| @@ -1,4 +1,4 @@ | ||
| 1 | 1 | <?php /** |
| 2 | 2 | * @version 1.0 |
| 3 | 3 | * @package Booking Calendar |
| 4 | 4 | * @category Data Engine for Booking Listing / Calendar Overview pages |
| @@ -24,12 +24,18 @@ | ||
| 24 | 24 | |
| 25 | 25 | if ( wpbc_is_bookings_page() ) { // We are inside of this page. Menu item selected. |
| 26 | 26 | |
| 27 | 27 | // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing |
| 28 | - if ( ( isset( $_REQUEST['tab'] ) ) && ( 'vm_booking_listing' === $_REQUEST['tab'] ) ) { //FixIn: 9.2.0 | |
| 28 | + $requested_tab = isset( $_REQUEST['tab'] ) ? sanitize_key( wp_unslash( $_REQUEST['tab'] ) ) : ''; | |
| 29 | + if ( ( '' !== $requested_tab ) && ( ! in_array( $requested_tab, array( 'vm_booking_listing', 'vm_calendar' ), true ) ) ) { // FixIn: Add Booking lives as its own Bookings tab. | |
| 29 | 30 | return; |
| 30 | 31 | } |
| 31 | 32 | |
| 33 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing | |
| 34 | + if ( 'vm_booking_listing' === $requested_tab ) { //FixIn: 9.2.0 | |
| 35 | + return; | |
| 36 | + } | |
| 37 | + | |
| 32 | 38 | $booking_default_view_mode = wpbc_get_default_saved_view_mode_for_wpbc_page(); |
| 33 | 39 | // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing |
| 34 | 40 | if ( ! isset( $_REQUEST['tab'] ) ) { |
| 35 | 41 | $_REQUEST['tab'] = $booking_default_view_mode; // Set to REQUEST |
| @@ -1110,14 +1116,19 @@ | ||
| 1110 | 1116 | $sql_where = " WHERE bk.booking_id > " . $wh_booking_id . " "; |
| 1111 | 1117 | |
| 1112 | 1118 | } |
| 1113 | 1119 | |
| 1114 | - else if ( strpos( $wh_booking_id, ',' ) !== false ) { | |
| 1115 | - $sql_where = " WHERE bk.booking_id IN (" . $wh_booking_id . ") "; | |
| 1116 | - | |
| 1117 | - } else { | |
| 1118 | - $sql_where = " WHERE bk.booking_id = " . $wh_booking_id . " "; | |
| 1119 | - } | |
| 1120 | + else if ( strpos( $wh_booking_id, ',' ) !== false ) { | |
| 1121 | + $booking_ids = array_filter( array_map( 'absint', explode( ',', $wh_booking_id ) ) ); | |
| 1122 | + $booking_ids = array_values( array_unique( $booking_ids ) ); | |
| 1123 | + $sql_where = empty( $booking_ids ) | |
| 1124 | + ? ' WHERE bk.booking_id = -1 ' | |
| 1125 | + : ' WHERE bk.booking_id IN (' . implode( ',', $booking_ids ) . ') '; | |
| 1126 | + | |
| 1127 | + } else { | |
| 1128 | + $booking_id = ( '-1' === (string) $wh_booking_id ) ? -1 : absint( $wh_booking_id ); | |
| 1129 | + $sql_where = ' WHERE bk.booking_id = ' . $booking_id . ' '; | |
| 1130 | + } | |
| 1120 | 1131 | |
| 1121 | 1132 | // Check if searching booking is belonging to specific user in Booking Calendar MultiUser version |
| 1122 | 1133 | $sql_where = apply_bk_filter('update_where_sql_for_getting_bookings_in_multiuser', $sql_where ); |
| 1123 | 1134 | |
