← All changes | Libs/adminify-framework/functions/actions.php +4 -21 4.2.20 → 4.0 View file →

		@@ -15,13 +15,8 @@
15	15	if ( ! wp_verify_nonce( $nonce, 'adminify_icon_nonce' ) ) {
16	16	wp_send_json_error( array( 'error' => esc_html__( 'Error: Invalid nonce verification.', 'adminify' ) ) );
17	17	}
18	18
19		- // Authorization: this icon picker is an editor-facing admin helper.
20		- if ( ! current_user_can( 'edit_posts' ) ) {
21		- wp_send_json_error( array( 'error' => esc_html__( 'Error: You do not have permission to perform this action.', 'adminify' ) ) );
22		- }
23		-
24	19	ob_start();
25	20
26	21	$icon_library = ( apply_filters( 'adminify_fa4', false ) ) ? 'fa4' : 'fa5';
27	22
		@@ -26,9 +21,9 @@
26	21	$icon_library = ( apply_filters( 'adminify_fa4', false ) ) ? 'fa4' : 'fa5';
27	22
28	23	ADMINIFY::include_plugin_file( 'fields/icon/'. $icon_library .'-icons.php' );
29	24
30		- $icon_lists = apply_filters( 'pxlbsadminify_field_icon_add_icons', adminify_get_default_icons() );
	25	+ $icon_lists = apply_filters( 'adminify_field_icon_add_icons', adminify_get_default_icons() );
31	26
32	27	if ( ! empty( $icon_lists ) ) {
33	28
34	29	foreach ( $icon_lists as $list ) {
		@@ -72,13 +67,8 @@
72	67	if ( ! wp_verify_nonce( $nonce, 'adminify_backup_nonce' ) ) {
73	68	die( esc_html__( 'Error: Invalid nonce verification.', 'adminify' ) );
74	69	}
75	70
76		- // Authorization: only administrators may export settings.
77		- if ( ! current_user_can( 'manage_options' ) ) {
78		- die( esc_html__( 'Error: You do not have permission to perform this action.', 'adminify' ) );
79		- }
80		-
81	71	if ( empty( $unique ) ) {
82	72	die( esc_html__( 'Error: Invalid key.', 'adminify' ) );
83	73	}
84	74
		@@ -88,9 +78,9 @@
88	78	header('Content-Transfer-Encoding: binary');
89	79	header('Pragma: no-cache');
90	80	header('Expires: 0');
91	81
92		- echo wp_json_encode( get_option( $unique ) );
	82	+ echo json_encode( get_option( $unique ) );
93	83
94	84	die();
95	85
96	86	}
		@@ -109,20 +99,14 @@
109	99	function adminify_import_ajax() {
110	100
111	101	$nonce = ( ! empty( $_POST[ 'nonce' ] ) ) ? sanitize_text_field( wp_unslash( $_POST[ 'nonce' ] ) ) : '';
112	102	$unique = ( ! empty( $_POST[ 'unique' ] ) ) ? sanitize_text_field( wp_unslash( $_POST[ 'unique' ] ) ) : '';
113		- // phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce verified below before any data is processed.
114		- $data = ( ! empty( $_POST[ 'data' ] ) ) ? wp_kses_post_deep( json_decode( trim( wp_unslash( $_POST[ 'data' ] ) ), true ) ) : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- each field is sanitized individually by the framework's per-field sanitize handlers.
	103	+ $data = ( ! empty( $_POST[ 'data' ] ) ) ? wp_kses_post_deep( json_decode( wp_unslash( trim( $_POST[ 'data' ] ) ), true ) ) : array();
115	104
116	105	if ( ! wp_verify_nonce( $nonce, 'adminify_backup_nonce' ) ) {
117	106	wp_send_json_error( array( 'error' => esc_html__( 'Error: Invalid nonce verification.', 'adminify' ) ) );
118	107	}
119	108
120		- // Authorization: only administrators may import settings.
121		- if ( ! current_user_can( 'manage_options' ) ) {
122		- wp_send_json_error( array( 'error' => esc_html__( 'Error: You do not have permission to perform this action.', 'adminify' ) ) );
123		- }
124		-
125	109	if ( empty( $unique ) ) {
126	110	wp_send_json_error( array( 'error' => esc_html__( 'Error: Invalid key.', 'adminify' ) ) );
127	111	}
128	112
		@@ -179,10 +163,9 @@
179	163
180	164	$nonce = ( ! empty( $_POST[ 'nonce' ] ) ) ? sanitize_text_field( wp_unslash( $_POST[ 'nonce' ] ) ) : '';
181	165	$type = ( ! empty( $_POST[ 'type' ] ) ) ? sanitize_text_field( wp_unslash( $_POST[ 'type' ] ) ) : '';
182	166	$term = ( ! empty( $_POST[ 'term' ] ) ) ? sanitize_text_field( wp_unslash( $_POST[ 'term' ] ) ) : '';
183		- // phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce verified below before any data is processed.
184		- $query = ( ! empty( $_POST[ 'query_args' ] ) ) ? wp_kses_post_deep( wp_unslash( $_POST[ 'query_args' ] ) ) : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- each field is sanitized individually by the framework's per-field sanitize handlers.
	167	+ $query = ( ! empty( $_POST[ 'query_args' ] ) ) ? wp_kses_post_deep( $_POST[ 'query_args' ] ) : array();
185	168
186	169	if ( ! wp_verify_nonce( $nonce, 'adminify_chosen_ajax_nonce' ) ) {
187	170	wp_send_json_error( array( 'error' => esc_html__( 'Error: Invalid nonce verification.', 'adminify' ) ) );
188	171	}