| @@ -264,9 +264,19 @@ | ||
| 264 | 264 | if ( ! empty( $params['calendar_request_overrides'] ) && is_array( $params['calendar_request_overrides'] ) ) { |
| 265 | 265 | foreach ( $params['calendar_request_overrides'] as $override_key => $override_value ) { |
| 266 | 266 | if ( 'allow_past' === $override_key ) { |
| 267 | 267 | $params_for_request['allow_past'] = ! empty( $override_value ) ? 1 : 0; |
| 268 | - } elseif ( 0 === strpos( (string) $override_key, 'wpbc_settings_calendar_preview' ) ) { | |
| 268 | + } elseif ( | |
| 269 | + 0 === strpos( (string) $override_key, 'wpbc_settings_calendar_preview' ) | |
| 270 | + || in_array( | |
| 271 | + (string) $override_key, | |
| 272 | + array( | |
| 273 | + 'wpbc_setup_wizard_date_selection_preview', | |
| 274 | + 'wpbc_setup_wizard_date_selection_preview_nonce', | |
| 275 | + ), | |
| 276 | + true | |
| 277 | + ) | |
| 278 | + ) { | |
| 269 | 279 | $params_for_request[ $override_key ] = $override_value; |
| 270 | 280 | } |
| 271 | 281 | } |
| 272 | 282 | } |
| @@ -401,10 +411,12 @@ | ||
| 401 | 411 | 'wpbc_settings_calendar_preview_cost_word' => array( 'validate' => 's', 'default' => '' ), |
| 402 | 412 | 'wpbc_settings_calendar_preview_show_cost_cell' => array( 'validate' => array( 'On', 'Off' ), 'default' => 'Off' ), |
| 403 | 413 | 'wpbc_settings_calendar_preview_cost_currency' => array( 'validate' => 's', 'default' => '' ), |
| 404 | 414 | 'wpbc_settings_calendar_preview_show_booked_details' => array( 'validate' => array( 'On', 'Off' ), 'default' => 'Off' ), |
| 405 | - 'wpbc_settings_calendar_preview_booked_details' => array( 'validate' => 's', 'default' => '' ), | |
| 406 | - ) | |
| 415 | + 'wpbc_settings_calendar_preview_booked_details' => array( 'validate' => 's', 'default' => '' ), | |
| 416 | + 'wpbc_setup_wizard_date_selection_preview' => array( 'validate' => 'd', 'default' => 0 ), | |
| 417 | + 'wpbc_setup_wizard_date_selection_preview_nonce' => array( 'validate' => 'strong', 'default' => '' ), | |
| 418 | + ) | |
| 407 | 419 | ) |
| 408 | 420 | ); |
| 409 | 421 | $request_prefix = 'calendar_request_params'; |
| 410 | 422 | $request_params = $user_request->get_sanitized__in_request__value_or_default( $request_prefix ); // NOT Direct: $_REQUEST['search_params']['resource_id'] |
| @@ -416,9 +428,11 @@ | ||
| 416 | 428 | $request_params['custom_form'], |
| 417 | 429 | $request_params['aggregate_resource_id_str'] |
| 418 | 430 | ); |
| 419 | 431 | if ( ! is_wp_error( $classic_context ) ) { |
| 420 | - $request_params['allow_past'] = ! empty( $classic_context['allow_past'] ) ? 1 : 0; | |
| 432 | + $request_params['allow_past'] = ! empty( $classic_context['allow_past'] ) ? 1 : 0; | |
| 433 | + // Use the signed canonical set so equivalent wire shapes cannot change availability input. | |
| 434 | + $request_params['aggregate_resource_id_str'] = implode( ',', $classic_context['aggregate_resource_ids'] ); | |
| 421 | 435 | $request_params['dates_to_check'] = array( |
| 422 | 436 | $classic_context['calendar_dates_start'], |
| 423 | 437 | $classic_context['calendar_dates_end'], |
| 424 | 438 | ); |
