16 ) { return false; } $method = sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Compare the sanitized method with its original unslashed bytes only to reject rewriting; no raw value is stored, displayed or accepted as a method. return 'POST' === $method && $method === wp_unslash( $_SERVER['REQUEST_METHOD'] ); } /** Identifiers are sanitized and must already use their canonical spelling. */ private static function key( array $values, string $name ): string { if ( ! isset( $values[ $name ] ) || ! is_string( $values[ $name ] ) || strlen( $values[ $name ] ) > 128 ) { return ''; } $value = wp_unslash( $values[ $name ] ); $clean = sanitize_key( $value ); return strlen( $clean ) <= 64 && $clean === $value && $clean === $values[ $name ] ? $clean : ''; } public static function register(): void { add_filter( 'admin_body_class', array( self::class, 'bodyClass' ) ); add_action( 'admin_post_antivirus_ai_workspace_display', array( self::class, 'handle' ) ); } public static function fullscreen(): bool { return 'windowed' !== get_user_meta( get_current_user_id(), 'antivirus_ai_workspace_display', true ); } private static function proScreenId(): string { // WordPress derives a submenu screen prefix from its parent's translated menu title. return get_plugin_page_hookname( 'antivirus-ai-pro', 'antivirus-ai' ); } public static function bodyClass( string $classes ): string { $screen = get_current_screen(); if ( current_user_can( 'manage_options' ) && $screen && in_array( $screen->id, array( 'toplevel_page_antivirus-ai', self::proScreenId() ), true ) ) { $pro = self::proScreenId() === $screen->id; return $classes . ( $pro ? ' avai-pro-workspace ' : ' ' ) . ( self::fullscreen() ? ' avai-fullscreen ' : ' avai-windowed ' ); } return $classes; } public static function toolbar( string $tab = '', string $view = '', bool $welcome_page = false ): void { $screen = get_current_screen(); $pro = $screen && self::proScreenId() === $screen->id; echo '

' . esc_html__( '← Back to WordPress', 'shieldlume-security' ) . '

'; } public static function handle(): void { if ( ! current_user_can( 'manage_options' ) || get_current_user_id() < 1 ) { wp_die( esc_html__( 'Administrator access is required.', 'shieldlume-security' ), '', array( 'response' => 403 ) ); return; } if ( ! self::postRequest() ) { wp_die( esc_html__( 'A POST request is required.', 'shieldlume-security' ), '', array( 'response' => 403 ) ); return; } // phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- The original nonce is read only for type and byte-length guards; sanitize_text_field(wp_unslash()) runs here before the standalone verifier and any requested operation. $nonce = isset( $_POST['_avai_display_nonce'] ) && is_string( $_POST['_avai_display_nonce'] ) && strlen( $_POST['_avai_display_nonce'] ) <= 40 ? sanitize_text_field( wp_unslash( $_POST['_avai_display_nonce'] ) ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Original nonce bytes are used only to reject sanitizer changes; only the bounded sanitized nonce reaches the following standalone verifier. if ( '' === $nonce || strlen( $nonce ) > 20 || $nonce !== wp_unslash( $_POST['_avai_display_nonce'] ) ) { wp_die( esc_html__( 'Refresh this form and try again.', 'shieldlume-security' ), '', array( 'response' => 403 ) ); return; } if ( ! wp_verify_nonce( $nonce, 'antivirus_ai_workspace_display' ) ) { wp_die( esc_html__( 'Refresh this form and try again.', 'shieldlume-security' ), '', array( 'response' => 403 ) ); return; } $display = self::key( $_POST, 'display' ); if ( ! in_array( $display, array( 'fullscreen', 'windowed' ), true ) ) { wp_die( esc_html__( 'Choose a valid workspace layout.', 'shieldlume-security' ), '', array( 'response' => 400 ) ); return; } $actor = get_current_user_id(); if ( false === update_user_meta( $actor, 'antivirus_ai_workspace_display', $display ) && get_user_meta( $actor, 'antivirus_ai_workspace_display', true ) !== $display ) { wp_die( esc_html__( 'The workspace preference could not be saved. Please try again.', 'shieldlume-security' ), '', array( 'response' => 500 ) ); return; } $pro = 'pro' === self::key( $_POST, 'edition' ); $tab = self::key( $_POST, 'tab' ); $view = self::key( $_POST, 'view' ); $welcome_page = ! $pro && 'welcome' === $tab && 'page' === self::key( $_POST, 'welcome_view' ); $extra = $welcome_page ? array( 'welcome_view' => 'page' ) : array(); if ( ! $pro && 'findings' === $tab ) { $extra = Admin::findingContext( $_POST, 'return_' ); } if ( ! $pro && 'setup' === $tab && 'welcome' === self::key( $_POST, 'setup_step' ) ) { $extra['setup_step'] = 'welcome'; } $url = $pro && class_exists( '\AntivirusAI\Pro\Workspace' ) ? \AntivirusAI\Pro\Workspace::url( $view ) : Admin::url( $tab, $extra ); wp_safe_redirect( $url ); exit; } }