← All changes | core/any/wpbm-class-dismiss.php +31 -15 2.1.7 → 2.1.21 View file →

		@@ -1,4 +1,4 @@
1	1	<?php /**
2	2	* @version 1.0
3	3	* @description Dismiss Class
4	4	* @category Dismiss panels Class
		@@ -78,23 +78,39 @@
78	78	element_id: panel_obj.id,
79	79	is_closed: 1
80	80	*
81	81	*/
82		- public function wpbm_ajax_WPBM_DISMISS() {
83		-
84		- if ( ! isset( $_POST['element_id'] ) || empty( $_POST['element_id'] ) ) {
85		- exit;
86		- }
87		-
88		- $action_name = $_POST['element_id'] . '_wpbmnonce';
89		- $nonce_post_key = 'nonce';
	82	+ public function wpbm_ajax_WPBM_DISMISS() {
	83	+
	84	+ $element_id = isset( $_POST['element_id'] ) && is_scalar( $_POST['element_id'] )
	85	+ ? sanitize_text_field( wp_unslash( (string) $_POST['element_id'] ) )
	86	+ : '';
	87	+ if ( '' === $element_id ) {
	88	+ status_header( 400 );
	89	+ wp_send_json_error( array( 'message' => __( 'The dismissible interface element is not valid.', 'booking-manager' ) ) );
	90	+ }
	91	+
	92	+ $action_name = $element_id . '_wpbmnonce';
	93	+ $nonce_post_key = 'nonce';
	94	+
	95	+ // Check Security
	96	+ $result = check_ajax_referer( $action_name, $nonce_post_key );
	97	+
	98	+ $requested_user_id = isset( $_POST['user_id'] ) && is_scalar( $_POST['user_id'] )
	99	+ ? absint( wp_unslash( (string) $_POST['user_id'] ) )
	100	+ : 0;
	101	+ $authorized_user_id = wpbm_get_authorized_user_option_target_id( $requested_user_id );
	102	+ if ( 0 === $authorized_user_id ) {
	103	+ status_header( 403 );
	104	+ wp_send_json_error( array( 'message' => __( 'You can update only your own interface preferences.', 'booking-manager' ) ) );
	105	+ }
	106	+
	107	+ // Save status
	108	+ $is_closed = isset( $_POST['is_closed'] ) && is_scalar( $_POST['is_closed'] )
	109	+ ? (int) wp_unslash( (string) $_POST['is_closed'] )
	110	+ : 0;
	111	+ update_user_option( $authorized_user_id, 'wpbm_win_' . $element_id, $is_closed );
90	112
91		- // Check Security
92		- $result = check_ajax_referer( $action_name, $nonce_post_key );
93		-
94		- // Save status
95		- update_user_option( (int) $_POST[ 'user_id' ], 'wpbm_win_' . esc_attr( $_POST[ 'element_id' ] ), (int) $_POST[ 'is_closed' ] );
96		-
97	113	// FixIn: 2.0.2.1 //Fix: We need to comment this line, because previously its possible that we already sent some messages, and its does not correct json format in this case.
98	114	//Fix: of showing "parsererror ~ SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data"
99	115	// send JSON
100	116	// wp_send_json( array( 'response' => 'success' ) ); // Return JS OBJ: response_data = { response: "success" } in "dismiss.js"
		@@ -186,5 +202,5 @@
186	202
187	203	?><a href="javascript:void(0)" <?php echo $attr_echo; ?> ><?php echo $title; ?></a><?php
188	204
189	205	if ( ! $echo ) { return ob_get_clean(); }
190		-}
	206	+}