id === 'toplevel_page_orderworth' && current_user_can('manage_woocommerce') && self::enabled()) { $classes .= ' owwc-focus-mode '; } return $classes; } public static function control(): void { $enabled = self::enabled(); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only navigation is retained for the separately nonce-protected form. $view = isset($_GET['view']) && is_string($_GET['view']) ? sanitize_key(wp_unslash($_GET['view'])) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- This only preserves the current order-review destination; it authorizes no order access or mutation. $order_id = isset($_GET['order_id']) && is_string($_GET['order_id']) ? OWWC_Admin::request_integer(sanitize_text_field(wp_unslash($_GET['order_id']))) : 0; echo '

'; echo ''; wp_nonce_field('owwc_focus'); echo '' . esc_html($enabled ? __('Exit focus mode', 'orderworth') : __('Enter focus mode', 'orderworth')) . '

'; } public static function save(): void { OWWC_Admin::authorize(); OWWC_Admin::validate_nonce_input(); if (wp_doing_ajax()) { check_ajax_referer('owwc_focus', '_wpnonce'); } else { check_admin_referer('owwc_focus'); } $method = isset($_SERVER['REQUEST_METHOD']) && is_string($_SERVER['REQUEST_METHOD']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_METHOD'])) : ''; if ($method !== 'POST') { wp_die(esc_html__('Submit the focus-mode form to change this preference.', 'orderworth'), '', ['response'=>405]); } $value = isset($_POST['focus']) && is_string($_POST['focus']) ? sanitize_text_field(wp_unslash($_POST['focus'])) : ''; if (!in_array($value, ['0', '1'], true)) { wp_die(esc_html__('Choose a valid focus-mode preference.', 'orderworth'), '', ['response'=>400]); } $key = OWWC_User_State::key(self::META); update_user_meta(get_current_user_id(), $key, $value); if (get_user_meta(get_current_user_id(), $key, true) !== $value) { wp_die(esc_html__('The preference could not be saved. Try again.', 'orderworth'), '', ['response'=>500]); } if (wp_doing_ajax()) { wp_send_json_success([ 'enabled'=>$value === '1', 'next'=>$value === '1' ? '0' : '1', 'label'=>$value === '1' ? __('Exit focus mode', 'orderworth') : __('Enter focus mode', 'orderworth'), 'message'=>$value === '1' ? __('Focus mode on. Preference saved.', 'orderworth') : __('Focus mode off. Preference saved.', 'orderworth'), ]); } $view = isset($_POST['view']) && is_string($_POST['view']) ? sanitize_key(wp_unslash($_POST['view'])) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- request_integer rejects every non-canonical, overflowing and invalid integer; only positive IDs are retained for navigation. $order_id = isset($_POST['order_id']) && is_string($_POST['order_id']) ? OWWC_Admin::request_integer(wp_unslash($_POST['order_id'])) : 0; $args = $view !== '' ? ['view'=>$view] : []; if ($view === 'order' && $order_id > 0) { $args['order_id'] = $order_id; } wp_safe_redirect(OWWC_Admin::url($args)); exit; } }