HEX
Server: Apache/2.4.41 (Ubuntu)
System: Linux wordpress-ubuntu-s-2vcpu-4gb-fra1-01 5.4.0-169-generic #187-Ubuntu SMP Thu Nov 23 14:52:28 UTC 2023 x86_64
User: root (0)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/delta/wp-content/plugins/sitepress-multilingual-cms/classes/ATE/proxies/Proxy.php
<?php

namespace WPML\ATE\Proxies;

use WPML\API\Sanitize;
use WPML\LIB\WP\User;

class Proxy implements \IWPML_Frontend_Action, \IWPML_DIC_Action
{
	const QUERY_VAR_ATE_WIDGET_SCRIPT = null;
	const SCRIPT_NAME                 = null;

	public function add_hooks()
	{
		// The widget is called using a script tag with src /?wpml-app=ate-widget, which invokes a frontend call.
		// There were several issues with 3rd party plugins which block the previous solution using 'template_include'.
		// Better using 'template_redirect'. This also prevents loading any further unnecessary frontend stuff.
		add_action(
			'template_redirect',
			function () {
				$script = $this->get_script();
				if ($script) {
					include $script;
					die();
				}
			},
			-PHP_INT_MAX // Make sure to be the first. Some plugins using this hook also to prevent usual rendering.
		);
	}

	/**
	 * @return string|void
	 */
	public function get_script()
	{
		if (! User::canManageTranslations()) {
			return false;
		}

		$app = Sanitize::stringProp(static::QUERY_VAR_ATE_WIDGET_SCRIPT, $_GET);

		if (! $this->showScript($app)) {
			return false;
		}

		$script = WPML_TM_PATH . '/res/js/' . static::SCRIPT_NAME . '.php';
		return file_exists($script)
			? $script
			: false;
	}

	protected function showScript($app)
	{
		return static::SCRIPT_NAME === $app;
	}
}