Skip to content

Inc20511261 xss fix and wp review #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
acalog wants to merge 10 commits into
base: master
Choose a base branch
from
Open

Inc20511261 xss fix and wp review #31

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
d48a067
fix text domain errors idenditified by WP PCP
dg4220 Jan 26, 2025
5c3726e
fix text domain errors identified by WP PCP:
dg4220 Jan 26, 2025
772f20c
Merge branch 'INC20511261-XSS-fix-and-WP-review' of github.com:bu-ist…
dg4220 Jan 26, 2025
26e5335
Escape all outputs
acalog Feb 1, 2025
967f1bf
Fix compatibility issues for 6.7.2
acalog Feb 13, 2025
053a0dd
Version bump
acalog Feb 13, 2025
90c1848
Version bump
acalog Dec 9, 2025
233c408
Fix wp prepare statements
acalog Dec 9, 2025
c153142
Fix line-endings; meta_key from BU_Group_Permissions class
acalog Dec 9, 2025
cd92dd2
Replace .bind/.delegate with .on; .attr with .prop
acalog Dec 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .wp-env.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
{
"core": "https://wordpress.org/wordpress-6.7.2.zip",
"plugins": [
".",
"C:/Users/acalog/bu/bu-slideshow",
"C:/Users/acalog/bu/wordpress/plugins/bu-navigation",
"C:/Users/acalog/bu/wordpress/plugins/plugin-check"
],
"config": {
"WP_DEBUG": true
}
}
10 changes: 7 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# BU Section Editing #
**Contributors:** mgburns, gcorne, awbauer, inderpreet99, anton-kachurin
**Tags:** permissions, section, access, acl, user management, custom roles, content editing, workflow, boston university, bu
**Requires at least:** 3.1
**Tested up to:** 4.5.3
**Stable tag:** 0.10.0
**Requires at least:** 3.1
**Tested up to:** 6.7.2
**Stable tag:** 0.10.1
**License:** GPLv2 or later
**License URI:** http://www.gnu.org/licenses/gpl-2.0.html

Expand Down Expand Up @@ -82,6 +82,10 @@ For more information on creating roles for use with section editing groups, see

## Changelog

### 0.10.0
* Conform to WP Coding Standards
* Tested for 6.7.2 compatibility

### 0.9.9
* Allow to add/edit posts of custom types

Expand Down
126 changes: 65 additions & 61 deletions admin.groups.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ public static function register_hooks() {
*/
public static function add_manage_users_column( $columns ) {

$columns[ self::MANAGE_USERS_COLUMN ] = __( 'Section Groups', BUSE_TEXTDOMAIN );
$columns[ self::MANAGE_USERS_COLUMN ] = __( 'Section Groups', 'bu-section-editing' );
return $columns;

}
Expand All @@ -77,7 +77,7 @@ public static function manage_users_group_column( $content, $column, $user_id )

if ( empty( $groups ) ) {

$content = __( 'None', BUSE_TEXTDOMAIN );
$content = __( 'None', 'bu-section-editing' );

} else {

Expand Down Expand Up @@ -106,10 +106,10 @@ public static function manage_users_group_column( $content, $column, $user_id )

if ( $truncated_count > 0 ) {
$content .= sprintf( ' %s <a href="%s"> %s %s</a>',
__( 'and', BUSE_TEXTDOMAIN ),
__( 'and', 'bu-section-editing' ),
admin_url( self::MANAGE_GROUPS_PAGE ),
$truncated_count,
_n( 'other', 'others', $truncated_count, BUSE_TEXTDOMAIN )
_n( 'other', 'others', $truncated_count, 'bu-section-editing' )
);
}
}
Expand Down Expand Up @@ -227,8 +227,9 @@ public static function add_edit_views() {
// Most of these options don't do anything at this time, but we should keep an eye
// on the ticket mentioned above as this could change in future releases
$args = array(
'label' => __( 'Editable', BUSE_TEXTDOMAIN ),
'label_count' => _n_noop( 'Editable <span class="count">(%s)</span>', 'Editable <span class="count">(%s)</span>' ),
'label' => __( 'Editable', 'bu-section-editing' ),
// translators: %s stands for number of labels.
'label_count' => _n_noop( 'Editable <span class="count">(%s)</span>', 'Editable <span class="count">(%s)</span>', 'bu-section-editing' ),
'public' => true,
'show_in_admin_all' => true,
'publicly_queryable' => true,
Expand Down Expand Up @@ -288,7 +289,7 @@ public static function add_editable_view( $views ) {

$count = $groups->get_allowed_post_count( $args );

$views[ self::EDITABLE_POST_STATUS ] = "<a href=\"$edit_link\" $class>" . __( 'Editable', BUSE_TEXTDOMAIN ) . " <span class=\"count\">($count)</span></a>";
$views[ self::EDITABLE_POST_STATUS ] = "<a href=\"$edit_link\" $class>" . __( 'Editable', 'bu-section-editing' ) . " <span class=\"count\">($count)</span></a>";

return $views;

Expand Down Expand Up @@ -409,8 +410,8 @@ public static function admin_scripts( $hook ) {
'showStatuses' => false,
'suppressUrls' => true,
'rpcUrl' => admin_url( 'admin-ajax.php?action=buse_render_post_list' ),
'allowLabel' => __( 'Allow', BUSE_TEXTDOMAIN ),
'denyLabel' => __( 'Deny', BUSE_TEXTDOMAIN ),
'allowLabel' => __( 'Allow', 'bu-section-editing' ),
'denyLabel' => __( 'Deny', 'bu-section-editing' ),
);

// Let the tree view class handle enqueing
Expand All @@ -426,9 +427,9 @@ public static function admin_scripts( $hook ) {
// Enforce section editor restrictions for inline/bulk edit actions
if ( 'edit.php' == $hook ) {
$strings = array(
'cantEditParentNotice' => __( 'You are not able to edit the parent.', BUSE_TEXTDOMAIN ),
'cantMovePostNotice' => __( 'You are not able to edit the parent, so you cannot place this page under the parent.', BUSE_TEXTDOMAIN ),
'publishLabel' => __( 'Published', BUSE_TEXTDOMAIN ),
'cantEditParentNotice' => __( 'You are not able to edit the parent.', 'bu-section-editing' ),
'cantMovePostNotice' => __( 'You are not able to edit the parent, so you cannot place this page under the parent.', 'bu-section-editing' ),
'publishLabel' => __( 'Published', 'bu-section-editing' ),
);
wp_enqueue_script( 'bu-section-editor-post', plugins_url( '/js/section-editor-post' . $suffix . '.js', __FILE__ ), array( 'jquery' ), $version, true );
wp_localize_script( 'bu-section-editor-post', 'buse_post', $strings );
Expand All @@ -441,39 +442,43 @@ public static function admin_scripts( $hook ) {
*/
public static function group_editor_i10n() {

$users_link = sprintf( '<a href="%s">%s</a>', admin_url( 'users.php' ), __( 'users page', BUSE_TEXTDOMAIN ) );
$add_user_link = sprintf( '<a href="%s">%s</a>', admin_url( 'user-new.php' ), __( 'add them to your site', BUSE_TEXTDOMAIN ) );
$nav_plugin_link = sprintf( '<a href="%s" target="_blank">%s</a>', BUSE_NAV_INSTALL_LINK, __( 'BU Navigation plugin', BUSE_TEXTDOMAIN ) );
$users_link = sprintf( '<a href="%s">%s</a>', admin_url( 'users.php' ), __( 'users page', 'bu-section-editing' ) );
$add_user_link = sprintf( '<a href="%s">%s</a>', admin_url( 'user-new.php' ), __( 'add them to your site', 'bu-section-editing' ) );
$nav_plugin_link = sprintf( '<a href="%s" target="_blank">%s</a>', BUSE_NAV_INSTALL_LINK, __( 'BU Navigation plugin', 'bu-section-editing' ) );

return array(
'bulkEditOpenText' => __( 'Bulk Edit', BUSE_TEXTDOMAIN ),
'bulkEditCloseText' => __( 'Close Bulk Edit', BUSE_TEXTDOMAIN ),
'bulkEditOpenTitle' => __( 'Enable bulk edit mode', BUSE_TEXTDOMAIN ),
'bulkEditCloseTitle' => __( 'Disable bulk edit mode', BUSE_TEXTDOMAIN ),
'confirmActionNotice' => __( 'Are you sure you want to do this?', BUSE_TEXTDOMAIN ),
'deleteGroupNotice' => __( 'You are about to permanently delete this section editing group. This action is irreversible.', BUSE_TEXTDOMAIN ),
'dirtyLeaverNotice' => __( 'Your group has pending edits. If you leave now, your changes will be lost.', BUSE_TEXTDOMAIN ),
'loadingText' => __( 'Loading...', BUSE_TEXTDOMAIN ),
'memberCountSingularLabel' => __( 'member', BUSE_TEXTDOMAIN ),
'memberCountPluralLabel' => __( 'members', BUSE_TEXTDOMAIN ),
'nameRequiredNotice' => __( 'Section editing groups require a name.', BUSE_TEXTDOMAIN ),
'bulkEditOpenText' => __( 'Bulk Edit', 'bu-section-editing' ),
'bulkEditCloseText' => __( 'Close Bulk Edit', 'bu-section-editing' ),
'bulkEditOpenTitle' => __( 'Enable bulk edit mode', 'bu-section-editing' ),
'bulkEditCloseTitle' => __( 'Disable bulk edit mode', 'bu-section-editing' ),
'confirmActionNotice' => __( 'Are you sure you want to do this?', 'bu-section-editing' ),
'deleteGroupNotice' => __( 'You are about to permanently delete this section editing group. This action is irreversible.', 'bu-section-editing' ),
'dirtyLeaverNotice' => __( 'Your group has pending edits. If you leave now, your changes will be lost.', 'bu-section-editing' ),
'loadingText' => __( 'Loading...', 'bu-section-editing' ),
'memberCountSingularLabel' => __( 'member', 'bu-section-editing' ),
'memberCountPluralLabel' => __( 'members', 'bu-section-editing' ),
'nameRequiredNotice' => __( 'Section editing groups require a name.', 'bu-section-editing' ),
'navDepAlertText' => sprintf(
__( "In order to set permissions for hierarchical post types, the BU Navigation plugin must be activated.\n\nPlease install BU Navigation:\n%s", BUSE_TEXTDOMAIN ),
// translators: %s stands for the BU Navigation install link.
__( "In order to set permissions for hierarchical post types, the BU Navigation plugin must be activated.\n\nPlease install BU Navigation:\n%s", 'bu-section-editing' ),
BUSE_NAV_INSTALL_LINK ),
'navDepEditorText' => sprintf(
__( 'Please install the %s in order to set permissions for this post type.', BUSE_TEXTDOMAIN ),
// translators: %s stands for an html anchor tag to the BU Navigation install link.
__( 'Please install the %s in order to set permissions for this post type.', 'bu-section-editing' ),
$nav_plugin_link ),
'permAllowLabel' => __( 'Allow', BUSE_TEXTDOMAIN ),
'permDenyLabel' => __( 'Deny', BUSE_TEXTDOMAIN ),
'permEditableLabel' => __( 'editable', BUSE_TEXTDOMAIN ),
'permNonEditableLabel' => __( 'non-editable', BUSE_TEXTDOMAIN ),
'permGlobalLabel' => __( 'All', BUSE_TEXTDOMAIN ),
'permAllowLabel' => __( 'Allow', 'bu-section-editing' ),
'permDenyLabel' => __( 'Deny', 'bu-section-editing' ),
'permEditableLabel' => __( 'editable', 'bu-section-editing' ),
'permNonEditableLabel' => __( 'non-editable', 'bu-section-editing' ),
'permGlobalLabel' => __( 'All', 'bu-section-editing' ),
'userWrongRoleNotice' => sprintf(
__( 'is not a section editor. Before you can assign them to a group, you must change their role to "Section Editor" on the %s.', BUSE_TEXTDOMAIN ),
// translators: %s stands for a link to the users page.
__( 'is not a section editor. Before you can assign them to a group, you must change their role to "Section Editor" on the %s.', 'bu-section-editing' ),
$users_link ),
'userAlreadyMemberNotice' => __( 'is already a member of this group.', BUSE_TEXTDOMAIN ),
'userAlreadyMemberNotice' => __( 'is already a member of this group.', 'bu-section-editing' ),
'userNotExistsNotice' => sprintf(
__( 'is not a member of this site. Please %s with the "Section Editor" role.', BUSE_TEXTDOMAIN ),
// translators: %s stands for a link to the add users page.
__( 'is not a member of this site. Please %s with the "Section Editor" role.', 'bu-section-editing' ),
$add_user_link ),
);
}
Expand All @@ -492,8 +497,8 @@ public static function admin_menus() {
}

$groups_manage = add_menu_page(
__( 'Section Groups', BUSE_TEXTDOMAIN ),
__( 'Section Groups', BUSE_TEXTDOMAIN ),
__( 'Section Groups', 'bu-section-editing' ),
__( 'Section Groups', 'bu-section-editing' ),
'promote_users',
self::MANAGE_GROUPS_SLUG,
array( 'BU_Groups_Admin', 'manage_groups_screen' ),
Expand All @@ -503,17 +508,17 @@ public static function admin_menus() {

add_submenu_page(
self::MANAGE_GROUPS_SLUG,
__( 'Section Groups', BUSE_TEXTDOMAIN ),
__( 'All Groups', BUSE_TEXTDOMAIN ),
__( 'Section Groups', 'bu-section-editing' ),
__( 'All Groups', 'bu-section-editing' ),
'promote_users',
self::MANAGE_GROUPS_SLUG,
array( 'BU_Groups_Admin', 'manage_groups_screen' )
);

$groups_edit = add_submenu_page(
self::MANAGE_GROUPS_SLUG,
__( 'Edit Section Group', BUSE_TEXTDOMAIN ),
__( 'Add New', BUSE_TEXTDOMAIN ),
__( 'Edit Section Group', 'bu-section-editing' ),
__( 'Add New', 'bu-section-editing' ),
'promote_users',
self::NEW_GROUP_SLUG,
array( 'BU_Groups_Admin', 'manage_groups_screen' )
Expand Down Expand Up @@ -542,14 +547,14 @@ public static function admin_notices() {
// List errors first
if ( isset( $notices['error'] ) ) {
foreach ( $notices['error'] as $msg ) {
printf( '<div id="message" class="error">%s</div>', $msg );
printf( '<div id="message" class="error">%s</div>', wp_kses_post( $msg ) );
}
}

// List notices second
if ( isset( $notices['update'] ) ) {
foreach ( $notices['update'] as $msg ) {
printf( '<div id="message" class="updated fade">%s</div>', $msg );
printf( '<div id="message" class="updated fade">%s</div>', wp_kses_post( $msg ) );
}
}

Expand All @@ -570,24 +575,24 @@ static function get_notices() {
if ( isset( $_GET['status'] ) ) {

$groups_url = admin_url( self::MANAGE_GROUPS_PAGE );
$view_txt = __( 'View all groups', BUSE_TEXTDOMAIN );
$view_txt = __( 'View all groups', 'bu-section-editing' );

switch ( $_GET['status'] ) {

case 1:
$notices['error'][] = '<p>' . __( 'There was an error saving the group.', BUSE_TEXTDOMAIN ) . '</p>';
$notices['error'][] = '<p>' . __( 'There was an error saving the group.', 'bu-section-editing' ) . '</p>';
break;

case 2:
$notices['update'][] = '<p>' . __( 'Group added.', BUSE_TEXTDOMAIN ) . " <a href=\"$groups_url\">$view_txt</a></p>";
$notices['update'][] = '<p>' . __( 'Group added.', 'bu-section-editing' ) . " <a href=\"$groups_url\">$view_txt</a></p>";
break;

case 3:
$notices['update'][] = '<p>' . __( 'Group updated.', BUSE_TEXTDOMAIN ) . " <a href=\"$groups_url\">$view_txt</a></p>";
$notices['update'][] = '<p>' . __( 'Group updated.', 'bu-section-editing' ) . " <a href=\"$groups_url\">$view_txt</a></p>";
break;

case 4:
$notices['update'][] = '<p>' . __( 'Group deleted.', BUSE_TEXTDOMAIN ) . '</p>';
$notices['update'][] = '<p>' . __( 'Group deleted.', 'bu-section-editing' ) . '</p>';
break;

default:
Expand All @@ -601,9 +606,11 @@ static function get_notices() {
if ( $valid_user_count == 0 ) {

$manage_users_url = admin_url( 'users.php' );
$users_link = sprintf( '<a href="%s">%s</a>', $manage_users_url, __( 'users page', BUSE_TEXTDOMAIN ) );
$no_users_warning = __( 'There are currently no users on your site that are capable of being assigned to section editing groups.', BUSE_TEXTDOMAIN );
$role_notice = sprintf( __( 'To start using this plugin, visit the %s and change the role for any users you would like to add to a section editing group to "Section Editor".', BUSE_TEXTDOMAIN ), $users_link );
// translators: %s stands for the manage users url.
$users_link = sprintf( '<a href="%s">%s</a>', $manage_users_url, __( 'users page', 'bu-section-editing' ) );
$no_users_warning = __( 'There are currently no users on your site that are capable of being assigned to section editing groups.', 'bu-section-editing' );
// translators: %s stands for the manage users url.
$role_notice = sprintf( __( 'To start using this plugin, visit the %s and change the role for any users you would like to add to a section editing group to "Section Editor".', 'bu-section-editing' ), $users_link );

$notices['error'][] = "<p>$no_users_warning</p><p>$role_notice</p>";
}
Expand Down Expand Up @@ -693,10 +700,7 @@ static function load_manage_groups() {

// Redirect if we have one
if ( $redirect_url ) {

// Use safe redirect as the redirect URL built with manage_groups_url() begins
// with admin_url and the final URL should be local.
wp_safe_redirect( $redirect_url );
wp_redirect( $redirect_url );
die();
}

Expand All @@ -706,7 +710,7 @@ static function load_manage_groups() {
$group = $groups->get( $group_id );

if ( empty( $group ) ) {
wp_die( 'No section editing group exists with an ID of : ' . $group_id );
wp_die( 'No section editing group exists with an ID of : ' . esc_html( $group_id ) );
}
}

Expand All @@ -717,7 +721,7 @@ static function load_manage_groups() {
if ( self::NEW_GROUP_SLUG == $_GET['page'] || $group_id > 0 ) {

add_screen_option( 'per_page', array(
'label' => __( 'Posts per page', BUSE_TEXTDOMAIN ),
'label' => __( 'Posts per page', 'bu-section-editing' ),
'default' => 10,
'option' => self::POSTS_PER_PAGE_OPTION,
)
Expand Down Expand Up @@ -796,7 +800,7 @@ static function manage_groups_screen() {
if ( $group_id > 0 ) {

$group = $groups->get( $group_id );
$page_title = __( 'Edit Section Group', BUSE_TEXTDOMAIN );
$page_title = __( 'Edit Section Group', 'bu-section-editing' );
$template_path = 'interface/edit-group.php';

} else {
Expand All @@ -810,7 +814,7 @@ static function manage_groups_screen() {
// New group page
case self::NEW_GROUP_SLUG:
$group = new BU_Edit_Group();
$page_title = __( 'Add Section Group', BUSE_TEXTDOMAIN );
$page_title = __( 'Add Section Group', 'bu-section-editing' );
$template_path = 'interface/edit-group.php';
break;
}
Expand Down Expand Up @@ -917,7 +921,7 @@ static function group_permissions_string( $group, $args = array() ) {
$counts[] = sprintf( '<span id="%s-stats" class="perm-stats %s"><span class="perm-stat-global">%s</span><span class="perm-stat-count">%s</span> <span class="perm-label">%s</span></span>',
$pt->name,
$global_edit,
__('All', BUSE_TEXTDOMAIN),
__('All', 'bu-section-editing'),
$count,
$label
);
Expand Down
Loading