Edit File by line

<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* WPSEO plugin file.

[2] Fix | Delete

[3] Fix | Delete

* @package WPSEO\Internals

[4] Fix | Delete

[5] Fix | Delete

[6] Fix | Delete

/**

[7] Fix | Delete

* Multisite utility class for network admin functionality.

[8] Fix | Delete

[9] Fix | Delete

class Yoast_Network_Admin implements WPSEO_WordPress_AJAX_Integration, WPSEO_WordPress_Integration {

[10] Fix | Delete

[11] Fix | Delete

/**

[12] Fix | Delete

* Action identifier for updating plugin network options.

[13] Fix | Delete

[14] Fix | Delete

* @var string

[15] Fix | Delete

[16] Fix | Delete

public const UPDATE_OPTIONS_ACTION = 'yoast_handle_network_options';

[17] Fix | Delete

[18] Fix | Delete

/**

[19] Fix | Delete

* Action identifier for restoring a site.

[20] Fix | Delete

[21] Fix | Delete

* @var string

[22] Fix | Delete

[23] Fix | Delete

public const RESTORE_SITE_ACTION = 'yoast_restore_site';

[24] Fix | Delete

[25] Fix | Delete

/**

[26] Fix | Delete

* Gets the available sites as choices, e.g. for a dropdown.

[27] Fix | Delete

[28] Fix | Delete

* @param bool $include_empty Optional. Whether to include an initial placeholder choice.

[29] Fix | Delete

* Default false.

[30] Fix | Delete

* @param bool $show_title Optional. Whether to show the title for each site. This requires

[31] Fix | Delete

* switching through the sites, so has performance implications for

[32] Fix | Delete

* sites that do not use a persistent cache.

[33] Fix | Delete

* Default false.

[34] Fix | Delete

[35] Fix | Delete

* @return array Choices as $site_id => $site_label pairs.

[36] Fix | Delete

[37] Fix | Delete

public function get_site_choices( $include_empty = false, $show_title = false ) {

[38] Fix | Delete

$choices = [];

[39] Fix | Delete

[40] Fix | Delete

if ( $include_empty ) {

[41] Fix | Delete

$choices['-'] = __( 'None', 'wordpress-seo' );

[42] Fix | Delete

}

[43] Fix | Delete

[44] Fix | Delete

$criteria = [

[45] Fix | Delete

'deleted' => 0,

[46] Fix | Delete

'network_id' => get_current_network_id(),

[47] Fix | Delete

];

[48] Fix | Delete

$sites = get_sites( $criteria );

[49] Fix | Delete

[50] Fix | Delete

foreach ( $sites as $site ) {

[51] Fix | Delete

$site_name = $site->domain . $site->path;

[52] Fix | Delete

if ( $show_title ) {

[53] Fix | Delete

$site_name = $site->blogname . ' (' . $site->domain . $site->path . ')';

[54] Fix | Delete

}

[55] Fix | Delete

$choices[ $site->blog_id ] = $site->blog_id . ': ' . $site_name;

[56] Fix | Delete

[57] Fix | Delete

$site_states = $this->get_site_states( $site );

[58] Fix | Delete

if ( ! empty( $site_states ) ) {

[59] Fix | Delete

$choices[ $site->blog_id ] .= ' [' . implode( ', ', $site_states ) . ']';

[60] Fix | Delete

}

[61] Fix | Delete

}

[62] Fix | Delete

[63] Fix | Delete

return $choices;

[64] Fix | Delete

}

[65] Fix | Delete

[66] Fix | Delete

/**

[67] Fix | Delete

* Gets the states of a site.

[68] Fix | Delete

[69] Fix | Delete

* @param WP_Site $site Site object.

[70] Fix | Delete

[71] Fix | Delete

* @return array Array of $state_slug => $state_label pairs.

[72] Fix | Delete

[73] Fix | Delete

public function get_site_states( $site ) {

[74] Fix | Delete

$available_states = [

[75] Fix | Delete

'public' => __( 'public', 'wordpress-seo' ),

[76] Fix | Delete

'archived' => __( 'archived', 'wordpress-seo' ),

[77] Fix | Delete

'mature' => __( 'mature', 'wordpress-seo' ),

[78] Fix | Delete

'spam' => __( 'spam', 'wordpress-seo' ),

[79] Fix | Delete

'deleted' => __( 'deleted', 'wordpress-seo' ),

[80] Fix | Delete

];

[81] Fix | Delete

[82] Fix | Delete

$site_states = [];

[83] Fix | Delete

foreach ( $available_states as $state_slug => $state_label ) {

[84] Fix | Delete

if ( $site->$state_slug === '1' ) {

[85] Fix | Delete

$site_states[ $state_slug ] = $state_label;

[86] Fix | Delete

}

[87] Fix | Delete

}

[88] Fix | Delete

[89] Fix | Delete

return $site_states;

[90] Fix | Delete

}

[91] Fix | Delete

[92] Fix | Delete

/**

[93] Fix | Delete

* Handles a request to update plugin network options.

[94] Fix | Delete

[95] Fix | Delete

* This method works similar to how option updates are handled in `wp-admin/options.php` and

[96] Fix | Delete

* `wp-admin/network/settings.php`.

[97] Fix | Delete

[98] Fix | Delete

* @return void

[99] Fix | Delete

[100] Fix | Delete

public function handle_update_options_request() {

[101] Fix | Delete

// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Reason: Nonce verification will happen in verify_request below.

[102] Fix | Delete

if ( ! isset( $_POST['network_option_group'] ) || ! is_string( $_POST['network_option_group'] ) ) {

[103] Fix | Delete

return;

[104] Fix | Delete

}

[105] Fix | Delete

[106] Fix | Delete

// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Reason: Nonce verification will happen in verify_request below.

[107] Fix | Delete

$option_group = sanitize_text_field( wp_unslash( $_POST['network_option_group'] ) );

[108] Fix | Delete

[109] Fix | Delete

if ( empty( $option_group ) ) {

[110] Fix | Delete

return;

[111] Fix | Delete

}

[112] Fix | Delete

[113] Fix | Delete

$this->verify_request( "{$option_group}-network-options" );

[114] Fix | Delete

[115] Fix | Delete

$whitelist_options = Yoast_Network_Settings_API::get()->get_whitelist_options( $option_group );

[116] Fix | Delete

[117] Fix | Delete

if ( empty( $whitelist_options ) ) {

[118] Fix | Delete

add_settings_error( $option_group, 'settings_updated', __( 'You are not allowed to modify unregistered network settings.', 'wordpress-seo' ), 'error' );

[119] Fix | Delete

[120] Fix | Delete

$this->terminate_request();

[121] Fix | Delete

return;

[122] Fix | Delete

}

[123] Fix | Delete

[124] Fix | Delete

// phpcs:disable WordPress.Security.NonceVerification -- Nonce verified via `verify_request()` above.

[125] Fix | Delete

foreach ( $whitelist_options as $option_name ) {

[126] Fix | Delete

$value = null;

[127] Fix | Delete

if ( isset( $_POST[ $option_name ] ) ) {

[128] Fix | Delete

// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Reason: Adding sanitize_text_field around this will break the saving of settings because it expects a string: https://github.com/Yoast/wordpress-seo/issues/12440.

[129] Fix | Delete

$value = wp_unslash( $_POST[ $option_name ] );

[130] Fix | Delete

}

[131] Fix | Delete

[132] Fix | Delete

WPSEO_Options::update_site_option( $option_name, $value );

[133] Fix | Delete

}

[134] Fix | Delete

// phpcs:enable WordPress.Security.NonceVerification

[135] Fix | Delete

[136] Fix | Delete

$settings_errors = get_settings_errors();

[137] Fix | Delete

if ( empty( $settings_errors ) ) {

[138] Fix | Delete

add_settings_error( $option_group, 'settings_updated', __( 'Settings Updated.', 'wordpress-seo' ), 'updated' );

[139] Fix | Delete

}

[140] Fix | Delete

[141] Fix | Delete

$this->terminate_request();

[142] Fix | Delete

}

[143] Fix | Delete

[144] Fix | Delete

/**

[145] Fix | Delete

* Handles a request to restore a site's default settings.

[146] Fix | Delete

[147] Fix | Delete

* @return void

[148] Fix | Delete

[149] Fix | Delete

public function handle_restore_site_request() {

[150] Fix | Delete

$this->verify_request( 'wpseo-network-restore', 'restore_site_nonce' );

[151] Fix | Delete

[152] Fix | Delete

$option_group = 'wpseo_ms';

[153] Fix | Delete

[154] Fix | Delete

// phpcs:ignore WordPress.Security.NonceVerification -- Nonce verified via `verify_request()` above.

[155] Fix | Delete

$site_id = ! empty( $_POST[ $option_group ]['site_id'] ) ? (int) $_POST[ $option_group ]['site_id'] : 0;

[156] Fix | Delete

if ( ! $site_id ) {

[157] Fix | Delete

add_settings_error( $option_group, 'settings_updated', __( 'No site has been selected to restore.', 'wordpress-seo' ), 'error' );

[158] Fix | Delete

[159] Fix | Delete

$this->terminate_request();

[160] Fix | Delete

return;

[161] Fix | Delete

}

[162] Fix | Delete

[163] Fix | Delete

$site = get_site( $site_id );

[164] Fix | Delete

if ( ! $site ) {

[165] Fix | Delete

/* translators: %s expands to the ID of a site within a multisite network. */

[166] Fix | Delete

add_settings_error( $option_group, 'settings_updated', sprintf( __( 'Site with ID %d not found.', 'wordpress-seo' ), $site_id ), 'error' );

[167] Fix | Delete

}

[168] Fix | Delete

else {

[169] Fix | Delete

WPSEO_Options::reset_ms_blog( $site_id );

[170] Fix | Delete

[171] Fix | Delete

/* translators: %s expands to the name of a site within a multisite network. */

[172] Fix | Delete

add_settings_error( $option_group, 'settings_updated', sprintf( __( '%s restored to default SEO settings.', 'wordpress-seo' ), esc_html( $site->blogname ) ), 'updated' );

[173] Fix | Delete

}

[174] Fix | Delete

[175] Fix | Delete

$this->terminate_request();

[176] Fix | Delete

}

[177] Fix | Delete

[178] Fix | Delete

/**

[179] Fix | Delete

* Outputs nonce, action and option group fields for a network settings page in the plugin.

[180] Fix | Delete

[181] Fix | Delete

* @param string $option_group Option group name for the current page.

[182] Fix | Delete

[183] Fix | Delete

* @return void

[184] Fix | Delete

[185] Fix | Delete

public function settings_fields( $option_group ) {

[186] Fix | Delete

[187] Fix | Delete

[188] Fix | Delete

[189] Fix | Delete

<?php

[190] Fix | Delete

wp_nonce_field( "$option_group-network-options" );

[191] Fix | Delete

}

[192] Fix | Delete

[193] Fix | Delete

/**

[194] Fix | Delete

* Enqueues network admin assets.

[195] Fix | Delete

[196] Fix | Delete

* @return void

[197] Fix | Delete

[198] Fix | Delete

public function enqueue_assets() {

[199] Fix | Delete

$asset_manager = new WPSEO_Admin_Asset_Manager();

[200] Fix | Delete

$asset_manager->enqueue_script( 'network-admin' );

[201] Fix | Delete

[202] Fix | Delete

$translations = [

[203] Fix | Delete

/* translators: %s: success message */

[204] Fix | Delete

'success_prefix' => __( 'Success: %s', 'wordpress-seo' ),

[205] Fix | Delete

/* translators: %s: error message */

[206] Fix | Delete

'error_prefix' => __( 'Error: %s', 'wordpress-seo' ),

[207] Fix | Delete

];

[208] Fix | Delete

$asset_manager->localize_script(

[209] Fix | Delete

'network-admin',

[210] Fix | Delete

'wpseoNetworkAdminGlobalL10n',

[211] Fix | Delete

$translations

[212] Fix | Delete

);

[213] Fix | Delete

}

[214] Fix | Delete

[215] Fix | Delete

/**

[216] Fix | Delete

* Hooks in the necessary actions and filters.

[217] Fix | Delete

[218] Fix | Delete

* @return void

[219] Fix | Delete

[220] Fix | Delete

public function register_hooks() {

[221] Fix | Delete

[222] Fix | Delete

if ( ! $this->meets_requirements() ) {

[223] Fix | Delete

return;

[224] Fix | Delete

}

[225] Fix | Delete

[226] Fix | Delete

add_action( 'admin_enqueue_scripts', [ $this, 'enqueue_assets' ] );

[227] Fix | Delete

[228] Fix | Delete

add_action( 'admin_action_' . self::UPDATE_OPTIONS_ACTION, [ $this, 'handle_update_options_request' ] );

[229] Fix | Delete

add_action( 'admin_action_' . self::RESTORE_SITE_ACTION, [ $this, 'handle_restore_site_request' ] );

[230] Fix | Delete

}

[231] Fix | Delete

[232] Fix | Delete

/**

[233] Fix | Delete

* Hooks in the necessary AJAX actions.

[234] Fix | Delete

[235] Fix | Delete

* @return void

[236] Fix | Delete

[237] Fix | Delete

public function register_ajax_hooks() {

[238] Fix | Delete

add_action( 'wp_ajax_' . self::UPDATE_OPTIONS_ACTION, [ $this, 'handle_update_options_request' ] );

[239] Fix | Delete

add_action( 'wp_ajax_' . self::RESTORE_SITE_ACTION, [ $this, 'handle_restore_site_request' ] );

[240] Fix | Delete

}

[241] Fix | Delete

[242] Fix | Delete

/**

[243] Fix | Delete

* Checks whether the requirements to use this class are met.

[244] Fix | Delete

[245] Fix | Delete

* @return bool True if requirements are met, false otherwise.

[246] Fix | Delete

[247] Fix | Delete

public function meets_requirements() {

[248] Fix | Delete

return is_multisite() && is_network_admin();

[249] Fix | Delete

}

[250] Fix | Delete

[251] Fix | Delete

/**

[252] Fix | Delete

* Verifies that the current request is valid.

[253] Fix | Delete

[254] Fix | Delete

* @param string $action Nonce action.

[255] Fix | Delete

* @param string $query_arg Optional. Nonce query argument. Default '_wpnonce'.

[256] Fix | Delete

[257] Fix | Delete

* @return void

[258] Fix | Delete

[259] Fix | Delete

public function verify_request( $action, $query_arg = '_wpnonce' ) {

[260] Fix | Delete

$has_access = current_user_can( 'wpseo_manage_network_options' );

[261] Fix | Delete

[262] Fix | Delete

if ( wp_doing_ajax() ) {

[263] Fix | Delete

check_ajax_referer( $action, $query_arg );

[264] Fix | Delete

[265] Fix | Delete

if ( ! $has_access ) {

[266] Fix | Delete

wp_die( -1, 403 );

[267] Fix | Delete

}

[268] Fix | Delete

return;

[269] Fix | Delete

}

[270] Fix | Delete

[271] Fix | Delete

check_admin_referer( $action, $query_arg );

[272] Fix | Delete

[273] Fix | Delete

if ( ! $has_access ) {

[274] Fix | Delete

wp_die( esc_html__( 'You are not allowed to perform this action.', 'wordpress-seo' ) );

[275] Fix | Delete

}

[276] Fix | Delete

}

[277] Fix | Delete

[278] Fix | Delete

/**

[279] Fix | Delete

* Terminates the current request by either redirecting back or sending an AJAX response.

[280] Fix | Delete

[281] Fix | Delete

* @return void

[282] Fix | Delete

[283] Fix | Delete

public function terminate_request() {

[284] Fix | Delete

if ( wp_doing_ajax() ) {

[285] Fix | Delete

$settings_errors = get_settings_errors();

[286] Fix | Delete

[287] Fix | Delete

if ( ! empty( $settings_errors ) && $settings_errors[0]['type'] === 'updated' ) {

[288] Fix | Delete

wp_send_json_success( $settings_errors, 200 );

[289] Fix | Delete

}

[290] Fix | Delete

[291] Fix | Delete

wp_send_json_error( $settings_errors, 400 );

[292] Fix | Delete

}

[293] Fix | Delete

[294] Fix | Delete

$this->persist_settings_errors();

[295] Fix | Delete

$this->redirect_back( [ 'settings-updated' => 'true' ] );

[296] Fix | Delete

}

[297] Fix | Delete

[298] Fix | Delete

/**

[299] Fix | Delete

* Persists settings errors.

[300] Fix | Delete

[301] Fix | Delete

* Settings errors are stored in a transient for 30 seconds so that this transient

[302] Fix | Delete

* can be retrieved on the next page load.

[303] Fix | Delete

[304] Fix | Delete

* @return void

[305] Fix | Delete

[306] Fix | Delete

protected function persist_settings_errors() {

[307] Fix | Delete

[308] Fix | Delete

* A regular transient is used here, since it is automatically cleared right after the redirect.

[309] Fix | Delete

* A network transient would be cleaner, but would require a lot of copied code from core for

[310] Fix | Delete

* just a minor adjustment when displaying settings errors.

[311] Fix | Delete

[312] Fix | Delete

set_transient( 'settings_errors', get_settings_errors(), 30 );

[313] Fix | Delete

}

[314] Fix | Delete

[315] Fix | Delete

/**

[316] Fix | Delete

* Redirects back to the referer URL, with optional query arguments.

[317] Fix | Delete

[318] Fix | Delete

* @param array $query_args Optional. Query arguments to add to the redirect URL. Default none.

[319] Fix | Delete

[320] Fix | Delete

* @return void

[321] Fix | Delete

[322] Fix | Delete

protected function redirect_back( $query_args = [] ) {

[323] Fix | Delete

$sendback = wp_get_referer();

[324] Fix | Delete

[325] Fix | Delete

if ( ! empty( $query_args ) ) {

[326] Fix | Delete

$sendback = add_query_arg( $query_args, $sendback );

[327] Fix | Delete

}

[328] Fix | Delete

[329] Fix | Delete

wp_safe_redirect( $sendback );

[330] Fix | Delete

exit;

[331] Fix | Delete

}

[332] Fix | Delete

}

[333] Fix | Delete

[334] Fix | Delete