Fix security escaping in plugin installer

- Sanitize POST variables with sanitize_text_field() and sanitize_key()
- Add wp_unslash() and isset() checks for POST data
- Escape plugin author output with wp_kses()
- Replace die() with wp_die()

Author: pfefferle

includes/class-plugin-installer.php

@@ -127,7 +127,7 @@ public static function render_template( $plugin, $api, $button_text, $button_cla
 					<h2><?php echo esc_html( $api->name ); ?></h2>
 					<p><?php echo esc_html( $api->short_description ); ?></p>
 
-					<p class="plugin-author"><?php esc_html_e( 'By', 'indieweb' ); ?> <?php echo $api->author; // phpcs:ignore ?></p>
+					<p class="plugin-author"><?php esc_html_e( 'By', 'indieweb' ); ?> <?php echo wp_kses( $api->author, array( 'a' => array( 'href' => array() ) ) ); ?></p>
 				</div>
 				<ul class="activation-row">
 					<li>
@@ -160,8 +160,8 @@ public function cnkt_plugin_installer() {
 				wp_die( esc_html( __( 'Sorry, you are not allowed to install plugins on this site.', 'indieweb' ) ) );
 			}
 
-			$nonce  = $_POST['nonce']; // phpcs:ignore
-			$plugin = $_POST['plugin']; // phpcs:ignore
+			$nonce  = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
+			$plugin = isset( $_POST['plugin'] ) ? sanitize_key( wp_unslash( $_POST['plugin'] ) ) : '';
 
 			// Check our nonce, if they don't match then bounce!
 			if ( ! wp_verify_nonce( $nonce, 'cnkt_installer_nonce' ) ) {
@@ -227,12 +227,12 @@ public function cnkt_plugin_activation() {
 				wp_die( esc_html( __( 'Sorry, you are not allowed to activate plugins on this site.', 'indieweb' ) ) );
 			}
 
-			$nonce  = $_POST['nonce']; // phpcs:ignore
-			$plugin = $_POST['plugin']; // phpcs:ignore
+			$nonce  = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
+			$plugin = isset( $_POST['plugin'] ) ? sanitize_key( wp_unslash( $_POST['plugin'] ) ) : '';
 
 			// Check our nonce, if they don't match then bounce!
 			if ( ! wp_verify_nonce( $nonce, 'cnkt_installer_nonce' ) ) {
-				die( esc_html( __( 'Error - unable to verify nonce, please try again.', 'indieweb' ) ) );
+				wp_die( esc_html( __( 'Error - unable to verify nonce, please try again.', 'indieweb' ) ) );
 			}
 
 			// Include required libs for activation.