202+
wp_send_json_error( new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) ) );
211203
}
212204

213205
if ( ! isset( $_REQUEST['post_id'] ) ) {
206+
wp_send_json_error( new \WP_Error( '-2', __( 'The post ID was not set', 'accessibility-checker' ) ) );
207+
}
214208

215-
$error = new \WP_Error( '-2', __( 'The post ID was not set', 'accessibility-checker' ) );
216-
wp_send_json_error( $error );
217-
209+
if ( ! current_user_can( 'edit_post', (int) $_REQUEST['post_id'] ) ) {
210+
wp_send_json_error( new \WP_Error( '-5', __( 'You do not have permission to view this information for this post.', 'accessibility-checker' ) ) );
218211
}
219212

220213
$html = '';
@@ -225,10 +218,7 @@ public function details() {
225218

226219
// Send error if table name is not valid.
227220
if ( ! $table_name ) {
228-
229-
$error = new \WP_Error( '-3', __( 'Invalid table name', 'accessibility-checker' ) );
230-
wp_send_json_error( $error );
231-
221+
wp_send_json_error( new \WP_Error( '-3', __( 'Invalid table name', 'accessibility-checker' ) ) );
232222
}
233223

234224
$rules = edac_register_rules();
@@ -567,10 +557,7 @@ function ( $a, $b ) {
567557
}
568558

569559
if ( ! $html ) {
570-
571-
$error = new \WP_Error( '-4', __( 'No details to return', 'accessibility-checker' ) );
572-
wp_send_json_error( $error );
573-
560+
wp_send_json_error( new \WP_Error( '-4', __( 'No details to return', 'accessibility-checker' ) ) );
574561
}
575562

576563
wp_send_json_success( wp_json_encode( $html ) );
@@ -584,22 +571,20 @@ function ( $a, $b ) {
584571
* - '-1' means that nonce could not be varified
585572
* - '-2' means that the post ID was not specified
586573
* - '-3' means that there isn't any readability data to return
574+
* - '-5' means that the user does not have permission to view this information for this post
587575
*/
588576
public function readability() {
589577

590-
// nonce security.
591578
if ( ! isset( $_REQUEST['nonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_REQUEST['nonce'] ) ), 'ajax-nonce' ) ) {
592-
593-
$error = new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) );
594-
wp_send_json_error( $error );
595-
579+
wp_send_json_error( new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) ) );
596580
}
597581

598582
if ( ! isset( $_REQUEST['post_id'] ) ) {
583+
wp_send_json_error( new \WP_Error( '-2', __( 'The post ID was not set', 'accessibility-checker' ) ) );
584+
}
599585

600-
$error = new \WP_Error( '-2', __( 'The post ID was not set', 'accessibility-checker' ) );
601-
wp_send_json_error( $error );
602-
586+
if ( ! current_user_can( 'edit_post', (int) $_REQUEST['post_id'] ) ) {
587+
wp_send_json_error( new \WP_Error( '-5', __( 'You do not have permission to view this information for this post.', 'accessibility-checker' ) ) );
603588
}
604589

605590
$post_id = (int) $_REQUEST['post_id'];
@@ -706,10 +691,7 @@ public function readability() {
706691
$html .= '<span class="dashicons dashicons-info"></span><a href="' . esc_url( edac_link_wrapper( 'https://a11ychecker.com/help3265', 'wordpress-general', 'content-analysis', false ) ) . '" target="_blank">Learn more about improving readability and simplified summary requirements</a>';
707692

708693
if ( ! $html ) {
709-
710-
$error = new \WP_Error( '-3', __( 'No readability data to return', 'accessibility-checker' ) );
711-
wp_send_json_error( $error );
712-
694+
wp_send_json_error( new \WP_Error( '-3', __( 'No readability data to return', 'accessibility-checker' ) ) );
713695
}
714696

715697
wp_send_json_success( wp_json_encode( $html ) );
@@ -727,32 +709,29 @@ public function add_ignore() {
727709

728710
// nonce security.
729711
if ( ! isset( $_REQUEST['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) ), 'ajax-nonce' ) ) {
730-
731-
$error = new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) );
732-
wp_send_json_error( $error );
733-
712+
wp_send_json_error( new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) ) );
734713
}
735714

736715
global $wpdb;
737-
$table_name = $wpdb->prefix . 'accessibility_checker';
738-
$raw_ids = isset( $_REQUEST['ids'] ) ? (array) wp_unslash( $_REQUEST['ids'] ) : []; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitization handled below.
739-
$ids = array_map(
716+
$table_name = $wpdb->prefix . 'accessibility_checker';
717+
$raw_ids = isset( $_REQUEST['ids'] ) ? (array) wp_unslash( $_REQUEST['ids'] ) : []; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitization handled below.
718+
$ids = array_map(
740719
function ( $value ) {
741720
return (int) $value;
742721
},
743722
$raw_ids
744723
); // Sanitizing array elements to integers.
745-
$action = isset( $_REQUEST['ignore_action'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['ignore_action'] ) ) : '';
746-
$type = isset( $_REQUEST['ignore_type'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['ignore_type'] ) ) : '';
747-
$siteid = get_current_blog_id();
748-
$ignre = ( 'enable' === $action ) ? 1 : 0;
749-
$ignre_user = ( 'enable' === $action ) ? get_current_user_id() : null;
750-
$ignre_user_info = ( 'enable' === $action ) ? get_userdata( $ignre_user ) : '';
751-
$ignre_username = ( 'enable' === $action ) ? $ignre_user_info->user_login : '';
752-
$ignre_date = ( 'enable' === $action ) ? gmdate( 'Y-m-d H:i:s' ) : null;
753-
$ignre_date_formatted = ( 'enable' === $action ) ? gmdate( 'F j, Y g:i a', strtotime( $ignre_date ) ) : '';
754-
$ignre_comment = ( 'enable' === $action && isset( $_REQUEST['comment'] ) ) ? sanitize_textarea_field( wp_unslash( $_REQUEST['comment'] ) ) : null;
755-
$ignore_global = ( 'enable' === $action && isset( $_REQUEST['ignore_global'] ) ) ? sanitize_textarea_field( wp_unslash( $_REQUEST['ignore_global'] ) ) : 0;
724+
$action = isset( $_REQUEST['ignore_action'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['ignore_action'] ) ) : '';
725+
$type = isset( $_REQUEST['ignore_type'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['ignore_type'] ) ) : '';
726+
$siteid = get_current_blog_id();
727+
$ignre = ( 'enable' === $action ) ? 1 : 0;
728+
$ignre_user = ( 'enable' === $action ) ? get_current_user_id() : null;
729+
$ignre_user_info = ( 'enable' === $action ) ? get_userdata( $ignre_user ) : '';
730+
$ignre_username = ( 'enable' === $action ) ? $ignre_user_info->user_login : '';
731+
$ignre_date = ( 'enable' === $action ) ? gmdate( 'Y-m-d H:i:s' ) : null;
732+
$ignre_date_formatted = ( 'enable' === $action ) ? gmdate( 'F j, Y g:i a', strtotime( $ignre_date ) ) : '';
733+
$ignre_comment = ( 'enable' === $action && isset( $_REQUEST['comment'] ) ) ? sanitize_textarea_field( wp_unslash( $_REQUEST['comment'] ) ) : null;
734+
$ignore_global = ( 'enable' === $action && isset( $_REQUEST['ignore_global'] ) ) ? sanitize_textarea_field( wp_unslash( $_REQUEST['ignore_global'] ) ) : 0;
756735

757736
// If largeBatch is set and 'true', we need to perform an update using the 'object'
758737
// instead of IDs. It is a much less efficient query than by IDs - but many IDs run
@@ -764,8 +743,7 @@ function ( $value ) {
764743
$object = $wpdb->get_var( $wpdb->prepare( 'SELECT object FROM %i WHERE id = %d', $table_name, $first_id ) );
765744

766745
if ( ! $object ) {
767-
$error = new \WP_Error( '-2', __( 'No ignore data to return', 'accessibility-checker' ) );
768-
wp_send_json_error( $error );
746+
wp_send_json_error( new \WP_Error( '-2', __( 'No ignore data to return', 'accessibility-checker' ) ) );
769747
}
770748
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Safe variable used for table name, caching not required for one time operation.
771749
$wpdb->query( $wpdb->prepare( 'UPDATE %i SET ignre = %d, ignre_user = %d, ignre_date = %s, ignre_comment = %s, ignre_global = %d WHERE siteid = %d and object = %s', $table_name, $ignre, $ignre_user, $ignre_date, $ignre_comment, $ignore_global, $siteid, $object ) );
@@ -786,10 +764,7 @@ function ( $value ) {
786764
];
787765

788766
if ( ! $data ) {
789-
790-
$error = new \WP_Error( '-2', __( 'No ignore data to return', 'accessibility-checker' ) );
791-
wp_send_json_error( $error );
792-
767+
wp_send_json_error( new \WP_Error( '-2', __( 'No ignore data to return', 'accessibility-checker' ) ) );
793768
}
794769
wp_send_json_success( wp_json_encode( $data ) );
795770
}
@@ -802,37 +777,33 @@ function ( $value ) {
802777
* - '-1' means that nonce could not be varified
803778
* - '-2' means that the post ID was not specified
804779
* - '-3' means that the summary was not specified
780+
* - '-5' means that the user does not have permission to view this information for this post
805781
*/
806782
public function simplified_summary() {
807783

808784
// nonce security.
809785
if ( ! isset( $_REQUEST['nonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_REQUEST['nonce'] ) ), 'ajax-nonce' ) ) {
810-
811-
$error = new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) );
812-
wp_send_json_error( $error );
813-
786+
wp_send_json_error( new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) ) );
814787
}
815788

816789
if ( ! isset( $_REQUEST['post_id'] ) ) {
817-
818-
$error = new \WP_Error( '-2', __( 'The post ID was not set', 'accessibility-checker' ) );
819-
wp_send_json_error( $error );
820-
790+
wp_send_json_error( new \WP_Error( '-2', __( 'The post ID was not set', 'accessibility-checker' ) ) );
821791
}
822792

823793
if ( ! isset( $_REQUEST['summary'] ) ) {
794+
wp_send_json_error( new \WP_Error( '-3', __( 'The summary was not set', 'accessibility-checker' ) ) );
795+
}
824796

825-
$error = new \WP_Error( '-3', __( 'The summary was not set', 'accessibility-checker' ) );
826-
wp_send_json_error( $error );
827-
797+
if ( ! current_user_can( 'edit_post', (int) $_REQUEST['post_id'] ) ) {
798+
wp_send_json_error( new \WP_Error( '-5', __( 'You do not have permission to edit this post.', 'accessibility-checker' ) ) );
828799
}
829800

830-
$post_id = (int) $_REQUEST['post_id'];
831-
update_post_meta(
832-
$post_id,
833-
'_edac_simplified_summary',
834-
sanitize_text_field( wp_unslash( $_REQUEST['summary'] ) )
835-
);
801+
$post_id = (int) $_REQUEST['post_id'];
802+
update_post_meta(
803+
$post_id,
804+
'_edac_simplified_summary',
805+
sanitize_text_field( wp_unslash( $_REQUEST['summary'] ) )
806+
);
836807

837808
$edac_simplified_summary = get_post_meta( $post_id, '_edac_simplified_summary', $single = true );
838809
$simplified_summary = $edac_simplified_summary ? $edac_simplified_summary : '';

‎admin/class-frontend-highlight.php‎

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -74,9 +74,8 @@ public function get_issues( $post_id ) {
7474
*/
7575
public function ajax() {
7676

77-
if ( ! check_ajax_referer( 'ajax-nonce', 'nonce', false ) ) {
78-
$error = new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) );
79-
wp_send_json_error( $error );
77+
if ( ! check_ajax_referer( 'frontend-highlighter', 'nonce', false ) ) {
78+
wp_send_json_error( new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) ) );
8079
}
8180

8281
if ( ! isset( $_REQUEST['post_id'] ) ) {
@@ -85,11 +84,31 @@ public function ajax() {
8584
}
8685

8786
$post_id = isset( $_REQUEST['post_id'] ) ? (int) $_REQUEST['post_id'] : 0;
87+
$post = get_post( $post_id );
88+
if ( ! $post ) {
89+
wp_send_json_error( new \WP_Error( '-4', __( 'Post not found', 'accessibility-checker' ) ) );
90+
}
91+
92+
// Check if the user has permission to view this post.
93+
if ( is_user_logged_in() ) {
94+
// For authenticated users, use read_post capability.
95+
if ( ! current_user_can( 'read_post', $post_id ) ) {
96+
wp_send_json_error( new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) ) );
97+
}
98+
} elseif ( apply_filters( 'edac_filter_frontend_highlighter_visibility', false ) ) {
99+
// For unauthenticated users, only allow access to publicly viewable posts.
100+
if ( ! is_post_publicly_viewable( $post ) ) {
101+
wp_send_json_error( new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) ) );
102+
}
103+
} else {
104+
// Shouldn't ever reach this point but error just in case.
105+
wp_send_json_error( new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) ) );
106+
}
107+
88108
$results = $this->get_issues( $post_id );
89109

90110
if ( ! $results ) {
91-
$error = new \WP_Error( '-3', __( 'Issue query returned no results', 'accessibility-checker' ) );
92-
wp_send_json_error( $error );
111+
wp_send_json_error( new \WP_Error( '-3', __( 'Issue query returned no results', 'accessibility-checker' ) ) );
93112
}
94113

95114
$rules = edac_register_rules();
@@ -133,10 +152,7 @@ public function ajax() {
133152
}
134153

135154
if ( ! $issues ) {
136-
137-
$error = new \WP_Error( '-5', __( 'Object query returned no results', 'accessibility-checker' ) );
138-
wp_send_json_error( $error );
139-
155+
wp_send_json_error( new \WP_Error( '-5', __( 'Object query returned no results', 'accessibility-checker' ) ) );
140156
}
141157

142158
// if we have fixes then create fields for each of the groups.

‎admin/opt-in/class-email-opt-in.php‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,16 @@ public static function render_form(): void {
146146
</div>
147147
</div>
148148
<div class="_button-wrapper _full_width edac-mt-3 edac-mb-3">
149+
<small>
150+
<?php
151+
printf(
152+
/* translators: 1: link to privacy policy page. 2: link close tag. */
153+
esc_html__( 'By subscribing, you consent to receive emails in accordance with our %1$sPrivacy Policy%2$s.', 'accessibility-checker' ),
154+
'<a href="' . esc_url( edac_link_wrapper( 'https://equalizedigital.com/privacy-policy/', 'email_newsletter', 'privacy', false ) ) . '" target="_blank">',
155+
'</a>'
156+
);
157+
?>
158+
</small>
149159
<button id="_form_1_submit" class="_submit button button-primary" type="submit">
150160
Subscribe
151161
</button>

‎includes/classes/class-enqueue-frontend.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,8 +100,8 @@ public static function maybe_enqueue_frontend_highlighter() {
100100
'edacFrontendHighlighterApp',
101101
[
102102
'postID' => $post_id,
103-
'nonce' => wp_create_nonce( 'ajax-nonce' ),
104-
'restNonce' => wp_create_nonce( 'wp_rest' ),
103+
'nonce' => wp_create_nonce( 'frontend-highlighter' ),
104+
'restNonce' => is_user_logged_in() ? wp_create_nonce( 'wp_rest' ) : '',
105105
'userCanFix' => current_user_can( apply_filters( 'edac_filter_settings_capability', 'manage_options' ) ),
106106
'userCanEdit' => current_user_can( 'edit_post', $post_id ),
107107
'edacUrl' => esc_url_raw( get_site_url() ),

0 commit comments

Comments
 (0)