← All changes | includes/ajax.php +26 -4 2.9.1 → 2.14.0 View file →

		@@ -1,8 +1,10 @@
1	1	<?php
2	2
3	3	namespace ABlocks;
4	4
	5	+use WP_Query;
	6	+
5	7	if ( ! defined( 'ABSPATH' ) ) {
6	8	exit; // Exit if accessed directly.
7	9	}
8	10
		@@ -9,12 +11,12 @@
9	11	use ABlocks\Ajax\Settings;
10	12	use ABlocks\Ajax\Dashboard;
11	13	use ABlocks\Ajax\DemoImport;
12	14	use ABlocks\Ajax\DynamicContent;
13		-use ABlocks\Ajax\SearchBlock;
14	15	use ABlocks\Ajax\FormBuilder;
15	16	use ABlocks\Ajax\Entry;
16	17	use ABlocks\Ajax\StripePaymentAjax;
	18	+use ABlocks\Ajax\EmailTemplate;
17	19	use ABlocks\Helper;
18	20
19	21	class Ajax {
20	22
		@@ -20,22 +22,23 @@
20	22
21	23	public static function init() {
22	24	$self = new self();
23	25	$self->dispatch_hooks();
24		- add_action( 'wp_ajax_get_academy_terms', array( $self, 'get_academy_terms' ) );
	26	+ add_action( 'wp_ajax_ablocks/get_academy_terms', array( $self, 'get_academy_terms' ) );
	27	+ add_action( 'wp_ajax_ablocks/get_storeengine_terms', array( $self, 'get_storeengine_terms' ) );
25	28	}
26	29	public function dispatch_hooks() {
27	30	( new Dashboard() )->dispatch_actions();
28	31	( new Settings() )->dispatch_actions();
29	32	( new DynamicContent() )->dispatch_actions();
30		- ( new SearchBlock() )->dispatch_actions();
31	33	( new FormBuilder() )->dispatch_actions();
32	34	( new Entry() )->dispatch_actions();
33	35	( new StripePaymentAjax() )->dispatch_actions();
34	36	( new DemoImport() )->dispatch_actions();
	37	+ ( new EmailTemplate() )->dispatch_actions();
35	38	}
36	39	public function get_academy_terms() {
37		- check_ajax_referer( 'ablocks-editor-nonce', 'security' );
	40	+ check_ajax_referer( 'ablocks_nonce', 'security' );
38	41
39	42	if ( ! current_user_can( 'edit_posts' ) ) {
40	43	die();
41	44	}
		@@ -41,8 +44,27 @@
41	44	}
42	45
43	46	$cats = Helper::get_terms_list( 'academy_courses_category' );
44	47	$tags = Helper::get_terms_list( 'academy_courses_tag' );
	48	+
	49	+ wp_send_json_success(array(
	50	+ 'categories' => $cats,
	51	+ 'tags' => $tags,
	52	+ ), 200);
	53	+ }
	54	+
	55	+ public function get_storeengine_terms() {
	56	+ check_ajax_referer( 'ablocks_nonce', 'security' );
	57	+
	58	+ // The nonce alone only proves the request came from an aBlocks screen,
	59	+ // not that this user may read the catalogue — and every logged-in user
	60	+ // is handed that nonce. Matches get_academy_terms() above.
	61	+ if ( ! current_user_can( 'edit_posts' ) ) {
	62	+ die();
	63	+ }
	64	+
	65	+ $cats = Helper::get_terms_list( 'storeengine_product_category' );
	66	+ $tags = Helper::get_terms_list( 'storeengine_product_tag' );
45	67
46	68	wp_send_json_success(array(
47	69	'categories' => $cats,
48	70	'tags' => $tags,