WordPress.org
Get WordPress

Plugin Directory

Changeset 3410920


Ignore:
Timestamp:
12/04/2025 12:47:52 PM (10 days ago)
Author:
domainsupport
Message:

Tagging version 1.5.5

Location:
block-wp-login
Files:
1 deleted
3 edited
6 copied

Legend:

Unmodified
Added
Removed

  • block-wp-login/tags/1.5.5/block-wp-login.php

    r3284110 r3410920  
    22/*
    33 * Plugin Name: Block wp-login
    4  * Version: 1.5.4
     4 * Version: 1.5.5
    55 * Plugin URI: https://webd.uk/support/
    66 * Description: This plugin completely blocks access to wp-login.php and creates a new secret login URL
    77 * Author: Webd Ltd
    88 * Author URI: https://webd.uk
     9 * License: GPLv2 or later
     10 * License URI: https://www.gnu.org/licenses/old-licenses/gpl-2.0.html
    911 * Text Domain: block-wp-login
    1012 */
    … …  
    1315
    1416if (!defined('ABSPATH')) {
    15     exit(__('This isn\'t the page you\'re looking for. Move along, move along.', 'block-wp-login'));
     17    exit(esc_html(__('This isn\'t the page you\'re looking for. Move along, move along.', 'block-wp-login')));
    1618}
    1719
    … …  
    2224    class bwpl_class {
    2325
    24         public static $version = '1.5.4';
     26        public static $version = '1.5.5';
    2527
    2628        private $bwpl_new_slug = '';
    … …  
    7375        function bwpl_configure_slug() {
    7476
    75             if (isset($_POST['bwpl_nonce']) && wp_verify_nonce($_POST['bwpl_nonce'], 'bwpl_slug_change') && isset($_POST['bwpl_slug']) && current_user_can('manage_options')) {
    76 
    77                 $this->bwpl_new_slug = trim(sanitize_key(wp_strip_all_tags($_POST['bwpl_slug'])));
     77            if (isset($_POST['bwpl_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['bwpl_nonce'])), 'bwpl_slug_change') && isset($_POST['bwpl_slug']) && current_user_can('manage_options')) {
     78
     79                $this->bwpl_new_slug = trim(sanitize_key(wp_strip_all_tags(wp_unslash($_POST['bwpl_slug']))));
    7880
    7981                if ($this->bwpl_new_slug) {
    8082
     83                    $notify = (isset($_POST['bwpl_notify']) && 'true' === $_POST['bwpl_notify']);
    8184                    $this->bwpl_uninstall();
    82                     $this->bwpl_install();
     85                    $this->bwpl_install(false, $notify);
    8386
    8487                } else {
    … …  
    126129                if (
    127130                    isset($_POST['bwpl_unknown_admin']) &&
    128                     $_POST['bwpl_unknown_admin'] &&
     131                    sanitize_text_field(wp_unslash($_POST['bwpl_unknown_admin'])) &&
    129132                    isset($_POST['bwpl_known_ips']) &&
    130                     $_POST['bwpl_known_ips']
     133                    sanitize_textarea_field(wp_unslash($_POST['bwpl_known_ips']))
    131134                ) {
    132135
    133                     $known_ips = preg_split('/\r\n|[\r\n]/', $_POST['bwpl_known_ips']);
     136                    $known_ips = preg_split('/\r\n|[\r\n]/', sanitize_textarea_field(wp_unslash($_POST['bwpl_known_ips'])));
    134137
    135138                    foreach ($known_ips AS $key => $known_ip) {
    … …  
    187190            for ($i = 0; $i < 8; $i++) {
    188191
    189                 $randomString .= $characters[rand(0, strlen($characters) - 1)];
     192                $randomString .= $characters[wp_rand(0, strlen($characters) - 1)];
    190193
    191194            }
    192195
    193196?>
    194 <input id="bwpl_slug" name="bwpl_slug" type="text" class="regular-text code" value="<?php echo get_option('bwpl_slug'); ?>" />
     197<input id="bwpl_slug" name="bwpl_slug" type="text" class="regular-text code" value="<?php echo esc_attr(get_option('bwpl_slug')); ?>" />
    195198
    196199<script type="text/javascript">
    … …  
    206209<p><?php esc_html_e('To change your WordPress login address, enter your chosen slug above. Leave it blank to enable the default login address.', 'block-wp-login'); ?></p>
    207210
    208 <p><?php printf(esc_html__('%1$sClick here%2$s to generate a random login address.', 'block-wp-login'),'<a href="javascript:void(0)" class="randomlogin">','</a>'); ?></p>
     211<p><a href="javascript:void(0)" class="randomlogin"><?php echo esc_html(__('Click here', 'block-wp-login')); ?></a> <?php echo esc_html(__('to generate a random login address.', 'block-wp-login')); ?></p>
    209212
    210213<script type="text/javascript">
    … …  
    217220    jQuery('#bwpl_slug').val(result);
    218221    alert(<?php echo json_encode(__('WARNING! DO NOT LOCK YOURSELF OUT! Your new login address will be', 'block-wp-login') . ' ' . get_site_url() . '/'); ?> + result + '/');
    219     jQuery('#bwpl_slug').val(result);
     222    jQuery('#bwpl_notify').prop('checked', true);
    220223});
    221224</script>
    … …  
    225228            if (get_option('bwpl_slug')) {
    226229
    227                 echo get_site_url(null, (get_option('bwpl_slug') . '/'));
     230                echo esc_url(get_site_url(null, (get_option('bwpl_slug') . '/')));
    228231
    229232            } else {
    230233
    231                 echo get_site_url(null, 'wp-login.php');
     234                echo esc_url(get_site_url(null, 'wp-login.php'));
    232235
    233236            } ?></p>
    … …  
    257260<p><strong><?php esc_html_e('Please Note: ', 'block-wp-login'); ?></strong><?php
    258261
    259                 printf(
     262                echo wp_kses(sprintf(
     263/* translators: link to plugin install page */
    260264                    __('To lock down your website to only serve legitimate content, please take a look at our new plugin "%s".', 'block-wp-login'),
    261                     '<a href="' . esc_url(add_query_arg(array('s' => 'deny-all-firewall+genuine', 'tab' => 'search', 'type' => 'term'), self_admin_url('plugin-install.php'))) . '" title="' . __('Deny All Firewall', 'block-wp-login') . '">' . __('Deny All Firewall', 'block-wp-login') . '</a>'
    262                 );
     265                    '<a href="' . esc_url(add_query_arg(array('s' => 'deny-all-firewall+genuine', 'tab' => 'search', 'type' => 'term'), self_admin_url('plugin-install.php'))) . '" title="' . esc_attr(__('Deny All Firewall', 'block-wp-login')) . '">' . __('Deny All Firewall', 'block-wp-login') . '</a>'
     266                ), 'post');
    263267
    264268?></p>
    … …  
    287291        }
    288292
    289         function bwpl_install($new_version = false) {
    290 
    291             if ($new_version || (isset($_POST['bwpl_notify']) && 'true' === $_POST['bwpl_notify'])) {
     293        function bwpl_install($new_version = false, $notify = true) {
     294
     295            global $wp_filesystem;
     296
     297            if (!$wp_filesystem) {
     298
     299                require_once (ABSPATH . '/wp-admin/includes/file.php');
     300
     301                WP_Filesystem();
     302
     303            }
     304
     305            if ($new_version || $notify) {
    292306
    293307                $this->bwpl_send_emails($new_version);
    … …  
    301315                $content = implode($this->bwpl_new_slug . '-wp-login.php', $content_chunks);
    302316
    303                 if ((!file_exists(bwplCommon::get_home_path() . $this->bwpl_new_slug . '-wp-login.php') && is_writable(bwplCommon::get_home_path())) || is_writable(bwplCommon::get_home_path() . $this->bwpl_new_slug . '-wp-login.php')) {
     317                if ((!file_exists(bwplCommon::get_home_path() . $this->bwpl_new_slug . '-wp-login.php') && $wp_filesystem->is_writable(bwplCommon::get_home_path())) || $wp_filesystem->is_writable(bwplCommon::get_home_path() . $this->bwpl_new_slug . '-wp-login.php')) {
    304318
    305319                    file_put_contents(bwplCommon::get_home_path() . $this->bwpl_new_slug . '-wp-login.php', $content);
    … …  
    309323            }
    310324
    311             if ((!file_exists(bwplCommon::get_home_path() . '.htaccess') && is_writable(bwplCommon::get_home_path())) || is_writable(bwplCommon::get_home_path() . '.htaccess')) {
     325            if ((!file_exists(bwplCommon::get_home_path() . '.htaccess') && $wp_filesystem->is_writable(bwplCommon::get_home_path())) || $wp_filesystem->is_writable(bwplCommon::get_home_path() . '.htaccess')) {
    312326
    313327                $markerdata = file(bwplCommon::get_home_path() . '.htaccess');
    … …  
    346360                    }
    347361
    348                     $f = @fopen(bwplCommon::get_home_path() . '.htaccess', 'w');
    349                     fwrite($f, $newdata);
     362                    $wp_filesystem->put_contents(
     363                        bwplCommon::get_home_path() . '.htaccess',
     364                        $newdata,
     365                        FS_CHMOD_FILE
     366                    );
    350367
    351368                }
    … …  
    361378?>
    362379<div class="notice notice-success">
    363     <p><?php printf(esc_html__('%1$sBlock wp-login%2$s activated. ', 'block-wp-login'),'<strong>','</strong>'); ?><a href="<?php echo admin_url('options-permalink.php'); ?>"><?php esc_html_e('Configure the plugin here.', 'block-wp-login'); ?></a></p>
     380    <p><?php
     381/* translators: <strong> HTML tags */
     382echo wp_kses(sprintf(__('%1$sBlock wp-login%2$s activated. ', 'block-wp-login'),'<strong>','</strong>'), 'post'); ?><a href="<?php echo esc_url(admin_url('options-permalink.php')); ?>"><?php esc_html_e('Configure the plugin here.', 'block-wp-login'); ?></a></p>
    364383</div>
    365384<?php
    … …  
    369388        function bwpl_uninstall() {
    370389
    371             if (is_writable(bwplCommon::get_home_path() . '.htaccess')) {
     390            global $wp_filesystem;
     391
     392            if (!$wp_filesystem) {
     393
     394                require_once (ABSPATH . '/wp-admin/includes/file.php');
     395
     396                WP_Filesystem();
     397
     398            }
     399
     400            if ($wp_filesystem->is_writable(bwplCommon::get_home_path() . '.htaccess')) {
    372401
    373402                $markerdata = file(bwplCommon::get_home_path() . '.htaccess');
    … …  
    424453                    }
    425454
    426                     $f = @fopen(bwplCommon::get_home_path() . '.htaccess', 'w');
    427                     fwrite($f, $newdata);
     455                    $wp_filesystem->put_contents(
     456                        bwplCommon::get_home_path() . '.htaccess',
     457                        $newdata,
     458                        FS_CHMOD_FILE
     459                    );
    428460
    429461                }
    … …  
    435467            add_filter('lostpassword_url', array($this, 'bwpl_reset_logout_url'));
    436468
    437             if (is_writable(bwplCommon::get_home_path() . get_option('bwpl_slug') . '-wp-login.php') && get_option('bwpl_slug')) {
    438 
    439                 unlink(bwplCommon::get_home_path() . get_option('bwpl_slug') . '-wp-login.php');
     469            if ($wp_filesystem->is_writable(bwplCommon::get_home_path() . get_option('bwpl_slug') . '-wp-login.php') && get_option('bwpl_slug')) {
     470
     471                wp_delete_file(bwplCommon::get_home_path() . get_option('bwpl_slug') . '-wp-login.php');
    440472
    441473            }
    … …  
    525557            if ($new_version) {
    526558
    527                 $message = __('A new version of WordPress has been detected so we have reinstalled "Block wp-login" and here is a reminder of your login URL:', 'block-wp-login') . "\r\n\r\n";
     559                $message = __('A recent WordPress core update has been detected and “Block wp-login” has been re-installed. Here is a reminder of your login address:', 'block-wp-login');
    528560
    529561            } else {
    530562
    531                 $message = __('Your WordPress login URL has been changed:', 'block-wp-login') . "\r\n\r\n";
    532 
    533             }
     563                $message = __('Your WordPress login address has been changed:', 'block-wp-login');
     564
     565            }
     566
     567            $message .=  "\r\n\r\n";
    534568
    535569            if ($this->bwpl_new_slug) {
    … …  
    543577            }
    544578
    545             $message .= __('Make sure you save this email and / or bookmark this address so you don\'t get locked out!', 'block-wp-login') . "\r\n\r\n";
    546             $message .= __('Contact us if you are having trouble with WordPress https://webd.uk', 'block-wp-login') . "\r\n\r\n";
    547             $message .= __('If you like our plugin please leave a short review: https://wordpress.org/support/plugin/block-wp-login/reviews/#new-post', 'block-wp-login') . "\r\n\r\n";
     579            $message .= __('Keep this link handy! Bookmarking it is the best way to ensure you never get locked out.', 'block-wp-login');
     580            $message .=  "\r\n\r\n---\r\n\r\n";
     581            $message .= __('Does your site need a glow-up?', 'block-wp-login');
     582            $message .=  "\r\n";
     583            $message .= __('Running slowly?', 'block-wp-login');
     584            $message .=  "\r\n";
     585            $message .= __('Want new features?', 'block-wp-login');
     586            $message .=  "\r\n\r\n";
     587            $message .= __('See how we can help', 'block-wp-login');
     588            $message .=  ' https://webd.uk';
    548589
    549590            if (is_multisite()) {
    … …  
    559600            if ($new_version) {
    560601
     602/* translators: website title */
    561603                $title = sprintf(__('[%s] WordPress Login Reminder', 'block-wp-login'), $blogname);
    562604
    563605            } else {
    564606
     607/* translators: website title */
    565608                $title = sprintf(__('[%s] WordPress Login Changed', 'block-wp-login'), $blogname);
    566609
    … …  
    579622?>
    580623<div class="notice notice-error">
    581     <p><?php printf(esc_html__('%1$sBlock wp-login%2$s activated email could not be sent.', 'block-wp-login'),'<strong>','</strong>'); ?></p>
     624    <p><?php
     625/* translators: <strong> HTML tags */
     626wp_kses(sprintf(__('%1$sBlock wp-login%2$s activated email could not be sent.', 'block-wp-login'),'<strong>','</strong>'), 'post'); ?></p>
    582627</div>
    583628<?php
    … …  
    655700                            }
    656701
     702/* translators: website title */
    657703                            $title = sprintf(__('[%s] WordPress Login Alert', 'block-wp-login'), $blogname);
    658704
    … …  
    681727            if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
    682728
    683                 $ip = $_SERVER['HTTP_CF_CONNECTING_IP'];
     729                $ip = filter_var(wp_unslash($_SERVER['HTTP_CF_CONNECTING_IP']), FILTER_VALIDATE_IP);
    684730
    685731            } elseif (isset($_SERVER['REMOTE_ADDR'])) {
    686732
    687                 $ip = $_SERVER['REMOTE_ADDR'];
     733                $ip = filter_var(wp_unslash($_SERVER['REMOTE_ADDR']), FILTER_VALIDATE_IP);
    688734
    689735            }
    … …  
    710756            global $wpdb;
    711757
     758// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
    712759            return (bool) $wpdb->get_var($wpdb->prepare("SELECT GET_LOCK(%s, %d)", 'bwpl_lock', 0));
    713760
    … …  
    718765            global $wpdb;
    719766
     767// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
    720768            return (bool) $wpdb->get_var($wpdb->prepare("SELECT RELEASE_LOCK(%s)", 'bwpl_lock'));
    721769
    … …  
    730778    }
    731779
    732     $Block_wp_login = new bwpl_class();
     780    new bwpl_class();
    733781
    734782}

  • block-wp-login/tags/1.5.5/includes/class-bwpl-common.php

    r2986003 r3410920  
    11<?php
    22/*
    3  * Version: 1.3.9
     3 * Version: 1.4
    44 */
    55
    … …  
    4343        public static function plugin_text_domain() {
    4444
    45             return self::$plugin_text_domain;
     45            return 'block-wp-login';
    4646
    4747        }
    … …  
    6161        public static function support_url() {
    6262
    63             return 'https://wordpress.org/support/plugin/' . self::$plugin_text_domain . '/';
     63            return 'https://wordpress.org/support/plugin/' . 'block-wp-login' . '/';
    6464
    6565        }
    … …  
    6767        public static function control_upgrade_text() {
    6868
    69             $upgrade_text = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr(sprintf(__('Upgrade now to %s Premium', self::$plugin_text_domain), self::$plugin_name)) . '">' . sprintf(__('Upgrade now to %s Premium', self::$plugin_text_domain), self::$plugin_name) . '</a>';
     69/* translators: name of the plugin */
     70            $upgrade_text = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr(sprintf(__('Upgrade now to %s Premium', 'block-wp-login'), self::$plugin_name)) . '">' . sprintf(__('Upgrade now to %s Premium', 'block-wp-login'), self::$plugin_name) . '</a>';
    7071
    7172            if (!class_exists(self::$plugin_premium_class) || !get_option(self::$plugin_prefix . '_purchased')) {
    … …  
    7374                if (!class_exists(self::$plugin_premium_class)) {
    7475
    75                     $upgrade_text .= sprintf(wp_kses(__(' or <a href="%s" title="Download Free Trial">trial it for 7 days</a>', self::$plugin_text_domain), array('a' => array('href' => array(), 'title' => array()))), esc_url(self::premium_link()));
     76/* translators: link to the premium upgrade */
     77                    $upgrade_text .= sprintf(wp_kses(__(' or <a href="%s" title="Download Free Trial">trial it for 7 days</a>', 'block-wp-login'), array('a' => array('href' => array(), 'title' => array()))), esc_url(self::premium_link()));
    7678
    7779                }
    … …  
    8587        public static function control_section_description() {
    8688
    87             $default_description = sprintf(wp_kses(__('If you have any requests for new features, please <a href="%s" title="Support Forum">let us know in the support forum</a>.', self::$plugin_text_domain), array('a' => array('href' => array(), 'title' => array()))), esc_url(self::support_url()));
     89/* translators: link to the plugin's support forum */
     90            $default_description = sprintf(wp_kses(__('If you have any requests for new features, please <a href="%s" title="Support Forum">let us know in the support forum</a>.', 'block-wp-login'), array('a' => array('href' => array(), 'title' => array()))), esc_url(self::support_url()));
    8891
    8992            if (self::$plugin_premium_class) {
    … …  
    9598                    if (!class_exists(self::$plugin_premium_class)) {
    9699
    97                         $section_description = '<strong>' . __('For even more options', self::$plugin_text_domain) . '</strong>' . ' ' . $upgrade_text;
     100                        $section_description = '<strong>' . __('For even more options', 'block-wp-login') . '</strong>' . ' ' . $upgrade_text;
    98101
    99102                    } else {
    100103
    101                         $section_description = '<strong>' . __('To keep using premium options', self::$plugin_text_domain) . '</strong>' . ' ' . $upgrade_text;
     104                        $section_description = '<strong>' . __('To keep using premium options', 'block-wp-login') . '</strong>' . ' ' . $upgrade_text;
    102105
    103106                    }
    … …  
    119122                $section_description .= ' ' . sprintf(
    120123                    wp_kses(
     124/* translators: link to plugin install page */
    121125                        __(
    122126                            '<strong>To reset this section of options to default settings</strong> without affecting other sections in the customizer, install <a href="%s" title="Reset Customizer">Reset Customizer</a>.',
    123                             self::$plugin_text_domain
     127                            'block-wp-login'
    124128                        ),
    125129                        array('strong' => array(), 'a' => array('href' => array(), 'title' => array()))
    … …  
    145149        public static function control_setting_upgrade_nag() {
    146150
    147             $upgrade_nag = self::control_upgrade_text() . __(' to use this option.', self::$plugin_text_domain);
     151            $upgrade_nag = self::control_upgrade_text() . __(' to use this option.', 'block-wp-login');
    148152
    149153            return $upgrade_nag;
    … …  
    234238
    235239                $generated_css = sprintf('%s { %s: %s; }', $selector, $style, $prefix.$mod.$postfix);
    236                 echo $generated_css;
     240                echo wp_kses($generated_css, 'strip');
    237241
    238242            } elseif ($mod) {
    239243
    240244                $generated_css = sprintf('%s { %s:%s; }', $selector, $style, $prefix.$value.$postfix);
    241                 echo $generated_css;
     245                echo wp_kses($generated_css, 'strip');
    242246
    243247            }
    … …  
    249253            if (self::$plugin_premium_class) {
    250254
    251                 return add_query_arg('url', (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'], 'https://webd.uk/product/' . self::$plugin_text_domain . '-upgrade/');
    252 
     255                if (isset($_SERVER['HTTP_HOST'])) {
     256
     257                    return add_query_arg('url', (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . filter_var(wp_unslash($_SERVER['HTTP_HOST'], FILTER_SANITIZE_URL)), 'https://webd.uk/product/' . 'block-wp-login' . '-upgrade/');
     258
     259                } else {
     260
     261                    return 'https://webd.uk/product/' . 'block-wp-login' . '-upgrade/';
     262
     263                }
    253264
    254265            } else {
    … …  
    276287            $settings_links = array();
    277288
    278             $settings_links[] = '<a href="' . esc_url($settings_link) . '" title="' . esc_attr(__('Settings', self::$plugin_text_domain)) . '">' . __('Settings', self::$plugin_text_domain) . '</a>';
     289            $settings_links[] = '<a href="' . esc_url($settings_link) . '" title="' . esc_attr(__('Settings', 'block-wp-login')) . '">' . __('Settings', 'block-wp-login') . '</a>';
    279290
    280291            if (!get_option(self::$plugin_prefix . '_purchased')) {
    … …  
    284295                    if (self::$plugin_upgrade) {
    285296
    286                         $settings_links[] = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr(sprintf(__('Buy %s Premium', self::$plugin_text_domain), self::$plugin_name)) . '" style="color: orange; font-weight: bold;">' . __('Buy Now', self::$plugin_text_domain) . '</a>';
     297/* translators: name of the plugin */
     298                        $settings_links[] = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr(sprintf(__('Buy %s Premium', 'block-wp-login'), self::$plugin_name)) . '" style="color: orange; font-weight: bold;">' . __('Buy Now', 'block-wp-login') . '</a>';
    287299
    288300                    } else {
    289301
    290                         $settings_links[] = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr(sprintf(__('Buy %s', self::$plugin_text_domain), self::$plugin_name)) . '" style="color: orange; font-weight: bold;">' . __('Buy Now', self::$plugin_text_domain) . '</a>';
     302/* translators: name of the plugin */
     303                        $settings_links[] = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr(sprintf(__('Buy %s', 'block-wp-login'), self::$plugin_name)) . '" style="color: orange; font-weight: bold;">' . __('Buy Now', 'block-wp-login') . '</a>';
    291304
    292305                    }
    … …  
    294307                } else {
    295308
    296                     $settings_links[] = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr((self::$plugin_premium_class ? sprintf(__('Upgrade now to %s Premium', self::$plugin_text_domain), self::$plugin_name) : sprintf(__('Contribute to %s', self::$plugin_text_domain), self::$plugin_name))) . '" style="color: orange; font-weight: bold;">' . (self::$plugin_premium_class ? __('Upgrade', self::$plugin_text_domain) : __('Support Us', self::$plugin_text_domain)) . '</a>';
     309/* translators: name of the plugin */
     310                    $settings_links[] = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr((self::$plugin_premium_class ? sprintf(__('Upgrade now to %s Premium', 'block-wp-login'), self::$plugin_name) : sprintf(__('Contribute to %s', 'block-wp-login'), self::$plugin_name))) . '" style="color: orange; font-weight: bold;">' . (self::$plugin_premium_class ? __('Upgrade', 'block-wp-login') : __('Support Us', 'block-wp-login')) . '</a>';
    297311
    298312                }
    … …  
    300314                if ($premium) {
    301315
    302                     $settings_links[] = '<a href="' . wp_nonce_url('?activate-' . self::$plugin_prefix . '=true', self::$plugin_prefix . '_activate') . '" id="' . self::$plugin_prefix . '_activate_upgrade" title="' . esc_attr(__('Activate Purchase', self::$plugin_text_domain)) . '" onclick="jQuery(this).append(&#39; <img src=&#34;/wp-admin/images/loading.gif&#34; style=&#34;float: none; width: auto; height: auto;&#34; />&#39;); setTimeout(function(){document.getElementById(\'' . self::$plugin_prefix . '_activate_upgrade\').removeAttribute(\'href\');},1); return true;">' . __('Activate Purchase', self::$plugin_text_domain) . '</a>';
    303 
    304                 } elseif (self::$plugin_trial && !is_plugin_active(self::$plugin_text_domain . '-premium/' . self::$plugin_text_domain . '-premium.php')) {
    305 
    306                     $settings_links[] = '<a href="' . esc_url(self::premium_link()) . '" title="' . esc_attr(sprintf(__('Trial %s Premium', self::$plugin_text_domain), self::$plugin_name)) . ' for 7 days">' . __('Download Trial', self::$plugin_text_domain) . '</a>';
     316                    $settings_links[] = '<a href="' . wp_nonce_url('?activate-' . self::$plugin_prefix . '=true', self::$plugin_prefix . '_activate') . '" id="' . self::$plugin_prefix . '_activate_upgrade" title="' . esc_attr(__('Activate Purchase', 'block-wp-login')) . '" onclick="jQuery(this).append(&#39; <img src=&#34;/wp-admin/images/loading.gif&#34; style=&#34;float: none; width: auto; height: auto;&#34; />&#39;); setTimeout(function(){document.getElementById(\'' . self::$plugin_prefix . '_activate_upgrade\').removeAttribute(\'href\');},1); return true;">' . __('Activate Purchase', 'block-wp-login') . '</a>';
     317
     318                } elseif (self::$plugin_trial && !is_plugin_active('block-wp-login' . '-premium/' . 'block-wp-login' . '-premium.php')) {
     319
     320/* translators: name of the plugin */
     321                    $settings_links[] = '<a href="' . esc_url(self::premium_link()) . '" title="' . esc_attr(sprintf(__('Trial %s Premium', 'block-wp-login'), self::$plugin_name)) . ' for 7 days">' . __('Download Trial', 'block-wp-login') . '</a>';
    307322
    308323                }
    … …  
    310325            } elseif ($premium) {
    311326
    312                 $settings_links[] = '<strong style="color: green; display: inline;">' . __('Purchase Confirmed', self::$plugin_text_domain) . '</strong>';
     327                $settings_links[] = '<strong style="color: green; display: inline;">' . __('Purchase Confirmed', 'block-wp-login') . '</strong>';
    313328
    314329            }
    … …  
    320335        public static function plugin_row_meta($plugin_meta, $plugin_file, $plugin_data, $status) {
    321336
    322             if ($plugin_file === self::$plugin_text_domain . '/' . self::$plugin_text_domain . '.php') {
    323 
    324                 $plugin_meta[] = '<a href="' . esc_url(self::support_url()) . '" title="' . __('Problems? We are here to help!', self::$plugin_text_domain) . '" style="color: orange; font-weight: bold;">' . __('Need help?', self::$plugin_text_domain) . '</a>';
    325                 $plugin_meta[] = '<a href="https://wordpress.org/support/plugin/' . self::$plugin_text_domain . '/reviews/#new-post" title="' . esc_attr(sprintf(__('If you like %s, please leave a review!', self::$plugin_text_domain), self::$plugin_name)) . '">' . __('Review plugin', self::$plugin_text_domain) . '</a>';
     337            if ($plugin_file === 'block-wp-login' . '/' . 'block-wp-login' . '.php') {
     338
     339                $plugin_meta[] = '<a href="' . esc_url(self::support_url()) . '" title="' . __('Problems? We are here to help!', 'block-wp-login') . '" style="color: orange; font-weight: bold;">' . __('Need help?', 'block-wp-login') . '</a>';
     340/* translators: name of the plugin */
     341                $plugin_meta[] = '<a href="https://wordpress.org/support/plugin/' . 'block-wp-login' . '/reviews/#new-post" title="' . esc_attr(sprintf(__('If you like %s, please leave a review!', 'block-wp-login'), self::$plugin_name)) . '">' . __('Review plugin', 'block-wp-login') . '</a>';
    326342
    327343            }
    … …  
    357373?>
    358374
    359 <div class="notice notice-error is-dismissible <?php echo self::$plugin_prefix; ?>-notice">
    360 
    361 <p><strong><?php echo self::$plugin_name; ?></strong><br />
    362 <?php esc_html_e('In order to use the premium features, you need to install the premium version of the plugin ...', self::$plugin_text_domain); ?></p>
    363 
    364 <p><a href="<?php echo esc_url(self::premium_link()); ?>" title="<?php echo esc_attr(sprintf(__('Download %s Premium', self::$plugin_text_domain), self::$plugin_name)); ?>" class="button-primary"><?php printf(__('Download %s Premium', self::$plugin_text_domain), self::$plugin_name); ?></a></p>
     375<div class="notice notice-error is-dismissible <?php echo esc_html(self::$plugin_prefix); ?>-notice">
     376
     377<p><strong><?php echo esc_html(self::$plugin_name); ?></strong><br />
     378<?php esc_html_e('In order to use the premium features, you need to install the premium version of the plugin ...', 'block-wp-login'); ?></p>
     379
     380<p><a href="<?php
     381/* translators: name of the plugin */
     382echo esc_url(self::premium_link()); ?>" title="<?php echo esc_attr(sprintf(__('Download %s Premium', 'block-wp-login'), self::$plugin_name)); ?>" class="button-primary"><?php printf(esc_html(__('Download %s Premium', 'block-wp-login')), esc_html(self::$plugin_name)); ?></a></p>
    365383
    366384</div>
    367385
    368386<script type="text/javascript">
    369     jQuery(document).on('click', '.<?php echo self::$plugin_prefix; ?>-notice .notice-dismiss', function() {
     387    jQuery(document).on('click', '.<?php echo esc_attr(self::$plugin_prefix); ?>-notice .notice-dismiss', function() {
    370388        jQuery.ajax({
    371389            url: ajaxurl,
    372390            data: {
    373                 action: 'dismiss_<?php echo self::$plugin_prefix; ?>_notice_handler',
    374                 _ajax_nonce: '<?php echo wp_create_nonce(self::$plugin_prefix . '-ajax-nonce'); ?>'
     391                action: 'dismiss_<?php echo esc_attr(self::$plugin_prefix); ?>_notice_handler',
     392                _ajax_nonce: '<?php echo esc_attr(wp_create_nonce(self::$plugin_prefix . '-ajax-nonce')); ?>'
    375393            }
    376394        });
    … …  
    384402?>
    385403
    386 <div class="notice notice-info is-dismissible <?php echo self::$plugin_prefix; ?>-notice">
    387 
    388 <p><strong><?php printf(__('Thank you for using %s plugin', self::$plugin_text_domain), self::$plugin_name); ?></strong><br />
     404<div class="notice notice-info is-dismissible <?php echo esc_attr(self::$plugin_prefix); ?>-notice">
     405
     406<p><strong><?php
     407/* translators: name of the plugin */
     408printf(esc_html(__('Thank you for using %s plugin', 'block-wp-login')), esc_html(self::$plugin_name)); ?></strong><br />
    389409<?php
    390410
    391411                    if (self::$plugin_trial == true) {
    392412
    393                         _e('Would you like to try even more features? Download your 7 day free trial now!', self::$plugin_text_domain);
     413                        echo esc_html(__('Would you like to try even more features? Download your 7 day free trial now!', 'block-wp-login'));
    394414
    395415                    } else {
    396416
    397                         echo sprintf(__('Upgrade now to %s Premium to enable more options and features and contribute to the further development of this plugin.', self::$plugin_text_domain), self::$plugin_name);
     417/* translators: name of the plugin */
     418                        echo esc_html(sprintf(__('Upgrade now to %s Premium to enable more options and features and contribute to the further development of this plugin.', 'block-wp-login'), self::$plugin_name));
    398419
    399420                    }
    … …  
    407428?>
    408429
    409 <a href="<?php echo esc_url(self::premium_link()); ?>" title="<?php echo esc_attr(sprintf(__('Try %s Premium', self::$plugin_text_domain), self::$plugin_name)); ?>" class="button-primary"><?php printf(__('Trial %s Premium for 7 days', self::$plugin_text_domain), self::$plugin_name); ?></a>
     430<a href="<?php echo esc_url(self::premium_link()); ?>" title="<?php
     431/* translators: name of the plugin */
     432echo esc_attr(sprintf(__('Try %s Premium', 'block-wp-login'), self::$plugin_name)); ?>" class="button-primary"><?php printf(esc_html(__('Trial %s Premium for 7 days', 'block-wp-login'), self::$plugin_name)); ?></a>
    410433
    411434<?php
    … …  
    414437
    415438?>
    416 <a href="<?php echo esc_url(self::upgrade_link()); ?>" title="<?php echo esc_attr(sprintf(__('Upgrade now to %s Premium', self::$plugin_text_domain), self::$plugin_name)); ?>" class="button-primary"><?php printf(__('Upgrade now to %s Premium', self::$plugin_text_domain), self::$plugin_name); ?></a></p>
     439<a href="<?php echo esc_url(self::upgrade_link()); ?>" title="<?php
     440/* translators: name of the plugin */
     441echo esc_attr(sprintf(__('Upgrade now to %s Premium', 'block-wp-login'), self::$plugin_name)); ?>" class="button-primary"><?php printf(esc_html(__('Upgrade now to %s Premium', 'block-wp-login')), esc_html(self::$plugin_name)); ?></a></p>
    417442
    418443</div>
    419444
    420445<script type="text/javascript">
    421     jQuery(document).on('click', '.<?php echo self::$plugin_prefix; ?>-notice .notice-dismiss', function() {
     446    jQuery(document).on('click', '.<?php echo esc_attr(self::$plugin_prefix); ?>-notice .notice-dismiss', function() {
    422447        jQuery.ajax({
    423448            url: ajaxurl,
    424449            data: {
    425                 action: 'dismiss_<?php echo self::$plugin_prefix; ?>_notice_handler',
    426                 _ajax_nonce: '<?php echo wp_create_nonce(self::$plugin_prefix . '-ajax-nonce'); ?>'
     450                action: 'dismiss_<?php echo esc_attr(self::$plugin_prefix); ?>_notice_handler',
     451                _ajax_nonce: '<?php echo esc_attr(wp_create_nonce(self::$plugin_prefix . '-ajax-nonce')); ?>'
    427452            }
    428453        });
    … …  
    434459                }
    435460
    436             } elseif (time() > (strtotime('+1 hour', filectime(__DIR__))) && get_user_meta(get_current_user_id(), self::$plugin_prefix . '-notice-dismissed', true) != self::plugin_version() && !get_option(self::$plugin_prefix . '_donated')) {
    437 
    438 ?>
    439 
    440 <div class="notice notice-info is-dismissible <?php echo self::$plugin_prefix; ?>-notice">
    441 <p><strong><?php printf(__('Thank you for using %s plugin', self::$plugin_text_domain), self::$plugin_name); ?></strong></p>
    442 <?php
    443 
     461            } elseif (
     462                time() > (strtotime('+1 hour', filectime(__DIR__))) &&
     463                get_user_meta(get_current_user_id(), self::$plugin_prefix . '-notice-dismissed', true) != self::plugin_version() &&
     464                !get_option(self::$plugin_prefix . '_donated')
     465            ) {
     466
     467?>
     468
     469<div class="notice notice-info is-dismissible <?php echo esc_attr(self::$plugin_prefix); ?>-notice">
     470<p><strong><?php
     471/* translators: name of the plugin */
     472printf(esc_html(__('Thank you for using %s plugin', 'block-wp-login')), esc_html(self::$plugin_name)); ?></strong></p>
     473<?php
     474
     475// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound
    444476                do_action(self::$plugin_prefix . '_admin_notice_donate');
    445477
    446478?>
    447 <p><?php esc_html_e('Funding plugins like this one with small financial contributions is essential to pay the developers to continue to do what they do. Please take a moment to give a small amount ...', self::$plugin_text_domain); ?></p>
    448 <p><a href="<?php echo esc_url(self::upgrade_link()); ?>" title="<?php echo esc_attr(sprintf(__('Contribute to %s', self::$plugin_text_domain), self::$plugin_name)); ?>" class="button-primary"><?php printf(__('Contribute to %s', self::$plugin_text_domain), self::$plugin_name); ?></a> <a href="#" id="<?php echo self::$plugin_prefix; ?>-already-paid" title="<?php echo esc_attr(__('Aleady Contributed!', self::$plugin_text_domain)); ?>" class="button-primary"><?php esc_html_e('Aleady Contributed!', self::$plugin_text_domain); ?></a></p>
     479<p><?php esc_html_e('Funding plugins like this one with small financial contributions is essential to pay the developers to continue to do what they do. Please take a moment to give a small amount ...', 'block-wp-login'); ?></p>
     480<p><a href="<?php echo esc_url(self::upgrade_link()); ?>" title="<?php
     481/* translators: name of the plugin */
     482echo esc_attr(sprintf(__('Contribute to %s', 'block-wp-login'), self::$plugin_name)); ?>" class="button-primary"><?php printf(esc_html(__('Contribute to %s', 'block-wp-login')), esc_html(self::$plugin_name)); ?></a> <a href="#" id="<?php echo esc_attr(self::$plugin_prefix); ?>-already-paid" title="<?php echo esc_attr(__('Aleady Contributed!', 'block-wp-login')); ?>" class="button-primary"><?php esc_html_e('Aleady Contributed!', 'block-wp-login'); ?></a></p>
    449483</div>
    450484
    451485<script type="text/javascript">
    452     jQuery(document).on('click', '#<?php echo self::$plugin_prefix; ?>-already-paid', function() {
    453         if (confirm(<?php echo json_encode(__('Have you really? Press "Cancel" if you forgot to 🙂', self::$plugin_text_domain)); ?>)) {
    454             alert(<?php echo json_encode(__('Thank you!', self::$plugin_text_domain)); ?>);
    455             jQuery('.<?php echo self::$plugin_prefix; ?>-notice').fadeTo(100, 0, function() {
    456                 jQuery('.<?php echo self::$plugin_prefix; ?>-notice').slideUp(100, function() {
    457                     jQuery('.<?php echo self::$plugin_prefix; ?>-notice').remove()
     486    jQuery(document).on('click', '#<?php echo esc_attr(self::$plugin_prefix); ?>-already-paid', function() {
     487        if (confirm(<?php echo json_encode(__('Have you really? Press "Cancel" if you forgot to 🙂', 'block-wp-login')); ?>)) {
     488            alert(<?php echo json_encode(__('Thank you!', 'block-wp-login')); ?>);
     489            jQuery('.<?php echo esc_attr(self::$plugin_prefix); ?>-notice').fadeTo(100, 0, function() {
     490                jQuery('.<?php echo esc_attr(self::$plugin_prefix); ?>-notice').slideUp(100, function() {
     491                    jQuery('.<?php echo esc_attr(self::$plugin_prefix); ?>-notice').remove()
    458492                });
    459493            });
    … …  
    461495                url: ajaxurl,
    462496                data: {
    463                     action: 'dismiss_<?php echo self::$plugin_prefix; ?>_notice_handler',
     497                    action: 'dismiss_<?php echo esc_attr(self::$plugin_prefix); ?>_notice_handler',
    464498                    donated: 'true',
    465                     _ajax_nonce: '<?php echo wp_create_nonce(self::$plugin_prefix . '-ajax-nonce'); ?>'
     499                    _ajax_nonce: '<?php echo esc_attr(wp_create_nonce(self::$plugin_prefix . '-ajax-nonce')); ?>'
    466500                }
    467501            });
    468502        } else {
    469             window.location.assign('<?php echo self::upgrade_link(); ?>');
     503            window.location.assign('<?php echo esc_url(self::upgrade_link()); ?>');
    470504        }
    471505    });
    472     jQuery(document).on('click', '.<?php echo self::$plugin_prefix; ?>-notice .notice-dismiss', function() {
     506    jQuery(document).on('click', '.<?php echo esc_attr(self::$plugin_prefix); ?>-notice .notice-dismiss', function() {
    473507        jQuery.ajax({
    474508            url: ajaxurl,
    475509            data: {
    476                 action: 'dismiss_<?php echo self::$plugin_prefix; ?>_notice_handler',
    477                 _ajax_nonce: '<?php echo wp_create_nonce(self::$plugin_prefix . '-ajax-nonce'); ?>'
     510                action: 'dismiss_<?php echo esc_attr(self::$plugin_prefix); ?>_notice_handler',
     511                _ajax_nonce: '<?php echo esc_attr(wp_create_nonce(self::$plugin_prefix . '-ajax-nonce')); ?>'
    478512            }
    479513        });
    … …  
    509543                    is_admin() &&
    510544                    $pagenow === 'customize.php' &&
    511                     isset($_GET['theme']) &&
    512                     !in_array($_GET['theme'], $themes, true)
     545                    isset($_GET['theme']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     546                    !in_array($_GET['theme'], $themes, true) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    513547                ) && !(
    514548                    !is_admin() &&
    515549                    $pagenow === 'index.php' &&
    516                     isset($_GET['customize_theme']) &&
    517                     isset($_GET['customize_changeset_uuid']) &&
    518                     !in_array($_GET['customize_theme'], $themes, true)
     550                    isset($_GET['customize_theme']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     551                    isset($_GET['customize_changeset_uuid']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     552                    !in_array($_GET['customize_theme'], $themes, true) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    519553                )
    520554            ) {
    … …  
    530564                    is_admin() &&
    531565                    $pagenow === 'customize.php' &&
    532                     isset($_GET['theme']) &&
    533                     in_array($_GET['theme'], $themes, true)
     566                    isset($_GET['theme']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     567                    in_array($_GET['theme'], $themes, true) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    534568                ) || (
    535569                    !is_admin() &&
    536570                    $pagenow === 'index.php' &&
    537                     isset($_GET['customize_theme']) &&
    538                     isset($_GET['customize_changeset_uuid']) &&
    539                     in_array($_GET['customize_theme'], $themes, true)
     571                    isset($_GET['customize_theme']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     572                    isset($_GET['customize_changeset_uuid']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     573                    in_array($_GET['customize_theme'], $themes, true) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    540574                ))
    541575            ) {
    … …  
    549583                    !is_admin() &&
    550584                    $pagenow === 'index.php' &&
    551                     isset($_GET['customize_theme']) &&
    552                     isset($_GET['customize_changeset_uuid'])
     585                    isset($_GET['customize_theme']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     586                    isset($_GET['customize_changeset_uuid']) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    553587               
    554588            ) {
    555589
    556                 $child = wp_get_theme($_GET['customize_theme']);
     590                $child = wp_get_theme(sanitize_file_name(wp_unslash($_GET['customize_theme']))); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    557591
    558592                if (isset($child->template) && in_array($child->template, $themes, true)) {
    … …  
    568602                is_admin() &&
    569603                ($pagenow === 'customize.php' || $pagenow === 'admin-ajax.php') &&
    570                 isset($_GET['theme']) || (isset($_POST['customize_theme']) && isset($_POST['customize_changeset_uuid']))
     604                (
     605                    isset($_GET['theme']) || // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     606                    (
     607                        isset($_POST['customize_theme']) && // phpcs:ignore WordPress.Security.NonceVerification.Missing
     608                        isset($_POST['customize_changeset_uuid']) // phpcs:ignore WordPress.Security.NonceVerification.Missing
     609                    )
     610                )
    571611            ) {
    572612
    573                 if (isset($_GET['theme'])) {
    574 
    575                     $child = wp_get_theme($_GET['theme']);
     613                if (isset($_GET['theme'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     614
     615                    $child = wp_get_theme(sanitize_file_name(wp_unslash($_GET['theme']))); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    576616
    577617                } else {
    578618
    579                     $child = wp_get_theme($_POST['customize_theme']);
     619                    $child = wp_get_theme(sanitize_file_name(wp_unslash($_POST['customize_theme']))); // phpcs:ignore WordPress.Security.NonceVerification.Missing
    580620
    581621                }
    … …  
    622662
    623663?>
    624 <span class="description customize-control-description"><?php echo $this->description; ?></span>
     664<span class="description customize-control-description"><?php echo esc_html($this->description); ?></span>
    625665<?php
    626666
    … …  
    647687?>
    648688        </ul>
    649         <input type="hidden" id="_customize-input-<?php echo $this->id; ?>" <?php $this->link(); ?> value="<?php echo esc_attr(implode(',', $multi_values)); ?>" />
     689        <input type="hidden" id="_customize-input-<?php echo esc_attr($this->id); ?>" <?php $this->link(); ?> value="<?php echo esc_attr(implode(',', $multi_values)); ?>" />
    650690<?php
    651691

  • block-wp-login/tags/1.5.5/readme.txt

    r3284110 r3410920  
    44Tags: security, secure, login security, block hackers, security plugin
    55Requires at least: 3.5.0
    6 Tested up to: 6.8
     6Tested up to: 6.9
    77Requires PHP: 5.6
    8 Stable tag: 1.5.4
     8Stable tag: 1.5.5
    99License: GPLv2 or later
    1010License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    4444
    4545== Changelog ==
     46
     47= 1.5.5 =
     48* Fix a minor bug and general housekeeping preparing for "Plugin Check" code review
    4649
    4750= 1.5.4 =
    … …  
    178181== Upgrade Notice ==
    179182
    180 = 1.5.4 =
    181 * Updated race condition prevention when WordPress core version changes
     183= 1.5.5 =
     184* Fix a minor bug and general housekeeping preparing for "Plugin Check" code review

  • block-wp-login/trunk/block-wp-login.php

    r3284110 r3410920  
    22/*
    33 * Plugin Name: Block wp-login
    4  * Version: 1.5.4
     4 * Version: 1.5.5
    55 * Plugin URI: https://webd.uk/support/
    66 * Description: This plugin completely blocks access to wp-login.php and creates a new secret login URL
    77 * Author: Webd Ltd
    88 * Author URI: https://webd.uk
     9 * License: GPLv2 or later
     10 * License URI: https://www.gnu.org/licenses/old-licenses/gpl-2.0.html
    911 * Text Domain: block-wp-login
    1012 */
    … …  
    1315
    1416if (!defined('ABSPATH')) {
    15     exit(__('This isn\'t the page you\'re looking for. Move along, move along.', 'block-wp-login'));
     17    exit(esc_html(__('This isn\'t the page you\'re looking for. Move along, move along.', 'block-wp-login')));
    1618}
    1719
    … …  
    2224    class bwpl_class {
    2325
    24         public static $version = '1.5.4';
     26        public static $version = '1.5.5';
    2527
    2628        private $bwpl_new_slug = '';
    … …  
    7375        function bwpl_configure_slug() {
    7476
    75             if (isset($_POST['bwpl_nonce']) && wp_verify_nonce($_POST['bwpl_nonce'], 'bwpl_slug_change') && isset($_POST['bwpl_slug']) && current_user_can('manage_options')) {
    76 
    77                 $this->bwpl_new_slug = trim(sanitize_key(wp_strip_all_tags($_POST['bwpl_slug'])));
     77            if (isset($_POST['bwpl_nonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['bwpl_nonce'])), 'bwpl_slug_change') && isset($_POST['bwpl_slug']) && current_user_can('manage_options')) {
     78
     79                $this->bwpl_new_slug = trim(sanitize_key(wp_strip_all_tags(wp_unslash($_POST['bwpl_slug']))));
    7880
    7981                if ($this->bwpl_new_slug) {
    8082
     83                    $notify = (isset($_POST['bwpl_notify']) && 'true' === $_POST['bwpl_notify']);
    8184                    $this->bwpl_uninstall();
    82                     $this->bwpl_install();
     85                    $this->bwpl_install(false, $notify);
    8386
    8487                } else {
    … …  
    126129                if (
    127130                    isset($_POST['bwpl_unknown_admin']) &&
    128                     $_POST['bwpl_unknown_admin'] &&
     131                    sanitize_text_field(wp_unslash($_POST['bwpl_unknown_admin'])) &&
    129132                    isset($_POST['bwpl_known_ips']) &&
    130                     $_POST['bwpl_known_ips']
     133                    sanitize_textarea_field(wp_unslash($_POST['bwpl_known_ips']))
    131134                ) {
    132135
    133                     $known_ips = preg_split('/\r\n|[\r\n]/', $_POST['bwpl_known_ips']);
     136                    $known_ips = preg_split('/\r\n|[\r\n]/', sanitize_textarea_field(wp_unslash($_POST['bwpl_known_ips'])));
    134137
    135138                    foreach ($known_ips AS $key => $known_ip) {
    … …  
    187190            for ($i = 0; $i < 8; $i++) {
    188191
    189                 $randomString .= $characters[rand(0, strlen($characters) - 1)];
     192                $randomString .= $characters[wp_rand(0, strlen($characters) - 1)];
    190193
    191194            }
    192195
    193196?>
    194 <input id="bwpl_slug" name="bwpl_slug" type="text" class="regular-text code" value="<?php echo get_option('bwpl_slug'); ?>" />
     197<input id="bwpl_slug" name="bwpl_slug" type="text" class="regular-text code" value="<?php echo esc_attr(get_option('bwpl_slug')); ?>" />
    195198
    196199<script type="text/javascript">
    … …  
    206209<p><?php esc_html_e('To change your WordPress login address, enter your chosen slug above. Leave it blank to enable the default login address.', 'block-wp-login'); ?></p>
    207210
    208 <p><?php printf(esc_html__('%1$sClick here%2$s to generate a random login address.', 'block-wp-login'),'<a href="javascript:void(0)" class="randomlogin">','</a>'); ?></p>
     211<p><a href="javascript:void(0)" class="randomlogin"><?php echo esc_html(__('Click here', 'block-wp-login')); ?></a> <?php echo esc_html(__('to generate a random login address.', 'block-wp-login')); ?></p>
    209212
    210213<script type="text/javascript">
    … …  
    217220    jQuery('#bwpl_slug').val(result);
    218221    alert(<?php echo json_encode(__('WARNING! DO NOT LOCK YOURSELF OUT! Your new login address will be', 'block-wp-login') . ' ' . get_site_url() . '/'); ?> + result + '/');
    219     jQuery('#bwpl_slug').val(result);
     222    jQuery('#bwpl_notify').prop('checked', true);
    220223});
    221224</script>
    … …  
    225228            if (get_option('bwpl_slug')) {
    226229
    227                 echo get_site_url(null, (get_option('bwpl_slug') . '/'));
     230                echo esc_url(get_site_url(null, (get_option('bwpl_slug') . '/')));
    228231
    229232            } else {
    230233
    231                 echo get_site_url(null, 'wp-login.php');
     234                echo esc_url(get_site_url(null, 'wp-login.php'));
    232235
    233236            } ?></p>
    … …  
    257260<p><strong><?php esc_html_e('Please Note: ', 'block-wp-login'); ?></strong><?php
    258261
    259                 printf(
     262                echo wp_kses(sprintf(
     263/* translators: link to plugin install page */
    260264                    __('To lock down your website to only serve legitimate content, please take a look at our new plugin "%s".', 'block-wp-login'),
    261                     '<a href="' . esc_url(add_query_arg(array('s' => 'deny-all-firewall+genuine', 'tab' => 'search', 'type' => 'term'), self_admin_url('plugin-install.php'))) . '" title="' . __('Deny All Firewall', 'block-wp-login') . '">' . __('Deny All Firewall', 'block-wp-login') . '</a>'
    262                 );
     265                    '<a href="' . esc_url(add_query_arg(array('s' => 'deny-all-firewall+genuine', 'tab' => 'search', 'type' => 'term'), self_admin_url('plugin-install.php'))) . '" title="' . esc_attr(__('Deny All Firewall', 'block-wp-login')) . '">' . __('Deny All Firewall', 'block-wp-login') . '</a>'
     266                ), 'post');
    263267
    264268?></p>
    … …  
    287291        }
    288292
    289         function bwpl_install($new_version = false) {
    290 
    291             if ($new_version || (isset($_POST['bwpl_notify']) && 'true' === $_POST['bwpl_notify'])) {
     293        function bwpl_install($new_version = false, $notify = true) {
     294
     295            global $wp_filesystem;
     296
     297            if (!$wp_filesystem) {
     298
     299                require_once (ABSPATH . '/wp-admin/includes/file.php');
     300
     301                WP_Filesystem();
     302
     303            }
     304
     305            if ($new_version || $notify) {
    292306
    293307                $this->bwpl_send_emails($new_version);
    … …  
    301315                $content = implode($this->bwpl_new_slug . '-wp-login.php', $content_chunks);
    302316
    303                 if ((!file_exists(bwplCommon::get_home_path() . $this->bwpl_new_slug . '-wp-login.php') && is_writable(bwplCommon::get_home_path())) || is_writable(bwplCommon::get_home_path() . $this->bwpl_new_slug . '-wp-login.php')) {
     317                if ((!file_exists(bwplCommon::get_home_path() . $this->bwpl_new_slug . '-wp-login.php') && $wp_filesystem->is_writable(bwplCommon::get_home_path())) || $wp_filesystem->is_writable(bwplCommon::get_home_path() . $this->bwpl_new_slug . '-wp-login.php')) {
    304318
    305319                    file_put_contents(bwplCommon::get_home_path() . $this->bwpl_new_slug . '-wp-login.php', $content);
    … …  
    309323            }
    310324
    311             if ((!file_exists(bwplCommon::get_home_path() . '.htaccess') && is_writable(bwplCommon::get_home_path())) || is_writable(bwplCommon::get_home_path() . '.htaccess')) {
     325            if ((!file_exists(bwplCommon::get_home_path() . '.htaccess') && $wp_filesystem->is_writable(bwplCommon::get_home_path())) || $wp_filesystem->is_writable(bwplCommon::get_home_path() . '.htaccess')) {
    312326
    313327                $markerdata = file(bwplCommon::get_home_path() . '.htaccess');
    … …  
    346360                    }
    347361
    348                     $f = @fopen(bwplCommon::get_home_path() . '.htaccess', 'w');
    349                     fwrite($f, $newdata);
     362                    $wp_filesystem->put_contents(
     363                        bwplCommon::get_home_path() . '.htaccess',
     364                        $newdata,
     365                        FS_CHMOD_FILE
     366                    );
    350367
    351368                }
    … …  
    361378?>
    362379<div class="notice notice-success">
    363     <p><?php printf(esc_html__('%1$sBlock wp-login%2$s activated. ', 'block-wp-login'),'<strong>','</strong>'); ?><a href="<?php echo admin_url('options-permalink.php'); ?>"><?php esc_html_e('Configure the plugin here.', 'block-wp-login'); ?></a></p>
     380    <p><?php
     381/* translators: <strong> HTML tags */
     382echo wp_kses(sprintf(__('%1$sBlock wp-login%2$s activated. ', 'block-wp-login'),'<strong>','</strong>'), 'post'); ?><a href="<?php echo esc_url(admin_url('options-permalink.php')); ?>"><?php esc_html_e('Configure the plugin here.', 'block-wp-login'); ?></a></p>
    364383</div>
    365384<?php
    … …  
    369388        function bwpl_uninstall() {
    370389
    371             if (is_writable(bwplCommon::get_home_path() . '.htaccess')) {
     390            global $wp_filesystem;
     391
     392            if (!$wp_filesystem) {
     393
     394                require_once (ABSPATH . '/wp-admin/includes/file.php');
     395
     396                WP_Filesystem();
     397
     398            }
     399
     400            if ($wp_filesystem->is_writable(bwplCommon::get_home_path() . '.htaccess')) {
    372401
    373402                $markerdata = file(bwplCommon::get_home_path() . '.htaccess');
    … …  
    424453                    }
    425454
    426                     $f = @fopen(bwplCommon::get_home_path() . '.htaccess', 'w');
    427                     fwrite($f, $newdata);
     455                    $wp_filesystem->put_contents(
     456                        bwplCommon::get_home_path() . '.htaccess',
     457                        $newdata,
     458                        FS_CHMOD_FILE
     459                    );
    428460
    429461                }
    … …  
    435467            add_filter('lostpassword_url', array($this, 'bwpl_reset_logout_url'));
    436468
    437             if (is_writable(bwplCommon::get_home_path() . get_option('bwpl_slug') . '-wp-login.php') && get_option('bwpl_slug')) {
    438 
    439                 unlink(bwplCommon::get_home_path() . get_option('bwpl_slug') . '-wp-login.php');
     469            if ($wp_filesystem->is_writable(bwplCommon::get_home_path() . get_option('bwpl_slug') . '-wp-login.php') && get_option('bwpl_slug')) {
     470
     471                wp_delete_file(bwplCommon::get_home_path() . get_option('bwpl_slug') . '-wp-login.php');
    440472
    441473            }
    … …  
    525557            if ($new_version) {
    526558
    527                 $message = __('A new version of WordPress has been detected so we have reinstalled "Block wp-login" and here is a reminder of your login URL:', 'block-wp-login') . "\r\n\r\n";
     559                $message = __('A recent WordPress core update has been detected and “Block wp-login” has been re-installed. Here is a reminder of your login address:', 'block-wp-login');
    528560
    529561            } else {
    530562
    531                 $message = __('Your WordPress login URL has been changed:', 'block-wp-login') . "\r\n\r\n";
    532 
    533             }
     563                $message = __('Your WordPress login address has been changed:', 'block-wp-login');
     564
     565            }
     566
     567            $message .=  "\r\n\r\n";
    534568
    535569            if ($this->bwpl_new_slug) {
    … …  
    543577            }
    544578
    545             $message .= __('Make sure you save this email and / or bookmark this address so you don\'t get locked out!', 'block-wp-login') . "\r\n\r\n";
    546             $message .= __('Contact us if you are having trouble with WordPress https://webd.uk', 'block-wp-login') . "\r\n\r\n";
    547             $message .= __('If you like our plugin please leave a short review: https://wordpress.org/support/plugin/block-wp-login/reviews/#new-post', 'block-wp-login') . "\r\n\r\n";
     579            $message .= __('Keep this link handy! Bookmarking it is the best way to ensure you never get locked out.', 'block-wp-login');
     580            $message .=  "\r\n\r\n---\r\n\r\n";
     581            $message .= __('Does your site need a glow-up?', 'block-wp-login');
     582            $message .=  "\r\n";
     583            $message .= __('Running slowly?', 'block-wp-login');
     584            $message .=  "\r\n";
     585            $message .= __('Want new features?', 'block-wp-login');
     586            $message .=  "\r\n\r\n";
     587            $message .= __('See how we can help', 'block-wp-login');
     588            $message .=  ' https://webd.uk';
    548589
    549590            if (is_multisite()) {
    … …  
    559600            if ($new_version) {
    560601
     602/* translators: website title */
    561603                $title = sprintf(__('[%s] WordPress Login Reminder', 'block-wp-login'), $blogname);
    562604
    563605            } else {
    564606
     607/* translators: website title */
    565608                $title = sprintf(__('[%s] WordPress Login Changed', 'block-wp-login'), $blogname);
    566609
    … …  
    579622?>
    580623<div class="notice notice-error">
    581     <p><?php printf(esc_html__('%1$sBlock wp-login%2$s activated email could not be sent.', 'block-wp-login'),'<strong>','</strong>'); ?></p>
     624    <p><?php
     625/* translators: <strong> HTML tags */
     626wp_kses(sprintf(__('%1$sBlock wp-login%2$s activated email could not be sent.', 'block-wp-login'),'<strong>','</strong>'), 'post'); ?></p>
    582627</div>
    583628<?php
    … …  
    655700                            }
    656701
     702/* translators: website title */
    657703                            $title = sprintf(__('[%s] WordPress Login Alert', 'block-wp-login'), $blogname);
    658704
    … …  
    681727            if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
    682728
    683                 $ip = $_SERVER['HTTP_CF_CONNECTING_IP'];
     729                $ip = filter_var(wp_unslash($_SERVER['HTTP_CF_CONNECTING_IP']), FILTER_VALIDATE_IP);
    684730
    685731            } elseif (isset($_SERVER['REMOTE_ADDR'])) {
    686732
    687                 $ip = $_SERVER['REMOTE_ADDR'];
     733                $ip = filter_var(wp_unslash($_SERVER['REMOTE_ADDR']), FILTER_VALIDATE_IP);
    688734
    689735            }
    … …  
    710756            global $wpdb;
    711757
     758// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
    712759            return (bool) $wpdb->get_var($wpdb->prepare("SELECT GET_LOCK(%s, %d)", 'bwpl_lock', 0));
    713760
    … …  
    718765            global $wpdb;
    719766
     767// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
    720768            return (bool) $wpdb->get_var($wpdb->prepare("SELECT RELEASE_LOCK(%s)", 'bwpl_lock'));
    721769
    … …  
    730778    }
    731779
    732     $Block_wp_login = new bwpl_class();
     780    new bwpl_class();
    733781
    734782}

  • block-wp-login/trunk/includes/class-bwpl-common.php

    r2986003 r3410920  
    11<?php
    22/*
    3  * Version: 1.3.9
     3 * Version: 1.4
    44 */
    55
    … …  
    4343        public static function plugin_text_domain() {
    4444
    45             return self::$plugin_text_domain;
     45            return 'block-wp-login';
    4646
    4747        }
    … …  
    6161        public static function support_url() {
    6262
    63             return 'https://wordpress.org/support/plugin/' . self::$plugin_text_domain . '/';
     63            return 'https://wordpress.org/support/plugin/' . 'block-wp-login' . '/';
    6464
    6565        }
    … …  
    6767        public static function control_upgrade_text() {
    6868
    69             $upgrade_text = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr(sprintf(__('Upgrade now to %s Premium', self::$plugin_text_domain), self::$plugin_name)) . '">' . sprintf(__('Upgrade now to %s Premium', self::$plugin_text_domain), self::$plugin_name) . '</a>';
     69/* translators: name of the plugin */
     70            $upgrade_text = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr(sprintf(__('Upgrade now to %s Premium', 'block-wp-login'), self::$plugin_name)) . '">' . sprintf(__('Upgrade now to %s Premium', 'block-wp-login'), self::$plugin_name) . '</a>';
    7071
    7172            if (!class_exists(self::$plugin_premium_class) || !get_option(self::$plugin_prefix . '_purchased')) {
    … …  
    7374                if (!class_exists(self::$plugin_premium_class)) {
    7475
    75                     $upgrade_text .= sprintf(wp_kses(__(' or <a href="%s" title="Download Free Trial">trial it for 7 days</a>', self::$plugin_text_domain), array('a' => array('href' => array(), 'title' => array()))), esc_url(self::premium_link()));
     76/* translators: link to the premium upgrade */
     77                    $upgrade_text .= sprintf(wp_kses(__(' or <a href="%s" title="Download Free Trial">trial it for 7 days</a>', 'block-wp-login'), array('a' => array('href' => array(), 'title' => array()))), esc_url(self::premium_link()));
    7678
    7779                }
    … …  
    8587        public static function control_section_description() {
    8688
    87             $default_description = sprintf(wp_kses(__('If you have any requests for new features, please <a href="%s" title="Support Forum">let us know in the support forum</a>.', self::$plugin_text_domain), array('a' => array('href' => array(), 'title' => array()))), esc_url(self::support_url()));
     89/* translators: link to the plugin's support forum */
     90            $default_description = sprintf(wp_kses(__('If you have any requests for new features, please <a href="%s" title="Support Forum">let us know in the support forum</a>.', 'block-wp-login'), array('a' => array('href' => array(), 'title' => array()))), esc_url(self::support_url()));
    8891
    8992            if (self::$plugin_premium_class) {
    … …  
    9598                    if (!class_exists(self::$plugin_premium_class)) {
    9699
    97                         $section_description = '<strong>' . __('For even more options', self::$plugin_text_domain) . '</strong>' . ' ' . $upgrade_text;
     100                        $section_description = '<strong>' . __('For even more options', 'block-wp-login') . '</strong>' . ' ' . $upgrade_text;
    98101
    99102                    } else {
    100103
    101                         $section_description = '<strong>' . __('To keep using premium options', self::$plugin_text_domain) . '</strong>' . ' ' . $upgrade_text;
     104                        $section_description = '<strong>' . __('To keep using premium options', 'block-wp-login') . '</strong>' . ' ' . $upgrade_text;
    102105
    103106                    }
    … …  
    119122                $section_description .= ' ' . sprintf(
    120123                    wp_kses(
     124/* translators: link to plugin install page */
    121125                        __(
    122126                            '<strong>To reset this section of options to default settings</strong> without affecting other sections in the customizer, install <a href="%s" title="Reset Customizer">Reset Customizer</a>.',
    123                             self::$plugin_text_domain
     127                            'block-wp-login'
    124128                        ),
    125129                        array('strong' => array(), 'a' => array('href' => array(), 'title' => array()))
    … …  
    145149        public static function control_setting_upgrade_nag() {
    146150
    147             $upgrade_nag = self::control_upgrade_text() . __(' to use this option.', self::$plugin_text_domain);
     151            $upgrade_nag = self::control_upgrade_text() . __(' to use this option.', 'block-wp-login');
    148152
    149153            return $upgrade_nag;
    … …  
    234238
    235239                $generated_css = sprintf('%s { %s: %s; }', $selector, $style, $prefix.$mod.$postfix);
    236                 echo $generated_css;
     240                echo wp_kses($generated_css, 'strip');
    237241
    238242            } elseif ($mod) {
    239243
    240244                $generated_css = sprintf('%s { %s:%s; }', $selector, $style, $prefix.$value.$postfix);
    241                 echo $generated_css;
     245                echo wp_kses($generated_css, 'strip');
    242246
    243247            }
    … …  
    249253            if (self::$plugin_premium_class) {
    250254
    251                 return add_query_arg('url', (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'], 'https://webd.uk/product/' . self::$plugin_text_domain . '-upgrade/');
    252 
     255                if (isset($_SERVER['HTTP_HOST'])) {
     256
     257                    return add_query_arg('url', (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . filter_var(wp_unslash($_SERVER['HTTP_HOST'], FILTER_SANITIZE_URL)), 'https://webd.uk/product/' . 'block-wp-login' . '-upgrade/');
     258
     259                } else {
     260
     261                    return 'https://webd.uk/product/' . 'block-wp-login' . '-upgrade/';
     262
     263                }
    253264
    254265            } else {
    … …  
    276287            $settings_links = array();
    277288
    278             $settings_links[] = '<a href="' . esc_url($settings_link) . '" title="' . esc_attr(__('Settings', self::$plugin_text_domain)) . '">' . __('Settings', self::$plugin_text_domain) . '</a>';
     289            $settings_links[] = '<a href="' . esc_url($settings_link) . '" title="' . esc_attr(__('Settings', 'block-wp-login')) . '">' . __('Settings', 'block-wp-login') . '</a>';
    279290
    280291            if (!get_option(self::$plugin_prefix . '_purchased')) {
    … …  
    284295                    if (self::$plugin_upgrade) {
    285296
    286                         $settings_links[] = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr(sprintf(__('Buy %s Premium', self::$plugin_text_domain), self::$plugin_name)) . '" style="color: orange; font-weight: bold;">' . __('Buy Now', self::$plugin_text_domain) . '</a>';
     297/* translators: name of the plugin */
     298                        $settings_links[] = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr(sprintf(__('Buy %s Premium', 'block-wp-login'), self::$plugin_name)) . '" style="color: orange; font-weight: bold;">' . __('Buy Now', 'block-wp-login') . '</a>';
    287299
    288300                    } else {
    289301
    290                         $settings_links[] = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr(sprintf(__('Buy %s', self::$plugin_text_domain), self::$plugin_name)) . '" style="color: orange; font-weight: bold;">' . __('Buy Now', self::$plugin_text_domain) . '</a>';
     302/* translators: name of the plugin */
     303                        $settings_links[] = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr(sprintf(__('Buy %s', 'block-wp-login'), self::$plugin_name)) . '" style="color: orange; font-weight: bold;">' . __('Buy Now', 'block-wp-login') . '</a>';
    291304
    292305                    }
    … …  
    294307                } else {
    295308
    296                     $settings_links[] = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr((self::$plugin_premium_class ? sprintf(__('Upgrade now to %s Premium', self::$plugin_text_domain), self::$plugin_name) : sprintf(__('Contribute to %s', self::$plugin_text_domain), self::$plugin_name))) . '" style="color: orange; font-weight: bold;">' . (self::$plugin_premium_class ? __('Upgrade', self::$plugin_text_domain) : __('Support Us', self::$plugin_text_domain)) . '</a>';
     309/* translators: name of the plugin */
     310                    $settings_links[] = '<a href="' . esc_url(self::upgrade_link()) . '" title="' . esc_attr((self::$plugin_premium_class ? sprintf(__('Upgrade now to %s Premium', 'block-wp-login'), self::$plugin_name) : sprintf(__('Contribute to %s', 'block-wp-login'), self::$plugin_name))) . '" style="color: orange; font-weight: bold;">' . (self::$plugin_premium_class ? __('Upgrade', 'block-wp-login') : __('Support Us', 'block-wp-login')) . '</a>';
    297311
    298312                }
    … …  
    300314                if ($premium) {
    301315
    302                     $settings_links[] = '<a href="' . wp_nonce_url('?activate-' . self::$plugin_prefix . '=true', self::$plugin_prefix . '_activate') . '" id="' . self::$plugin_prefix . '_activate_upgrade" title="' . esc_attr(__('Activate Purchase', self::$plugin_text_domain)) . '" onclick="jQuery(this).append(&#39; <img src=&#34;/wp-admin/images/loading.gif&#34; style=&#34;float: none; width: auto; height: auto;&#34; />&#39;); setTimeout(function(){document.getElementById(\'' . self::$plugin_prefix . '_activate_upgrade\').removeAttribute(\'href\');},1); return true;">' . __('Activate Purchase', self::$plugin_text_domain) . '</a>';
    303 
    304                 } elseif (self::$plugin_trial && !is_plugin_active(self::$plugin_text_domain . '-premium/' . self::$plugin_text_domain . '-premium.php')) {
    305 
    306                     $settings_links[] = '<a href="' . esc_url(self::premium_link()) . '" title="' . esc_attr(sprintf(__('Trial %s Premium', self::$plugin_text_domain), self::$plugin_name)) . ' for 7 days">' . __('Download Trial', self::$plugin_text_domain) . '</a>';
     316                    $settings_links[] = '<a href="' . wp_nonce_url('?activate-' . self::$plugin_prefix . '=true', self::$plugin_prefix . '_activate') . '" id="' . self::$plugin_prefix . '_activate_upgrade" title="' . esc_attr(__('Activate Purchase', 'block-wp-login')) . '" onclick="jQuery(this).append(&#39; <img src=&#34;/wp-admin/images/loading.gif&#34; style=&#34;float: none; width: auto; height: auto;&#34; />&#39;); setTimeout(function(){document.getElementById(\'' . self::$plugin_prefix . '_activate_upgrade\').removeAttribute(\'href\');},1); return true;">' . __('Activate Purchase', 'block-wp-login') . '</a>';
     317
     318                } elseif (self::$plugin_trial && !is_plugin_active('block-wp-login' . '-premium/' . 'block-wp-login' . '-premium.php')) {
     319
     320/* translators: name of the plugin */
     321                    $settings_links[] = '<a href="' . esc_url(self::premium_link()) . '" title="' . esc_attr(sprintf(__('Trial %s Premium', 'block-wp-login'), self::$plugin_name)) . ' for 7 days">' . __('Download Trial', 'block-wp-login') . '</a>';
    307322
    308323                }
    … …  
    310325            } elseif ($premium) {
    311326
    312                 $settings_links[] = '<strong style="color: green; display: inline;">' . __('Purchase Confirmed', self::$plugin_text_domain) . '</strong>';
     327                $settings_links[] = '<strong style="color: green; display: inline;">' . __('Purchase Confirmed', 'block-wp-login') . '</strong>';
    313328
    314329            }
    … …  
    320335        public static function plugin_row_meta($plugin_meta, $plugin_file, $plugin_data, $status) {
    321336
    322             if ($plugin_file === self::$plugin_text_domain . '/' . self::$plugin_text_domain . '.php') {
    323 
    324                 $plugin_meta[] = '<a href="' . esc_url(self::support_url()) . '" title="' . __('Problems? We are here to help!', self::$plugin_text_domain) . '" style="color: orange; font-weight: bold;">' . __('Need help?', self::$plugin_text_domain) . '</a>';
    325                 $plugin_meta[] = '<a href="https://wordpress.org/support/plugin/' . self::$plugin_text_domain . '/reviews/#new-post" title="' . esc_attr(sprintf(__('If you like %s, please leave a review!', self::$plugin_text_domain), self::$plugin_name)) . '">' . __('Review plugin', self::$plugin_text_domain) . '</a>';
     337            if ($plugin_file === 'block-wp-login' . '/' . 'block-wp-login' . '.php') {
     338
     339                $plugin_meta[] = '<a href="' . esc_url(self::support_url()) . '" title="' . __('Problems? We are here to help!', 'block-wp-login') . '" style="color: orange; font-weight: bold;">' . __('Need help?', 'block-wp-login') . '</a>';
     340/* translators: name of the plugin */
     341                $plugin_meta[] = '<a href="https://wordpress.org/support/plugin/' . 'block-wp-login' . '/reviews/#new-post" title="' . esc_attr(sprintf(__('If you like %s, please leave a review!', 'block-wp-login'), self::$plugin_name)) . '">' . __('Review plugin', 'block-wp-login') . '</a>';
    326342
    327343            }
    … …  
    357373?>
    358374
    359 <div class="notice notice-error is-dismissible <?php echo self::$plugin_prefix; ?>-notice">
    360 
    361 <p><strong><?php echo self::$plugin_name; ?></strong><br />
    362 <?php esc_html_e('In order to use the premium features, you need to install the premium version of the plugin ...', self::$plugin_text_domain); ?></p>
    363 
    364 <p><a href="<?php echo esc_url(self::premium_link()); ?>" title="<?php echo esc_attr(sprintf(__('Download %s Premium', self::$plugin_text_domain), self::$plugin_name)); ?>" class="button-primary"><?php printf(__('Download %s Premium', self::$plugin_text_domain), self::$plugin_name); ?></a></p>
     375<div class="notice notice-error is-dismissible <?php echo esc_html(self::$plugin_prefix); ?>-notice">
     376
     377<p><strong><?php echo esc_html(self::$plugin_name); ?></strong><br />
     378<?php esc_html_e('In order to use the premium features, you need to install the premium version of the plugin ...', 'block-wp-login'); ?></p>
     379
     380<p><a href="<?php
     381/* translators: name of the plugin */
     382echo esc_url(self::premium_link()); ?>" title="<?php echo esc_attr(sprintf(__('Download %s Premium', 'block-wp-login'), self::$plugin_name)); ?>" class="button-primary"><?php printf(esc_html(__('Download %s Premium', 'block-wp-login')), esc_html(self::$plugin_name)); ?></a></p>
    365383
    366384</div>
    367385
    368386<script type="text/javascript">
    369     jQuery(document).on('click', '.<?php echo self::$plugin_prefix; ?>-notice .notice-dismiss', function() {
     387    jQuery(document).on('click', '.<?php echo esc_attr(self::$plugin_prefix); ?>-notice .notice-dismiss', function() {
    370388        jQuery.ajax({
    371389            url: ajaxurl,
    372390            data: {
    373                 action: 'dismiss_<?php echo self::$plugin_prefix; ?>_notice_handler',
    374                 _ajax_nonce: '<?php echo wp_create_nonce(self::$plugin_prefix . '-ajax-nonce'); ?>'
     391                action: 'dismiss_<?php echo esc_attr(self::$plugin_prefix); ?>_notice_handler',
     392                _ajax_nonce: '<?php echo esc_attr(wp_create_nonce(self::$plugin_prefix . '-ajax-nonce')); ?>'
    375393            }
    376394        });
    … …  
    384402?>
    385403
    386 <div class="notice notice-info is-dismissible <?php echo self::$plugin_prefix; ?>-notice">
    387 
    388 <p><strong><?php printf(__('Thank you for using %s plugin', self::$plugin_text_domain), self::$plugin_name); ?></strong><br />
     404<div class="notice notice-info is-dismissible <?php echo esc_attr(self::$plugin_prefix); ?>-notice">
     405
     406<p><strong><?php
     407/* translators: name of the plugin */
     408printf(esc_html(__('Thank you for using %s plugin', 'block-wp-login')), esc_html(self::$plugin_name)); ?></strong><br />
    389409<?php
    390410
    391411                    if (self::$plugin_trial == true) {
    392412
    393                         _e('Would you like to try even more features? Download your 7 day free trial now!', self::$plugin_text_domain);
     413                        echo esc_html(__('Would you like to try even more features? Download your 7 day free trial now!', 'block-wp-login'));
    394414
    395415                    } else {
    396416
    397                         echo sprintf(__('Upgrade now to %s Premium to enable more options and features and contribute to the further development of this plugin.', self::$plugin_text_domain), self::$plugin_name);
     417/* translators: name of the plugin */
     418                        echo esc_html(sprintf(__('Upgrade now to %s Premium to enable more options and features and contribute to the further development of this plugin.', 'block-wp-login'), self::$plugin_name));
    398419
    399420                    }
    … …  
    407428?>
    408429
    409 <a href="<?php echo esc_url(self::premium_link()); ?>" title="<?php echo esc_attr(sprintf(__('Try %s Premium', self::$plugin_text_domain), self::$plugin_name)); ?>" class="button-primary"><?php printf(__('Trial %s Premium for 7 days', self::$plugin_text_domain), self::$plugin_name); ?></a>
     430<a href="<?php echo esc_url(self::premium_link()); ?>" title="<?php
     431/* translators: name of the plugin */
     432echo esc_attr(sprintf(__('Try %s Premium', 'block-wp-login'), self::$plugin_name)); ?>" class="button-primary"><?php printf(esc_html(__('Trial %s Premium for 7 days', 'block-wp-login'), self::$plugin_name)); ?></a>
    410433
    411434<?php
    … …  
    414437
    415438?>
    416 <a href="<?php echo esc_url(self::upgrade_link()); ?>" title="<?php echo esc_attr(sprintf(__('Upgrade now to %s Premium', self::$plugin_text_domain), self::$plugin_name)); ?>" class="button-primary"><?php printf(__('Upgrade now to %s Premium', self::$plugin_text_domain), self::$plugin_name); ?></a></p>
     439<a href="<?php echo esc_url(self::upgrade_link()); ?>" title="<?php
     440/* translators: name of the plugin */
     441echo esc_attr(sprintf(__('Upgrade now to %s Premium', 'block-wp-login'), self::$plugin_name)); ?>" class="button-primary"><?php printf(esc_html(__('Upgrade now to %s Premium', 'block-wp-login')), esc_html(self::$plugin_name)); ?></a></p>
    417442
    418443</div>
    419444
    420445<script type="text/javascript">
    421     jQuery(document).on('click', '.<?php echo self::$plugin_prefix; ?>-notice .notice-dismiss', function() {
     446    jQuery(document).on('click', '.<?php echo esc_attr(self::$plugin_prefix); ?>-notice .notice-dismiss', function() {
    422447        jQuery.ajax({
    423448            url: ajaxurl,
    424449            data: {
    425                 action: 'dismiss_<?php echo self::$plugin_prefix; ?>_notice_handler',
    426                 _ajax_nonce: '<?php echo wp_create_nonce(self::$plugin_prefix . '-ajax-nonce'); ?>'
     450                action: 'dismiss_<?php echo esc_attr(self::$plugin_prefix); ?>_notice_handler',
     451                _ajax_nonce: '<?php echo esc_attr(wp_create_nonce(self::$plugin_prefix . '-ajax-nonce')); ?>'
    427452            }
    428453        });
    … …  
    434459                }
    435460
    436             } elseif (time() > (strtotime('+1 hour', filectime(__DIR__))) && get_user_meta(get_current_user_id(), self::$plugin_prefix . '-notice-dismissed', true) != self::plugin_version() && !get_option(self::$plugin_prefix . '_donated')) {
    437 
    438 ?>
    439 
    440 <div class="notice notice-info is-dismissible <?php echo self::$plugin_prefix; ?>-notice">
    441 <p><strong><?php printf(__('Thank you for using %s plugin', self::$plugin_text_domain), self::$plugin_name); ?></strong></p>
    442 <?php
    443 
     461            } elseif (
     462                time() > (strtotime('+1 hour', filectime(__DIR__))) &&
     463                get_user_meta(get_current_user_id(), self::$plugin_prefix . '-notice-dismissed', true) != self::plugin_version() &&
     464                !get_option(self::$plugin_prefix . '_donated')
     465            ) {
     466
     467?>
     468
     469<div class="notice notice-info is-dismissible <?php echo esc_attr(self::$plugin_prefix); ?>-notice">
     470<p><strong><?php
     471/* translators: name of the plugin */
     472printf(esc_html(__('Thank you for using %s plugin', 'block-wp-login')), esc_html(self::$plugin_name)); ?></strong></p>
     473<?php
     474
     475// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound
    444476                do_action(self::$plugin_prefix . '_admin_notice_donate');
    445477
    446478?>
    447 <p><?php esc_html_e('Funding plugins like this one with small financial contributions is essential to pay the developers to continue to do what they do. Please take a moment to give a small amount ...', self::$plugin_text_domain); ?></p>
    448 <p><a href="<?php echo esc_url(self::upgrade_link()); ?>" title="<?php echo esc_attr(sprintf(__('Contribute to %s', self::$plugin_text_domain), self::$plugin_name)); ?>" class="button-primary"><?php printf(__('Contribute to %s', self::$plugin_text_domain), self::$plugin_name); ?></a> <a href="#" id="<?php echo self::$plugin_prefix; ?>-already-paid" title="<?php echo esc_attr(__('Aleady Contributed!', self::$plugin_text_domain)); ?>" class="button-primary"><?php esc_html_e('Aleady Contributed!', self::$plugin_text_domain); ?></a></p>
     479<p><?php esc_html_e('Funding plugins like this one with small financial contributions is essential to pay the developers to continue to do what they do. Please take a moment to give a small amount ...', 'block-wp-login'); ?></p>
     480<p><a href="<?php echo esc_url(self::upgrade_link()); ?>" title="<?php
     481/* translators: name of the plugin */
     482echo esc_attr(sprintf(__('Contribute to %s', 'block-wp-login'), self::$plugin_name)); ?>" class="button-primary"><?php printf(esc_html(__('Contribute to %s', 'block-wp-login')), esc_html(self::$plugin_name)); ?></a> <a href="#" id="<?php echo esc_attr(self::$plugin_prefix); ?>-already-paid" title="<?php echo esc_attr(__('Aleady Contributed!', 'block-wp-login')); ?>" class="button-primary"><?php esc_html_e('Aleady Contributed!', 'block-wp-login'); ?></a></p>
    449483</div>
    450484
    451485<script type="text/javascript">
    452     jQuery(document).on('click', '#<?php echo self::$plugin_prefix; ?>-already-paid', function() {
    453         if (confirm(<?php echo json_encode(__('Have you really? Press "Cancel" if you forgot to 🙂', self::$plugin_text_domain)); ?>)) {
    454             alert(<?php echo json_encode(__('Thank you!', self::$plugin_text_domain)); ?>);
    455             jQuery('.<?php echo self::$plugin_prefix; ?>-notice').fadeTo(100, 0, function() {
    456                 jQuery('.<?php echo self::$plugin_prefix; ?>-notice').slideUp(100, function() {
    457                     jQuery('.<?php echo self::$plugin_prefix; ?>-notice').remove()
     486    jQuery(document).on('click', '#<?php echo esc_attr(self::$plugin_prefix); ?>-already-paid', function() {
     487        if (confirm(<?php echo json_encode(__('Have you really? Press "Cancel" if you forgot to 🙂', 'block-wp-login')); ?>)) {
     488            alert(<?php echo json_encode(__('Thank you!', 'block-wp-login')); ?>);
     489            jQuery('.<?php echo esc_attr(self::$plugin_prefix); ?>-notice').fadeTo(100, 0, function() {
     490                jQuery('.<?php echo esc_attr(self::$plugin_prefix); ?>-notice').slideUp(100, function() {
     491                    jQuery('.<?php echo esc_attr(self::$plugin_prefix); ?>-notice').remove()
    458492                });
    459493            });
    … …  
    461495                url: ajaxurl,
    462496                data: {
    463                     action: 'dismiss_<?php echo self::$plugin_prefix; ?>_notice_handler',
     497                    action: 'dismiss_<?php echo esc_attr(self::$plugin_prefix); ?>_notice_handler',
    464498                    donated: 'true',
    465                     _ajax_nonce: '<?php echo wp_create_nonce(self::$plugin_prefix . '-ajax-nonce'); ?>'
     499                    _ajax_nonce: '<?php echo esc_attr(wp_create_nonce(self::$plugin_prefix . '-ajax-nonce')); ?>'
    466500                }
    467501            });
    468502        } else {
    469             window.location.assign('<?php echo self::upgrade_link(); ?>');
     503            window.location.assign('<?php echo esc_url(self::upgrade_link()); ?>');
    470504        }
    471505    });
    472     jQuery(document).on('click', '.<?php echo self::$plugin_prefix; ?>-notice .notice-dismiss', function() {
     506    jQuery(document).on('click', '.<?php echo esc_attr(self::$plugin_prefix); ?>-notice .notice-dismiss', function() {
    473507        jQuery.ajax({
    474508            url: ajaxurl,
    475509            data: {
    476                 action: 'dismiss_<?php echo self::$plugin_prefix; ?>_notice_handler',
    477                 _ajax_nonce: '<?php echo wp_create_nonce(self::$plugin_prefix . '-ajax-nonce'); ?>'
     510                action: 'dismiss_<?php echo esc_attr(self::$plugin_prefix); ?>_notice_handler',
     511                _ajax_nonce: '<?php echo esc_attr(wp_create_nonce(self::$plugin_prefix . '-ajax-nonce')); ?>'
    478512            }
    479513        });
    … …  
    509543                    is_admin() &&
    510544                    $pagenow === 'customize.php' &&
    511                     isset($_GET['theme']) &&
    512                     !in_array($_GET['theme'], $themes, true)
     545                    isset($_GET['theme']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     546                    !in_array($_GET['theme'], $themes, true) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    513547                ) && !(
    514548                    !is_admin() &&
    515549                    $pagenow === 'index.php' &&
    516                     isset($_GET['customize_theme']) &&
    517                     isset($_GET['customize_changeset_uuid']) &&
    518                     !in_array($_GET['customize_theme'], $themes, true)
     550                    isset($_GET['customize_theme']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     551                    isset($_GET['customize_changeset_uuid']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     552                    !in_array($_GET['customize_theme'], $themes, true) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    519553                )
    520554            ) {
    … …  
    530564                    is_admin() &&
    531565                    $pagenow === 'customize.php' &&
    532                     isset($_GET['theme']) &&
    533                     in_array($_GET['theme'], $themes, true)
     566                    isset($_GET['theme']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     567                    in_array($_GET['theme'], $themes, true) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    534568                ) || (
    535569                    !is_admin() &&
    536570                    $pagenow === 'index.php' &&
    537                     isset($_GET['customize_theme']) &&
    538                     isset($_GET['customize_changeset_uuid']) &&
    539                     in_array($_GET['customize_theme'], $themes, true)
     571                    isset($_GET['customize_theme']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     572                    isset($_GET['customize_changeset_uuid']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     573                    in_array($_GET['customize_theme'], $themes, true) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    540574                ))
    541575            ) {
    … …  
    549583                    !is_admin() &&
    550584                    $pagenow === 'index.php' &&
    551                     isset($_GET['customize_theme']) &&
    552                     isset($_GET['customize_changeset_uuid'])
     585                    isset($_GET['customize_theme']) && // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     586                    isset($_GET['customize_changeset_uuid']) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    553587               
    554588            ) {
    555589
    556                 $child = wp_get_theme($_GET['customize_theme']);
     590                $child = wp_get_theme(sanitize_file_name(wp_unslash($_GET['customize_theme']))); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    557591
    558592                if (isset($child->template) && in_array($child->template, $themes, true)) {
    … …  
    568602                is_admin() &&
    569603                ($pagenow === 'customize.php' || $pagenow === 'admin-ajax.php') &&
    570                 isset($_GET['theme']) || (isset($_POST['customize_theme']) && isset($_POST['customize_changeset_uuid']))
     604                (
     605                    isset($_GET['theme']) || // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     606                    (
     607                        isset($_POST['customize_theme']) && // phpcs:ignore WordPress.Security.NonceVerification.Missing
     608                        isset($_POST['customize_changeset_uuid']) // phpcs:ignore WordPress.Security.NonceVerification.Missing
     609                    )
     610                )
    571611            ) {
    572612
    573                 if (isset($_GET['theme'])) {
    574 
    575                     $child = wp_get_theme($_GET['theme']);
     613                if (isset($_GET['theme'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     614
     615                    $child = wp_get_theme(sanitize_file_name(wp_unslash($_GET['theme']))); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    576616
    577617                } else {
    578618
    579                     $child = wp_get_theme($_POST['customize_theme']);
     619                    $child = wp_get_theme(sanitize_file_name(wp_unslash($_POST['customize_theme']))); // phpcs:ignore WordPress.Security.NonceVerification.Missing
    580620
    581621                }
    … …  
    622662
    623663?>
    624 <span class="description customize-control-description"><?php echo $this->description; ?></span>
     664<span class="description customize-control-description"><?php echo esc_html($this->description); ?></span>
    625665<?php
    626666
    … …  
    647687?>
    648688        </ul>
    649         <input type="hidden" id="_customize-input-<?php echo $this->id; ?>" <?php $this->link(); ?> value="<?php echo esc_attr(implode(',', $multi_values)); ?>" />
     689        <input type="hidden" id="_customize-input-<?php echo esc_attr($this->id); ?>" <?php $this->link(); ?> value="<?php echo esc_attr(implode(',', $multi_values)); ?>" />
    650690<?php
    651691

  • block-wp-login/trunk/readme.txt

    r3284110 r3410920  
    44Tags: security, secure, login security, block hackers, security plugin
    55Requires at least: 3.5.0
    6 Tested up to: 6.8
     6Tested up to: 6.9
    77Requires PHP: 5.6
    8 Stable tag: 1.5.4
     8Stable tag: 1.5.5
    99License: GPLv2 or later
    1010License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    4444
    4545== Changelog ==
     46
     47= 1.5.5 =
     48* Fix a minor bug and general housekeeping preparing for "Plugin Check" code review
    4649
    4750= 1.5.4 =
    … …  
    178181== Upgrade Notice ==
    179182
    180 = 1.5.4 =
    181 * Updated race condition prevention when WordPress core version changes
     183= 1.5.5 =
     184* Fix a minor bug and general housekeeping preparing for "Plugin Check" code review
Note: See TracChangeset for help on using the changeset viewer.