diff --git a/.travis.yml b/.travis.yml index ddd5082..a8aaf65 100644 --- a/.travis.yml +++ b/.travis.yml @@ -49,4 +49,4 @@ before_script: - sed -i "s/yourpasswordhere//" wp-tests-config.php - cd "/tmp/wordpress/src/wp-content/plugins/$PLUGIN_SLUG" -script: phpunit \ No newline at end of file +script: phpunit diff --git a/class-bjgk-genesis-enews-extended.php b/class-bjgk-genesis-enews-extended.php index 2be83da..2292552 100644 --- a/class-bjgk-genesis-enews-extended.php +++ b/class-bjgk-genesis-enews-extended.php @@ -3,10 +3,10 @@ * Genesis eNews Extended * * @package BJGK\Genesis_enews_extended - * @version 2.0.2 + * @version 2.1.0 * @author Brandon Kraft - * @link http://www.brandonkraft.com/genesis-enews-extended/ - * @copyright Copyright (c) 2012-2015, Brandon Kraft + * @link https://kraft.blog/genesis-enews-extended/ + * @copyright Copyright (c) 2012-2018, Brandon Kraft * @license GPL-2.0+ */ @@ -16,7 +16,7 @@ * @package BJGK\Genesis_enews_extended * @author Brandon Kraft */ -class BJGK_Genesis_eNews_Extended extends WP_Widget { +class BJGK_Genesis_ENews_Extended extends WP_Widget { /** * Holds widget settings defaults, populated in constructor. @@ -30,24 +30,25 @@ class BJGK_Genesis_eNews_Extended extends WP_Widget { * * @since 0.1.0 */ - function __construct() { + public function __construct() { $this->defaults = array( - 'title' => '', - 'text' => '', - 'after_text' => '', - 'hidden_fields' => '', - 'open_same_window' => 0, - 'fname-field' => '', - 'lname-field' => '', - 'input_text' => '', - 'fname_text' => '', - 'lname_text' => '', - 'button_text' => '', - 'id' => '', - 'email-field' => '', - 'action' => '', - 'mailpoet_check' => __( 'Check your inbox or spam folder now to confirm your subscription.', 'wysija-newsletters' ), - 'mailpoet_subbed' => __( "You've successfully subscribed.", 'wysija-newsletters' ), + 'title' => '', + 'text' => '', + 'after_text' => '', + 'hidden_fields' => '', + 'open_same_window' => 0, + 'fname-field' => '', + 'lname-field' => '', + 'input_text' => '', + 'fname_text' => '', + 'lname_text' => '', + 'button_text' => '', + 'id' => '', + 'email-field' => '', + 'action' => '', + 'display_privacy' => 0, + 'mailpoet_check' => __( 'Check your inbox or spam folder now to confirm your subscription.', 'wysija-newsletters' ), + 'mailpoet_subbed' => __( "You've successfully subscribed.", 'wysija-newsletters' ), ); $widget_ops = array( @@ -61,90 +62,138 @@ function __construct() { /** * Echo the widget content. * + * The WordPress.CSRF.NonceVerification sniff is disabled since we are dealing with intentionally logged-out submissions. + * * @since 0.1.0 * * @param array $args Display arguments including before_title, after_title, before_widget, and after_widget. * @param array $instance The settings for the particular instance of the widget. */ - function widget( $args, $instance ) { - extract( $args ); - - // Merge with defaults + public function widget( $args, $instance ) { + // phpcs:disable WordPress.CSRF.NonceVerification + $before_widget = $args['before_widget']; + $before_title = $args['before_title']; + $after_title = $args['after_title']; + $after_widget = $args['after_widget']; + + // Merge with defaults. $instance = wp_parse_args( (array) $instance, $this->defaults ); - $instance = apply_filters( 'genesis-enews-extended-args', $instance ); + $instance = apply_filters( 'genesis-enews-extended-args', $instance ); //phpcs:ignore WordPress.NamingConventions.ValidHookName - // Checks if MailPoet exists. If so, a check for form submission wil take place. - if ( class_exists( 'WYSIJA' ) && isset( $_POST['submission-type'] ) && 'mailpoet' == $_POST['submission-type'] && ! empty( $instance['mailpoet-list'] ) ) { + // Checks if MailPoet exists. If so, a check for form submission will take place. + if ( class_exists( 'WYSIJA' ) && isset( $_POST['submission-type'] ) && 'mailpoet' === $_POST['submission-type'] && ! empty( $instance['mailpoet-list'] ) ) { // Input var okay. $subscriber_data = array( - 'user' => array( - 'firstname' => isset( $_POST['mailpoet-firstname'] ) ? $_POST['mailpoet-firstname'] : '', - 'lastname' => isset( $_POST['mailpoet-lastname'] ) ? $_POST['mailpoet-lastname'] : '', - 'email' => isset( $_POST['mailpoet-email'] ) ? $_POST['mailpoet-email'] : '', + 'user' => array( + 'firstname' => isset( $_POST['mailpoet-firstname'] ) ? sanitize_title( wp_unslash( $_POST['mailpoet-firstname'] ) ) : '', // Input var okay. + 'lastname' => isset( $_POST['mailpoet-lastname'] ) ? sanitize_title( wp_unslash( $_POST['mailpoet-lastname'] ) ) : '', // Input var okay. + 'email' => isset( $_POST['mailpoet-email'] ) ? sanitize_email( wp_unslash( $_POST['mailpoet-email'] ) ) : '', // Input var okay. ), 'user_list' => array( - 'list_ids' => array_values( $instance['mailpoet-list'] ) + 'list_ids' => array_values( $instance['mailpoet-list'] ), ), ); - $mailpoet_subscriber_id = WYSIJA::get( 'user', 'helper' )->addSubscriber( $subscriber_data ); + $mailpoet_subscriber_id = WYSIJA::get( 'user', 'helper' )->addSubscriber( $subscriber_data ); } - // Set default fname_text, lname_text for backwards compat for installs upgraded from 0.1.6+ to 0.3.0+ - if (empty($instance['fname_text'])) { - $instance['fname_text'] = "First Name"; + // Set default fname_text, lname_text for backwards compat for installs upgraded from 0.1.6+ to 0.3.0+. + if ( empty( $instance['fname_text'] ) ) { + $instance['fname_text'] = 'First Name'; } - if (empty($instance['lname_text'])) { - $instance['lname_text'] = "Last Name"; + if ( empty( $instance['lname_text'] ) ) { + $instance['lname_text'] = 'Last Name'; } // Establishes current URL for MailPoet action fields. - $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; + $current_url = ( is_ssl() ? 'https://' : 'http://' ) . wp_unslash( $_SERVER['HTTP_HOST'] ) . wp_unslash( $_SERVER['REQUEST_URI'] ); // Input var okay; sanitization okay. - echo $before_widget . '
'; + // We run KSES on update since we want to allow some HTML, so ignoring the ouput escape check. + echo $before_widget . '
'; // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped - if ( ! empty( $instance['title'] ) ) - echo $before_title . apply_filters( 'widget_title', $instance['title'], $instance, $this->id_base ) . $after_title; + if ( ! empty( $instance['title'] ) ) { + // We run KSES on update since we want to allow some HTML, so ignoring the ouput escape check. + echo $before_title . apply_filters( 'widget_title', $instance['title'], $instance, $this->id_base ) . $after_title; // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped + } - echo wpautop( apply_filters( 'gee_text', $instance['text'] ) ); // We run KSES on update + // We run KSES on update since we want to allow some HTML, so ignoring the ouput escape check. + echo wpautop( apply_filters( 'gee_text', $instance['text'] ) ); // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped if ( ! empty( $instance['id'] ) ) : ?> -
- required="required" /> + + + required="required" />
-
target="_blank" onsubmit="if ( subbox1.value == '') { subbox1.value = ''; } if ( subbox2.value == '') { subbox2.value = ''; }" name="id ); ?>"> - - - required="required" /> - + + target="_blank" onsubmit="if ( subbox1.value == '') { subbox1.value = ''; } if ( subbox2.value == '') { subbox2.value = ''; }" name="id ); ?>"> + + + + + + required="required" /> + // We run KSES on update since we want to allow some HTML, so ignoring the ouput escape check. +
- -
- getValue( 'confirm_dbleoptin' ); // bool - $success_message = $mailpoet_needs_confirmation ? $instance['mailpoet_check'] : $instance['mailpoet_subbed']; + + + getValue( 'confirm_dbleoptin' ); // bool. + $success_message = $mailpoet_needs_confirmation ? $instance['mailpoet_check'] : $instance['mailpoet_subbed']; ?>
- - - required="required" /> - + + + + + + required="required" /> + // We run KSES on update since we want to allow some HTML, so ignoring the ouput escape check. +
- ', ''); + + } + // We run KSES on update since we want to allow some HTML, so ignoring the ouput escape check. + echo wpautop( apply_filters( 'gee_after_text', $instance['after_text'] ) ); // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped - echo '
' . $after_widget; + echo '
' . $after_widget; // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped + // phpcs:enable WordPress.CSRF.NonceVerification } /** @@ -155,24 +204,27 @@ function widget( $args, $instance ) { * If false is returned, the instance won't be saved / updated. * * @since 0.1.0 + * @since 2.0.3 Allow "a" tags in the Hidden Fields setting. * * @param array $new_instance New settings for this instance as input by the user via form(). * @param array $old_instance Old settings for this instance. * * @return array Settings to save or bool false to cancel saving */ - function update( $new_instance, $old_instance ) { - $new_instance['title'] = strip_tags( $new_instance['title'], "" ); - $new_instance['text'] = wp_kses_post( $new_instance['text']); - $new_instance['hidden_fields'] = strip_tags( $new_instance['hidden_fields'], "
,
, ,