Skip to content

Commit eb1514e

Browse files
otarheotarhe
authored
Merge pull request #20 from pressable/security-performance-php81-audit
Security, performance & PHP 8.1 audit - 23 findings fixed
2 parents 5a32e57 + 924102c commit eb1514e

26 files changed

Lines changed: 297 additions & 259 deletions

‎admin/admin-menu.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ function pressable_cache_management_add_toplevel_menu()
5858
$remove_pressable_branding_tab_options = get_option('remove_pressable_branding_tab_options');
5959

6060

61-
if ($remove_pressable_branding_tab_options && 'disable' == $remove_pressable_branding_tab_options['branding_on_off_radio_button'] )
61+
if ( is_array( $remove_pressable_branding_tab_options ) && isset( $remove_pressable_branding_tab_options['branding_on_off_radio_button'] ) && 'disable' === $remove_pressable_branding_tab_options['branding_on_off_radio_button'] )
6262
{
6363

6464
add_menu_page(esc_html__('Cache Management Settings', 'pressable_cache_management') , esc_html__('Cache Control', 'pressable_cache_management') , 'manage_options', 'pressable_cache_management', 'pressable_cache_management_display_settings_page',

‎admin/custom-functions/cache-purge-admin-bar.php‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ function cache_purge_action_js() { ?>
3737
jQuery("li#wp-admin-bar-cache-purge .ab-item").on( "click", function() {
3838
var data = {
3939
'action': 'pressable_cache_purge',
40+
'_ajax_nonce': '<?php echo esc_js( wp_create_nonce( 'pressable_cache_purge_nonce' ) ); ?>',
4041
};
4142

4243
jQuery.post(ajaxurl, data, function(response) {
@@ -63,13 +64,17 @@ function cache_purge_action_js() { ?>
6364

6465

6566
function pressable_cache_purge_callback() {
67+
check_ajax_referer( 'pressable_cache_purge_nonce' );
68+
69+
if ( ! current_user_can( 'manage_options' ) ) {
70+
wp_send_json_error( array( 'message' => 'Unauthorized' ), 403 );
71+
}
72+
6673
wp_cache_flush();
6774

6875
//Save time stamp to database if cache is flushed.
69-
$object_cache_flush_time = date( ' jS F Y g:ia' ) . "\nUTC";
76+
$object_cache_flush_time = gmdate( 'j M Y, g:ia' ) . ' UTC';
7077

7178
update_option( 'flush-obj-cache-time-stamp', $object_cache_flush_time );
72-
$response = 'Object Cache Purged';
73-
echo $response;
74-
wp_die();
79+
wp_send_json_success( array( 'message' => 'Object Cache Purged' ) );
7580
}

‎admin/custom-functions/cache-wpp-cookie-page.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ function cache_wpp_cookies_pages_admin_notice($message = '', $classes = 'notice-
6161

6262
if (!empty($message))
6363
{
64-
printf('<div class="notice %2$s">%1$s</div>', $message, $classes);
64+
printf('<div class="notice %2$s">%1$s</div>', wp_kses_post( $message ), esc_attr( $classes ));
6565
}
6666
}
6767

‎admin/custom-functions/defensive-mode-edge-cache.php‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -92,8 +92,8 @@ function pcm_pressable_enable_defensive_mode() {
9292
),
9393
) );
9494

95-
if ( false === $result['success'] ) {
96-
$err = ! empty( $result['error'] ) ? $result['error'] : esc_html__( 'Unknown error enabling Defensive Mode.', 'pressable_cache_management' );
95+
if ( ! is_array( $result ) || empty( $result['success'] ) ) {
96+
$err = ( is_array( $result ) && ! empty( $result['error'] ) ) ? $result['error'] : esc_html__( 'Unknown error enabling Defensive Mode.', 'pressable_cache_management' );
9797
add_action( 'admin_notices', function() use ( $err ) {
9898
if ( function_exists( 'pcm_branded_notice' ) ) {
9999
pcm_branded_notice( $err, '#dd3a03' );
@@ -149,8 +149,8 @@ function pcm_pressable_disable_defensive_mode() {
149149
),
150150
) );
151151

152-
if ( false === $result['success'] ) {
153-
$err = ! empty( $result['error'] ) ? $result['error'] : esc_html__( 'Unknown error disabling Defensive Mode.', 'pressable_cache_management' );
152+
if ( ! is_array( $result ) || empty( $result['success'] ) ) {
153+
$err = ( is_array( $result ) && ! empty( $result['error'] ) ) ? $result['error'] : esc_html__( 'Unknown error disabling Defensive Mode.', 'pressable_cache_management' );
154154
add_action( 'admin_notices', function() use ( $err ) {
155155
if ( function_exists( 'pcm_branded_notice' ) ) {
156156
pcm_branded_notice( $err, '#dd3a03' );
@@ -177,6 +177,8 @@ function pcm_pressable_disable_defensive_mode() {
177177
// Uses get_ec_ddos_until() which calls query_ec_backend( 'ddos_until' ) as a
178178
// GET (no body args) and returns the ddos_until Unix timestamp, or 0 if off.
179179
function pcm_ajax_check_defensive_mode_status() {
180+
check_ajax_referer( 'pcm_defensive_mode_status_nonce' );
181+
180182
if ( ! current_user_can( 'manage_options' ) ) {
181183
wp_send_json_error( [ 'message' => 'Unauthorized' ], 403 );
182184
return;

‎admin/custom-functions/exclude-query-string-gclid-from-cache.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ function exclude_query_string_gclid_admin_notice($message = '', $classes = 'noti
6363

6464
if (!empty($message))
6565
{
66-
printf('<div class="notice %2$s">%1$s</div>', $message, $classes);
66+
printf('<div class="notice %2$s">%1$s</div>', wp_kses_post( $message ), esc_attr( $classes ));
6767
}
6868
}
6969

‎admin/custom-functions/flush-batcache-for-particular-page.php‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
add_action( 'init', 'pcm_show_flush_cache_column' );
1515

1616
function pcm_show_flush_cache_column() {
17-
if ( current_user_can('administrator') || current_user_can('editor') || current_user_can('manage_woocommerce') ) {
17+
if ( current_user_can('manage_options') || current_user_can('edit_posts') || current_user_can('manage_woocommerce') ) {
1818
$column = new FlushObjectCachePageColumn();
1919
$column->add();
2020
}
@@ -24,7 +24,7 @@ function flush_object_cache_for_single_page_notice() {
2424
$state = get_option( 'flush-object-cache-for-single-page-notice', 'activating' );
2525

2626
if ( 'activating' === $state &&
27-
( current_user_can('administrator') || current_user_can('editor') || current_user_can('manage_woocommerce') )
27+
( current_user_can('manage_options') || current_user_can('edit_posts') || current_user_can('manage_woocommerce') )
2828
) {
2929
add_action( 'admin_notices', function() {
3030
$screen = get_current_screen();
@@ -68,7 +68,7 @@ public function add() {
6868
}
6969

7070
public function add_flush_object_cache_link( $actions, $post ) {
71-
if ( current_user_can('administrator') || current_user_can('editor') || current_user_can('manage_woocommerce') ) {
71+
if ( current_user_can('manage_options') || current_user_can('edit_posts') || current_user_can('manage_woocommerce') ) {
7272
$actions['flush_object_cache_url'] =
7373
'<a data-id="' . esc_attr( $post->ID ) . '"'
7474
. ' data-nonce="' . wp_create_nonce( 'flush-object-cache_' . $post->ID ) . '"'
@@ -80,28 +80,28 @@ public function add_flush_object_cache_link( $actions, $post ) {
8080
}
8181

8282
public function flush_object_cache_column() {
83-
if ( ! ( current_user_can('administrator') || current_user_can('editor') || current_user_can('manage_woocommerce') ) ) {
84-
die( json_encode( array( 'success' => false, 'message' => 'Unauthorized' ) ) );
83+
if ( ! ( current_user_can('manage_options') || current_user_can('edit_posts') || current_user_can('manage_woocommerce') ) ) {
84+
wp_send_json_error( array( 'message' => 'Unauthorized' ), 403 );
8585
}
8686

87-
if ( ! isset( $_GET['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['nonce'] ) ), 'flush-object-cache_' . intval( $_GET['id'] ) ) ) {
88-
die( json_encode( array( 'success' => false, 'message' => 'Nonce verification failed' ) ) );
87+
if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'flush-object-cache_' . intval( $_POST['id'] ) ) ) {
88+
wp_send_json_error( array( 'message' => 'Nonce verification failed' ), 403 );
8989
}
9090

91-
$url_key = get_permalink( intval( $_GET['id'] ) );
92-
$page_title = get_the_title( intval( $_GET['id'] ) );
91+
$url_key = get_permalink( intval( $_POST['id'] ) );
92+
$page_title = get_the_title( intval( $_POST['id'] ) );
9393
update_option( 'page-title', $page_title );
9494

9595
global $batcache, $wp_object_cache;
9696

9797
if ( ! isset( $batcache ) || ! is_object( $batcache ) || ! method_exists( $wp_object_cache, 'incr' ) ) {
98-
die( json_encode( array( 'success' => false ) ) );
98+
wp_send_json_error( array( 'message' => 'Batcache not available' ) );
9999
}
100100

101101
$batcache->configure_groups();
102102
$url = apply_filters( 'batcache_manager_link', $url_key );
103103
if ( empty( $url ) ) {
104-
die( json_encode( array( 'success' => false ) ) );
104+
wp_send_json_error( array( 'message' => 'Empty URL' ) );
105105
}
106106

107107
do_action( 'batcache_manager_before_flush', $url );
@@ -111,11 +111,12 @@ public function flush_object_cache_column() {
111111
wp_cache_add( "{$url_key}_version", 0, $batcache->group );
112112
wp_cache_incr( "{$url_key}_version", 1, $batcache->group );
113113

114+
$retval = wp_cache_get( "{$url_key}_version", $batcache->group );
114115
if ( property_exists( $wp_object_cache, 'no_remote_groups' ) ) {
115116
$k = array_search( $batcache->group, (array) $wp_object_cache->no_remote_groups );
116117
if ( false !== $k ) {
117118
unset( $wp_object_cache->no_remote_groups[ $k ] );
118-
wp_cache_set( "{$url_key}_version", $batcache->group );
119+
wp_cache_set( "{$url_key}_version", $retval, $batcache->group );
119120
$wp_object_cache->no_remote_groups[ $k ] = $batcache->group;
120121
}
121122
}
@@ -125,14 +126,15 @@ public function flush_object_cache_column() {
125126
// Also store the flushed URL so it shows on the settings page
126127
update_option( 'single-page-url-flushed', $url );
127128

128-
die( json_encode( array( 'success' => true ) ) );
129+
wp_send_json_success( array( 'message' => 'Cache flushed' ) );
129130
}
130131

131132
public function load_js() {
133+
$js_file = plugin_dir_path( dirname( __FILE__ ) ) . 'public/js/column.js';
132134
wp_enqueue_script(
133135
'flush-object-cache-column',
134136
plugin_dir_url( dirname( __FILE__ ) ) . 'public/js/column.js',
135-
array(), time(), true
137+
array(), file_exists( $js_file ) ? filemtime( $js_file ) : '1.0', true
136138
);
137139
}
138140
}

‎admin/custom-functions/flush-batcache-for-woo-individual-page.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
$needs_update = ! file_exists( $mu_plugin_dest )
2929
|| ( file_exists( $mu_plugin_src ) && md5_file( $mu_plugin_src ) !== md5_file( $mu_plugin_dest ) );
3030

31-
if ( $needs_update && file_exists( $mu_plugin_src ) && @copy( $mu_plugin_src, $mu_plugin_dest ) ) {
31+
if ( $needs_update && file_exists( $mu_plugin_src ) && copy( $mu_plugin_src, $mu_plugin_dest ) ) {
3232
if ( ! file_exists( $mu_plugin_dest ) ) {
3333
// Only flush and show notice on fresh enable, not on every update
3434
wp_cache_flush();
@@ -93,7 +93,7 @@ function pcm_woo_individual_page_render_notice() {
9393
update_option( 'flush_batcache_for_woo_product_individual_page_activate_notice', 'activating' );
9494

9595
if ( file_exists( $mu_plugin_dest ) ) {
96-
@unlink( $mu_plugin_dest );
96+
unlink( $mu_plugin_dest );
9797
wp_cache_flush();
9898
}
9999

‎admin/custom-functions/flush-cache-on-comment-delete.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
<?php // Pressable Cache Management - Flush cache when comment is deleted
22

3+
if ( ! defined( 'ABSPATH' ) ) {
4+
exit;
5+
}
6+
37
$options = get_option('pressable_cache_management_options');
48

59

@@ -21,7 +25,7 @@ function pcm_trash_comment_action( $comment_id, $comment ){
2125
wp_cache_flush();
2226

2327
//Save time stamp to database if cache is flushed when comment is deleted.
24-
$object_cache_flush_time = date(' jS F Y g:ia') . "\nUTC";
28+
$object_cache_flush_time = gmdate( 'j M Y, g:ia' ) . ' UTC';
2529
update_option('flush-cache-on-comment-delete-time-stamp', $object_cache_flush_time);
2630
}
2731

‎admin/custom-functions/flush-cache-on-page-edit.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,11 +67,12 @@ function pcm_flush_batcache_on_page_edit( $post_id, $post, $update ) {
6767
wp_cache_incr( "{$url_key}_version", 1, $batcache->group );
6868

6969
// Handle sites where the Batcache group is excluded from remote sync
70+
$retval = wp_cache_get( "{$url_key}_version", $batcache->group );
7071
if ( property_exists( $wp_object_cache, 'no_remote_groups' ) ) {
7172
$k = array_search( $batcache->group, (array) $wp_object_cache->no_remote_groups );
7273
if ( false !== $k ) {
7374
unset( $wp_object_cache->no_remote_groups[ $k ] );
74-
wp_cache_set( "{$url_key}_version", $batcache->group );
75+
wp_cache_set( "{$url_key}_version", $retval, $batcache->group );
7576
$wp_object_cache->no_remote_groups[ $k ] = $batcache->group;
7677
}
7778
}

‎admin/custom-functions/flush-cache-on-page-post-delete.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,8 @@ function fire_on_page_post_delete( $post_ID, $post_after, $post_before ) {
2525
wp_cache_flush();
2626
}
2727

28-
// Save time stamp to database if cache is flushed when a post or page was daleted.
29-
$object_cache_flush_time = date(' jS F Y g:ia') . "\nUTC";
28+
// Save time stamp to database if cache is flushed when a post or page was deleted.
29+
$object_cache_flush_time = gmdate( 'j M Y, g:ia' ) . ' UTC';
3030
update_option('flush-cache-on-page-post-delete-time-stamp', $object_cache_flush_time);
3131

3232
//Set transient for admin notice for 9 seconds

0 commit comments

Comments
 (0)