← All changes | core/wpbm-ajax.php +55 -13 2.0.1 → 2.1.21 View file →

		@@ -5,9 +5,9 @@
5	5	* @subpackage Ajax Responder
6	6	* @category Items
7	7	*
8	8	* @author wpdevelop
9		- * @link http://oplugins.com/
	9	+ * @link https://oplugins.com/
10	10	* @email [email protected]
11	11	*
12	12	* @modified 2014.05.26
13	13	*/
		@@ -72,27 +72,69 @@
72	72	////////////////////////////////////////////////////////////////////////////////
73	73
74	74
75	75	function wpbm_ajax_WPBM_USER_SAVE_WINDOW_STATE() {
76		-
77		-// if ( ! wpbm_check_nonce_in_admin_panel() ) return false;
78		-// update_user_option($_POST['user_id'],'wpbm_win_' . $_POST['window'] ,$_POST['is_closed']);
79		-
80		- if ( ! wpbm_check_nonce_in_admin_panel() ) return false;
81		- update_user_option( (int) $_POST['user_id'], 'wpbm_win_' . esc_attr( $_POST['window'] ) , (int) $_POST['is_closed'] );
82		- wp_send_json_success();
	76	+ if ( ! wpbm_check_nonce_in_admin_panel() ) {
	77	+ return false;
	78	+ }
	79	+
	80	+ $requested_user_id = isset( $_POST['user_id'] ) && is_scalar( $_POST['user_id'] )
	81	+ ? absint( wp_unslash( (string) $_POST['user_id'] ) )
	82	+ : 0;
	83	+ $authorized_user_id = wpbm_get_authorized_user_option_target_id( $requested_user_id );
	84	+ if ( 0 === $authorized_user_id ) {
	85	+ status_header( 403 );
	86	+ wp_send_json_error( array( 'message' => __( 'You can update only your own interface preferences.', 'booking-manager' ) ) );
	87	+ }
	88	+
	89	+ $window_name = isset( $_POST['window'] ) && is_scalar( $_POST['window'] )
	90	+ ? sanitize_text_field( wp_unslash( (string) $_POST['window'] ) )
	91	+ : '';
	92	+ if ( '' === $window_name ) {
	93	+ status_header( 400 );
	94	+ wp_send_json_error( array( 'message' => __( 'The interface preference is not valid.', 'booking-manager' ) ) );
	95	+ }
	96	+
	97	+ $is_closed = isset( $_POST['is_closed'] ) && is_scalar( $_POST['is_closed'] )
	98	+ ? (int) wp_unslash( (string) $_POST['is_closed'] )
	99	+ : 0;
	100	+ update_user_option( $authorized_user_id, 'wpbm_win_' . $window_name, $is_closed );
	101	+ wp_send_json_success();
83	102	}
84	103
85	104
86	105	/** Save Custom User Data */
87	106	function wpbm_ajax_WPBM_USER_SAVE_CUSTOM_DATA() {
88		-
89		- if ( ! wpbm_check_nonce_in_admin_panel() ) return false;
	107	+ if ( ! wpbm_check_nonce_in_admin_panel() ) {
	108	+ return false;
	109	+ }
	110	+
	111	+ $requested_user_id = isset( $_POST['user_id'] ) && is_scalar( $_POST['user_id'] )
	112	+ ? absint( wp_unslash( (string) $_POST['user_id'] ) )
	113	+ : 0;
	114	+ $authorized_user_id = wpbm_get_authorized_user_option_target_id( $requested_user_id );
	115	+ if ( 0 === $authorized_user_id ) {
	116	+ status_header( 403 );
	117	+ wp_send_json_error( array( 'message' => __( 'You can update only your own interface preferences.', 'booking-manager' ) ) );
	118	+ }
	119	+
	120	+ $data_name = isset( $_POST['data_name'] ) && is_scalar( $_POST['data_name'] )
	121	+ ? sanitize_text_field( wp_unslash( (string) $_POST['data_name'] ) )
	122	+ : '';
	123	+ $data_value = isset( $_POST['data_value'] ) && is_scalar( $_POST['data_value'] )
	124	+ ? wp_unslash( (string) $_POST['data_value'] )
	125	+ : '';
	126	+ if ( '' === $data_name ) {
	127	+ status_header( 400 );
	128	+ wp_send_json_error( array( 'message' => __( 'The interface preference is not valid.', 'booking-manager' ) ) );
	129	+ }
	130	+ $is_reload = ! empty( $_POST['is_reload'] );
	131	+
90	132	/* Exmaple of $_POST:
91	133	[data_name] => add_wpbm_calendar_options
92	134	[data_value] => calendar_months_count=1&calendar_months_num_in_1_row=1&calendar_width=500px&calendar_cell_height
93	135	*/
94		- $post_param = explode( '&', $_POST['data_value'] ); // "&" was set by jQuery.param( data_params ) in client side.
	136	+ $post_param = explode( '&', $data_value ); // "&" was set by jQuery.param( data_params ) in client side.
95	137	$data_to_save = array();
96	138	foreach ( $post_param as $param ) {
97	139	$param_data = explode( '=', $param );
98	140
		@@ -108,14 +150,14 @@
108	150	)
109	151	*/
110	152
111	153	// Save Custom User Data
112		- update_user_option( (int) $_POST['user_id'], 'wpbm_custom_' . esc_attr( $_POST['data_name'] ) , serialize( $data_to_save ) );
	154	+ update_user_option( $authorized_user_id, 'wpbm_custom_' . $data_name, serialize( $data_to_save ) );
113	155
114	156	?> <script type="text/javascript">
115	157	var my_message = '<?php echo html_entity_decode( esc_js( __('Saved' , 'booking-manager') ),ENT_QUOTES) ; ?>';
116	158	wpbm_admin_show_message( my_message, 'success', 1000 );
117		- <?php if ( ! empty( $_POST['is_reload'] ) == 1 ) { ?>
	159	+ <?php if ( $is_reload ) { ?>
118	160	setTimeout(function ( ) {location.reload(true);} ,1500);
119	161	<?php } ?>
120	162	</script> <?php
121	163	die();