From 52aff0f9e702408d5c8dda9ca9731e49b2257f15 Mon Sep 17 00:00:00 2001
From: David Stone <david@nnucomputerwhiz.com>
Date: Wed, 15 Apr 2026 12:34:16 -0600
Subject: [PATCH] fix: move network-activate handler to external JS file (#836)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The inline <script> in requirements_table.php was rendered as visible
text because wu_get_template_contents() captures output via ob_start
and injects it as innerHTML — browsers do not execute script tags
inserted this way.

Extract the click handler to assets/js/network-activate.js, enqueue it
via wp_enqueue_script in register_scripts(), and pass the translated
error string through wp_localize_script.

Also fix the AJAX nonce handling:
- Use _ajax_nonce parameter (WordPress standard convention) instead of
  the generic 'nonce' key which can conflict with server-side filtering
- Move capability check before nonce check so unauthorized users get a
  meaningful 'Permission denied' error instead of an opaque 403
- Use check_ajax_referer with stop=false to return a JSON error on
  nonce failure instead of wp_die(-1)

Resolves #836
---
 assets/js/network-activate.js                 | 65 +++++++++++++++++++
 .../class-setup-wizard-admin-page.php         | 18 ++++-
 .../Setup_Wizard_Admin_Page_Test.php          |  6 +-
 views/wizards/setup/requirements_table.php    | 57 +---------------
 4 files changed, 85 insertions(+), 61 deletions(-)
 create mode 100644 assets/js/network-activate.js

diff --git a/assets/js/network-activate.js b/assets/js/network-activate.js
new file mode 100644
index 00000000..264314ce
--- /dev/null
+++ b/assets/js/network-activate.js
@@ -0,0 +1,65 @@
+/**
+ * Network Activate button handler for the Setup Wizard requirements table.
+ *
+ * Fires an AJAX request to network-activate Ultimate Multisite, then
+ * reloads the page on success or shows an error message with a fallback
+ * help link on failure.
+ *
+ * @package WP_Ultimo
+ * @subpackage Assets
+ * @since 2.6.0
+ */
+
+/* global jQuery, ajaxurl, wu_network_activate */
+jQuery(function($) {
+
+	$(document).on('click', '.wu-network-activate-btn', function() {
+
+		var $btn      = $(this);
+		var $wrapper  = $btn.closest('div');
+		var nonce     = $btn.data('ajax-nonce');
+		var $spinner  = $wrapper.find('.wu-network-activate-spinner');
+		var $message  = $wrapper.find('.wu-network-activate-message');
+		var $fallback = $wrapper.find('.wu-network-activate-fallback');
+
+		$btn.prop('disabled', true);
+		$spinner.addClass('is-active');
+		$message.text('');
+
+		$.post(
+			ajaxurl,
+			{
+				action: 'wu_setup_network_activate',
+				_ajax_nonce: nonce,
+			},
+			function(response) {
+
+				if (response.success) {
+					window.location.reload();
+					return;
+				}
+
+				$spinner.removeClass('is-active');
+				$btn.hide();
+				$fallback.show();
+
+				var errorMsg = wu_network_activate.error_message;
+
+				if (response.data && response.data.message) {
+					errorMsg = response.data.message;
+				}
+
+				$message.text(errorMsg);
+			}
+		).fail(function() {
+
+			$spinner.removeClass('is-active');
+			$btn.hide();
+			$fallback.show();
+			$message.text(wu_network_activate.error_message);
+
+		});
+
+	});
+
+});
diff --git a/inc/admin-pages/class-setup-wizard-admin-page.php b/inc/admin-pages/class-setup-wizard-admin-page.php
index f17eaa16..e0b2a6b5 100644
--- a/inc/admin-pages/class-setup-wizard-admin-page.php
+++ b/inc/admin-pages/class-setup-wizard-admin-page.php
@@ -161,14 +161,18 @@ public function __construct() {
 	 */
 	public function ajax_network_activate(): void {
 
-		check_ajax_referer('wu_setup_network_activate', 'nonce');
-
 		if ( ! current_user_can('manage_network')) {
 			wp_send_json_error(new \WP_Error('not-allowed', __('Permission denied.', 'ultimate-multisite')));
 
 			exit;
 		}
 
+		if ( ! check_ajax_referer('wu_setup_network_activate', false, false)) {
+			wp_send_json_error(new \WP_Error('bad-nonce', __('Security check failed. Please reload the page and try again.', 'ultimate-multisite')));
+
+			exit;
+		}
+
 		if ( ! function_exists('activate_plugin')) {
 			require_once ABSPATH . 'wp-admin/includes/plugin.php';
 		}
@@ -974,6 +978,16 @@ public function register_scripts(): void {
 
 		wp_enqueue_script('wu-setup-wizard-extra', wu_get_asset('setup-wizard-extra.js', 'js'), ['jquery', 'wu-fields', 'wu-functions', 'wubox'], wu_get_version(), true);
 
+		wp_enqueue_script('wu-network-activate', wu_get_asset('network-activate.js', 'js'), ['jquery'], wu_get_version(), true);
+
+		wp_localize_script(
+			'wu-network-activate',
+			'wu_network_activate',
+			[
+				'error_message' => __('Activation failed. Please activate the plugin manually.', 'ultimate-multisite'),
+			]
+		);
+
 		wp_enqueue_media();
 
 		wp_register_script('wu-setup-wizard', wu_get_asset('setup-wizard.js', 'js'), ['jquery'], wu_get_version(), true);
diff --git a/tests/WP_Ultimo/Admin_Pages/Setup_Wizard_Admin_Page_Test.php b/tests/WP_Ultimo/Admin_Pages/Setup_Wizard_Admin_Page_Test.php
index dc41732c..095468c7 100644
--- a/tests/WP_Ultimo/Admin_Pages/Setup_Wizard_Admin_Page_Test.php
+++ b/tests/WP_Ultimo/Admin_Pages/Setup_Wizard_Admin_Page_Test.php
@@ -453,12 +453,12 @@ public function test_constructor_registers_network_activate_ajax_action(): void
 	}
 
 	// -------------------------------------------------------------------------
-	// ajax_network_activate() — permission guard
+	// ajax_network_activate() — permission guard (checked before nonce)
 	// -------------------------------------------------------------------------
 
 	public function test_ajax_network_activate_sends_json_error_without_permission(): void {
-		// Provide a valid nonce so the nonce check passes, isolating the permission check.
-		$_REQUEST['nonce'] = wp_create_nonce('wu_setup_network_activate');
+		// Capability check fires before nonce check, so no nonce needed to
+		// isolate this path — an unauthenticated user is rejected immediately.
 		wp_set_current_user(0);
 		$this->expectException(\WPAjaxDieStopException::class);
 		$this->page->ajax_network_activate();
diff --git a/views/wizards/setup/requirements_table.php b/views/wizards/setup/requirements_table.php
index 363ea7c7..6d98defe 100644
--- a/views/wizards/setup/requirements_table.php
+++ b/views/wizards/setup/requirements_table.php
@@ -77,7 +77,7 @@
 						<button
 							type="button"
 							class="button button-primary wu-network-activate-btn"
-							data-nonce="<?php echo esc_attr($req['network_activate_nonce']); ?>"
+							data-ajax-nonce="<?php echo esc_attr($req['network_activate_nonce']); ?>"
 						>
 							<?php esc_html_e('Network Activate', 'ultimate-multisite'); ?>
 						</button>
@@ -126,58 +126,3 @@ class="wu-no-underline wu-ml-2 wu-network-activate-fallback"
 	<?php endif; ?>
 
 </div>
-
-<script type="text/javascript">
-jQuery(function($) {
-
-	$(document).on('click', '.wu-network-activate-btn', function() {
-
-		var $btn     = $(this);
-		var $wrapper = $btn.closest('div');
-		var nonce    = $btn.data('nonce');
-		var $spinner  = $wrapper.find('.wu-network-activate-spinner');
-		var $message  = $wrapper.find('.wu-network-activate-message');
-		var $fallback = $wrapper.find('.wu-network-activate-fallback');
-
-		$btn.prop('disabled', true);
-		$spinner.addClass('is-active');
-		$message.text('');
-
-		$.post(
-			ajaxurl,
-			{
-				action: 'wu_setup_network_activate',
-				nonce: nonce,
-			},
-			function(response) {
-
-				if (response.success) {
-					window.location.reload();
-					return;
-				}
-
-				$spinner.removeClass('is-active');
-				$btn.hide();
-				$fallback.show();
-
-				var errorMsg = <?php echo wp_json_encode(__('Activation failed. Please activate the plugin manually.', 'ultimate-multisite')); ?>;
-
-				if (response.data && response.data.message) {
-					errorMsg = response.data.message;
-				}
-
-				$message.text(errorMsg);
-			}
-		).fail(function() {
-
-			$spinner.removeClass('is-active');
-			$btn.hide();
-			$fallback.show();
-			$message.text(<?php echo wp_json_encode(__('Activation failed. Please activate the plugin manually.', 'ultimate-multisite')); ?>);
-
-		});
-
-	});
-
-});
-</script>