' . self::pill( $level, $lang ) . '
' . esc_html( $name ) . '
'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- pill() escapes.
} else {
echo '' . ( null !== $f['level'] ? self::pill( $level, $lang ) : '' ) . '
' );
}
private static function fmt_date( $ts ) {
return function_exists( 'wp_date' ) ? wp_date( 'j M Y, H:i', $ts ) : gmdate( 'j M Y, H:i', $ts );
}
private static function notice() {
$n = isset( $_GET['notice'] ) ? sanitize_key( wp_unslash( $_GET['notice'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only, whitelisted.
if ( ! in_array( $n, self::NOTICES, true ) ) {
return;
}
if ( 'fixresult' === $n ) {
Watchfox_Fixui::render_result();
return;
}
$text = array_merge( Watchfox_Fixui::autofix_notices(), array(
'saved' => __( 'Saved.', 'watchfox-ai' ),
'email' => __( 'That email address does not look right. Please check it.', 'watchfox-ai' ),
'checked' => __( 'Checked just now.', 'watchfox-ai' ),
'muted' => __( "Done. We won't warn you about this again.", 'watchfox-ai' ),
'unmuted' => __( 'Done. We will warn you about this again.', 'watchfox-ai' ),
'reset' => __( 'Set up again.', 'watchfox-ai' ),
'resent' => __( 'Sent. Check your inbox, and your spam folder too.', 'watchfox-ai' ),
'sample' => __( 'Sample sent. Check your inbox.', 'watchfox-ai' ),
'already' => __( 'Your email is already confirmed.', 'watchfox-ai' ),
'confirmed' => __( 'Email confirmed. Warnings will come to your inbox.', 'watchfox-ai' ),
'not_yet' => __( 'Not confirmed yet. Click the Confirm button in the email, then try again.', 'watchfox-ai' ),
'resend_limit' => __( 'We already sent it 3 times today. Please check your spam folder, or try again tomorrow.', 'watchfox-ai' ),
'confirm_limit' => __( 'Too many emails today. Try again tomorrow.', 'watchfox-ai' ),
'mail_failed' => __( "We couldn't send that just now. Please try again in a little while.", 'watchfox-ai' ),
'pay_failed' => __( "We couldn't open the payment page. Please try again in a minute, or write to alerts@watchfox.site.", 'watchfox-ai' ),
'pay_unconfirmed' => __( 'Confirm your email first, then you can choose a plan.', 'watchfox-ai' ),
'pay_paid' => __( 'This site already has a paid plan.', 'watchfox-ai' ),
'pay_none' => __( "You haven't paid yet, so there is nothing to manage.", 'watchfox-ai' ),
'pay_elsewhere' => self::billing_elsewhere_text(),
) );
$bad = in_array( $n, array( 'email', 'resend_limit', 'confirm_limit', 'mail_failed', 'pay_failed', 'pay_unconfirmed', 'pay_paid', 'pay_none', 'pay_elsewhere', 'autofix_no_cap', 'autofix_no_consent', 'autofix_file_mods', 'autofix_needs_credentials', 'autofix_cannot_verify' ), true );
echo '';
}
/* ---------- plans ---------- */
const CHECKOUT_HOSTS = array( 'checkout.dodopayments.com' );
private static function fmt_day( $iso ) {
$ts = strtotime( (string) $iso );
if ( false === $ts ) {
return '';
}
return function_exists( 'wp_date' ) ? wp_date( 'j M Y', $ts ) : gmdate( 'j M Y', $ts );
}
/** The one sentence about the plan, from the last reply of the hub. */
public static function plan_sentence( array $p ) {
$name = isset( $p['name'] ) ? $p['name'] : '';
$paid = in_array( $name, array( 'pro', 'agency' ), true );
if ( empty( $p['confirmed'] ) ) {
return __( 'Your 14-day trial starts when you confirm your email.', 'watchfox-ai' );
}
if ( $paid && ! empty( $p['grace_ends_at'] ) ) {
/* translators: %s: date */
return sprintf( __( 'Payment problem: please update your card by %s.', 'watchfox-ai' ), self::fmt_day( $p['grace_ends_at'] ) );
}
if ( $paid && ! empty( $p['cancelling'] ) ) {
/* translators: %s: date */
return sprintf( __( 'Cancelled, works until %s.', 'watchfox-ai' ), self::fmt_day( $p['paid_until'] ) );
}
switch ( $name ) {
case 'trial':
$days = max( 0, (int) ceil( ( strtotime( (string) $p['trial_ends_at'] ) - watchfox_now() ) / DAY_IN_SECONDS ) );
/* translators: %d: days left in the free trial */
return sprintf( _n( 'Trial: %d day left', 'Trial: %d days left', $days, 'watchfox-ai' ), $days );
case 'pro':
/* translators: %s: date */
return sprintf( __( 'Pro, renews %s', 'watchfox-ai' ), self::fmt_day( $p['paid_until'] ) );
case 'agency':
/* translators: %s: date */
return sprintf( __( 'Agency, renews %s', 'watchfox-ai' ), self::fmt_day( $p['paid_until'] ) );
case 'free_extra':
return __( 'Free plan. Another site on your account has the free spot, so this site gets no warning emails.', 'watchfox-ai' );
default:
return __( 'Free plan', 'watchfox-ai' );
}
}
/** "Billing is managed from j***@example.com's Watchfox account page." Empty when the plan has no such address. */
public static function billing_elsewhere_text() {
$p = Watchfox_Hub::plan();
if ( null === $p || empty( $p['billing_email'] ) ) {
return __( "Billing is managed from your Watchfox account page.", 'watchfox-ai' );
}
/* translators: %s: masked email address, for example j***@example.com */
return sprintf( __( "Billing is managed from %s's Watchfox account page.", 'watchfox-ai' ), $p['billing_email'] );
}
/** The Plans tab. Findings are shown on every plan; the plan only decides which emails the hub sends. */
public static function render_plans() {
echo '';
$p = Watchfox_Hub::plan();
if ( null === $p ) {
echo ' ';
return;
}
$name = $p['name'];
$paid = in_array( $name, array( 'pro', 'agency' ), true );
$elsewhere = ! empty( $p['billing_email'] );
$yearly = ! empty( $p['yearly'] ) && ! $elsewhere;
echo '';
if ( $yearly ) {
// A CSS-only switch: the radios sit before the grid and show the monthly or the yearly prices and buttons.
echo '';
}
echo '';
if ( $elsewhere ) {
echo '';
}
$current = 'free_extra' === $name ? 'free' : $name;
$cards = array(
'free' => array( __( 'Free', 'watchfox-ai' ), __( '$0', 'watchfox-ai' ), __( 'forever', 'watchfox-ai' ), __( '$0', 'watchfox-ai' ), __( 'forever', 'watchfox-ai' ), array( __( '1 site', 'watchfox-ai' ), __( 'One check a month', 'watchfox-ai' ), __( 'The first "Today" warning each month, in full', 'watchfox-ai' ) ) ),
'pro' => array( __( 'Pro', 'watchfox-ai' ), __( '$4', 'watchfox-ai' ), __( 'a month, per site', 'watchfox-ai' ), __( '$40', 'watchfox-ai' ), __( 'a year, per site', 'watchfox-ai' ), array( __( 'Checked all day, every day', 'watchfox-ai' ), __( 'Every warning, with its proof', 'watchfox-ai' ), __( 'Early warnings from the news', 'watchfox-ai' ), __( 'Optional weekly summary', 'watchfox-ai' ) ) ),
'agency' => array( __( 'Agency', 'watchfox-ai' ), __( '$19', 'watchfox-ai' ), __( 'a month, up to 10 sites', 'watchfox-ai' ), __( '$190', 'watchfox-ai' ), __( 'a year, up to 10 sites', 'watchfox-ai' ), array( __( 'Everything in Pro', 'watchfox-ai' ), __( 'All sites on one page', 'watchfox-ai' ), __( 'One combined email, not ten', 'watchfox-ai' ) ) ),
);
echo '
' . ( null !== $f['level'] ? self::pill( $level, $lang ) : '' ) . '' . esc_html( $name ) . '
'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- pill() escapes.
}
if ( $count > 1 ) {
/* translators: %d: number of security problems found in one item */
echo '';
}
echo '
' . ( $open ? '' : '' . esc_html( sprintf( _n( '%d security problem', '%d security problems', $count, 'watchfox-ai' ), $count ) ) . '
'; } else { echo '' . esc_html( Watchfox_Words::what_short( $f, $lang ) ) . '
'; } echo '' . esc_html( Watchfox_Words::why( $f, $lang ) ) . '
'; $ui = Watchfox_Fixui::card( $group, $f ); echo '' . esc_html__( 'What to do:', 'watchfox-ai' ) . ' ' . esc_html( '' !== $ui['text'] ? $ui['text'] : Watchfox_Words::fix( $fixf, $lang ) ) . '
';
if ( $ui['steps'] ) {
echo '- ';
foreach ( $ui['steps'] as $step ) {
echo '
- ' . esc_html( $step ) . ' '; } echo '
' . esc_html( $ui['safety']['text'] ) . '
'; } if ( '' !== $ui['note'] ) { echo '' . esc_html( $ui['note'] ) . '
'; } echo '' . ( '' !== $ui['text'] ? $ui['buttons'] : $button ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- built from escaped parts above.
if ( $mutable && count( $mutable ) === $count ) {
self::mute_form( $mutable, 1 === $count );
}
echo '
';
$has_proof = false;
foreach ( $group as $g ) {
$p = Watchfox_Words::proof( $g );
if ( $p['sources'] || '' !== $p['official_id'] ) {
$has_proof = true;
}
}
if ( $has_proof ) {
echo '' . esc_html__( 'The proof', 'watchfox-ai' ) . '
- ';
if ( 1 === $count ) {
self::proof_rows( Watchfox_Words::proof( $group[0] ) );
} else {
foreach ( $group as $g ) {
$p = Watchfox_Words::proof( $g );
echo '
- ';
if ( '' !== $p['official_id'] ) {
echo '
- ' . esc_html__( 'Official ID', 'watchfox-ai' ) . ': ' . esc_html( $p['official_id'] ) . ' '; $p['official_id'] = ''; } self::proof_rows( $p ); if ( 'urgent' !== $g['level'] && null !== $g['level'] ) { echo '
- '; self::mute_form( array( $g['threat_id'] ), true ); echo ' '; } echo '
';
}
}
echo '
' . esc_html( $text[ $n ] ) . '
'; $muted = isset( $_GET['muted'] ) ? sanitize_text_field( wp_unslash( $_GET['muted'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- fills an Undo form that has its own nonce. if ( 'muted' === $n && '' !== $muted && Watchfox_Settings::is_muted( $muted ) ) { echo ''; } echo '';
self::empty_state( '', __( 'No plan yet', 'watchfox-ai' ), __( 'Your plan shows here after your first check.', 'watchfox-ai' ) );
echo '
';
echo '' . esc_html( self::plan_sentence( $p ) ) . '
'; if ( 'trial' === $name ) { echo '' . esc_html__( 'When the trial ends, every finding still shows here. Only the warning emails change.', 'watchfox-ai' ) . '
'; } if ( '' !== $p['suggestion'] && ! $paid ) { echo '' . esc_html( $p['suggestion'] ) . '
'; } echo '' . esc_html( self::billing_elsewhere_text() ) . '
';
foreach ( $cards as $key => $c ) {
$is_now = $key === $current;
echo '';
if ( $is_now ) {
echo '' . esc_html__( 'Your plan', 'watchfox-ai' ) . '';
} elseif ( 'pro' === $key && 'trial' === $current ) {
echo '' . esc_html__( 'You are trying this now', 'watchfox-ai' ) . '';
}
echo ' ';
}
echo '
';
echo '' . esc_html( $c[0] ) . '
'; echo '' . esc_html( $c[1] ) . ' ' . esc_html( $c[2] ) . '
'; if ( $yearly ) { echo '' . esc_html( $c[3] ) . ' ' . esc_html( $c[4] ) . '
'; } echo '- ';
foreach ( $c[5] as $line ) {
echo '
- ' . esc_html( $line ) . ' '; } echo '
';
if ( $elsewhere ) {
if ( $is_now ) {
echo '
' . esc_html__( "You're on this plan", 'watchfox-ai' ) . '
'; } } elseif ( 'pro' === $key && ! $paid ) { self::plan_button( 'pro', __( 'Get Pro for this site', 'watchfox-ai' ), __( 'Get Pro for this site, yearly ($40)', 'watchfox-ai' ), $yearly ); } elseif ( 'agency' === $key && 'agency' !== $name ) { self::plan_button( 'agency', __( 'Get Agency', 'watchfox-ai' ), __( 'Get Agency, yearly ($190)', 'watchfox-ai' ), $yearly, 'pro' !== $name ); } elseif ( $is_now && $paid && ! empty( $p['can_portal'] ) ) { echo '' . esc_html__( "You're on this plan", 'watchfox-ai' ) . '
'; echo ''; } elseif ( $is_now ) { echo '' . esc_html__( "You're on this plan", 'watchfox-ai' ) . '
'; } else { echo '' . esc_html__( 'Compare plans', 'watchfox-ai' ) . ''; } echo '' . esc_html__( 'Deleting the plugin does not cancel a paid plan. Cancel here or from any payment email.', 'watchfox-ai' ) . '
'; } /** Monthly and yearly checkout buttons; with yearly on offer, the period switch shows one of them. */ private static function plan_button( $plan, $label, $yearly_label, $yearly, $ghost = false ) { echo ''; } /** * Where a payment redirect may go: https on Dodo's checkout hosts, and for the customer portal any dodopayments.com host * the hub handed over. Anything else is refused, so a wrong reply can never send the owner elsewhere. * * @return string|null The URL, or null when it is not allowed. */ public static function redirect_target( $url, $kind ) { $parts = is_string( $url ) ? wp_parse_url( $url ) : false; if ( ! is_array( $parts ) || empty( $parts['host'] ) || ! isset( $parts['scheme'] ) || 'https' !== $parts['scheme'] || isset( $parts['user'] ) || isset( $parts['port'] ) ) { return null; } $host = strtolower( $parts['host'] ); $ok = in_array( $host, self::CHECKOUT_HOSTS, true ) || ( 'portal' === $kind && ( 'dodopayments.com' === $host || '.dodopayments.com' === substr( $host, -17 ) ) ); return $ok ? $url : null; } public static function handle_checkout() { self::guard( 'watchfox_checkout' ); self::pay_redirect( Watchfox_Hub::checkout( 'agency' === self::post( 'plan' ) ? 'agency' : 'pro', 'year' === self::post( 'interval' ) ? 'year' : 'month' ), 'checkout' ); } public static function handle_portal() { self::guard( 'watchfox_portal' ); self::pay_redirect( Watchfox_Hub::portal(), 'portal' ); } /** Sends the owner to the payment page, or back to the Plans tab with an honest reason. */ private static function pay_redirect( array $r, $kind ) { if ( $r['ok'] ) { $target = self::redirect_target( $r['url'], $kind ); if ( null !== $target ) { $host = (string) wp_parse_url( $target, PHP_URL_HOST ); add_filter( 'allowed_redirect_hosts', function ( $hosts ) use ( $host ) { $hosts[] = $host; return $hosts; } ); wp_safe_redirect( $target ); exit; } } $map = array( 'unconfirmed' => 'pay_unconfirmed', 'already_paid' => 'pay_paid', 'no_customer' => 'pay_none', 'billing_elsewhere' => 'pay_elsewhere' ); self::go( self::PAGE_SETTINGS, array( 'notice' => isset( $map[ $r['error'] ] ) ? $map[ $r['error'] ] : 'pay_failed' ), '#plans' ); } /* ---------- settings ---------- */ public static function render_settings() { if ( ! current_user_can( 'manage_options' ) ) { wp_die( esc_html__( 'You do not have permission to see this page.', 'watchfox-ai' ) ); } Watchfox_Hub::sync_email_state(); $s = Watchfox_Settings::get(); echo '';
self::header( self::PAGE_SETTINGS );
self::notice();
echo '
';
}
/* ---------- form handlers ---------- */
private static function guard( $action ) {
if ( ! current_user_can( 'manage_options' ) ) {
wp_die( esc_html__( 'You do not have permission to do this.', 'watchfox-ai' ), '', array( 'response' => 403 ) );
}
check_admin_referer( $action );
}
private static function go( $page, array $args, $hash = '' ) {
wp_safe_redirect( add_query_arg( array_merge( array( 'page' => $page ), $args ), admin_url( 'admin.php' ) ) . $hash );
exit;
}
private static function post( $key ) {
return isset( $_POST[ $key ] ) ? sanitize_text_field( wp_unslash( $_POST[ $key ] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- guard() verified the nonce.
}
public static function handle_setup_email() {
self::guard( 'watchfox_setup_email' );
$email = sanitize_email( self::post( 'email' ) );
if ( '' === $email ) {
self::go( self::PAGE, array( 'notice' => 'email' ) );
}
Watchfox_Settings::save( array( 'email' => $email, 'lang' => self::post( 'lang' ) ) );
self::go( self::PAGE, array( 'step' => 2 ) );
}
public static function handle_setup_levels() {
self::guard( 'watchfox_setup_levels' );
Watchfox_Settings::save( self::levels_from_post() );
$s = Watchfox_Settings::get();
Watchfox_Hub::register( $s['email'], $s['lang'] ); // If the hub is down the first check registers later.
Watchfox_Settings::save( array( 'done' => true ) );
Watchfox_Checker::schedule();
Watchfox_Checker::run();
self::go( self::PAGE, array( 'step' => 3 ) );
}
private static function levels_from_post() {
// phpcs:disable WordPress.Security.NonceVerification.Missing -- guard() verified the nonce.
return array(
'levels' => array( 'possible' => ! empty( $_POST['level_possible'] ), 'low' => ! empty( $_POST['level_low'] ) ),
'weekly' => ! empty( $_POST['weekly'] ),
);
// phpcs:enable
}
public static function handle_save_emails() {
self::guard( 'watchfox_save_emails' );
$email = sanitize_email( self::post( 'email' ) );
if ( '' === $email ) {
self::go( self::PAGE_SETTINGS, array( 'notice' => 'email' ) );
}
$review = array( 'review_mail' => ! empty( $_POST['review_mail'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- guard() verified the nonce.
Watchfox_Settings::save( array_merge( array( 'email' => $email, 'lang' => self::post( 'lang' ) ), self::levels_from_post(), $review ) );
self::push_settings();
self::go( self::PAGE_SETTINGS, array( 'notice' => 'saved' ) );
}
public static function handle_mute() {
self::guard( 'watchfox_mute' );
$ids = array();
if ( isset( $_POST['threat_ids'] ) && is_array( $_POST['threat_ids'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- guard() verified the nonce.
$ids = array_map( 'sanitize_text_field', wp_unslash( $_POST['threat_ids'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- sanitized by array_map.
}
if ( '' !== self::post( 'threat_id' ) ) {
$ids[] = self::post( 'threat_id' );
}
$done = false;
foreach ( Watchfox_Checker::findings() as $f ) {
// "Today" warnings are refused by Settings::mute.
if ( in_array( $f['threat_id'], $ids, true ) && null !== $f['level'] && Watchfox_Settings::mute( $f['threat_id'], $f['level'] ) ) {
$done = true;
}
}
if ( $done ) {
self::push_settings();
self::go( self::PAGE, array( 'notice' => 'muted' ) );
}
self::go( self::PAGE, array() );
}
public static function handle_unmute() {
self::guard( 'watchfox_unmute' );
Watchfox_Settings::unmute( self::post( 'threat_id' ) );
self::push_settings();
self::go( 'main' === self::post( 'from' ) ? self::PAGE : self::PAGE_SETTINGS, array( 'notice' => 'unmuted' ) );
}
/** "I've confirmed, check again": asks the hub now, skipping the 30 second wait. */
public static function handle_sync() {
self::guard( 'watchfox_sync' );
Watchfox_Hub::sync_email_state( true );
$state = Watchfox_Hub::state();
self::go( self::PAGE, true === $state['confirmed'] && null === $state['pending_email'] ? array( 'notice' => 'confirmed' ) : array( 'notice' => 'not_yet' ) );
}
public static function handle_recheck() {
self::guard( 'watchfox_recheck' );
Watchfox_Checker::run();
if ( Watchfox_Hub::plan_age() > 60 ) {
Watchfox_Hub::refresh_plan(); // A payment may have gone through since the last report.
}
self::go( self::PAGE, array( 'notice' => 'checked' ) );
}
public static function handle_resend() {
self::guard( 'watchfox_resend' );
self::go( self::PAGE, array( 'notice' => self::mail_notice( Watchfox_Hub::resend_confirm(), 'resent' ) ) );
}
public static function handle_sample() {
self::guard( 'watchfox_sample' );
self::go( self::PAGE, array( 'notice' => self::mail_notice( Watchfox_Hub::send_sample(), 'sample' ) ) );
}
/** The notice for a resend or sample reply: success, or an honest reason. */
public static function mail_notice( array $r, $ok_notice ) {
if ( $r['ok'] ) {
return $ok_notice;
}
switch ( $r['error'] ) {
case 'resend_daily':
return 'resend_limit';
case 'confirm_limit':
case 'sample_daily':
return 'confirm_limit';
case 'confirmed':
return 'already';
default:
return 'mail_failed';
}
}
public static function handle_reset() {
self::guard( 'watchfox_reset' );
delete_option( Watchfox_Hub::OPT_SITE );
delete_option( Watchfox_Hub::OPT_STATE );
delete_option( Watchfox_Hub::OPT_COPY );
delete_option( Watchfox_Hub::OPT_LOST );
delete_option( Watchfox_Hub::OPT_HUB );
delete_option( Watchfox_Hub::OPT_PLAN );
delete_option( Watchfox_Hub::OPT_CLEARED );
Watchfox_Settings::save( array( 'done' => false ) );
self::go( self::PAGE, array( 'notice' => 'reset' ) );
}
/** Settings changed: tell the hub now (the report is skipped if nothing changed). */
private static function push_settings() {
if ( Watchfox_Hub::is_registered() ) {
// Under the check lock so it cannot overlap a running check; if one is running, its report carries the settings.
Watchfox_Checker::with_lock(
function () {
Watchfox_Hub::report( Watchfox_Checker::findings(), Watchfox_Settings::for_report() );
}
);
}
}
}
' . esc_html__( 'Settings', 'watchfox-ai' ) . '
'; // Without JS the tabs are plain links to the sections below; with JS they switch panels. echo ''; echo '';
self::form_open( 'save_emails', 'wfx-panel' );
echo '';
echo '';
self::level_fields( $s );
echo '';
echo '
';
if ( ! $s['muted'] ) {
echo '
';
self::empty_state( '', __( 'Nothing is muted', 'watchfox-ai' ), __( 'When you stop a warning, it shows up here so you can undo it.', 'watchfox-ai' ) );
echo '
';
} else {
$names = array();
foreach ( Watchfox_Checker::findings() as $f ) {
$names[ $f['threat_id'] ] = trim( $f['name'] . ' ' . $f['version'] );
}
echo '- ';
foreach ( $s['muted'] as $id ) {
echo '
- ' . esc_html( isset( $names[ $id ] ) ? $names[ $id ] : $id ) . ''; echo ' '; } echo '