Automatic YouTube Gallery: You have development mode enabled. We do not cache API results in this mode. While this is ok when you are testing the plugin, we strongly recommend disabling this option when your site goes live.', 'automatic-youtube-gallery' ),
esc_url( admin_url( 'admin.php?page=automatic-youtube-gallery-settings' ) )
);
?>
__( 'Permission denied.', 'automatic-youtube-gallery' ) ) );
}
$general_settings = ayg_get_option( 'ayg_general_settings' );
$general_settings['api_key'] = sanitize_text_field( $_POST['api_key'] );
update_option( 'ayg_general_settings', $general_settings );
wp_send_json_success();
}
/**
* Save a gallery (insert or update).
*
* @since 2.8.0
*/
public function ajax_callback_save_gallery() {
check_ajax_referer( 'ayg_ajax_nonce', 'security' );
if ( ! current_user_can( 'manage_options' ) ) {
wp_send_json_error( array( 'message' => __( 'Permission denied.', 'automatic-youtube-gallery' ) ) );
}
$gallery_id = absint( isset( $_POST['gallery_id'] ) ? $_POST['gallery_id'] : 0 );
$gallery_title = sanitize_text_field( isset( $_POST['title'] ) ? $_POST['title'] : '' );
$params = array();
$source_locked = false;
$source_type = '';
$source_value = '';
if ( $gallery_id > 0 ) {
$existing = ayg_get_gallery( $gallery_id );
if ( ! $existing ) {
wp_send_json_error( array( 'message' => __( 'Gallery not found.', 'automatic-youtube-gallery' ) ) );
}
// Seed params from the saved row so values from disabled inputs and runtime
// keys (page_token, last_video_published_at) survive the update.
$saved_params = json_decode( (string) $existing->params, true );
if ( is_array( $saved_params ) ) {
$params = $saved_params;
}
// The source locks only once videos have been imported. While the gallery
// still has no videos (e.g. the first import failed on a bad source), the
// source stays editable so it can be corrected in place. Live sources
// (search / livestream / single video) never import, so they never lock.
$source_locked = ( (int) $existing->video_count > 0 && ! in_array( $existing->source_type, array( 'search', 'livestream', 'video' ), true ) );
if ( $source_locked ) {
$source_type = $existing->source_type;
$source_value = $existing->source_value;
}
}
// Read the source from POST for a new gallery, or for an update before the first
// import. A re-edited source starts a clean import, so drop the runtime keys.
if ( ! $source_locked ) {
unset( $params['page_token'], $params['last_video_published_at'] );
$allowed_source_types = ayg_get_source_types();
$source_type = sanitize_key( isset( $_POST['type'] ) ? $_POST['type'] : 'playlist' );
if ( ! array_key_exists( $source_type, $allowed_source_types ) ) {
$source_type = 'playlist';
}
switch ( $source_type ) {
case 'channel':
case 'livestream':
$source_value = sanitize_text_field( isset( $_POST['channel'] ) ? $_POST['channel'] : '' );
break;
case 'playlist':
$source_value = sanitize_text_field( isset( $_POST['playlist'] ) ? $_POST['playlist'] : '' );
break;
case 'username':
$source_value = sanitize_text_field( isset( $_POST['username'] ) ? $_POST['username'] : '' );
break;
case 'search':
$source_value = sanitize_text_field( isset( $_POST['search'] ) ? $_POST['search'] : '' );
break;
case 'video':
$source_value = sanitize_text_field( isset( $_POST['video'] ) ? $_POST['video'] : '' );
break;
case 'videos':
$source_value = sanitize_textarea_field( isset( $_POST['videos'] ) ? $_POST['videos'] : '' );
break;
default:
$source_value = '';
}
}
$exclude = sanitize_textarea_field( isset( $_POST['exclude'] ) ? $_POST['exclude'] : '' );
if ( ! empty( $exclude ) ) $exclude = array_values( array_filter( array_map( 'trim', explode( "\n", $exclude ) ) ) );
$params['exclude'] = $exclude;
// 'paused' is a non-numeric sentinel (stop automatic imports); every other value is seconds.
$schedule = sanitize_text_field( isset( $_POST['schedule'] ) ? $_POST['schedule'] : 86400 );
$params['schedule'] = ( 'paused' === $schedule ) ? 'paused' : absint( $schedule );
// Display-time sort (gallery-form-only fields). Validated against whitelists; get_videos_from_db()
// maps them into a safe ORDER BY. Defaults reproduce the prior hardcoded "newest first".
$sort_by = sanitize_key( isset( $_POST['sort_by'] ) ? $_POST['sort_by'] : '' );
$params['sort_by'] = in_array( $sort_by, array( 'date', 'title', 'duration', 'random' ), true ) ? $sort_by : 'date';
$sort_order = sanitize_key( isset( $_POST['sort_order'] ) ? $_POST['sort_order'] : '' );
$params['sort_order'] = ( 'asc' === $sort_order ) ? 'asc' : 'desc';
// Display-time duration filter. get_videos_from_db() applies it only when a direction is set.
$duration_filter = sanitize_key( isset( $_POST['duration_filter'] ) ? $_POST['duration_filter'] : '' );
$params['duration_filter'] = in_array( $duration_filter, array( 'long', 'short' ), true ) ? $duration_filter : '';
$params['duration'] = absint( isset( $_POST['duration'] ) ? $_POST['duration'] : 0 );
// Fields stored in dedicated DB columns, not in params. 'cache' is kept (saved to params) so
// the live 'search' source type can control its API cache duration.
$fields = ayg_get_editor_fields();
$excluded = array( 'type', 'channel', 'playlist', 'username', 'search', 'video', 'videos' );
foreach ( $fields as $section ) {
foreach ( $section['fields'] as $field ) {
$name = $field['name'];
if ( in_array( $name, $excluded, true ) ) {
continue;
}
if ( 'checkbox' === $field['type'] ) {
$params[ $name ] = isset( $_POST[ $name ] ) ? 1 : 0;
} elseif ( ! isset( $_POST[ $name ] ) ) {
continue;
} elseif ( 'select' === $field['type'] && isset( $field['options'] ) ) {
$raw = sanitize_text_field( $_POST[ $name ] );
$params[ $name ] = array_key_exists( $raw, $field['options'] ) ? $raw : sanitize_text_field( $field['value'] );
} else {
$sanitize_callback = ! empty( $field['sanitize_callback'] ) ? $field['sanitize_callback'] : 'sanitize_text_field';
$params[ $name ] = call_user_func( $sanitize_callback, $_POST[ $name ] );
}
}
}
global $wpdb;
$table = $wpdb->prefix . 'ayg_galleries';
$now = current_time( 'mysql' );
$data = array(
'title' => $gallery_title,
'params' => wp_json_encode( $params ),
'updated_at' => $now
);
// Persist the source columns whenever they aren't locked (new gallery, or an
// update before the first import). All columns here are strings, so the format
// is left to default ('%s') instead of tracking a positional list.
if ( ! $source_locked ) {
$data['source_type'] = $source_type;
$data['source_value'] = $source_value;
}
// A "paused" schedule stops automatic imports: flag the gallery paused, clear any prior
// import error (so a user pause is distinguishable from a quota pause, which keeps its
// message), and drop it from the cron queue. The JS save flow skips the import for this case.
if ( 'paused' === $params['schedule'] ) {
$data['import_status'] = 'paused';
$data['import_error'] = '';
$data['next_import_at'] = null;
} elseif ( 0 === $params['schedule'] ) {
// "Only Once" is non-recurring: ensure no future cron run stays queued. Switching here from a
// recurring schedule may have left a stale next_import_at behind; clear it so a display-only
// save (import skipped) can't trigger one more unexpected background import. A save that does
// import will have import_batch() finalize the status / next run on completion anyway.
$data['next_import_at'] = null;
}
if ( $gallery_id > 0 ) {
if ( empty( $gallery_title ) ) {
$gallery_title = sprintf( __( 'Gallery %d', 'automatic-youtube-gallery' ), $gallery_id );
$data['title'] = $gallery_title;
}
// Drop any newly-excluded videos from this gallery's links (the videos table is left intact —
// rows may be shared by other galleries) and fold the refreshed count into this same update.
if ( ayg_delete_excluded_relationships( $gallery_id, $params['exclude'] ) > 0 ) {
$data['video_count'] = (int) $wpdb->get_var(
$wpdb->prepare( "SELECT COUNT(*) FROM {$wpdb->prefix}ayg_gallery_relationships WHERE gallery_id = %s", strval( $gallery_id ) )
);
}
$wpdb->update(
$table,
$data,
array( 'id' => $gallery_id ),
null,
array( '%d' )
);
} else {
$data['created_at'] = $now;
$wpdb->insert( $table, $data );
$gallery_id = (int) $wpdb->insert_id;
if ( empty( $gallery_title ) ) {
$gallery_title = sprintf( __( 'Gallery %d', 'automatic-youtube-gallery' ), $gallery_id );
$wpdb->update(
$table,
array( 'title' => $gallery_title ),
array( 'id' => $gallery_id ),
array( '%s' ),
array( '%d' )
);
}
}
// Live galleries (search / livestream / single video) render from the API and cache responses. Clear
// this gallery's cache on save so the front-end reflects the latest results right after "Update Gallery".
if ( in_array( $source_type, array( 'search', 'livestream', 'video' ), true ) ) {
ayg_delete_cache( strval( $gallery_id ) );
}
wp_send_json_success( array(
'gallery_id' => $gallery_id,
'shortcode' => sprintf( '[automatic_youtube_gallery id="%d"]', $gallery_id ),
) );
}
/**
* Import one batch of videos into a gallery via AJAX.
*
* The client calls this in a loop, passing back the page_token returned by
* the previous call, until done = true.
*
* @since 2.8.0
*/
public function ajax_callback_import_gallery() {
check_ajax_referer( 'ayg_ajax_nonce', 'security' );
if ( ! current_user_can( 'manage_options' ) ) {
wp_send_json_error( array( 'message' => __( 'Permission denied.', 'automatic-youtube-gallery' ) ) );
}
$gallery_id = absint( isset( $_POST['id'] ) ? $_POST['id'] : 0 );
$page_token = sanitize_text_field( isset( $_POST['page_token'] ) ? $_POST['page_token'] : '' );
// The browser-driven import is always a manual run: full re-scan, uncapped, prunes deletions.
$importer = new AYG_Import();
$result = $importer->import_batch( $gallery_id, $page_token, true );
if ( isset( $result['error'] ) ) {
wp_send_json_error( array(
'message' => $result['error'],
'quota_exceeded' => ! empty( $result['quota_exceeded'] )
) );
}
wp_send_json_success( $result );
}
/**
* Delete a gallery via AJAX.
*
* @since 2.8.0
*/
public function ajax_callback_delete_gallery() {
check_ajax_referer( 'ayg_ajax_nonce', 'security' );
if ( ! current_user_can( 'manage_options' ) ) {
wp_send_json_error( array( 'message' => __( 'Permission denied.', 'automatic-youtube-gallery' ) ) );
}
require_once AYG_DIR . 'admin/galleries.php';
$id = absint( isset( $_POST['id'] ) ? $_POST['id'] : 0 );
AYG_Admin_Gallery_List_Table::delete_gallery( $id );
wp_send_json_success();
}
}