method name. Each becomes admin_post_turtlereport_{suffix}. * * @return array */ abstract protected function actions(); /** * Hooks the handlers. * * @return void */ public function register() { foreach ( $this->actions() as $action => $method ) { add_action( 'admin_post_turtlereport_' . $action, array( $this, $method ) ); } } /** * Nonce action and field name for a form. * * @param string $action Action suffix. * @return string */ public static function nonce_action( $action ) { return 'turtlereport_' . $action; } /** * Outputs the hidden fields a form needs. * * @param string $action Action suffix. * @return void */ public static function form_fields( $action ) { printf( '', esc_attr( 'turtlereport_' . $action ) ); wp_nonce_field( self::nonce_action( $action ) ); } /** * Stops unless the user may manage the plugin and the nonce is valid. * * @param string $action Action suffix. * @return void */ protected function guard( $action ) { if ( ! current_user_can( Capabilities::MANAGE ) ) { wp_die( esc_html__( 'Sorry, you are not allowed to do that.', 'turtlereport' ), '', array( 'response' => 403 ) ); } check_admin_referer( self::nonce_action( $action ) ); } /** * Reads a single-line text field from the posted form. * * @param string $name Field name. * @return string */ protected function text( $name ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Callers run guard() first. return isset( $_POST[ $name ] ) && is_string( $_POST[ $name ] ) ? trim( sanitize_text_field( wp_unslash( $_POST[ $name ] ) ) ) : ''; } /** * Reads a checkbox or submit button whose sole checked value is "1". * * @param string $name Field name. * @return bool */ protected function flag( $name ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Callers run guard(); strict string equality validates the only accepted value. return isset( $_POST[ $name ] ) && is_string( $_POST[ $name ] ) && '1' === wp_unslash( $_POST[ $name ] ); } /** * Queues a notice and redirects back to an admin screen. * * @param string $url Destination. * @param string $type Notice type. * @param string $message Notice text. * @return never */ protected function finish( $url, $type = '', $message = '' ) { if ( '' !== $message ) { Notices::add( $type, $message ); } wp_safe_redirect( $url ); exit; } }