WEBFORM - #100 - Changing Title Not Working (#101)

* Add hidden nonce field and update button to active forms

* Refactor header_style method to improve canonical URL generation with added sanitization checks

* Refactor canonical URL generation to enhance sanitization order for HTTP host and request URI

Author: kodinkat

includes/post-type-active-forms.php

@@ -203,6 +203,8 @@ public function load_core_fields_metabox( $post ) {
             return;
         }
 
+        echo '<input type="hidden" name="' . esc_attr( $this->post_type ) . '_noonce" id="' . esc_attr( $this->post_type ) . '_noonce" value="' . esc_attr( wp_create_nonce( 'update_dt_webforms' ) ) . '" />';
+
         $core_fields    = $this->get_core_fields( $post->ID );
         ?>
         <table class="widefat striped">
@@ -250,6 +252,11 @@ public function load_core_fields_metabox( $post ) {
             ?>
             </tbody>
         </table>
+        <div>
+            <br clear="all">
+            <span style="float:right;" id="update_fields_button"><button type="submit" class="button">Update</button> </span>
+            <br clear="all">
+        </div>
         <?php
     }
 

magic-link/magic-link-webform-app.php

@@ -104,14 +104,18 @@ public function wp_enqueue_scripts(){
      */
     public function header_style(){
         // Get the current URL
-        $canonical_url  = (is_ssl() ? 'https://' : 'http://');
-        $canonical_url .= $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+        $canonical_url  = ( is_ssl() ? 'https://' : 'http://' );
+        if ( isset( $_SERVER['HTTP_HOST'] ) && isset( $_SERVER['REQUEST_URI'] ) ) {
+            $http_host = sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) );
+            $request_uri = sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) );
+            $canonical_url .= $http_host . $request_uri;
+        }
 
         // Sanitize it (optional but safer)
-        $canonical_url = esc_url($canonical_url);
+        $canonical_url = esc_url( $canonical_url );
 
         // Output the canonical link tag
-        echo '<link rel="canonical" href="' . $canonical_url . '" />' . "\n";
+        echo '<link rel="canonical" href="' . esc_url( $canonical_url ) . '" />' . "\n";
     }
 
     /**