Merge branch '1.10' into stable

composer.json

@@ -3,6 +3,7 @@
         "php": ">=5.2.0"
     },
     "require-dev": {
-        "jdgrimes/wp-plugin-uninstall-tester": "~0.4"
+        "jdgrimes/wp-plugin-uninstall-tester": "~0.4",
+        "jdgrimes/wp-filesystem-mock": "~0.1"
     }
-}
+}

src/admin/includes/class-wordpoints-module-installer.php

@@ -84,11 +84,13 @@ public function install_package( $args = array() ) {
 		$modules_dir = wordpoints_modules_dir();
 
 		// Attempt to create the /wp-content/wordpoints-modules directory if needed.
-		if (
-			! $wp_filesystem->exists( $modules_dir )
-			&& ! $wp_filesystem->mkdir( $modules_dir, FS_CHMOD_DIR )
-		) {
-			return new WP_Error( 'mkdir_failed_modules', $this->strings['mkdir_failed_modules'], $modules_dir );
+		if ( ! $wp_filesystem->exists( $modules_dir ) ) {
+
+			if ( $wp_filesystem->mkdir( $modules_dir, FS_CHMOD_DIR ) ) {
+				$wp_filesystem->put_contents( $modules_dir . '/index.php', '<?php // Gold is silent.' );
+			} else {
+				return new WP_Error( 'mkdir_failed_modules', $this->strings['mkdir_failed_modules'], $modules_dir );
+			}
 		}
 
 		$wp_theme_directories[] = $module_dir = wordpoints_modules_dir();

src/components/points/includes/class-wordpoints-points-hook.php

@@ -778,7 +778,7 @@ final protected function init( $name, array $options = array() ) {
 
 		// Option names can only be 64 characters long.
 		if ( isset( $this->option_name{65} ) ) {
-			_doing_it_wrong( __METHOD__, sprintf( 'Points hook class names cannot be longer than 48 characters, %s is %s charachter(s) too long.', $this->id_base, strlen( $this->id_base ) - 48 ), '1.5.0' );
+			_doing_it_wrong( __METHOD__, sprintf( 'Points hook class names cannot be longer than 48 characters, %s is %s character(s) too long.', esc_html( $this->id_base ), (int) strlen( $this->id_base ) - 48 ), '1.5.0' );
 			return;
 		}
 

src/components/points/includes/class-wordpoints-points-logs-query.php

@@ -273,7 +273,7 @@ public function __construct( $args = array() ) {
 				if ( isset( $this->_args['meta_query'][ $key ] ) ) {
 
 					unset( $this->_args['meta_query'][ $key ] );
-					_deprecated_argument( __METHOD__, '1.1.0', sprintf( '%s is no longer supported.', "\$args['meta_query'][{$key}]" ) );
+					_deprecated_argument( __METHOD__, '1.1.0', sprintf( '%s is no longer supported.', esc_html( "\$args['meta_query'][{$key}]" ) ) );
 				}
 			}
 
@@ -290,7 +290,7 @@ public function __construct( $args = array() ) {
 
 					$this->_args['meta_value'] = $this->_args['meta_query'][ $key ];
 					unset( $this->_args['meta_query'][ $key ] );
-					_deprecated_argument( __METHOD__, '1.1.0', sprintf( '%s has been replaced by %s.', "\$args['meta_query'][{$key}]", '$args["meta_value"]' ) );
+					_deprecated_argument( __METHOD__, '1.1.0', sprintf( '%s has been replaced by %s.', esc_html( "\$args['meta_query'][{$key}]" ), '$args["meta_value"]' ) );
 
 					if ( 'value__not_in' === $key ) {
 						$this->_args['meta_compare'] = 'NOT IN';
@@ -396,7 +396,7 @@ public function get( $method = 'results', $use_cache = true ) {
 
 		if ( ! in_array( $method, $methods ) ) {
 
-			_doing_it_wrong( __METHOD__, "WordPoints Debug Error: invalid get method {$method}, possible values are " . implode( ', ', $methods ), '1.0.0' );
+			_doing_it_wrong( __METHOD__, esc_html( sprintf( 'WordPoints Debug Error: invalid get method %s, possible values are %s', $method, implode( ', ', $methods ) ) ), '1.0.0' );
 
 			return false;
 		}
@@ -800,7 +800,7 @@ private function _prepare_select() {
 			} elseif ( in_array( $_fields, $this->_fields ) ) {
 				$fields = $_fields;
 			} else {
-				_doing_it_wrong( __METHOD__, "WordPoints Debug Error: invalid field {$_fields}, possible values are " . implode( ', ', $this->_fields ), '1.0.0' );
+				_doing_it_wrong( __METHOD__, esc_html( "WordPoints Debug Error: invalid field {$_fields}, possible values are " . implode( ', ', $this->_fields ) ), '1.0.0' );
 			}
 
 		} elseif ( 'array' === $var_type ) {
@@ -809,7 +809,7 @@ private function _prepare_select() {
 			$_fields = array_intersect( $this->_fields, $_fields );
 
 			if ( ! empty( $diff ) ) {
-				_doing_it_wrong( __METHOD__, 'WordPoints Debug Error: invalid field(s) "' . implode( '", "', $diff ) . '" given', '1.0.0' );
+				_doing_it_wrong( __METHOD__, esc_html( 'WordPoints Debug Error: invalid field(s) "' . implode( '", "', $diff ) . '" given' ), '1.0.0' );
 			}
 
 			if ( ! empty( $_fields ) ) {
@@ -888,15 +888,16 @@ private function _prepare_where() {
 
 			if ( ! wordpoints_int( $this->_args['points'] ) ) {
 
-				_doing_it_wrong( __METHOD__, "WordPoints Debug Error: 'points' must be an integer, " . gettype( $_points ) . ' given',  '1.0.0' );
+				_doing_it_wrong( __METHOD__, esc_html( "WordPoints Debug Error: 'points' must be an integer, " . gettype( $_points ) . ' given' ),  '1.0.0' );
 
 			} else {
 
 				$comparisons = array( '=', '<', '>', '<>', '!=', '<=', '>=' );
 
 				if ( ! in_array( $this->_args['points__compare'], $comparisons ) ) {
 
-					_doing_it_wrong( __METHOD__, "WordPoints Debug Error: invalid 'points__compare' {$this->_args['points__compare']}, possible values are " . implode( ', ', $comparisons ), '1.0.0' );
+					_doing_it_wrong( __METHOD__, esc_html( "WordPoints Debug Error: invalid 'points__compare' {$this->_args['points__compare']}, possible values are " . implode( ', ', $comparisons ) ), '1.0.0' );
+					$this->_args['points__compare'] = '=';
 				}
 
 				$this->_wheres[] = $wpdb->prepare( "`points` {$this->_args['points__compare']} %d", $this->_args['points'] );
@@ -910,7 +911,8 @@ private function _prepare_where() {
 
 			if ( ! in_array( $this->_args['text__compare'], $comparisons ) ) {
 
-				_doing_it_wrong( __METHOD__, "WordPoints Debug Error: invalid 'text__compare' {$this->_args['text__compare']}, possible values are " . implode( ', ', $comparisons ), '1.6.0' );
+				_doing_it_wrong( __METHOD__, esc_html( "WordPoints Debug Error: invalid 'text__compare' {$this->_args['text__compare']}, possible values are " . implode( ', ', $comparisons ) ), '1.6.0' );
+				$this->_args['text__compare'] = '=';
 			}
 
 			$this->_wheres[] = $wpdb->prepare( "`text` {$this->_args['text__compare']} %s", $this->_args['text'] );
@@ -999,7 +1001,7 @@ private function _prepare_limit() {
 
 		if ( false === wordpoints_int( $this->_args['limit'] ) ) {
 
-			_doing_it_wrong( __METHOD__, "WordPoints Debug Error: 'limit' must be a positive integer, " . ( strval( $_var ) ? $_var : gettype( $_var ) ) . ' given', '1.0.0' );
+			_doing_it_wrong( __METHOD__, "WordPoints Debug Error: 'limit' must be a positive integer, " . ( strval( $_var ) ? esc_html( $_var ) : esc_html( gettype( $_var ) ) ) . ' given', '1.0.0' );
 
 			$this->_args['limit'] = 0;
 		}
@@ -1008,7 +1010,7 @@ private function _prepare_limit() {
 
 		if ( false === wordpoints_int( $this->_args['start'] ) ) {
 
-			_doing_it_wrong( __METHOD__, "WordPoints Debug Error: 'start' must be a positive integer, " . ( strval( $_var ) ? $_var : gettype( $_var ) ) . ' given', '1.0.0' );
+			_doing_it_wrong( __METHOD__, "WordPoints Debug Error: 'start' must be a positive integer, " . ( strval( $_var ) ? esc_html( $_var ) : esc_html( gettype( $_var ) ) ) . ' given', '1.0.0' );
 
 			$this->_args['start'] = 0;
 		}
@@ -1038,7 +1040,7 @@ private function _prepare_orderby() {
 
 		if ( ! in_array( $order, array( 'DESC', 'ASC' ) ) ) {
 
-			_doing_it_wrong( __METHOD__, "WordPoints Debug Error: invalid 'order' \"{$order}\", possible values are DESC and ASC", '1.0.0' );
+			_doing_it_wrong( __METHOD__, esc_html( "WordPoints Debug Error: invalid 'order' \"{$order}\", possible values are DESC and ASC" ), '1.0.0' );
 			$order = 'DESC';
 		}
 
@@ -1056,7 +1058,7 @@ private function _prepare_orderby() {
 
 		} elseif ( ! in_array( $order_by, $this->_fields ) ) {
 
-			_doing_it_wrong( __METHOD__, "WordPoints Debug Error: invalid 'orderby' \"{$order_by}\", possible values are " . implode( ', ', $this->_fields ), '1.0.0' );
+			_doing_it_wrong( __METHOD__, esc_html( "WordPoints Debug Error: invalid 'orderby' \"{$order_by}\", possible values are " . implode( ', ', $this->_fields ) ), '1.0.0' );
 			return;
 		}
 

src/components/points/includes/points.php

@@ -1048,14 +1048,25 @@ function wordpoints_points_get_top_users( $num_users, $points_type ) {
 
 		$exclude_users = '';
 		if ( ! empty( $excluded ) ) {
-			$exclude_users = 'WHERE `user_ID` NOT IN (' . wordpoints_prepare__in( $excluded, '%d' ) . ')';
+			$exclude_users = 'WHERE `ID` NOT IN (' . wordpoints_prepare__in( $excluded, '%d' ) . ')';
+		}
+
+		$multisite_join = '';
+		if ( is_multisite() && ! is_wordpoints_network_active() ) {
+
+			$prefix = $wpdb->get_blog_prefix( get_current_blog_id() );
+
+			$multisite_join = "
+					INNER JOIN `{$wpdb->usermeta}` AS `cap`
+						ON `users`.`ID` = `cap`.`user_ID`
+						AND `cap`.`meta_key` = '{$prefix}capabilities'";
 		}
 
 		/*
 		 * We can't use WP_User_Query here because the meta value must be converted
-		 * to a singed integer for ordering.
+		 * to a signed integer for ordering.
 		 *
-		 * (But see <https://core.trac.wordpress.org/ticket/27887>).
+		 * (But see <https://core.trac.wordpress.org/ticket/27887>, fixed in 4.2).
 		 */
 		$top_users = $wpdb->get_col(
 			$wpdb->prepare(
@@ -1065,8 +1076,9 @@ function wordpoints_points_get_top_users( $num_users, $points_type ) {
                     LEFT JOIN `{$wpdb->usermeta}` AS `meta`
                     	ON `users`.`ID` = `meta`.`user_ID`
                         AND `meta`.`meta_key` = %s
+					{$multisite_join}
                     {$exclude_users}
-					ORDER BY CONVERT(`meta_value`, SIGNED INTEGER) DESC
+					ORDER BY COALESCE(CONVERT(`meta`.`meta_value`, SIGNED INTEGER), 0) DESC
 					LIMIT %d,%d
 				",
 				wordpoints_get_points_user_meta_key( $points_type ),
@@ -1230,4 +1242,52 @@ function wordpoints_clean_points_top_users_cache( $user_id, $points, $points_typ
 }
 add_action( 'wordpoints_points_altered', 'wordpoints_clean_points_top_users_cache', 10, 3 );
 
+/**
+ * Clear the top users cache when a new user is added, if needed.
+ *
+ * @since 1.10.2
+ */
+function wordpoints_clean_points_top_users_cache_user_register() {
+
+	foreach ( wordpoints_get_points_types() as $slug => $unused ) {
+
+		$cache = wp_cache_get( $slug, 'wordpoints_points_top_users' );
+
+		// If there aren't fewer users than the cache holds, we don't need to clear it.
+		if ( ! is_array( $cache ) || ! $cache['is_max'] ) {
+			continue;
+		}
+
+		wp_cache_delete( $slug, 'wordpoints_points_top_users' );
+	}
+}
+add_action( 'user_register', 'wordpoints_clean_points_top_users_cache_user_register' );
+
+/**
+ * Clear the top users cache when a user is deleted.
+ *
+ * @since 1.10.2
+ *
+ * @param int $user_id The ID of the user who was deleted.
+ */
+function wordpoints_clean_points_top_users_cache_user_deleted( $user_id ) {
+
+	foreach ( wordpoints_get_points_types() as $slug => $unused ) {
+
+		$cache = wp_cache_get( $slug, 'wordpoints_points_top_users' );
+
+		// If this user isn't in the cache, we don't need to clear it.
+		if ( ! is_array( $cache ) || ! in_array( $user_id, $cache['top_users'] ) ) {
+			continue;
+		}
+
+		wp_cache_delete( $slug, 'wordpoints_points_top_users' );
+	}
+}
+if ( ! is_multisite() || is_wordpoints_network_active() ) {
+	add_action( 'deleted_user', 'wordpoints_clean_points_top_users_cache_user_deleted' );
+} else {
+	add_action( 'remove_user_from_blog', 'wordpoints_clean_points_top_users_cache_user_deleted' );
+}
+
 // EOF

src/components/points/includes/widgets.php

@@ -201,7 +201,7 @@ protected function widget_body( $instance ) {
 
 		echo '<div class="wordpoints-points-widget-text">', $text, '</div><br />'; // XSS OK, WPCS
 
-		if ( 0 !== $instance['number_logs'] ) {
+		if ( is_user_logged_in() && 0 !== $instance['number_logs'] ) {
 
 			$query_args = wordpoints_get_points_logs_query_args( $instance['points_type'], 'current_user' );
 

src/components/ranks/includes/class-wordpoints-rank-type.php

@@ -235,7 +235,7 @@ class="widefat"
 						__METHOD__
 						, sprintf(
 							'WordPoints Error: Unknown field type "%s".'
-							, $field['type']
+							, esc_html( $field['type'] )
 						)
 						, '1.7.0'
 					);
@@ -258,22 +258,17 @@ final public function maybe_increase_user_rank( $user_id, $rank, array $args = a
 
 		$next_rank = $rank->get_adjacent( 1 );
 
-		if ( ! $next_rank || $next_rank->type !== $this->slug ) {
+		if ( ! $next_rank ) {
 			return $rank;
 		}
 
-		if ( ! $this->can_transition_user_rank( $user_id, $next_rank, $args ) ) {
-			return $rank;
-		}
-
-		$next_rank_2 = $next_rank->get_adjacent( 1 );
+		$rank_type = WordPoints_Rank_Types::get_type( $next_rank->type );
 
-		if ( ! $next_rank_2 ) {
-			return $next_rank;
+		if ( ! $rank_type->can_transition_user_rank( $user_id, $next_rank, $args ) ) {
+			return $rank;
 		}
 
-		return WordPoints_Rank_Types::get_type( $next_rank_2->type )
-			->maybe_increase_user_rank( $user_id, $next_rank_2, $args );
+		return $this->maybe_increase_user_rank( $user_id, $next_rank, $args );
 	}
 
 	/**
@@ -289,11 +284,9 @@ final public function maybe_increase_user_rank( $user_id, $rank, array $args = a
 	 */
 	final public function maybe_decrease_user_rank( $user_id, $rank, array $args = array() ) {
 
-		if ( $rank->type !== $this->slug ) {
-			return $rank;
-		}
+		$rank_type = WordPoints_Rank_Types::get_type( $rank->type );
 
-		if ( $this->can_transition_user_rank( $user_id, $rank, $args ) ) {
+		if ( $rank_type->can_transition_user_rank( $user_id, $rank, $args ) ) {
 			return $rank;
 		}
 
@@ -303,8 +296,7 @@ final public function maybe_decrease_user_rank( $user_id, $rank, array $args = a
 			return $rank;
 		}
 
-		return WordPoints_Rank_Types::get_type( $previous_rank->type )
-			->maybe_decrease_user_rank( $user_id, $previous_rank, $args );
+		return $this->maybe_decrease_user_rank( $user_id, $previous_rank, $args );
 	}
 
 	//