Skip to content

Commit

Permalink
Add since tag and move method down
Browse files Browse the repository at this point in the history
  • Loading branch information
zackkatz committed Jan 30, 2024
1 parent a6d9291 commit 8acb2cf
Showing 1 changed file with 27 additions and 25 deletions.
52 changes: 27 additions & 25 deletions inc/class.rda-remove-access.php
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,8 @@ function dashboard_redirect() {
/**
* Returns an array of admin pages that are allowed.
*
* @since 1.2
*
* @return array Allowlist of admin pages.
*/
private function get_allowlist() {
Expand Down Expand Up @@ -167,62 +169,62 @@ private function get_allowlist() {
}

/**
* Checks if a set of parameters matches the current $_GET parameters.
* Checks if the current page is allowed.
*
* @since 1.2
*
* @param array $allowed_params_set A set of allowed GET parameters.
* @return bool True if the current $_GET parameters match the allowed set, false otherwise.
* @return bool True if the current page is in the allowlist, false otherwise.
*/
private function is_params_set_allowed( $allowed_params_set ) {
private function is_allowed_page() {
global $pagenow;

if ( ! is_array( $_GET ) || ! is_array( $allowed_params_set ) ) {
if ( empty( $pagenow ) ) {
return false;
}

// Check if the number of parameters in both arrays is the same. This prevents sub-pages from being allowed,
// e.g. admin.php?page=example&subpage=secure-thing.
if ( count( $_GET ) !== count( $allowed_params_set ) ) {
$allowlist = $this->get_allowlist();

if ( ! array_key_exists( $pagenow, $allowlist ) ) {
return false;
}

foreach ( $allowed_params_set as $param_key => $param_value ) {
if ( ! isset( $_GET[ $param_key ] ) || $_GET[ $param_key ] !== $param_value ) {
return false;
// Iterate over each set of allowed GET parameters for the current page.
foreach ( $allowlist[ $pagenow ] as $allowed_params_set ) {
if ( $this->is_params_set_allowed( $allowed_params_set ) ) {
return true;
}
}

return true;
return false;
}

/**
* Checks if the current page is allowed.
* Checks if a set of parameters matches the current $_GET parameters.
*
* @since 1.2
*
* @return bool True if the current page is in the allowlist, false otherwise.
* @param array $allowed_params_set A set of allowed GET parameters.
* @return bool True if the current $_GET parameters match the allowed set, false otherwise.
*/
private function is_allowed_page() {
global $pagenow;
private function is_params_set_allowed( $allowed_params_set ) {

if ( empty( $pagenow ) ) {
if ( ! is_array( $_GET ) || ! is_array( $allowed_params_set ) ) {
return false;
}

$allowlist = $this->get_allowlist();

if ( ! array_key_exists( $pagenow, $allowlist ) ) {
// Check if the number of parameters in both arrays is the same. This prevents sub-pages from being allowed,
// e.g. admin.php?page=example&subpage=secure-thing.
if ( count( $_GET ) !== count( $allowed_params_set ) ) {
return false;
}

// Iterate over each set of allowed GET parameters for the current page.
foreach ( $allowlist[ $pagenow ] as $allowed_params_set ) {
if ( $this->is_params_set_allowed( $allowed_params_set ) ) {
return true;
foreach ( $allowed_params_set as $param_key => $param_value ) {
if ( ! isset( $_GET[ $param_key ] ) || $_GET[ $param_key ] !== $param_value ) {
return false;
}
}

return false;
return true;
}

/**
Expand Down

0 comments on commit 8acb2cf

Please sign in to comment.