#4006 - XSS fix in 'color_scheme' import.

Author: kprovance

redux-core/assets/css/redux-fields.min.css

@@ -448,13 +448,86 @@ public function parse_ajax() {
 						// Export scheme file.
 					} elseif ( 'export' === $_REQUEST['type'] ) {
 						$this->download_schemes();
+
+						// Import scheme file.
+					} elseif ( 'import' === $_REQUEST['type'] ) {
+						$this->import_schemes();
 					}
 				}
 			} else {
 				wp_die( esc_html__( 'Invalid Security Credentials.  Please reload the page and try again.', 'redux-framework' ) );
 			}
 		}
 
+		/**
+		 * Download Scheme File.
+		 *
+		 * @since       4.4.18
+		 * @access      private
+		 * @return      void
+		 */
+		private function import_schemes() {
+			if ( isset( $_REQUEST['content'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
+				$content = wp_unslash( $_REQUEST['content'] ); // phpcs:ignore WordPress.Security.NonceVerification, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+				$content = is_array( $content ) ? array_map( 'stripslashes_deep', $content ) : stripslashes( $content );
+				$content = json_decode( $content, true );
+
+				if ( is_null( $content ) ) {
+					$result = array(
+						'result' => false,
+						'data'   => esc_html__( 'Import unsuccessful! Malformed JSON data detected.', 'redux-framework' ),
+					);
+
+					$result = wp_json_encode( $result );
+
+					echo $result; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+
+					die;
+				}
+
+				if ( isset( $content['Default']['color_scheme_name'] ) ) {
+					$content = wp_json_encode( $content );
+
+					$param_array = array(
+						'content'   => $content,
+						'overwrite' => true,
+						'chmod'     => FS_CHMOD_FILE,
+					);
+
+					$import_file = Redux_Color_Scheme_Functions::$upload_dir . Redux_Color_Scheme_Functions::$parent->args['opt_name'] . '_' . Redux_Color_Scheme_Functions::$field_id . '.json';
+
+					if ( true === Redux_Color_Scheme_Functions::$parent->filesystem->execute( 'put_contents', $import_file, $param_array ) ) {
+						$result = array(
+							'result' => true,
+							// translators: %s = HTML content.
+							'data'   => sprintf( esc_html__( 'Import successful! Click %s to refresh.', 'redux-framework' ), '<strong>' . esc_html__( 'OK', 'redux-framework' ) . '</strong>' ),
+						);
+					} else {
+						$result = array(
+							'result' => false,
+							'data'   => esc_html__( 'Import unsuccessful! File permission error: Could not write import data to server.', 'redux-framework' ),
+						);
+					}
+				} else {
+					$result = array(
+						'result' => false,
+						'data'   => esc_html__( 'Import unsuccessful! The selected file is not a valid color scheme file.', 'redux-framework' ),
+					);
+				}
+			} else {
+				$result = array(
+					'result' => false,
+					'data'   => esc_html__( 'Import unsuccessful! No data detected in the import file.', 'redux-framework' ),
+				);
+			}
+
+			$result = wp_json_encode( $result );
+
+			echo $result; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+
+			die;
+		}
+
 		/**
 		 * Download Scheme File.
 		 *