44 *
55 * @since 1.0.0
66 * @package LiteSpeed_Cache
7- * @subpackage LiteSpeed_Cache/admin
8- * @author LiteSpeed Technologies <info@litespeedtech.com>
97 */
8+
109namespace LiteSpeed ;
1110
12- defined ('WPINC ' ) || exit ();
11+ defined ( 'WPINC ' ) || exit ();
1312
13+ /**
14+ * Class Admin
15+ *
16+ * Wires admin-side hooks, actions, and safe redirects.
17+ */
1418class Admin extends Root {
1519
1620 const LOG_TAG = '👮 ' ;
@@ -19,97 +23,100 @@ class Admin extends Root {
1923
2024 /**
2125 * Initialize the class and set its properties.
22- * Run in hook `after_setup_theme` when is_admin()
26+ * Runs in hook `after_setup_theme` when is_admin().
2327 *
24- * @since 1.0.0
28+ * @since 1.0.0
2529 */
2630 public function __construct () {
27- // Define LSCWP_MU_PLUGIN if is mu-plugins
28- if (defined ('WPMU_PLUGIN_DIR ' ) && dirname (LSCWP_DIR ) == WPMU_PLUGIN_DIR ) {
29- define ('LSCWP_MU_PLUGIN ' , true );
31+ // Define LSCWP_MU_PLUGIN if in mu-plugins.
32+ if ( defined ( 'WPMU_PLUGIN_DIR ' ) && dirname ( LSCWP_DIR ) === WPMU_PLUGIN_DIR && ! defined ( ' LSCWP_MU_PLUGIN ' ) ) {
33+ define ( 'LSCWP_MU_PLUGIN ' , true );
3034 }
3135
32- self ::debug ('No cache due to Admin page ' );
33- defined ('DONOTCACHEPAGE ' ) || define ('DONOTCACHEPAGE ' , true );
36+ self ::debug ( 'No cache due to Admin page ' );
3437
35- // Additional litespeed assets on admin display
36- // Also register menu
37- $ this ->cls ('Admin_Display ' );
38+ if ( ! defined ( 'DONOTCACHEPAGE ' ) ) {
39+ define ( 'DONOTCACHEPAGE ' , true );
40+ }
41+
42+ // Additional LiteSpeed assets on admin display (also registers menus).
43+ $ this ->cls ( 'Admin_Display ' );
44+
45+ // Initialize admin actions.
46+ add_action ( 'admin_init ' , array ( $ this , 'admin_init ' ) );
3847
39- // initialize admin actions
40- add_action ('admin_init ' , array ( $ this , 'admin_init ' ));
41- // add link to plugin list page
42- add_filter ('plugin_action_links_ ' . LSCWP_BASENAME , array ( $ this ->cls ('Admin_Display ' ), 'add_plugin_links ' ));
48+ // Add link to plugin list page.
49+ add_filter (
50+ 'plugin_action_links_ ' . LSCWP_BASENAME ,
51+ array ( $ this ->cls ( 'Admin_Display ' ), 'add_plugin_links ' )
52+ );
4353 }
4454
4555 /**
4656 * Callback that initializes the admin options for LiteSpeed Cache.
4757 *
4858 * @since 1.0.0
49- * @access public
59+ * @return void
5060 */
5161 public function admin_init () {
52- // Hook attachment upload
53- if ($ this ->conf (Base::O_IMG_OPTM_AUTO ) ) {
54- add_filter ('wp_update_attachment_metadata ' , array ( $ this , 'wp_update_attachment_metadata ' ), 9999 , 2 );
62+ // Hook attachment upload auto optimization.
63+ if ( $ this ->conf ( Base::O_IMG_OPTM_AUTO ) ) {
64+ add_filter ( 'wp_update_attachment_metadata ' , array ( $ this , 'wp_update_attachment_metadata ' ), 9999 , 2 );
5565 }
5666
5767 $ this ->_proceed_admin_action ();
5868
59- // Terminate if user doesn't have the access to settings
60- if (is_network_admin ()) {
61- $ capability = 'manage_network_options ' ;
62- } else {
63- $ capability = 'manage_options ' ;
64- }
65- if (!current_user_can ($ capability )) {
69+ // Terminate if user doesn't have access to settings.
70+ $ capability = is_network_admin () ? 'manage_network_options ' : 'manage_options ' ;
71+ if ( ! current_user_can ( $ capability ) ) {
6672 return ;
6773 }
6874
69- // Save setting from admin settings page
70- // NOTE: cli will call `validate_plugin_settings` manually. Cron activation doesn't need to validate
71-
72- // Add privacy policy
73- // @since 2.2.6
74- if (function_exists ('wp_add_privacy_policy_content ' )) {
75- wp_add_privacy_policy_content (Core::NAME , Doc::privacy_policy ());
75+ // Add privacy policy (since 2.2.6).
76+ if ( function_exists ( 'wp_add_privacy_policy_content ' ) ) {
77+ wp_add_privacy_policy_content ( Core::NAME , Doc::privacy_policy () );
7678 }
7779
78- $ this ->cls ('Media ' )->after_admin_init ();
80+ $ this ->cls ( 'Media ' )->after_admin_init ();
7981
80- do_action ('litespeed_after_admin_init ' );
82+ do_action ( 'litespeed_after_admin_init ' );
8183
82- if ($ this ->cls ('Router ' )->esi_enabled ()) {
83- add_action ('in_widget_form ' , array ( $ this ->cls ('Admin_Display ' ), 'show_widget_edit ' ), 100 , 3 );
84- add_filter ('widget_update_callback ' , __NAMESPACE__ . '\Admin_Settings::validate_widget_save ' , 10 , 4 );
84+ if ( $ this ->cls ( 'Router ' )->esi_enabled () ) {
85+ add_action ( 'in_widget_form ' , array ( $ this ->cls ( 'Admin_Display ' ), 'show_widget_edit ' ), 100 , 3 );
86+ add_filter ( 'widget_update_callback ' , __NAMESPACE__ . '\Admin_Settings::validate_widget_save ' , 10 , 4 );
8587 }
8688 }
8789
8890 /**
89- * Handle attachment update
91+ * Handle attachment metadata update.
9092 *
91- * @since 4.0
93+ * @since 4.0
94+ *
95+ * @param array $data Attachment meta.
96+ * @param int $post_id Attachment ID.
97+ * @return array Filtered meta.
9298 */
9399 public function wp_update_attachment_metadata ( $ data , $ post_id ) {
94- $ this ->cls ('Img_Optm ' )->wp_update_attachment_metadata ($ data , $ post_id );
100+ $ this ->cls ( 'Img_Optm ' )->wp_update_attachment_metadata ( $ data , $ post_id );
95101 return $ data ;
96102 }
97103
98104 /**
99- * Run litespeed admin actions
105+ * Run LiteSpeed admin actions routed via Router.
100106 *
101107 * @since 1.1.0
108+ * @return void
102109 */
103110 private function _proceed_admin_action () {
104- // handle actions
105- switch (Router::get_action ()) {
111+ $ action = Router::get_action ();
112+
113+ switch ( $ action ) {
106114 case Router::ACTION_SAVE_SETTINGS :
107- $ this ->cls ('Admin_Settings ' )->save ($ _POST );
115+ $ this ->cls ( 'Admin_Settings ' )->save ( wp_unslash ( $ _POST ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
108116 break ;
109117
110- // Save network settings
111118 case Router::ACTION_SAVE_SETTINGS_NETWORK :
112- $ this ->cls ('Admin_Settings ' )->network_save ($ _POST );
119+ $ this ->cls ( 'Admin_Settings ' )->network_save ( wp_unslash ( $ _POST ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
113120 break ;
114121
115122 default :
@@ -118,66 +125,65 @@ private function _proceed_admin_action() {
118125 }
119126
120127 /**
121- * Clean up the input string of any extra slashes/spaces.
128+ * Clean up the input (array or scalar) of any extra slashes/spaces.
122129 *
123130 * @since 1.0.4
124- * @access public
125- * @param string $input The input string to clean.
126- * @return string The cleaned up input .
131+ *
132+ * @param mixed $input The input value to clean.
133+ * @return mixed Cleaned value .
127134 */
128135 public static function cleanup_text ( $ input ) {
129- if (is_array ($ input) ) {
130- return array_map (__CLASS__ . '::cleanup_text ' , $ input );
136+ if ( is_array ( $ input ) ) {
137+ return array_map ( __CLASS__ . '::cleanup_text ' , $ input );
131138 }
132139
133140 return stripslashes (trim ($ input ));
134141 }
135142
136143 /**
137- * After a LSCWP_CTRL action, need to redirect back to the same page
138- * without the nonce and action in the query string.
144+ * After a LSCWP_CTRL action, redirect back to same page
145+ * without nonce and action in the query string.
139146 *
140- * If the redirect url cannot be determined, redirects to the homepage.
147+ * If the redirect URL cannot be determined, redirects to the homepage.
141148 *
142149 * @since 1.0.12
143- * @access public
144- * @global string $pagenow
150+ *
151+ * @param string|false $url Optional destination URL.
152+ * @return void
145153 */
146154 public static function redirect ( $ url = false ) {
147155 global $ pagenow ;
148156
149- if (!empty ($ _GET ['_litespeed_ori ' ])) {
150- wp_safe_redirect (wp_get_referer () ?: get_home_url ());
151- exit ();
157+ // If originated, go back to referrer or home.
158+ if ( ! empty ( $ _GET ['_litespeed_ori ' ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
159+ $ ref = wp_get_referer ();
160+ wp_safe_redirect ( $ ref ? $ ref : get_home_url () );
161+ exit ;
152162 }
153163
154- $ qs = '' ;
155- if (!$ url ) {
156- if (!empty ($ _GET )) {
157- if (isset ($ _GET [Router::ACTION ])) {
158- unset($ _GET [Router::ACTION ]);
159- }
160- if (isset ($ _GET [Router::NONCE ])) {
161- unset($ _GET [Router::NONCE ]);
162- }
163- if (isset ($ _GET [Router::TYPE ])) {
164- unset($ _GET [Router::TYPE ]);
165- }
166- if (isset ($ _GET ['litespeed_i ' ])) {
167- unset($ _GET ['litespeed_i ' ]);
168- }
169- if (!empty ($ _GET )) {
170- $ qs = '? ' . http_build_query ($ _GET );
164+ if ( ! $ url ) {
165+ $ clean = [];
166+
167+ // Sanitize current query args while removing our internals.
168+ if ( ! empty ( $ _GET ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
169+ foreach ( $ _GET as $ k => $ v ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
170+ if ( in_array ( $ k , array ( Router::ACTION , Router::NONCE , Router::TYPE , 'litespeed_i ' ), true ) ) {
171+ continue ;
172+ }
173+ // Normalize to string for URL building.
174+ $ clean [ $ k ] = is_array ( $ v ) ? array_map ( 'sanitize_text_field ' , wp_unslash ( $ v ) ) : sanitize_text_field ( wp_unslash ( $ v ) );
171175 }
172176 }
173- if ( is_network_admin ()) {
174- $ url = network_admin_url ( $ pagenow . $ qs ) ;
175- } else {
176- $ url = admin_url ( $ pagenow . $ qs );
177+
178+ $ qs = '' ;
179+ if ( ! empty ( $ clean ) ) {
180+ $ qs = ' ? ' . http_build_query ( $ clean );
177181 }
182+
183+ $ url = is_network_admin () ? network_admin_url ( $ pagenow . $ qs ) : admin_url ( $ pagenow . $ qs );
178184 }
179185
180- wp_redirect ( $ url );
181- exit () ;
186+ wp_safe_redirect ( $ url );
187+ exit ;
182188 }
183189}
0 commit comments