Admin Menus & Pages

<?php
defined( 'ABSPATH' ) || exit;

add_action( 'admin_menu', static function (): void {
	// The parent slug for a CPT submenu includes the query string.
	$hook = add_submenu_page(
		'edit.php?post_type=acme_event',
		__( 'Import Events', 'acme-events' ),
		__( 'Import', 'acme-events' ),
		'manage_options',
		'acme-events-import',
		'acme_events_import_page'
	);

	// false when the current user lacks manage_options - guard before using it.
	if ( false === $hook ) {
		return;
	}

	// 'load-{$hook_suffix}' fires before any output on that screen: the right
	// place to process a POST, because you can still redirect.
	add_action( "load-{$hook}", 'acme_events_handle_import' );
} );

// A hidden page - registered so its URL works, but with a null parent so it
// never appears in the menu.
add_action( 'admin_menu', static function (): void {
	add_submenu_page(
		null,
		__( 'Import Results', 'acme-events' ),
		'',
		'manage_options',
		'acme-events-import-results',
		'acme_events_import_results_page'
	);
} );

<?php
defined( 'ABSPATH' ) || exit;

function acme_events_handle_import(): void {
	if ( 'POST' !== ( $_SERVER['REQUEST_METHOD'] ?? '' ) ) {
		return;
	}

	// 1. Capability, checked again here and not trusted from add_submenu_page().
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( esc_html__( 'You do not have permission to import events.', 'acme-events' ), 403 );
	}

	// 2. Nonce. check_admin_referer() dies on failure.
	check_admin_referer( 'acme_events_import' );

	$count = acme_events_run_import( wp_unslash( $_POST['acme_source'] ?? '' ) );

	// 3. Redirect so a refresh does not resubmit, carrying state in the query string.
	wp_safe_redirect(
		add_query_arg(
			array( 'page' => 'acme-events-import', 'imported' => (int) $count ),
			admin_url( 'edit.php?post_type=acme_event' )
		)
	);
	exit;
}

function acme_events_import_page(): void {
	?>
	<div class="wrap">
		<h1><?php echo esc_html( get_admin_page_title() ); ?></h1>
		<form method="post">
			<?php wp_nonce_field( 'acme_events_import' ); ?>
			<input type="url" name="acme_source" class="regular-text" required />
			<?php submit_button( __( 'Import', 'acme-events' ) ); ?>
		</form>
	</div>
	<?php
}

<?php
defined( 'ABSPATH' ) || exit;

add_action( 'admin_notices', static function (): void {
	$screen = get_current_screen();

	// admin_notices fires on every admin page. Without this, the notice
	// follows the user around the whole dashboard.
	if ( ! $screen || 'acme_event' !== $screen->post_type ) {
		return;
	}

	$imported = isset( $_GET['imported'] ) ? absint( $_GET['imported'] ) : null;

	if ( null === $imported ) {
		return;
	}

	// wp_admin_notice( string $message, array $args ) - WordPress 6.4.
	wp_admin_notice(
		sprintf(
			/* translators: %d: number of events imported. */
			_n( '%d event imported.', '%d events imported.', $imported, 'acme-events' ),
			$imported
		),
		array(
			'type'              => 'success',
			'dismissible'       => true,
			'id'                => 'acme-events-imported',
			'additional_classes' => array( 'acme-notice' ),
		)
	);
} );

// Before 6.4 the equivalent longhand was:
// printf(
//     '<div class="notice notice-success is-dismissible" id="acme-events-imported"><p>%s</p></div>',
//     esc_html( $message )
// );