Skip to content
This repository was archived by the owner on Aug 22, 2025. It is now read-only.

Commit f4f6850

Browse files
dhaval-parekhdhaval-parekh
committed
Add wraper function for input_filter, and replace it
1 parent 445c9d8 commit f4f6850

File tree

7 files changed

+189
-36
lines changed

7 files changed

+189
-36
lines changed

‎admin/rt-retranscode-admin.php‎

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -235,20 +235,23 @@ public function add_bulk_actions_via_javascript() {
235235
*/
236236
public function bulk_action_handler() {
237237

238-
$action = filter_input( INPUT_POST, 'action', FILTER_SANITIZE_STRING );
239-
$action2 = filter_input( INPUT_POST, 'action2', FILTER_SANITIZE_STRING );
238+
$action = transcoder_filter_input( INPUT_REQUEST, 'action', FILTER_SANITIZE_STRING );
239+
$action2 = transcoder_filter_input( INPUT_REQUEST, 'action2', FILTER_SANITIZE_STRING );
240+
$media = transcoder_filter_input( INPUT_REQUEST, 'media', FILTER_SANITIZE_NUMBER_INT, FILTER_REQUIRE_ARRAY );
240241

241-
if ( empty( $action ) || ( 'bulk_retranscode_media' !== $action && 'bulk_retranscode_media' !== $action2 ) ) {
242+
if ( empty( $action ) || empty( $media ) || ! is_array( $media ) ||
243+
( 'bulk_retranscode_media' !== $action && 'bulk_retranscode_media' !== $action2 )
244+
) {
242245
return;
243246
}
244247

245-
if ( empty( $_REQUEST['media'] ) || ! is_array( $_REQUEST['media'] ) ) {
248+
if ( empty( $media ) || ! is_array( $media ) ) {
246249
return;
247250
}
248251

249252
check_admin_referer( 'bulk-media' );
250253

251-
$ids = implode( ',', array_map( 'intval', $_REQUEST['media'] ) );
254+
$ids = implode( ',', $media );
252255

253256
// Can't use wp_nonce_url() as it escapes HTML entities.
254257
$redirect_url = add_query_arg(
@@ -287,9 +290,11 @@ public function retranscode_interface() {
287290

288291
$file_size = 0;
289292
$files = array();
293+
290294
// Create the list of image IDs.
291295
$usage_info = get_site_option( 'rt-transcoding-usage' );
292-
$ids = filter_input( INPUT_POST, 'ids', FILTER_SANITIZE_STRING );
296+
$ids = transcoder_filter_input( INPUT_REQUEST, 'ids', FILTER_SANITIZE_NUMBER_INT, FILTER_REQUIRE_ARRAY );
297+
293298
if ( ! empty( $ids ) ) {
294299
if ( is_array( $ids ) ) {
295300
$ids = implode( ',', $ids );
@@ -594,17 +599,20 @@ function RetranscodeMedia( id ) {
594599
public function ajax_process_retranscode_request() {
595600

596601
header( 'Content-type: application/json' );
597-
$id = filter_input( INPUT_GET, 'id', FILTER_SANITIZE_NUMBER_INT );
598-
if ( empty( $id ) ) {
599-
$id = filter_input( INPUT_GET, 'id', FILTER_SANITIZE_NUMBER_INT );
602+
603+
$id = transcoder_filter_input( INPUT_REQUEST, 'id', FILTER_SANITIZE_NUMBER_INT );
604+
$id = intval( $id );
605+
606+
if ( empty( $id ) || 0 >= $id ) {
607+
wp_send_json_error();
600608
}
601609

602610
$media = get_post( $id );
603611

604612
if ( ! $media || 'attachment' !== $media->post_type || ( 'audio/' !== substr( $media->post_mime_type, 0, 6 ) && 'video/' !== substr( $media->post_mime_type, 0, 6 ) ) ) {
605613

606614
// translators: Media id of the invalid media type.
607-
die( wp_json_encode( array( 'error' => sprintf( __( 'Sending Failed: %s is an invalid media ID/type.', 'transcoder' ), esc_html( $id ) ) ) ) );
615+
die( wp_json_encode( array( 'error' => sprintf( __( 'Sending Failed: %d is an invalid media ID/type.', 'transcoder' ), intval( $id ) ) ) ) );
608616
}
609617

610618
if ( 'audio/mpeg' === $media->post_mime_type ) {

‎admin/rt-transcoder-actions.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@ function rtt_rtmedia_vedio_editor_content() {
174174
function rtt_set_video_thumbnail( $id ) {
175175
$media_type = rtmedia_type( $id );
176176
$attachment_id = rtmedia_media_id( $id ); // Get the wp attachment ID.
177-
$thumbnail = filter_input( INPUT_POST, 'rtmedia-thumbnail', FILTER_SANITIZE_URL );
177+
$thumbnail = transcoder_filter_input( INPUT_POST, 'rtmedia-thumbnail', FILTER_SANITIZE_URL );
178178
if ( 'video' === $media_type && ! empty( $thumbnail ) ) {
179179

180180
if ( ! is_numeric( $thumbnail ) ) {

‎admin/rt-transcoder-admin.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ public function disable_encoding() {
185185
public function enqueue_scripts_styles() {
186186
global $pagenow;
187187

188-
$page = filter_input( INPUT_GET, 'page', FILTER_SANITIZE_STRING );
188+
$page = transcoder_filter_input( INPUT_GET, 'page', FILTER_SANITIZE_STRING );
189189

190190
if ( 'admin.php' !== $pagenow || 'rt-transcoder' !== $page ) {
191191
return;
@@ -375,7 +375,7 @@ public function edit_video_thumbnail_( $form_fields, $post ) {
375375
* @return array $form_fields
376376
*/
377377
public function save_video_thumbnail( $post ) {
378-
$rtmedia_thumbnail = filter_input( INPUT_POST, 'rtmedia-thumbnail', FILTER_SANITIZE_STRING );
378+
$rtmedia_thumbnail = transcoder_filter_input( INPUT_POST, 'rtmedia-thumbnail', FILTER_SANITIZE_STRING );
379379
$id = $post['post_ID'];
380380
if ( isset( $rtmedia_thumbnail ) ) {
381381
if ( class_exists( 'rtMedia' ) ) {

‎admin/rt-transcoder-functions.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -829,7 +829,7 @@ function rt_transcoder_enqueue_block_editor_assets() {
829829
function rtt_ajax_process_check_status_request() {
830830

831831
check_ajax_referer( 'check-transcoding-status-ajax-nonce', 'security', true );
832-
$post_id = filter_input( INPUT_POST, 'postid', FILTER_SANITIZE_NUMBER_INT );
832+
$post_id = transcoder_filter_input( INPUT_POST, 'postid', FILTER_SANITIZE_NUMBER_INT );
833833

834834
if ( ! empty( $post_id ) ) {
835835
echo esc_html( rtt_get_transcoding_status( $post_id ) );
@@ -998,7 +998,7 @@ function rtt_media_update_usage( $wp_metadata, $attachment_id, $autoformat = tru
998998
function get_server_var( $server_key, $filter_type = FILTER_SANITIZE_STRING ) {
999999
$server_val = '';
10001000
if ( function_exists( 'filter_input' ) && filter_has_var( INPUT_SERVER, $server_key ) ) {
1001-
$server_val = filter_input( INPUT_SERVER, $server_key, $filter_type );
1001+
$server_val = transcoder_filter_input( INPUT_SERVER, $server_key, $filter_type );
10021002
} elseif ( isset( $_SERVER[ $server_key ] ) ) {
10031003
$server_val = $_SERVER[ $server_key ]; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
10041004
}

‎admin/rt-transcoder-handler.php‎

Lines changed: 23 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -406,9 +406,9 @@ public function usage_quota_over() {
406406
* @since 1.0.0
407407
*/
408408
public function save_api_key() {
409-
$is_api_key_updated = filter_input( INPUT_GET, 'api-key-updated', FILTER_SANITIZE_STRING );
410-
$is_invalid_license_key = filter_input( INPUT_GET, 'invalid-license-key', FILTER_SANITIZE_STRING );
411-
$is_localhost = filter_input( INPUT_GET, 'need-public-host', FILTER_SANITIZE_STRING );
409+
$is_api_key_updated = transcoder_filter_input( INPUT_GET, 'api-key-updated', FILTER_SANITIZE_STRING );
410+
$is_invalid_license_key = transcoder_filter_input( INPUT_GET, 'invalid-license-key', FILTER_SANITIZE_STRING );
411+
$is_localhost = transcoder_filter_input( INPUT_GET, 'need-public-host', FILTER_SANITIZE_STRING );
412412

413413
if ( $is_api_key_updated ) {
414414
if ( is_multisite() ) {
@@ -430,8 +430,8 @@ public function save_api_key() {
430430
add_action( 'admin_notices', array( $this, 'public_host_needed_notice' ) );
431431
}
432432

433-
$apikey = trim( filter_input( INPUT_GET, 'apikey', FILTER_SANITIZE_STRING ) );
434-
$page = filter_input( INPUT_GET, 'page', FILTER_SANITIZE_STRING );
433+
$apikey = trim( transcoder_filter_input( INPUT_GET, 'apikey', FILTER_SANITIZE_STRING ) );
434+
$page = transcoder_filter_input( INPUT_GET, 'page', FILTER_SANITIZE_STRING );
435435

436436
if ( ! empty( $apikey ) && is_admin() && ! empty( $page ) && ( 'rt-transcoder' === $page ) ) {
437437
/* Do not activate transcoding service on localhost */
@@ -528,7 +528,7 @@ public function successfully_subscribed_notice() {
528528
<div class="updated">
529529
<p>
530530
<?php
531-
$api_key_updated = filter_input( INPUT_GET, 'api-key-updated', FILTER_SANITIZE_STRING );
531+
$api_key_updated = transcoder_filter_input( INPUT_GET, 'api-key-updated', FILTER_SANITIZE_STRING );
532532
printf(
533533
wp_kses(
534534
__( 'You have successfully subscribed.', 'transcoder' ),
@@ -1004,29 +1004,27 @@ public function get_post_id_by_meta_key_and_value( $key, $value ) {
10041004
public function handle_callback() {
10051005
require_once ABSPATH . 'wp-admin/includes/image.php';
10061006

1007-
$job_id = filter_input( INPUT_POST, 'job_id', FILTER_SANITIZE_STRING );
1008-
$file_status = filter_input( INPUT_POST, 'file_status', FILTER_SANITIZE_STRING );
1009-
$error_msg = filter_input( INPUT_POST, 'error_msg', FILTER_SANITIZE_STRING );
1010-
$job_for = filter_input( INPUT_POST, 'job_for', FILTER_SANITIZE_STRING );
1011-
$thumbnail = filter_input( INPUT_POST, 'thumbnail', FILTER_SANITIZE_STRING );
1012-
$format = filter_input( INPUT_POST, 'format', FILTER_SANITIZE_STRING );
1007+
$job_id = transcoder_filter_input( INPUT_POST, 'job_id', FILTER_SANITIZE_STRING );
1008+
$file_status = transcoder_filter_input( INPUT_POST, 'file_status', FILTER_SANITIZE_STRING );
1009+
$error_msg = transcoder_filter_input( INPUT_POST, 'error_msg', FILTER_SANITIZE_STRING );
1010+
$job_for = transcoder_filter_input( INPUT_POST, 'job_for', FILTER_SANITIZE_STRING );
1011+
$thumbnail = transcoder_filter_input( INPUT_POST, 'thumbnail', FILTER_SANITIZE_STRING );
1012+
$format = transcoder_filter_input( INPUT_POST, 'format', FILTER_SANITIZE_STRING );
10131013

10141014
if ( ! empty( $job_id ) && ! empty( $file_status ) && ( 'error' === $file_status ) ) {
10151015
$this->nofity_transcoding_failed( $job_id, $error_msg );
10161016
echo esc_html__( 'Something went wrong. Invalid post request.', 'transcoder' );
10171017
die();
10181018
}
10191019

1020+
$mail = defined( 'RT_TRANSCODER_NO_MAIL' ) ? false : true;
1021+
10201022
$attachment_id = '';
10211023

10221024
if ( isset( $job_for ) && ( 'wp-media' === $job_for ) ) {
10231025
if ( isset( $job_id ) ) {
10241026
$has_thumbs = isset( $thumbnail ) ? true : false;
10251027
$flag = false;
1026-
$mail = true;
1027-
if ( defined( 'RT_TRANSCODER_NO_MAIL' ) ) {
1028-
$mail = false;
1029-
}
10301028

10311029
$id = $this->get_post_id_by_meta_key_and_value( '_rt_transcoding_job_id', $job_id );
10321030

@@ -1072,21 +1070,25 @@ public function handle_callback() {
10721070
die();
10731071
}
10741072
} else {
1075-
if ( isset( $job_id ) ) {
1076-
$has_thumbs = isset( $thumbnail ) ? true : false;
1077-
$flag = false;
1078-
$model = new RTDBModel( 'rtm_media_meta', false, 10, true );
1073+
if ( isset( $job_id ) && class_exists( 'RTDBModel' ) ) {
1074+
1075+
$has_thumbs = isset( $thumbnail ) ? true : false;
1076+
$flag = false;
1077+
$model = new RTDBModel( 'rtm_media_meta', false, 10, true );
1078+
10791079
$meta_details = $model->get(
10801080
array(
10811081
'meta_value' => sanitize_text_field( wp_unslash( $job_id ) ), // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value
10821082
'meta_key' => 'rtmedia-transcoding-job-id', // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key
10831083
)
10841084
);
1085+
10851086
if ( ! isset( $meta_details[0] ) ) {
10861087
$id = $this->get_post_id_by_meta_key_and_value( '_rt_transcoding_job_id', $job_id );
10871088
} else {
10881089
$id = $meta_details[0]->media_id;
10891090
}
1091+
10901092
if ( isset( $id ) && is_numeric( $id ) ) {
10911093
$model = new RTMediaModel();
10921094
$media = $model->get_media( array( 'media_id' => $id ), 0, 1 );
@@ -1164,7 +1166,7 @@ public function hide_transcoding_notice() {
11641166
* @since 1.0
11651167
*/
11661168
public function enter_api_key() {
1167-
$apikey = filter_input( INPUT_GET, 'apikey', FILTER_SANITIZE_STRING );
1169+
$apikey = transcoder_filter_input( INPUT_GET, 'apikey', FILTER_SANITIZE_STRING );
11681170
if ( ! empty( $apikey ) ) {
11691171
echo wp_json_encode( array( 'apikey' => $apikey ) );
11701172
} else {

‎inc/helpers/custom-functions.php‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
<?php
2+
/**
3+
* Custom functions.
4+
*
5+
* @package transcoder
6+
*/
7+
8+
9+
/**
10+
* This method is an improved version of PHP's filter_input() and
11+
* works well on PHP CLI as well which PHP default method does not.
12+
* Also Provide support INPUT_REQUEST.
13+
*
14+
*
15+
* Reference:
16+
* - https://bugs.php.net/bug.php?id=49184
17+
* - https://bugs.php.net/bug.php?id=54672
18+
*
19+
* @param int $type One of INPUT_GET, INPUT_POST, INPUT_REQUEST, INPUT_COOKIE, INPUT_SERVER, or INPUT_ENV.
20+
* @param string $variable_name Name of a variable to get.
21+
* @param int $filter The ID of the filter to apply.
22+
* @param mixed $options filter to apply.
23+
*
24+
* @return mixed Value of the requested variable on success, FALSE if the filter fails, or NULL if the
25+
* variable_name variable is not set.
26+
*/
27+
function transcoder_filter_input( $type, $variable_name, $filter = FILTER_DEFAULT, $options = null ) {
28+
29+
/**
30+
* Provide support of INPUT_REQUEST
31+
*
32+
* Reference: https://bugs.php.net/bug.php?id=54672
33+
*/
34+
if ( INPUT_REQUEST === $type ) {
35+
36+
if ( isset( $_POST[ $variable_name ] ) ) {
37+
$type = INPUT_POST;
38+
} elseif ( isset( $_GET[ $variable_name ] ) ) {
39+
$type = INPUT_GET;
40+
} else {
41+
return null;
42+
}
43+
44+
}
45+
46+
if ( php_sapi_name() !== 'cli' ) {
47+
48+
/**
49+
* We can not have code coverage since.
50+
* Since this will only execute when sapi is "fpm-fcgi".
51+
* While Unit test case run on "cli"
52+
*/
53+
// @codeCoverageIgnoreStart
54+
55+
$sanitized_variable = filter_input( $type, $variable_name, $filter, $options );
56+
57+
/**
58+
* Code is not running on PHP Cli and we are in clear.
59+
* Use the PHP method and bail out.
60+
*/
61+
if ( ! empty( $sanitized_variable ) && FILTER_SANITIZE_STRING === $filter ) {
62+
$sanitized_variable = sanitize_text_field( $sanitized_variable );
63+
}
64+
65+
return $sanitized_variable;
66+
// @codeCoverageIgnoreEnd
67+
}
68+
69+
/**
70+
* Code is running on PHP Cli and INPUT_SERVER returns NULL
71+
* even for set vars when run on Cli
72+
* See: https://bugs.php.net/bug.php?id=49184
73+
*
74+
* This is a workaround for that bug till its resolved in PHP binary
75+
* which doesn't look to be anytime soon. This is a friggin' 10 year old bug.
76+
*/
77+
78+
$input = '';
79+
80+
$allowed_html_tags = wp_kses_allowed_html( 'post' );
81+
82+
/**
83+
* Marking the switch() block below to be ignored by PHPCS
84+
* because PHPCS squawks on using superglobals like $_POST or $_GET
85+
* directly but it can't be helped in this case as this code
86+
* is running on Cli.
87+
*/
88+
89+
// phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPressVIPMinimum.Variables.RestrictedVariables.cache_constraints___COOKIE
90+
91+
switch ( $type ) {
92+
93+
case INPUT_GET:
94+
if ( ! isset( $_GET[ $variable_name ] ) ) {
95+
return null;
96+
}
97+
98+
$input = wp_kses( $_GET[ $variable_name ], $allowed_html_tags );
99+
break;
100+
101+
case INPUT_POST:
102+
if ( ! isset( $_POST[ $variable_name ] ) ) {
103+
return null;
104+
}
105+
106+
$input = wp_kses( $_POST[ $variable_name ], $allowed_html_tags );
107+
break;
108+
109+
case INPUT_COOKIE:
110+
if ( ! isset( $_COOKIE[ $variable_name ] ) ) {
111+
return null;
112+
}
113+
114+
$input = wp_kses( $_COOKIE[ $variable_name ], $allowed_html_tags );
115+
break;
116+
117+
case INPUT_SERVER:
118+
if ( ! isset( $_SERVER[ $variable_name ] ) ) {
119+
return null;
120+
}
121+
122+
$input = wp_kses( $_SERVER[ $variable_name ], $allowed_html_tags );
123+
break;
124+
125+
case INPUT_ENV:
126+
if ( ! isset( $_ENV[ $variable_name ] ) ) {
127+
return null;
128+
}
129+
130+
$input = wp_kses( $_ENV[ $variable_name ], $allowed_html_tags );
131+
break;
132+
133+
default:
134+
return null;
135+
136+
}
137+
138+
// phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPressVIPMinimum.Variables.RestrictedVariables.cache_constraints___COOKIE
139+
140+
return filter_var( $input, $filter );
141+
142+
}

‎rt-transcoder.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@
4747
}
4848

4949
require_once RT_TRANSCODER_PATH . 'inc/helpers/autoloader.php'; // phpcs:ignore WordPressVIPMinimum.Files.IncludingFile.UsingCustomConstant.
50+
require_once RT_TRANSCODER_PATH . 'inc/helpers/custom-functions.php'; // phpcs:ignore WordPressVIPMinimum.Files.IncludingFile.UsingCustomConstant.
5051
require_once RT_TRANSCODER_PATH . 'admin/rt-transcoder-functions.php'; // phpcs:ignore WordPressVIPMinimum.Files.IncludingFile.UsingCustomConstant.
5152
require_once RT_TRANSCODER_PATH . 'admin/rt-transcoder-admin.php'; // phpcs:ignore WordPressVIPMinimum.Files.IncludingFile.UsingCustomConstant.
5253

0 commit comments

Comments
 (0)