?>

<div class="notice notice-error">

<p>

<?php

printf(

/* translators: %s: Minimum WordPress version required. */

esc_html__( 'Press This 2.0 requires WordPress %s or higher. Please upgrade WordPress to use this version.', 'press-this' ),

esc_html( PRESS_THIS__MIN_WP_VERSION )

);

?>

</p>

</div>

<?php

include_once plugin_dir_path( __FILE__ ) . 'class-wp-press-this-plugin.php';

$wp_press_this = new WP_Press_This_Plugin();

// Enable URL validation for image sideloading.

press_this_http_request_context( true );

$wp_press_this->save_post();

press_this_http_request_context( false );

include_once plugin_dir_path( __FILE__ ) . 'class-wp-press-this-plugin.php';

$wp_press_this = new WP_Press_This_Plugin();

$wp_press_this->add_category();

// Web App Manifest for Add to Home Screen / PWA support.

register_rest_route(

'press-this/v1',

'/manifest',

array(

'methods' => WP_REST_Server::READABLE,

'callback' => 'press_this_rest_manifest',

'permission_callback' => '__return_true',

)

);

// URL scraping endpoint for Direct Access Mode.

register_rest_route(

'press-this/v1',

'/scrape',

array(

'methods' => WP_REST_Server::CREATABLE,

'callback' => 'press_this_rest_scrape_url',

'permission_callback' => 'press_this_rest_scrape_permission',

'args' => array(

'url' => array(

'required' => true,

'type' => 'string',

'sanitize_callback' => 'esc_url_raw',

),

),

)

);

// Save endpoint.

register_rest_route(

'press-this/v1',

'/save',

array(

'methods' => WP_REST_Server::CREATABLE,

'callback' => 'press_this_rest_save_post',

'permission_callback' => 'press_this_rest_save_permission',

'args' => array(

'post_id' => array(

'required' => true,

'type' => 'integer',

'sanitize_callback' => 'absint',

),

'title' => array(

'type' => 'string',

'sanitize_callback' => 'sanitize_text_field',

'default' => '',

),

'content' => array(

'type' => 'string',

'default' => '',

),

'status' => array(

'type' => 'string',

'sanitize_callback' => 'sanitize_text_field',

'default' => 'draft',

'enum' => array( 'draft', 'publish', 'future' ),

),

'date' => array(

'type' => 'string',

'sanitize_callback' => 'sanitize_text_field',

// Validates format only (ISO 8601 datetime). Semantic validation

// (e.g. month/day ranges, leap years) is handled server-side by

// strtotime() in the save handler, which rejects unparseable

// dates and normalizes edge cases like Feb 30 → Mar 2.

'validate_callback' => function ( $value ) {

if ( empty( $value ) ) {

return true;

}

if ( ! preg_match( '/^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}(:\d{2})?$/', $value ) ) {

return new WP_Error(

'press_this_invalid_date_format',

__( 'Date must be in ISO 8601 format.', 'press-this' ),

array( 'status' => 400 )

);

}

return true;

},

'default' => '',

),

'format' => array(

'type' => 'string',

'sanitize_callback' => 'sanitize_text_field',

'default' => '',

),

'categories' => array(

'type' => 'array',

'items' => array( 'type' => 'integer' ),

'default' => array(),

),

'tags' => array(

'type' => 'array',

'items' => array( 'type' => 'string' ),

'default' => array(),

),

'featured_image' => array(

'type' => 'integer',

'sanitize_callback' => 'absint',

'default' => 0,

),

'force_redirect' => array(

'type' => 'boolean',

'default' => false,

),

),

)

);

// Sideload image endpoint (for featured image from scraped content).

register_rest_route(

'press-this/v1',

'/sideload',

array(

'methods' => WP_REST_Server::CREATABLE,

'callback' => 'press_this_rest_sideload_image',

'permission_callback' => 'press_this_rest_sideload_permission',

'args' => array(

'url' => array(

'required' => true,

'type' => 'string',

'sanitize_callback' => 'esc_url_raw',

),

'post_id' => array(

'type' => 'integer',

'sanitize_callback' => 'absint',

'default' => 0,

),

),

)

);

// Validate embeds endpoint (filters URLs through WordPress oEmbed providers).

register_rest_route(

'press-this/v1',

'/validate-embeds',

array(

'methods' => WP_REST_Server::CREATABLE,

'callback' => 'press_this_rest_validate_embeds',

'permission_callback' => 'press_this_rest_validate_embeds_permission',

'args' => array(

'urls' => array(

'required' => true,

'type' => 'array',

'items' => array( 'type' => 'string' ),

),

),

)

);

$post_id = $request->get_param( 'post_id' );

if ( ! $post_id ) {

return new WP_Error(

'press_this_missing_post_id',

__( 'Missing post ID.', 'press-this' ),

array( 'status' => 400 )

);

}

if ( ! current_user_can( 'edit_post', $post_id ) ) {

return new WP_Error(

'press_this_cannot_edit',

__( 'You do not have permission to edit this post.', 'press-this' ),

array( 'status' => 403 )

);

}

return true;

include_once plugin_dir_path( __FILE__ ) . 'class-wp-press-this-plugin.php';

$post_id = $request->get_param( 'post_id' );

// Get the existing post to preserve its post type.

$existing_post = get_post( $post_id );

$post_type = $existing_post ? $existing_post->post_type : 'post';

$post_data = array(

'ID' => $post_id,

'post_title' => $request->get_param( 'title' ),

'post_content' => wp_kses_post( $request->get_param( 'content' ) ),

'post_type' => $post_type,

'post_status' => 'draft',

'post_format' => $request->get_param( 'format' ),

);

// Handle categories if user can assign.

$category_tax = get_taxonomy( 'category' );

if ( current_user_can( $category_tax->cap->assign_terms ) ) {

$categories = $request->get_param( 'categories' );

if ( ! empty( $categories ) ) {

$post_data['post_category'] = array_map( 'absint', $categories );

}

}

// Handle tags if user can assign.

$tag_tax = get_taxonomy( 'post_tag' );

if ( current_user_can( $tag_tax->cap->assign_terms ) ) {

$tags = $request->get_param( 'tags' );

if ( ! empty( $tags ) ) {

$post_data['tax_input'] = array(

'post_tag' => array_map( 'sanitize_text_field', $tags ),

);

}

}

// Handle publish status.

$status = $request->get_param( 'status' );

if ( 'publish' === $status ) {

if ( current_user_can( 'publish_posts' ) ) {

$post_data['post_status'] = 'publish';

} else {

$post_data['post_status'] = 'pending';

}

}

// Handle future (scheduled) status.

// We intentionally don't reject past dates here. WordPress core's

// wp_insert_post() auto-converts future+past-date to 'publish', so

// a past date simply publishes immediately — matching core REST API behavior.

if ( 'future' === $status ) {

if ( current_user_can( 'publish_posts' ) ) {

$date = $request->get_param( 'date' );

if ( empty( $date ) || false === strtotime( $date ) ) {

return new WP_Error(

'press_this_invalid_date',

__( 'A valid date is required to schedule a post.', 'press-this' ),

array( 'status' => 400 )

);

}

// The frontend sends a naive datetime in the site's local timezone (no TZ qualifier).

// WordPress sets PHP's timezone to UTC, so strtotime() interprets the string as UTC

// and gmdate() formats it back as UTC -- the round-trip preserves the original value.

// The result is the site-local time string we need for post_date.

$post_data['post_date'] = gmdate( 'Y-m-d H:i:s', strtotime( $date ) );

$post_data['post_date_gmt'] = get_gmt_from_date( $post_data['post_date'] );

$post_data['post_status'] = 'future';

// Required: wp_update_post ignores post_date changes unless edit_date is true.

$post_data['edit_date'] = true;

} else {

$post_data['post_status'] = 'pending';

}

}

// Side-load images from content.

// Require admin includes needed by media_sideload_image() (not loaded in REST context).

require_once ABSPATH . 'wp-admin/includes/file.php';

require_once ABSPATH . 'wp-admin/includes/media.php';

require_once ABSPATH . 'wp-admin/includes/image.php';

$wp_press_this = new WP_Press_This_Plugin();

press_this_http_request_context( true );

$post_data['post_content'] = $wp_press_this->side_load_images( $post_id, wp_slash( $post_data['post_content'] ) );

press_this_http_request_context( false );

$post_data['post_content'] = wp_unslash( $post_data['post_content'] );

/**

$post_data = apply_filters( 'press_this_save_post', $post_data );

$updated = wp_update_post( $post_data, true );

if ( is_wp_error( $updated ) ) {

// Log detailed error when WP_DEBUG is enabled, return generic message to user.

if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {

// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Debug logging only when WP_DEBUG enabled.

error_log( 'Press This save_post error: ' . $updated->get_error_message() );

}

return new WP_Error(

'press_this_save_failed',

__( 'Unable to save the post. Please try again.', 'press-this' ),

array( 'status' => 500 )

);

}

// Set post format.

if ( ! empty( $post_data['post_format'] ) ) {

if ( current_theme_supports( 'post-formats', $post_data['post_format'] ) ) {

set_post_format( $post_id, $post_data['post_format'] );

} else {

set_post_format( $post_id, false );

}

}

// Set featured image.

$featured_image = $request->get_param( 'featured_image' );

if ( $featured_image && current_user_can( 'upload_files' ) ) {

// Validate that the attachment ID exists and is a valid image.

$attachment = get_post( $featured_image );

if ( $attachment && 'attachment' === $attachment->post_type && wp_attachment_is_image( $featured_image ) ) {

set_post_thumbnail( $post_id, $featured_image );

} elseif ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {

// Log invalid attachment IDs for debugging.

// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log

error_log( sprintf( 'Press This: Invalid featured image ID %d for post %d', $featured_image, $post_id ) );

}

} elseif ( 0 === $featured_image ) {

delete_post_thumbnail( $post_id );

}

// Determine redirect URL.

$force_redirect = $request->get_param( 'force_redirect' );

$redirect = false;

if ( 'publish' === get_post_status( $post_id ) ) {

$redirect = get_post_permalink( $post_id );

} elseif ( $force_redirect ) {

$redirect = get_edit_post_link( $post_id, 'js' );

}

/**

$redirect = apply_filters( 'press_this_save_redirect', $redirect, $post_id, $post_data['post_status'] );

// Validate redirect URL is on same host or relative.

if ( $redirect ) {

$redirect_host = wp_parse_url( $redirect, PHP_URL_HOST );

$site_host = wp_parse_url( home_url(), PHP_URL_HOST );

// Block external redirects.

if ( $redirect_host && $redirect_host !== $site_host ) {

if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {

// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Debug logging only when WP_DEBUG enabled.

error_log( sprintf( 'Press This: Blocked external redirect to %s', esc_url( $redirect ) ) );

}

$redirect = get_edit_post_link( $post_id, 'raw' );

}

}

return rest_ensure_response(

array(

'success' => true,

'post_id' => $post_id,

'redirect' => $redirect,

'force' => $force_redirect,

)

);

if ( ! current_user_can( 'upload_files' ) ) {

return new WP_Error(

'press_this_cannot_upload',

__( 'You do not have permission to upload files.', 'press-this' ),

array( 'status' => 403 )

);

}

return true;

if ( ! current_user_can( 'edit_posts' ) ) {

return new WP_Error(

'press_this_cannot_validate',

__( 'You do not have permission to use this feature.', 'press-this' ),

array( 'status' => 403 )

);

}

return true;

include_once plugin_dir_path( __FILE__ ) . 'class-wp-press-this-plugin.php';

$urls = $request->get_param( 'urls' );

$valid = array();

if ( ! is_array( $urls ) ) {

return rest_ensure_response( array( 'embeds' => array() ) );

}

// Create an instance to access limit_embed method.

$press_this = new WP_Press_This_Plugin();

// Use reflection to access the private limit_embed method.

$reflection = new ReflectionClass( $press_this );

$method = $reflection->getMethod( 'limit_embed' );

$method->setAccessible( true );

foreach ( $urls as $url ) {

if ( ! is_string( $url ) ) {

continue;

}

// Sanitize and validate the URL.

$url = esc_url_raw( $url );

if ( empty( $url ) ) {

continue;

}

// Use limit_embed to validate against oEmbed providers.

$validated = $method->invoke( $press_this, $url );

if ( ! empty( $validated ) ) {

$valid[] = $validated;

}

}

// Remove duplicates.

$valid = array_unique( $valid );

return rest_ensure_response( array( 'embeds' => array_values( $valid ) ) );

$default_types = array(

'image/jpeg',

'image/jpg',

'image/png',

'image/gif',

'image/webp',

);

/**

return apply_filters( 'press_this_sideload_allowed_types', $default_types );

$default_max = 10 * 1024 * 1024; // 10MB.

/**

return apply_filters( 'press_this_sideload_max_size', $default_max );

include_once plugin_dir_path( __FILE__ ) . 'class-wp-press-this-plugin.php';

$url = $request->get_param( 'url' );

$post_id = $request->get_param( 'post_id' );

// Validate URL format.

if ( empty( $url ) || ! filter_var( $url, FILTER_VALIDATE_URL ) ) {

return new WP_Error(

'press_this_invalid_url',

__( 'Invalid image URL.', 'press-this' ),

array( 'status' => 400 )

);

}

// Validate URL is safe to fetch.

$valid = press_this_validate_url_for_proxy( $url );

if ( is_wp_error( $valid ) ) {

$valid->add_data( array( 'status' => 400 ) );

return $valid;

}

// Perform HEAD request to validate content-type before full download.

$allowed_types = press_this_get_sideload_allowed_types();

$max_size = press_this_get_sideload_max_size();

press_this_http_request_context( true );

$head_response = wp_remote_head(

$url,

array(

'timeout' => 10,

'redirection' => 3,

'reject_unsafe_urls' => true,

)

);

press_this_http_request_context( false );

// If HEAD succeeds, validate content-type and size.

if ( ! is_wp_error( $head_response ) ) {

$content_type = wp_remote_retrieve_header( $head_response, 'content-type' );

// Extract base content-type (remove charset, boundary, etc.).

if ( $content_type ) {

$content_type = strtolower( trim( explode( ';', $content_type )[0] ) );

}

// Check content-type is an allowed image type.

if ( $content_type && ! in_array( $content_type, $allowed_types, true ) ) {

// Log detailed error when WP_DEBUG is enabled.

if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {

// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Debug logging only when WP_DEBUG enabled.

error_log( sprintf( 'Press This sideload rejected content-type: %s for URL: %s', $content_type, $url ) );

}

return new WP_Error(

'press_this_invalid_image_type',

__( 'The URL does not point to a valid image file.', 'press-this' ),

array( 'status' => 400 )

);

}

// Check file size if Content-Length header is present.

$content_length = wp_remote_retrieve_header( $head_response, 'content-length' );

if ( $content_length && (int) $content_length > $max_size ) {

// Log detailed error when WP_DEBUG is enabled.

if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {

// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Debug logging only when WP_DEBUG enabled.

error_log( sprintf( 'Press This sideload rejected file size: %d bytes for URL: %s', (int) $content_length, $url ) );

}

return new WP_Error(

'press_this_file_too_large',

__( 'The image file is too large.', 'press-this' ),

array( 'status' => 400 )

);

}

}

// If HEAD fails, proceed anyway - let media_handle_sideload validate.

// This handles servers that don't support HEAD requests.

// Require necessary files for media sideload.

require_once ABSPATH . 'wp-admin/includes/file.php';

require_once ABSPATH . 'wp-admin/includes/media.php';

require_once ABSPATH . 'wp-admin/includes/image.php';

// Download the file.

$tmp_file = press_this_download_url( $url, 30 );

if ( is_wp_error( $tmp_file ) ) {

// Log detailed error when WP_DEBUG is enabled.

if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {

// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Debug logging only when WP_DEBUG enabled.

error_log( 'Press This sideload download error: ' . $tmp_file->get_error_message() );

}

return new WP_Error(

'press_this_download_failed',

__( 'Unable to download the image. Please try again.', 'press-this' ),

array( 'status' => 500 )

);

}

// Get the filename from URL.

$filename = basename( wp_parse_url( $url, PHP_URL_PATH ) );

if ( empty( $filename ) ) {

$filename = 'image';

}

// Prepare file array for sideloading.

$file_array = array(

'name' => sanitize_file_name( $filename ),

'tmp_name' => $tmp_file,

);

// Sideload the file.

$attachment_id = media_handle_sideload( $file_array, $post_id );

// Clean up temp file if sideload failed.

if ( is_wp_error( $attachment_id ) ) {

wp_delete_file( $tmp_file );

// Log detailed error when WP_DEBUG is enabled.

if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {

// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Debug logging only when WP_DEBUG enabled.

error_log( 'Press This sideload error: ' . $attachment_id->get_error_message() );

}

return new WP_Error(

'press_this_sideload_failed',

__( 'Unable to process the image. Please try again.', 'press-this' ),

array( 'status' => 500 )

);

}

// Get the attachment data.

$attachment_url = wp_get_attachment_url( $attachment_id );

$attachment = wp_get_attachment_metadata( $attachment_id );

return rest_ensure_response(

array(

'success' => true,

'id' => $attachment_id,

'url' => $attachment_url,

'width' => isset( $attachment['width'] ) ? $attachment['width'] : 0,

'height' => isset( $attachment['height'] ) ? $attachment['height'] : 0,

)

);

if ( current_user_can( 'edit_posts' ) ) {

?>

<div class="card pressthis">

<h2><?php esc_html_e( 'Press This', 'press-this' ); ?></h2>

<p><?php esc_html_e( 'Press This is a little tool that lets you grab bits of the web and create new posts with ease.', 'press-this' ); ?>

<?php esc_html_e( 'It will even allow you to choose from images or videos included on the page and use them in your post.', 'press-this' ); ?>

<?php esc_html_e( 'Use Press This as a quick and lightweight way to highlight another page on the web.', 'press-this' ); ?>

</p>

<p class="description">

<?php esc_html_e( 'Now featuring the WordPress block editor for a modern editing experience.', 'press-this' ); ?>

</p>

<form>

<h3><?php esc_html_e( 'Install Press This', 'press-this' ); ?></h3>

<h4><?php esc_html_e( 'Direct link (best for mobile)', 'press-this' ); ?></h4>

<p><a href="<?php echo esc_url( admin_url( 'press-this.php' ) ); ?>"><?php esc_html_e( 'Open Press This', 'press-this' ); ?></a>

<?php esc_html_e( 'then add it to your device&#8217;s bookmarks or home screen.', 'press-this' ); ?>

</p>

<h4><?php esc_html_e( 'Bookmarklet', 'press-this' ); ?></h4>

<p><?php esc_html_e( 'Drag the bookmarklet below to your bookmarks bar. Then, when you&#8217;re on a page you want to share, simply &#8220;press&#8221; it.', 'press-this' ); ?></p>

<p class="pressthis-bookmarklet-wrapper">

<?php

// Use esc_attr() instead of esc_url() because esc_url() strips javascript: protocol.

// The bookmarklet link is trusted (we generate it) and needs the javascript: prefix.

?>

<a class="pressthis-bookmarklet" onclick="return false;" href="<?php echo esc_attr( press_this_get_shortcut_link() ); ?>"><span><?php esc_html_e( 'Press This', 'press-this' ); ?></span></a>

<button type="button" class="button pressthis-js-toggle js-show-pressthis-code-wrap" aria-expanded="false" aria-controls="pressthis-code-wrap">

<span class="dashicons dashicons-clipboard"></span>

<span class="screen-reader-text"><?php esc_html_e( 'Copy &#8220;Press This&#8221; bookmarklet code', 'press-this' ); ?></span>

</button>

</p>

<div class="hidden js-pressthis-code-wrap clear" id="pressthis-code-wrap">

<p id="pressthis-code-desc">

<?php esc_html_e( 'If you can&#8217;t drag the bookmarklet to your bookmarks, copy the following code and create a new bookmark. Paste the code into the new bookmark&#8217;s URL field.', 'press-this' ); ?>

</p>

<p>

<textarea class="js-pressthis-code" rows="5" cols="120" readonly="readonly" aria-labelledby="pressthis-code-desc"><?php echo esc_textarea( press_this_get_shortcut_link() ); ?></textarea>

</p>

</div>

<script>

jQuery( document ).ready( function( $ ) {

var $showPressThisWrap = $( '.js-show-pressthis-code-wrap' );

var $pressthisCode = $( '.js-pressthis-code' );

$showPressThisWrap.on( 'click', function( event ) {

var $this = $( this );

$this.parent().next( '.js-pressthis-code-wrap' ).slideToggle( 200 );

$this.attr( 'aria-expanded', $this.attr( 'aria-expanded' ) === 'false' ? 'true' : 'false' );

});

// Select Press This code when focusing (tabbing) or clicking the textarea.

$pressthisCode.on( 'click focus', function() {

var self = this;

setTimeout( function() { self.select(); }, 50 );

});

});

</script>

</form>

</div>

<?php

}

global $is_IE;

include_once plugin_dir_path( __FILE__ ) . 'class-wp-press-this-plugin.php';

$link = '';

if ( $is_IE ) {

/*

$ua = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '';

if ( ! empty( $ua ) && preg_match( '/\bMSIE (\d)/', $ua, $matches ) && (int) $matches[1] <= 8 ) {

$url = wp_json_encode( admin_url( 'press-this.php' ) );

$link = 'javascript:var d=document,w=window,e=w.getSelection,k=d.getSelection,x=d.selection,' .

's=(e?e():(k)?k():(x?x.createRange().text:0)),f=' . $url . ',l=d.location,e=encodeURIComponent,' .

'u=f+"?u="+e(l.href)+"&t="+e(d.title)+"&s="+e(s)+"&v=' . WP_Press_This_Plugin::VERSION . '";' .

'a=function(){if(!w.open(u,"t","toolbar=0,resizable=1,scrollbars=1,status=1,width=600,height=700"))l.href=u;};' .

'if(/Firefox/.test(navigator.userAgent))setTimeout(a,0);else a();void(0)';

}

}

if ( empty( $link ) ) {

$src = @file_get_contents( plugin_dir_path( __FILE__ ) . 'assets/bookmarklet.min.js' ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged

if ( $src ) {

$url = wp_json_encode( admin_url( 'press-this.php' ) . '?v=' . WP_Press_This_Plugin::VERSION );

$link = 'javascript:' . str_replace( 'window.pt_url', $url, $src );

}

}

$link = str_replace( array( "\r", "\n", "\t" ), '', $link );

/**

return apply_filters( 'shortcut_link', $link );

$editor_url = admin_url( 'press-this.php' );

if ( ! empty( $url ) ) {

$editor_url = add_query_arg( 'u', rawurlencode( $url ), $editor_url );

}

return $editor_url;

/**

return apply_filters( 'press_this_enable_url_proxy', false );