Tt 3643 fix issues causing closure of suffice toolkit plugin on word press org

includes/abstracts/views/html-admin-tmpl-repeater.php

@@ -7,15 +7,15 @@
 	exit;
 }
 
-$repeater_field_id = strtolower( str_replace( ' ', '-', $setting['title'] ) ) . '-{{ data.field_id }}';
-$max_field_entries = count( (array) $value  ) >= apply_filters( 'suffice_toolkit_maximum_repeater_field_entries', 5 ) ? 'disabled' : 'enabled';
+$suffice_toolkit_repeater_field_id = strtolower( str_replace( ' ', '-', $setting['title'] ) ) . '-{{ data.field_id }}';
+$suffice_toolkit_max_field_entries = count( (array) $value ) >= apply_filters( 'suffice_toolkit_maximum_repeater_field_entries', 5 ) ? 'disabled' : 'enabled';
 
 ?>
 <div id="tg-widget-repeater-field" class="accordion-sortables">
-	<p><label for="<?php echo $this->get_field_id( $key ); ?>"><?php echo esc_html( $setting['label'] ); ?></label></p>
+	<p><label for="<?php echo esc_attr( $this->get_field_id( $key ) ); ?>"><?php echo esc_html( $setting['label'] ); ?></label></p>
 	<ul class="tg-widget-repeater-field-items" data-widget_id="<?php echo esc_attr( $this->id ); ?>">
 		<?php if ( ! empty( $value ) ) : ?>
-			<?php foreach ( $value as $field_key => $field ) : ?>
+			<?php foreach ( $value as $field_key => $field ) : //phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound ?>
 				<li class="tg-widget-accordion-item" data-id="<?php echo esc_attr( $field_key ); ?>">
 					<div class="accordion-top">
 						<div class="accordion-title-action"><a class="accordion-action" href="#available-fields"></a></div>
@@ -33,21 +33,21 @@
 		<?php endif; ?>
 	</ul>
 	<div class="tg-widget-repeater-field-button">
-		<p><a href="#" class="button button-secondary tg-widget-repeater-field-add <?php echo esc_attr( $max_field_entries ); ?>"><?php echo esc_html( $setting['button'] ); ?></a></p>
+		<p><a href="#" class="button button-secondary tg-widget-repeater-field-add <?php echo esc_attr( $suffice_toolkit_max_field_entries ); ?>"><?php echo esc_html( $setting['button'] ); ?></a></p>
 	</div>
 	<?php if ( isset( $setting['desc'] ) ) : ?>
 		<small><?php echo wp_kses_post( $setting['desc'] ); ?></small>
 	<?php endif; ?>
 </div>
 
 <script type="text/html" id="tmpl-tg-widget-repeater-field-<?php echo esc_attr( $this->id ); ?>">
-	<li class="tg-widget-accordion-item open" data-id="<?php echo esc_attr( $repeater_field_id ); ?>">
+	<li class="tg-widget-accordion-item open" data-id="<?php echo esc_attr( $suffice_toolkit_repeater_field_id ); ?>">
 		<div class="accordion-top">
 			<div class="accordion-title-action"><a class="accordion-action" href="#available-fields"></a></div>
 			<div class="accordion-title"><h3><?php echo esc_attr( $setting['title'] ); ?><span class="in-accordion-title"></span></h3></div>
 		</div>
 		<div class="accordion-inside">
-			<?php $this->output_repeater_field( $setting['fields'], $instance, $key, $repeater_field_id, $setting['std'] ); ?>
+			<?php $this->output_repeater_field( $setting['fields'], $instance, $key, $suffice_toolkit_repeater_field_id, $setting['std'] ); ?>
 			<div class="accordion-control-actions alignright">
 				<a href="#" class="accordion-control-remove"><?php esc_html_e( 'Delete', 'suffice-toolkit' ); ?></a> | <a href="#" class="accordion-control-close"><?php esc_html_e( 'Close', 'suffice-toolkit' ); ?></a>
 			</div>
@@ -58,7 +58,7 @@
 
 <script type="text/html" id="tmpl-tg-widget-repeater-field-blank">
 	<li class="tg-widget-repeater-field-blank-state">
-		<h3 class="tg-widget-repeater-field-BlankState-message"><?php _e( 'When you add field, it will appear here.', 'suffice-toolkit' ); ?></h3>
-		<a class="tg-widget-repeater-field-BlankState-cta button-primary tg-widget-repeater-field-add" href="#"><?php _e( 'Create your first field!', 'suffice-toolkit' ); ?></a>
+		<h3 class="tg-widget-repeater-field-BlankState-message"><?php esc_html_e( 'When you add field, it will appear here.', 'suffice-toolkit' ); ?></h3>
+		<a class="tg-widget-repeater-field-BlankState-cta button-primary tg-widget-repeater-field-add" href="#"><?php esc_html_e( 'Create your first field!', 'suffice-toolkit' ); ?></a>
 	</li>
 </script>

includes/admin/class-suffice-admin-assets.php

@@ -37,11 +37,11 @@ public function admin_styles() {
 
 		$screen         = get_current_screen();
 		$screen_id      = $screen ? $screen->id : '';
-		$jquery_version = isset( $wp_scripts->registered['jquery-ui-core']->ver ) ? $wp_scripts->registered['jquery-ui-core']->ver : '1.9.2';
+		$jquery_version = isset( $wp_scripts->registered['jquery-ui-core']->ver ) ? $wp_scripts->registered['jquery-ui-core']->ver : '1.14.2';
 
 		// Register admin styles.
 		wp_register_style( 'font-awesome', ST()->plugin_url() . '/assets/css/fontawesome.css', array(), '4.6.3' );
-		wp_register_style( 'jquery-ui-style', '//code.jquery.com/ui/' . $jquery_version . '/themes/smoothness/jquery-ui.css', array(), $jquery_version );
+		wp_register_style( 'jquery-ui-style', ST()->plugin_url() . '/assets/css/jquery-ui.css', array(), $jquery_version );
 		wp_register_style( 'suffice-toolkit-menu', ST()->plugin_url() . '/assets/css/menu.css', array(), ST_VERSION );
 		wp_register_style( 'suffice-toolkit-admin', ST()->plugin_url() . '/assets/css/admin.css', array(), ST_VERSION );
 		wp_register_style( 'suffice-toolkit-admin-widgets', ST()->plugin_url() . '/assets/css/widgets.css', array( 'font-awesome', 'wp-color-picker' ), ST_VERSION );
@@ -70,30 +70,44 @@ public function admin_scripts() {
 		$suffix    = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ? '' : '.min';
 
 		// Register admin scripts.
-		wp_register_script( 'suffice-toolkit-admin', ST()->plugin_url() . '/assets/js/admin/admin' . $suffix . '.js', array( 'jquery', 'jquery-ui-sortable', 'jquery-ui-widget', 'jquery-ui-core', 'jquery-tiptip' ), ST_VERSION );
-		wp_register_script( 'suffice-toolkit-admin-widgets', ST()->plugin_url() . '/assets/js/admin/widgets' . $suffix . '.js', array( 'jquery', 'jquery-ui-sortable', 'wp-util', 'underscore', 'backbone', 'suffice-enhanced-select', 'wp-color-picker' ), ST_VERSION );
-		wp_register_script( 'suffice-toolkit-admin-sidebars', ST()->plugin_url() . '/assets/js/admin/sidebars' . $suffix . '.js', array( 'jquery' ), ST_VERSION );
+		wp_register_script( 'suffice-toolkit-admin', ST()->plugin_url() . '/assets/js/admin/admin' . $suffix . '.js', array( 'jquery', 'jquery-ui-sortable', 'jquery-ui-widget', 'jquery-ui-core', 'jquery-tiptip' ), ST_VERSION, true );
+		wp_register_script( 'suffice-toolkit-admin-widgets', ST()->plugin_url() . '/assets/js/admin/widgets' . $suffix . '.js', array( 'jquery', 'jquery-ui-sortable', 'wp-util', 'underscore', 'backbone', 'suffice-enhanced-select', 'wp-color-picker' ), ST_VERSION, true );
+		wp_register_script( 'suffice-toolkit-admin-sidebars', ST()->plugin_url() . '/assets/js/admin/sidebars' . $suffix . '.js', array( 'jquery' ), ST_VERSION, true );
 		wp_register_script( 'jquery-tiptip', ST()->plugin_url() . '/assets/js/jquery-tiptip/jquery.tipTip' . $suffix . '.js', array( 'jquery' ), ST_VERSION, true );
-		wp_register_script( 'select2', ST()->plugin_url() . '/assets/js/select2/select2' . $suffix . '.js', array( 'jquery' ), '4.0.3' );
-		wp_register_script( 'suffice-enhanced-select', ST()->plugin_url() . '/assets/js/admin/enhanced-select' . $suffix . '.js', array( 'jquery', 'select2' ), ST_VERSION );
-		wp_localize_script( 'suffice-enhanced-select', 'suffice_enhanced_select_params', array(
-			'i18n_matches_1'            => _x( 'One result is available, press enter to select it.', 'enhanced select', 'suffice-toolkit' ),
-			'i18n_matches_n'            => _x( '%qty% results are available, use up and down arrow keys to navigate.', 'enhanced select', 'suffice-toolkit' ),
-			'i18n_no_matches'           => _x( 'No matches found', 'enhanced select', 'suffice-toolkit' ),
-			'i18n_ajax_error'           => _x( 'Loading failed', 'enhanced select', 'suffice-toolkit' ),
-			'i18n_input_too_short_1'    => _x( 'Please enter 1 or more characters', 'enhanced select', 'suffice-toolkit' ),
-			'i18n_input_too_short_n'    => _x( 'Please enter %qty% or more characters', 'enhanced select', 'suffice-toolkit' ),
-			'i18n_input_too_long_1'     => _x( 'Please delete 1 character', 'enhanced select', 'suffice-toolkit' ),
-			'i18n_input_too_long_n'     => _x( 'Please delete %qty% characters', 'enhanced select', 'suffice-toolkit' ),
-			'i18n_selection_too_long_1' => _x( 'You can only select 1 item', 'enhanced select', 'suffice-toolkit' ),
-			'i18n_selection_too_long_n' => _x( 'You can only select %qty% items', 'enhanced select', 'suffice-toolkit' ),
-			'i18n_load_more'            => _x( 'Loading more results…', 'enhanced select', 'suffice-toolkit' ),
-			'i18n_searching'            => _x( 'Searching…', 'enhanced select', 'suffice-toolkit' )
-		) );
-		wp_localize_script( 'suffice-toolkit-admin-widgets', 'sufficeToolkitLocalizeScript', array(
-			'i18n_max_field_entries' => apply_filters( 'suffice_toolkit_maximum_repeater_field_entries', 5 ),
-			'i18n_max_field_message' => esc_js( sprintf( __( 'You can add upto %s fields.', 'suffice-toolkit' ), apply_filters( 'suffice_toolkit_maximum_repeater_field_entries', 5 ) ) ),
-		) );
+		wp_register_script( 'select2', ST()->plugin_url() . '/assets/js/select2/select2' . $suffix . '.js', array( 'jquery' ), '4.0.3', true );
+		wp_register_script( 'suffice-enhanced-select', ST()->plugin_url() . '/assets/js/admin/enhanced-select' . $suffix . '.js', array( 'jquery', 'select2' ), ST_VERSION, true );
+		wp_localize_script(
+			'suffice-enhanced-select',
+			'suffice_enhanced_select_params',
+			array(
+				'i18n_matches_1'            => _x( 'One result is available, press enter to select it.', 'enhanced select', 'suffice-toolkit' ),
+				'i18n_matches_n'            => _x( '%qty% results are available, use up and down arrow keys to navigate.', 'enhanced select', 'suffice-toolkit' ),
+				'i18n_no_matches'           => _x( 'No matches found', 'enhanced select', 'suffice-toolkit' ),
+				'i18n_ajax_error'           => _x( 'Loading failed', 'enhanced select', 'suffice-toolkit' ),
+				'i18n_input_too_short_1'    => _x( 'Please enter 1 or more characters', 'enhanced select', 'suffice-toolkit' ),
+				'i18n_input_too_short_n'    => _x( 'Please enter %qty% or more characters', 'enhanced select', 'suffice-toolkit' ),
+				'i18n_input_too_long_1'     => _x( 'Please delete 1 character', 'enhanced select', 'suffice-toolkit' ),
+				'i18n_input_too_long_n'     => _x( 'Please delete %qty% characters', 'enhanced select', 'suffice-toolkit' ),
+				'i18n_selection_too_long_1' => _x( 'You can only select 1 item', 'enhanced select', 'suffice-toolkit' ),
+				'i18n_selection_too_long_n' => _x( 'You can only select %qty% items', 'enhanced select', 'suffice-toolkit' ),
+				'i18n_load_more'            => _x( 'Loading more results…', 'enhanced select', 'suffice-toolkit' ),
+				'i18n_searching'            => _x( 'Searching…', 'enhanced select', 'suffice-toolkit' ),
+			)
+		);
+		wp_localize_script(
+			'suffice-toolkit-admin-widgets',
+			'sufficeToolkitLocalizeScript',
+			array(
+				'i18n_max_field_entries' => apply_filters( 'suffice_toolkit_maximum_repeater_field_entries', 5 ),
+				'i18n_max_field_message' => esc_js(
+					sprintf(
+						/* translators: %s: maximum number of fields allowed */
+						__( 'You can add up to %s fields.', 'suffice-toolkit' ),
+						apply_filters( 'suffice_toolkit_maximum_repeater_field_entries', 5 )
+					)
+				),
+			)
+		);
 
 		// SufficeToolkit admin pages.
 		if ( in_array( $screen_id, suffice_toolkit_get_screen_ids() ) ) {
@@ -109,11 +123,15 @@ public function admin_scripts() {
 
 			if ( 'widgets' === $screen_id && is_suffice_pro_active() ) {
 				wp_enqueue_script( 'suffice-toolkit-admin-sidebars' );
-				wp_localize_script( 'suffice-toolkit-admin-sidebars',	'suffice_toolkit_admin_sidebars', array(
-					'ajax_url'                           => admin_url( 'admin-ajax.php' ),
-					'delete_custom_sidebar_nonce'        => wp_create_nonce( 'delete-custom-sidebar' ),
-					'i18n_confirm_delete_custom_sidebar' => __( 'Delete this Sidebar Permanently and store all widgets in Inactive Sidebar. Are you positive you want to delete this Sidebar?', 'suffice-toolkit' ),
-				) );
+				wp_localize_script(
+					'suffice-toolkit-admin-sidebars',
+					'suffice_toolkit_admin_sidebars',
+					array(
+						'ajax_url'                    => admin_url( 'admin-ajax.php' ),
+						'delete_custom_sidebar_nonce' => wp_create_nonce( 'delete-custom-sidebar' ),
+						'i18n_confirm_delete_custom_sidebar' => __( 'Delete this Sidebar Permanently and store all widgets in Inactive Sidebar. Are you positive you want to delete this Sidebar?', 'suffice-toolkit' ),
+					)
+				);
 			}
 		}
 	}

includes/admin/class-suffice-admin-notices.php

@@ -99,15 +99,15 @@ public static function has_notice( $name ) {
 	 */
 	public static function hide_notices() {
 		if ( isset( $_GET['suffice-toolkit-hide-notice'] ) && isset( $_GET['_suffice_toolkit_notice_nonce'] ) ) {
-			if ( ! wp_verify_nonce( $_GET['_suffice_toolkit_notice_nonce'], 'suffice_toolkit_hide_notices_nonce' ) ) {
-				wp_die( __( 'Action failed. Please refresh the page and retry.', 'suffice-toolkit' ) );
+			if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_suffice_toolkit_notice_nonce'] ) ), 'suffice_toolkit_hide_notices_nonce' ) ) {
+				wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'suffice-toolkit' ) );
 			}
 
 			if ( ! current_user_can( 'manage_suffice_toolkit' ) ) {
-				wp_die( __( 'Cheatin’ huh?', 'suffice-toolkit' ) );
+				wp_die( esc_html__( "Cheatin' huh?", 'suffice-toolkit' ) );
 			}
 
-			$hide_notice = sanitize_text_field( $_GET['suffice-toolkit-hide-notice'] );
+			$hide_notice = sanitize_text_field( wp_unslash( $_GET['suffice-toolkit-hide-notice'] ) );
 			self::remove_notice( $hide_notice );
 			do_action( 'suffice_toolkit_hide_' . $hide_notice . '_notice' );
 		}
@@ -153,7 +153,7 @@ public static function output_custom_notices() {
 					$notice_html = get_option( 'suffice_toolkit_admin_notice_' . $notice );
 
 					if ( $notice_html ) {
-						include( 'views/html-notice-custom.php' );
+						include 'views/html-notice-custom.php';
 					}
 				}
 			}
@@ -165,14 +165,27 @@ public static function output_custom_notices() {
 	 */
 	public static function update_notice() {
 		if ( version_compare( get_option( 'suffice_toolkit_db_version' ), ST_VERSION, '<' ) ) {
-			$updater = new ST_Background_Updater();
+			$updater = new \ST_Background_Updater();
 			if ( $updater->is_updating() || ! empty( $_GET['do_update_suffice_toolkit'] ) ) {
-				include( 'views/html-notice-updating.php' );
+				if ( ! current_user_can( 'manage_options' ) ) {
+					wp_die( esc_html__( "Cheatin' huh?", 'suffice-toolkit' ) );
+				}
+
+				if (
+				! isset( $_GET['_wpnonce'] ) ||
+				! wp_verify_nonce(
+					sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ),
+					'suffice_toolkit_update'
+				)
+				) {
+					wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'suffice-toolkit' ) );
+				}
+				include 'views/html-notice-updating.php';
 			} else {
-				include( 'views/html-notice-update.php' );
+				include 'views/html-notice-update.php';
 			}
 		} else {
-			include( 'views/html-notice-updated.php' );
+			include 'views/html-notice-updated.php';
 		}
 	}
 }