PluginProbe
Booking Calendar / 11.8.4
Booking Calendar v11.8.4
11.8.4 11.8.3 11.8.2 11.8.1 11.8 11.7 11.6.1 11.6 11.5 11.4.3 11.4.2 11.4.1 11.4 11.3 11.2.1 11.2 11.1 11.0 10.15.7 10.15.6 10.1.3 10.10 10.10.1 10.10.2 10.11 All 204 releases
← All changes | core/lib/wpbc-ajax.php +233 -192 10.1.3 → 11.8.4 View file →
@@ -23,29 +23,29 @@
23 23
24 24 //FixIn: Flex TimeLine 1.0
25 25 function wpbc_ajax_WPBC_FLEXTIMELINE_NAV() {
26 26
27 - // if ( ! wpbc_check_nonce_in_admin_panel( $_POST['action'] ) ) return false; //FixIn: 7.2.1.10 // This line for admin panel
27 + // Timeline markup always includes this action-specific nonce. Unlike the
28 + // optional booking-form nonce policy, public timeline navigation must never
29 + // process or reflect a cross-origin request without verifying it.
30 + $nonce = isset( $_POST['wpbc_nonce'] ) && is_scalar( $_POST['wpbc_nonce'] )
31 + ? sanitize_text_field( wp_unslash( (string) $_POST['wpbc_nonce'] ) )
32 + : '';
33 + if ( ! wp_verify_nonce( $nonce, 'WPBC_FLEXTIMELINE_NAV' ) ) {
34 + wp_die( '', '', array( 'response' => 403 ) );
35 + }
28 36
29 - if ( wpbc_is_use_nonce_at_front_end() ) { //FixIn: 10.1.1.2
30 - $nonce = ( isset($_REQUEST['wpbc_nonce']) ) ? $_REQUEST['wpbc_nonce'] : '';
31 - if ( ! wp_verify_nonce( $nonce, $_POST['action'] ) ) { // This nonce is not valid.
32 - wp_die(
33 - sprintf(__('%sError!%s Request do not pass security check! Please refresh the page and try one more time.' ,'booking'),'<strong>','</strong>')
34 - . '<br/>' . sprintf( __( 'Please check more %shere%s', 'booking' ), '<a href="https://wpbookingcalendar.com/faq/request-do-not-pass-security-check/?after_update=10.1.1" target="_blank">', '</a>.' ) //FixIn: 8.8.3.6
35 - ); // Its prevent of showing '0' et the end of request.
36 - }
37 - }
38 - make_bk_action('wpbc_ajax_flex_timeline');
39 - wp_die(''); // Its prevent of showing '0' et the end of request.
37 + make_bk_action( 'wpbc_ajax_flex_timeline' );
38 + wp_die( '' ); // Its prevent of showing '0' et the end of request.
40 39 }
41 40
42 41
43 42 function wpbc_ajax_CALCULATE_THE_COST() {
44 43
45 - if ( wpbc_is_use_nonce_at_front_end() ) { //FixIn: 10.1.1.2
44 + if ( wpbc_is_use_nonce_at_front_end() ) { // FixIn: 10.1.1.2.
45 + // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
46 46 if ( ! wpbc_check_nonce_in_admin_panel( $_POST['action'] ) ) {
47 - return false;//FixIn: 7.2.1.10
47 + return false;// FixIn: 7.2.1.10.
48 48 }
49 49 }
50 50 make_bk_action( 'wpdev_ajax_show_cost' );
51 51 }
@@ -51,51 +51,52 @@
51 51 }
52 52
53 53
54 54
55 -//FixIn: 9.6.3.5
55 +// FixIn: 9.6.3.5.
56 56
57 57 function wpbc_ajax_UPDATE_APPROVE() {
58 -
59 - global $wpdb;
60 58
61 - if ( ! wpbc_check_nonce_in_admin_panel() ) return false; //FixIn: 7.2.1.10
62 -
63 - make_bk_action('check_multiuser_params_for_client_side_by_user_id', $_POST['user_id'] );
59 + global $wpdb;
64 60
65 - // Approve or Reject
66 - $is_approve_or_pending = $_POST[ "is_approve_or_pending" ];
67 - if ($is_approve_or_pending == 1)
68 - $is_approve_or_pending = '1';
69 - else
70 - $is_approve_or_pending = '0';
61 + if ( ! wpbc_check_nonce_in_admin_panel() ) {
62 + return false; // FixIn: 7.2.1.10.
63 + }
71 64
72 - $booking_id = $_POST[ "booking_id" ];
73 - $approved_id = explode('|',$booking_id);
74 - $approved_id = wpbc_clean_digit_or_csd( $approved_id ); //FixIn: 8.4.5.15
65 + // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
66 + make_bk_action( 'check_multiuser_params_for_client_side_by_user_id', sanitize_text_field( wp_unslash( $_POST['user_id'] ) ) );
75 67
76 - if (! isset($_POST["denyreason"]))
77 - $_POST["denyreason"] = '';
78 - $denyreason = stripslashes( $_POST["denyreason"] ); //FixIn: 7.0.1.46 - translate words like don\'t to don't
79 - $is_send_emeils = $_POST["is_send_emeils"];
68 + // Approve or Reject?
69 + // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
70 + $is_approve_or_pending = ( 1 == $_POST["is_approve_or_pending"] ) ? '1' : '0';
80 71
72 + $booking_id = isset( $_POST['booking_id'] ) ? sanitize_text_field( wp_unslash( $_POST['booking_id'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended */ /* FixIn: sanitize_unslash */ // Booking ID.
81 73
82 - if ( ( count($approved_id) > 0 ) && ( $approved_id !== false ) ) {
74 + $approved_id = explode( '|', $booking_id );
75 + $approved_id = wpbc_clean_digit_or_csd( $approved_id ); // FixIn: 8.4.5.15.
83 76
84 - $approved_id_str = join( ',', $approved_id);
85 - $approved_id_str = wpbc_clean_digit_or_csd( $approved_id_str );
77 + $denyreason = isset( $_POST['denyreason'] ) ? sanitize_textarea_field( wp_unslash( $_POST['denyreason'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended */ /* FixIn: sanitize_unslash */
78 + $is_send_emeils = isset( $_POST['is_send_emeils'] ) ? sanitize_text_field( wp_unslash( $_POST['is_send_emeils'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended */ /* FixIn: sanitize_unslash */
86 79
87 - if ( false === $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->prefix}bookingdates SET approved = %s WHERE booking_id IN ({$approved_id_str})", $is_approve_or_pending ) ) ){
88 - ?> <script type="text/javascript">
89 - var my_message = '<?php echo html_entity_decode( esc_js( get_debuge_error('Error during updating to DB' ,__FILE__,__LINE__) ),ENT_QUOTES) ; ?>';
90 - wpbc_admin_show_message( my_message, 'error', 30000 );
91 - </script> <?php
92 - die();
93 - }
80 + if ( ( count( $approved_id ) > 0 ) && ( false !== $approved_id ) ) {
94 81
95 - //FixIn: 8.6.1.10
96 - $curr_user = get_user_by( 'id', (int) $_POST['user_id'] );
97 - $user_info = $curr_user->first_name . ' ' . $curr_user->last_name . ' (' . $curr_user->user_email . ')'; // get_user_meta( $curr_user->ID, 'nickname' )
82 + $approved_id_str = join( ',', $approved_id );
83 + $approved_id_str = wpbc_clean_digit_or_csd( $approved_id_str );
84 +
85 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
86 + if ( false === $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->prefix}bookingdates SET approved = %s WHERE booking_id IN ( {$approved_id_str} )", $is_approve_or_pending ) ) ) {
87 + ?>
88 + <script type="text/javascript">
89 + var my_message = '<?php echo esc_js( get_debuge_error( 'Error during updating to DB', __FILE__, __LINE__ ) ); ?>';
90 + wpbc_admin_show_message(my_message, 'error', 30000);
91 + </script>
92 + <?php
93 + die();
94 + }
95 +
96 + $my_user_id = isset( $_POST['user_id'] ) ? intval( $_POST['user_id'] ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing */
97 + $curr_user = get_user_by( 'id', $my_user_id );
98 + $user_info = $curr_user->first_name . ' ' . $curr_user->last_name . ' (' . $curr_user->user_email . ')'; // get_user_meta( $curr_user->ID, 'nickname' ).
98 99 wpbc_db__add_log_info( explode(',',$approved_id_str),
99 100 ( ( $is_approve_or_pending == '1' ) ? __( 'Approved by:', 'booking' ) : __( 'Declined by:', 'booking' ) )
100 101 . ' ' . $user_info );
101 102
@@ -100,37 +101,48 @@
100 101 . ' ' . $user_info );
101 102
102 103 wpbc_db_update_number_new_bookings( explode(',', $approved_id_str) );
103 104
104 - do_action( 'wpbc_booking_approved', $approved_id_str, $is_approve_or_pending ); //FixIn: 8.7.6.1
105 + do_action( 'wpbc_booking_approved', $approved_id_str, $is_approve_or_pending ); // FixIn: 8.7.6.1.
105 106
106 - if ($is_approve_or_pending == '1') {
107 - if ( ! empty($is_send_emeils ) ) //FixIn: 7.0.1.5
108 - wpbc_send_email_approved($approved_id_str, $is_send_emeils,$denyreason);
109 - $all_bk_id_what_canceled = apply_bk_filter('cancel_pending_same_resource_bookings_for_specific_dates', false, $approved_id_str );
110 - } else {
111 - if ( ! empty($is_send_emeils ) )
112 - wpbc_send_email_deny($approved_id_str, $is_send_emeils,$denyreason);
113 - }
107 + if ( $is_approve_or_pending == '1' ) {
108 + if ( ! empty( $is_send_emeils ) ) // FixIn: 7.0.1.5.
109 + {
110 + wpbc_send_email_approved( $approved_id_str, $is_send_emeils, $denyreason );
111 + }
112 + $all_bk_id_what_canceled = apply_bk_filter( 'cancel_pending_same_resource_bookings_for_specific_dates', false, $approved_id_str );
113 + } else {
114 + if ( ! empty( $is_send_emeils ) ) {
115 + wpbc_send_email_deny( $approved_id_str, $is_send_emeils, $denyreason );
116 + }
117 + }
114 118
115 - ?> <script type="text/javascript">
116 - <?php foreach ($approved_id as $bk_id) {
117 - if ($is_approve_or_pending == '1') { ?>
118 - set_booking_row_approved_in_timeline(<?php echo $bk_id ?>);
119 - set_booking_row_approved(<?php echo $bk_id ?>);
120 - set_booking_row_read(<?php echo $bk_id ?>);
121 - <?php } else { ?>
122 - set_booking_row_pending_in_timeline(<?php echo $bk_id ?>);
123 - set_booking_row_pending(<?php echo $bk_id ?>);
124 - <?php }?>
125 - <?php } ?>
126 - <?php if ($is_approve_or_pending == '1') { ?>
127 - var my_message = '<?php echo html_entity_decode( esc_js( __('Set as Approved' ,'booking') ),ENT_QUOTES) ; ?>';
128 - <?php } else { ?>
129 - var my_message = '<?php echo html_entity_decode( esc_js( __('Set as Pending' ,'booking') ),ENT_QUOTES) ; ?>';
130 - <?php } ?>
131 - wpbc_admin_show_message( my_message, 'success', 3000 );
132 - </script> <?php
119 + ?>
120 + <script type="text/javascript">
121 + <?php
122 + foreach ( $approved_id as $bk_id ) {
123 + if ( $is_approve_or_pending == '1' ) {
124 + ?>
125 + set_booking_row_approved_in_timeline(<?php echo esc_attr( $bk_id ); ?>);
126 + set_booking_row_approved(<?php echo esc_attr( $bk_id ); ?>);
127 + set_booking_row_read(<?php echo esc_attr( $bk_id ); ?>);
128 + <?php
129 + } else {
130 + ?>
131 + set_booking_row_pending_in_timeline(<?php echo esc_attr( $bk_id ); ?>);
132 + set_booking_row_pending(<?php echo esc_attr( $bk_id ); ?>);
133 + <?php
134 + }
135 + }
136 + ?>
137 + <?php if ($is_approve_or_pending == '1') { ?>
138 + var my_message = '<?php echo esc_js( __( 'Set as Approved', 'booking' ) ); ?>';
139 + <?php } else { ?>
140 + var my_message = '<?php echo esc_js( __( 'Set as Pending', 'booking' ) ); ?>';
141 + <?php } ?>
142 + wpbc_admin_show_message(my_message, 'success', 3000);
143 + </script>
144 + <?php
133 145 }
134 146 }
135 147
136 148
@@ -137,55 +149,58 @@
137 149 //FixIn: 6.1.1.10
138 150 function wpbc_ajax_TRASH_RESTORE() {
139 151 global $wpdb;
140 152
141 - if ( ! wpbc_check_nonce_in_admin_panel() ) return false; //FixIn: 7.2.1.10
142 -
143 - make_bk_action('check_multiuser_params_for_client_side_by_user_id', $_POST['user_id'] );
153 + if ( ! wpbc_check_nonce_in_admin_panel() ) return false; // FixIn: 7.2.1.10.
144 154
145 - $booking_id = $_POST[ "booking_id" ]; // Booking ID
155 + $my_user_id = isset( $_POST['user_id'] ) ? intval( $_POST['user_id'] ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing */
156 + make_bk_action('check_multiuser_params_for_client_side_by_user_id', $my_user_id );
146 157
147 - if ( ! isset($_POST["denyreason"] ) )
148 - $_POST["denyreason"] = '';
149 - $denyreason = stripslashes( $_POST["denyreason"] ); //FixIn: 7.0.1.46 - trasnalte words like don\'t to don't
150 - if ( ( $denyreason == __('Reason for cancellation here' ,'booking'))
151 - || ( $denyreason == __('Reason of cancellation here' ,'booking'))
152 - || ( $denyreason == 'Reason of cancel here')
153 - ) $denyreason = '';
154 - $is_send_emeils = $_POST["is_send_emeils"];
158 + $booking_id = isset( $_POST['booking_id'] ) ? sanitize_text_field( wp_unslash( $_POST['booking_id'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended */ /* FixIn: sanitize_unslash */ // Booking ID.
155 159
156 - $approved_id = explode('|',$booking_id);
157 - $approved_id = wpbc_clean_digit_or_csd( $approved_id ); //FixIn: 8.4.5.15
160 + $denyreason = isset( $_POST['denyreason'] ) ? sanitize_textarea_field( wp_unslash( $_POST['denyreason'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended */ /* FixIn: sanitize_unslash */
158 161
159 - $is_trash = intval( $_POST["is_trash"] );
162 + if ( ( $denyreason === __( 'Reason for cancellation here', 'booking' ) ) || ( $denyreason === __( 'Reason of cancellation here', 'booking' ) ) || ( $denyreason === 'Reason of cancel here' ) ) {
163 + $denyreason = '';
164 + }
160 165
161 - if ( (count($approved_id)>0) && ($approved_id !=false) && ($approved_id !='')) {
166 + $is_send_emeils = isset( $_POST['is_send_emeils'] ) ? sanitize_text_field( wp_unslash( $_POST['is_send_emeils'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended */ /* FixIn: sanitize_unslash */
162 167
168 + $approved_id = explode( '|', $booking_id );
169 + $approved_id = wpbc_clean_digit_or_csd( $approved_id ); // FixIn: 8.4.5.15.
170 +
171 + $is_trash = isset( $_POST['is_trash'] ) ? intval( $_POST['is_trash'] ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended */ /* FixIn: sanitize_unslash */
172 +
173 + if ( ( count( $approved_id ) > 0 ) && ( $approved_id != false ) && ( $approved_id != '' ) ) {
174 +
163 175 $approved_id_str = join( ',', $approved_id);
164 176 $approved_id_str = wpbc_clean_like_string_for_db( $approved_id_str );
165 177
166 - do_action( 'wpbc_booking_trash', $booking_id, $is_trash ); //FixIn: 8.7.6.2
178 + do_action( 'wpbc_booking_trash', $booking_id, $is_trash ); // FixIn: .8.7.6.2.
167 179
168 - if ( $is_trash ) {
169 - if ( ! empty( $is_send_emeils ) ) { //FixIn: 8.1.3.35
170 - wpbc_send_email_trash( $approved_id_str, $is_send_emeils, $denyreason );
171 - }
172 - } else {
173 - if ( ! empty( $is_send_emeils ) ) { //FixIn: 8.1.3.35
174 - // wpbc_send_email_approved($approved_id_str, $is_send_emeils,$denyreason); //FixIn: 8.1.2.7
175 - }
176 - }
177 -
178 - if ( false === $wpdb->query( "UPDATE {$wpdb->prefix}booking AS bk SET bk.trash = {$is_trash} WHERE booking_id IN ({$approved_id_str})" ) ){
179 - ?> <script type="text/javascript">
180 - var my_message = '<?php echo html_entity_decode( esc_js( get_debuge_error('Error during trash booking in DB' ,__FILE__,__LINE__) ),ENT_QUOTES) ; ?>';
181 - wpbc_admin_show_message( my_message, 'error', 30000 );
182 - </script> <?php
183 - die();
184 - }
180 + if ( $is_trash ) {
181 + if ( ! empty( $is_send_emeils ) ) { // FixIn: 8.1.3.35.
182 + wpbc_send_email_trash( $approved_id_str, $is_send_emeils, $denyreason );
183 + }
184 + } else {
185 + if ( ! empty( $is_send_emeils ) ) { // FixIn: 8.1.3.35.
186 + // wpbc_send_email_approved($approved_id_str, $is_send_emeils,$denyreason); // FixIn: 8.1.2.7.
187 + }
188 + }
189 + // FixIn: 10.12.1.5.
190 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
191 + if ( false === $wpdb->query( "UPDATE {$wpdb->prefix}booking SET trash = {$is_trash} WHERE booking_id IN ({$approved_id_str})" ) ) {
192 + ?>
193 + <script type="text/javascript">
194 + var my_message = '<?php echo esc_attr( html_entity_decode( esc_js( get_debuge_error( 'Error during trash booking in DB', __FILE__, __LINE__ ) ), ENT_QUOTES ) ); ?>';
195 + wpbc_admin_show_message(my_message, 'error', 30000);
196 + </script>
197 + <?php
198 + die();
199 + }
185 200
186 201 // Update the Hash and Cost of the booking
187 - $booking_id_arr = explode(',', $approved_id_str ); //FixIn: 8.6.1.11
202 + $booking_id_arr = explode( ',', $approved_id_str ); // FixIn: 8.6.1.11.
188 203 foreach ( $booking_id_arr as $booking_id ) {
189 204 wpbc_hash__update_booking_hash( $booking_id );
190 205 }
191 206
@@ -195,23 +210,23 @@
195 210 if ( $is_trash ) {
196 211
197 212 foreach ($approved_id as $bk_id) {
198 213 ?>
199 - set_booking_row_trash(<?php echo $bk_id ?>);
200 - //set_booking_row_deleted_in_timeline(<?php echo $bk_id ?>);
201 - //setTimeout(function() { set_booking_row_deleted(<?php echo $bk_id ?>); }, 1000);
214 + set_booking_row_trash(<?php echo esc_attr( $bk_id ); ?>);
215 + //set_booking_row_deleted_in_timeline(<?php echo esc_attr( $bk_id ); ?>);
216 + //setTimeout(function() { set_booking_row_deleted(<?php echo esc_attr( $bk_id ); ?>); }, 1000);
202 217 <?php
203 218 }
204 219 ?>
205 - var my_message = '<?php echo html_entity_decode( esc_js( __('Moved to trash' ,'booking') ),ENT_QUOTES) ; ?>';
220 + var my_message = '<?php echo esc_js( __('Moved to trash' ,'booking') ) ; ?>';
206 221 wpbc_admin_show_message( my_message, 'success', 3000 );
207 222 <?php
208 223 } else {
209 224 foreach ($approved_id as $bk_id) {
210 - ?> set_booking_row_restore(<?php echo $bk_id ?>); <?php
225 + ?> set_booking_row_restore(<?php echo esc_attr( $bk_id ); ?>); <?php
211 226 }
212 227 ?>
213 - var my_message = '<?php echo html_entity_decode( esc_js( __('Restored' ,'booking') ),ENT_QUOTES) ; ?>';
228 + var my_message = '<?php echo esc_js( __('Restored' ,'booking') ) ; ?>';
214 229 wpbc_admin_show_message( my_message, 'success', 3000 );
215 230 <?php
216 231 }
217 232 ?>
@@ -219,9 +234,9 @@
219 234 <?php
220 235 }
221 236 }
222 237
223 -//FixIn: 9.6.3.5
238 +// FixIn: 9.6.3.5.
224 239
225 240
226 241 function wpbc_ajax_DELETE_APPROVE() {
227 242
@@ -226,73 +241,85 @@
226 241 function wpbc_ajax_DELETE_APPROVE() {
227 242
228 243 global $wpdb;
229 244
230 - if ( ! wpbc_check_nonce_in_admin_panel() ) return false; //FixIn: 7.2.1.10
231 -
232 - make_bk_action('check_multiuser_params_for_client_side_by_user_id', $_POST['user_id'] );
245 + if ( ! wpbc_check_nonce_in_admin_panel() ) return false; // FixIn: 7.2.1.10.
246 + $my_user_id = isset( $_POST['user_id'] ) ? intval( $_POST['user_id'] ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing */
247 + make_bk_action('check_multiuser_params_for_client_side_by_user_id', $my_user_id );
233 248
234 - $booking_id = $_POST[ "booking_id" ]; // Booking ID
235 - if ( ! isset($_POST["denyreason"] ) )
236 - $_POST["denyreason"] = '';
237 - $denyreason = stripslashes( $_POST["denyreason"] ); //FixIn: 7.0.1.46 - trasnalte words like don\'t to don't
238 - if ( ( $denyreason == __('Reason for cancellation here' ,'booking'))
239 - || ( $denyreason == __('Reason of cancellation here' ,'booking'))
240 - || ( $denyreason == 'Reason of cancel here')
241 - ) $denyreason = '';
242 - $is_send_emeils = $_POST["is_send_emeils"];
243 - $approved_id = explode('|',$booking_id);
244 - $approved_id = wpbc_clean_digit_or_csd( $approved_id ); //FixIn: 8.4.5.15
249 + $booking_id = isset( $_POST['booking_id'] ) ? sanitize_text_field( wp_unslash( $_POST['booking_id'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended */ /* FixIn: sanitize_unslash */ // Booking ID.
245 250
251 + $denyreason = isset( $_POST['denyreason'] ) ? sanitize_textarea_field( wp_unslash( $_POST['denyreason'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended */ /* FixIn: sanitize_unslash */
252 +
253 + if ( ( $denyreason == __( 'Reason for cancellation here', 'booking' ) )
254 + || ( $denyreason == __( 'Reason of cancellation here', 'booking' ) )
255 + || ( $denyreason == 'Reason of cancel here' )
256 + ) {
257 + $denyreason = '';
258 + }
259 +
260 + $is_send_emeils = isset( $_POST['is_send_emeils'] ) ? sanitize_text_field( wp_unslash( $_POST['is_send_emeils'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended */ /* FixIn: sanitize_unslash */
261 +
262 + $approved_id = explode( '|', $booking_id );
263 + $approved_id = wpbc_clean_digit_or_csd( $approved_id ); // FixIn: 8.4.5.15.
264 +
246 265 if ( (count($approved_id)>0) && ($approved_id !=false) && ($approved_id !='')) {
247 266
248 267 $approved_id_str = join( ',', $approved_id);
249 268 $approved_id_str = wpbc_clean_like_string_for_db( $approved_id_str );
250 269
251 - do_action( 'wpbc_booking_delete', $approved_id_str ); //FixIn: 8.7.6.3
270 + do_action( 'wpbc_booking_delete', $approved_id_str ); // FixIn: 8.7.6.3.
252 271
253 - if ( ! empty( $is_send_emeils ) ) { //FixIn: 8.1.3.35
272 + if ( ! empty( $is_send_emeils ) ) { // FixIn: 8.1.3.35.
254 273 wpbc_send_email_deleted( $approved_id_str, $is_send_emeils, $denyreason );
255 274 }
256 275
257 - if ( false === $wpdb->query( "DELETE FROM {$wpdb->prefix}bookingdates WHERE booking_id IN ({$approved_id_str})" ) ){
258 - ?> <script type="text/javascript">
259 - var my_message = '<?php echo html_entity_decode( esc_js( get_debuge_error('Error during deleting dates in DB' ,__FILE__,__LINE__) ),ENT_QUOTES) ; ?>';
260 - wpbc_admin_show_message( my_message, 'error', 30000 );
261 - </script> <?php
262 - die();
263 - }
276 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
277 + if ( false === $wpdb->query( "DELETE FROM {$wpdb->prefix}bookingdates WHERE booking_id IN ({$approved_id_str})" ) ) {
278 + ?>
279 + <script type="text/javascript">
280 + var my_message = '<?php echo esc_attr( html_entity_decode( esc_js( get_debuge_error( 'Error during deleting dates in DB', __FILE__, __LINE__ ) ), ENT_QUOTES ) ); ?>';
281 + wpbc_admin_show_message(my_message, 'error', 30000);
282 + </script>
283 + <?php
284 + die();
285 + }
264 286
265 - if ( false === $wpdb->query( "DELETE FROM {$wpdb->prefix}booking WHERE booking_id IN ({$approved_id_str})" ) ){
266 - ?> <script type="text/javascript">
267 - var my_message = '<?php echo html_entity_decode( esc_js( get_debuge_error('Error during deleting booking in DB' ,__FILE__,__LINE__) ),ENT_QUOTES) ; ?>';
268 - wpbc_admin_show_message( my_message, 'error', 30000 );
269 - </script> <?php
270 - die();
271 - }
272 - ?>
273 - <script type="text/javascript">
274 - <?php foreach ($approved_id as $bk_id) { ?>
275 - set_booking_row_deleted_in_timeline(<?php echo $bk_id ?>);
276 - set_booking_row_deleted(<?php echo $bk_id ?>);
277 - <?php } ?>
278 - var my_message = '<?php echo html_entity_decode( esc_js( __('Deleted' ,'booking') ),ENT_QUOTES) ; ?>';
279 - wpbc_admin_show_message( my_message, 'success', 3000 );
280 - </script>
281 - <?php
282 - }
287 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
288 + if ( false === $wpdb->query( "DELETE FROM {$wpdb->prefix}booking WHERE booking_id IN ({$approved_id_str})" ) ) {
289 + ?>
290 + <script type="text/javascript">
291 + var my_message = '<?php echo esc_attr( html_entity_decode( esc_js( get_debuge_error( 'Error during deleting booking in DB', __FILE__, __LINE__ ) ), ENT_QUOTES ) ); ?>';
292 + wpbc_admin_show_message(my_message, 'error', 30000);
293 + </script>
294 + <?php
295 + die();
296 + }
297 + ?>
298 + <script type="text/javascript">
299 + <?php foreach ( $approved_id as $bk_id ) { ?>
300 + set_booking_row_deleted_in_timeline(<?php echo intval( $bk_id ); ?>);
301 + set_booking_row_deleted(<?php echo intval( $bk_id ); ?>);
302 + <?php } ?>
303 + var my_message = '<?php echo esc_attr( html_entity_decode( esc_js( __( 'Deleted', 'booking' ) ), ENT_QUOTES ) ); ?>';
304 + wpbc_admin_show_message(my_message, 'success', 3000);
305 + </script>
306 + <?php
307 + }
283 308 }
284 309
285 310
286 311 function wpbc_ajax_DELETE_BY_VISITOR() {
287 312
288 - if ( wpbc_is_use_nonce_at_front_end() ) { //FixIn: 10.1.1.2
313 + if ( wpbc_is_use_nonce_at_front_end() ) { // FixIn: 10.1.1.2.
314 +
315 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
289 316 if ( ! wpbc_check_nonce_in_admin_panel( $_POST['action'] ) ) {
290 - return false; //FixIn: 7.2.1.10
317 + return false; // FixIn: 7.2.1.10.
291 318 }
292 319 }
293 320
294 - make_bk_action('wpdev_delete_booking_by_visitor');
321 + make_bk_action( 'wpdev_delete_booking_by_visitor' );
295 322 }
296 323
297 324
298 325
@@ -299,10 +326,11 @@
299 326
300 327
301 328 function wpbc_ajax_DELETE_BK_FORM() {
302 329
303 - if ( ! wpbc_check_nonce_in_admin_panel() ) return false; //FixIn: 7.2.1.10
304 - make_bk_action('check_multiuser_params_for_client_side_by_user_id', $_POST['user_id'] );
330 + if ( ! wpbc_check_nonce_in_admin_panel() ) return false; // FixIn: 7.2.1.10.
331 + $my_user_id = isset( $_POST['user_id'] ) ? intval( $_POST['user_id'] ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing */
332 + make_bk_action('check_multiuser_params_for_client_side_by_user_id', $my_user_id );
305 333 make_bk_action('wpbc_make_delete_custom_booking_form');
306 334 }
307 335
308 336
@@ -307,13 +335,18 @@
307 335
308 336
309 337 function wpbc_ajax_USER_SAVE_WINDOW_STATE() {
310 338
311 - if ( ! wpbc_check_nonce_in_admin_panel() ) return false;
339 + if ( ! wpbc_check_nonce_in_admin_panel() ) {
340 + return false;
341 + }
342 + $my_user_id = isset( $_POST['user_id'] ) ? intval( $_POST['user_id'] ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing */
343 + $my_window = isset( $_POST['window'] ) ? sanitize_textarea_field( wp_unslash( $_POST['window'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing */
344 + $my_is_closed = isset( $_POST['is_closed'] ) ? intval( $_POST['is_closed'] ) : 0; /* phpcs:ignore WordPress.Security.NonceVerification.Missing */
312 345
313 - update_user_option( (int) $_POST['user_id'], 'booking_win_' . esc_attr( $_POST['window'] ) , (int) $_POST['is_closed'] );
314 -
315 - wp_send_json_success(); //FixIn: 7.2.1.10.2 //Fix "400 Bad Request" error showing. At some situations, if Ajax request does not return anything, its will generate an issue
346 + update_user_option( $my_user_id, 'booking_win_' . $my_window, $my_is_closed );
347 +
348 + wp_send_json_success(); // FixIn: 7.2.1.10.2 //Fix "400 Bad Request" error showing. At some situations, if Ajax request does not return anything, its will generate an issue.
316 349 }
317 350
318 351
319 352 /** Save Custom User Data */
@@ -323,10 +356,16 @@
323 356 /* Exmaple of $_POST:
324 357 [data_name] => add_booking_calendar_options
325 358 [data_value] => calendar_months_count=1&calendar_months_num_in_1_row=1&calendar_width=500px&calendar_cell_height
326 359 */
327 - $post_param = explode( '&', $_POST['data_value'] ); // "&" was set by jQuery.param( data_params ) in client side.
328 - $data_to_save = array();
360 + // "&" was set by jQuery.param( data_params ) in client side.
361 +
362 + $my_user_id = isset( $_POST['user_id'] ) ? intval( $_POST['user_id'] ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing */
363 + $my_data_name = isset( $_POST['data_name'] ) ? sanitize_textarea_field( wp_unslash( $_POST['data_name'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing */
364 + $my_data_value = isset( $_POST['data_value'] ) ? sanitize_textarea_field( wp_unslash( $_POST['data_value'] ) ) : ''; /* phpcs:ignore WordPress.Security.NonceVerification.Missing */
365 +
366 + $post_param = explode( '&', $my_data_value );
367 + $data_to_save = array();
329 368 foreach ( $post_param as $param ) {
330 369 $param_data = explode( '=', $param );
331 370
332 371 $data_to_save[ $param_data[0] ] = ( isset( $param_data[1] ) ) ? esc_attr( $param_data[1] ) : '';
@@ -340,15 +379,15 @@
340 379 [calendar_cell_height] =>
341 380 )
342 381 */
343 382
344 - // Save Custom User Data
345 - update_user_option( (int) $_POST['user_id'], 'booking_custom_' . esc_attr( $_POST['data_name'] ) , serialize( $data_to_save ) );
383 + // Save Custom User Data.
384 + update_user_option( $my_user_id, 'booking_custom_' . $my_data_name, serialize( $data_to_save ) );
346 385
347 386 ?> <script type="text/javascript">
348 - var my_message = '<?php echo html_entity_decode( esc_js( __('Saved' ,'booking') ),ENT_QUOTES) ; ?>';
349 - wpbc_admin_show_message( my_message, 'success', 1000 );
350 - <?php if ( ! empty( $_POST['is_reload'] ) == 1 ) { ?>
387 + var my_message = '<?php echo esc_js( __('Saved' ,'booking') ) ; ?>';
388 + wpbc_admin_show_message( my_message, 'success', 1000 );
389 + <?php if ( ! empty( $_POST['is_reload'] ) && intval( $_POST['is_reload'] ) === 1 ) { /* phpcs:ignore WordPress.Security.NonceVerification.Missing */ ?>
351 390 setTimeout(function ( ) {location.reload(true);} ,1500);
352 391 <?php } ?>
353 392 </script> <?php
354 393 die();
@@ -357,11 +396,12 @@
357 396
358 397
359 398 function wpbc_ajax_BOOKING_SEARCH() {
360 399
361 - if ( wpbc_is_use_nonce_at_front_end() ) { //FixIn: 10.1.1.2
400 + if ( wpbc_is_use_nonce_at_front_end() ) { // FixIn: 10.1.1.2.
401 + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing
362 402 if ( ! wpbc_check_nonce_in_admin_panel( $_POST['action'] ) ) {
363 - return false; //FixIn: 7.2.1.10
403 + return false; // FixIn: 7.2.1.10.
364 404 }
365 405 }
366 406
367 407 if ( function_exists( 'wpbc_ajax_start_searching' ) ) {
@@ -371,24 +411,24 @@
371 411
372 412
373 413 function wpbc_ajax_CHECK_BK_NEWS() {
374 414
375 - if ( ! wpbc_check_nonce_in_admin_panel() ) return false; //FixIn: 7.2.1.10
376 - wpdev_ajax_check_bk_news();
415 + if ( ! wpbc_check_nonce_in_admin_panel() ) return false; // FixIn: 7.2.1.10.
416 + wpbc_old_ajax_check_bk_news();
377 417 }
378 418
379 419
380 420 function wpbc_ajax_CHECK_BK_FEATURES() {
381 421
382 - if ( ! wpbc_check_nonce_in_admin_panel() ) return false; //FixIn: 7.2.1.10
383 - wpdev_ajax_check_bk_news('info/features/');
422 + if ( ! wpbc_check_nonce_in_admin_panel() ) return false; // FixIn: 7.2.1.10.
423 + wpbc_old_ajax_check_bk_news('info/features/');
384 424 }
385 425
386 426
387 427 function wpbc_ajax_CHECK_BK_VERSION() {
388 428
389 - if ( ! wpbc_check_nonce_in_admin_panel() ) return false; //FixIn: 7.2.1.10
390 - wpdev_ajax_check_bk_version();
429 + if ( ! wpbc_check_nonce_in_admin_panel() ) return false; // FixIn: 7.2.1.10.
430 + wpbc_old_ajax_check_bk_version();
391 431 }
392 432
393 433
394 434
@@ -398,12 +438,12 @@
398 438 // R u n A j a x //////////////////////////////////
399 439 // ---------------------------------------------------------------------------------------------------------------------
400 440 if ( is_admin() && ( defined( 'DOING_AJAX' ) ) && ( DOING_AJAX ) ) {
401 441
402 - //FixIn: 8.9.4.5
442 + // FixIn: 8.9.4.5.
403 443
404 - // Hooks list
405 - $actions_list = array(
444 + // Hooks list.
445 + $wpbc_booking_actions_list = array(
406 446 'WPBC_FLEXTIMELINE_NAV' => 'both' //FixIn: Flex TimeLine 1.0
407 447 ,'CALCULATE_THE_COST' => 'both'
408 448
409 449
@@ -409,9 +449,9 @@
409 449
410 450 ,'UPDATE_APPROVE' => 'admin'
411 451 ,'DELETE_APPROVE' => 'admin'
412 452 ,'DELETE_BY_VISITOR' => 'both'
413 - ,'TRASH_RESTORE' => 'admin' //FixIn: 6.1.1.10
453 + ,'TRASH_RESTORE' => 'admin' // FixIn: 6.1.1.10.
414 454
415 455 ,'DELETE_BK_FORM' => 'admin'
416 456 ,'USER_SAVE_WINDOW_STATE' => 'admin'
417 457 ,'USER_SAVE_CUSTOM_DATA' => 'admin'
@@ -422,18 +462,19 @@
422 462
423 463 , 'WPBC_IMPORT_ICS_URL' => 'admin' //FixIn: 7.3
424 464 );
425 465
426 - $actions_list = apply_filters( 'wpbc_ajax_action_list', $actions_list );
466 + $wpbc_booking_actions_list = apply_filters( 'wpbc_ajax_action_list', $wpbc_booking_actions_list );
427 467
428 - foreach ($actions_list as $action_name => $action_where) {
468 + foreach ( $wpbc_booking_actions_list as $wpbc_action_name => $wpbc_action_where) {
429 469
430 - if ( ( isset($_POST['action']) ) && ( $_POST['action'] == $action_name ) ){
470 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing
471 + if ( ( isset($_POST['action']) ) && ( $_POST['action'] == $wpbc_action_name ) ){
431 472
432 - if ( ( $action_where == 'admin' ) || ( $action_where == 'both' ) )
433 - add_action( 'wp_ajax_' . $action_name, 'wpbc_ajax_' . $action_name); // Admin & Client (logged in usres)
473 + if ( ( $wpbc_action_where == 'admin' ) || ( $wpbc_action_where == 'both' ) )
474 + add_action( 'wp_ajax_' . $wpbc_action_name, 'wpbc_ajax_' . $wpbc_action_name); // Admin & Client (logged in usres)
434 475
435 - if ( ( $action_where == 'both' ) || ( $action_where == 'client' ) )
436 - add_action( 'wp_ajax_nopriv_' . $action_name, 'wpbc_ajax_' . $action_name); // Client (not logged in)
476 + if ( ( $wpbc_action_where == 'both' ) || ( $wpbc_action_where == 'client' ) )
477 + add_action( 'wp_ajax_nopriv_' . $wpbc_action_name, 'wpbc_ajax_' . $wpbc_action_name); // Client (not logged in)
437 478 }
438 479 }
439 -}
480 +}