options_repository = $options_repository; $this->logger = $logger; } /** * Add admin menu item. */ public function add_admin_menu(): void { add_options_page( __('AdsDestroyer', 'ads-destroyer'), __('AdsDestroyer', 'ads-destroyer'), 'manage_options', $this->menu_slug, [$this, 'render_settings_page'] ); } /** * Render settings page. */ public function render_settings_page(): void { if (!current_user_can('manage_options')) { wp_die(esc_html__('You do not have sufficient permissions to access this page.', 'ads-destroyer')); } $opts = $this->options_repository->get_all(); // Sanitize tab parameter with allowed values $allowed_tabs = ['rules', 'settings', 'logs']; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- URL parameter, not form submission $active_tab = isset($_GET['tab']) ? sanitize_text_field(wp_unslash($_GET['tab'])) : 'rules'; if (!in_array($active_tab, $allowed_tabs, true)) { $active_tab = 'rules'; } if ($active_tab === 'logs' && empty($opts['logging']['enabled'])) { $active_tab = 'rules'; } ?>

render_rules_tab(); ?> render_settings_tab($opts); ?> render_logs_tab(); ?>

' . esc_html__('All rules have been reset successfully.', 'ads-destroyer') . '

'; } ?>

options_repository); $rules_table->display(); $this->render_instructions(); ?>
$opts Current plugin options. */ private function render_settings_tab(array $opts): void { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- URL parameter check, not form submission if (isset($_GET['updated']) && sanitize_text_field(wp_unslash($_GET['updated'])) === '1') { echo '

' . esc_html__('Settings saved successfully.', 'ads-destroyer') . '

'; } ?>

options_repository->get_all(); $opts['ui']['show_admin_bar_button'] = !empty($_POST['show_admin_bar_button']); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Array is sanitized via array_map $roles_allowed = isset($_POST['roles_allowed']) ? (array) wp_unslash($_POST['roles_allowed']) : ['administrator']; $opts['access']['roles_allowed'] = array_map('sanitize_key', $roles_allowed); $opts['logging']['enabled'] = !empty($_POST['logging_enabled']); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Array is sanitized via array_map $log_levels = isset($_POST['log_levels']) ? (array) wp_unslash($_POST['log_levels']) : ['error']; $opts['logging']['levels'] = array_map('sanitize_key', $log_levels); $this->options_repository->save_all($opts); if ($opts['logging']['enabled']) { $this->logger->enable(); $this->logger->set_log_levels($opts['logging']['levels']); } else { $this->logger->disable(); } wp_safe_redirect(add_query_arg(['updated' => '1'], admin_url('options-general.php?page=ads-destroyer&tab=settings'))); exit; } /** * Handle reset rules form submission. */ public function handle_reset_rules(): void { $nonce = sanitize_text_field(wp_unslash($_POST['_wpnonce'] ?? '')); if (!wp_verify_nonce($nonce, 'adsd_reset_rules')) { wp_die(esc_html__('Security check failed', 'ads-destroyer')); } if (!current_user_can('manage_options')) { wp_die(esc_html__('Insufficient permissions', 'ads-destroyer')); } $this->options_repository->set_option('rules', []); $this->logger->info('All rules reset by user: ' . wp_get_current_user()->user_login); wp_safe_redirect(add_query_arg(['updated' => '1'], admin_url('options-general.php?page=ads-destroyer&tab=rules'))); exit; } }