← All changes
|
includes/admin/import-items/class-charitable-import-items.php
+14
-6
1.8.11.3
→
1.8.13
View file →
| @@ -81,8 +81,12 @@ | ||
| 81 | 81 | if ( ! isset( $_POST['charitable_nonce'] ) || ! wp_verify_nonce( $_POST['charitable_nonce'], 'import_campaign' ) ) { // phpcs:ignore |
| 82 | 82 | return; |
| 83 | 83 | } |
| 84 | 84 | |
| 85 | + if ( ! current_user_can( 'manage_charitable_settings' ) ) { | |
| 86 | + return; | |
| 87 | + } | |
| 88 | + | |
| 85 | 89 | if ( ! $this->has_json_extension() ) { |
| 86 | 90 | $this->errors[] = __( 'Sorry, but Charitable import files must be in <code>.json</code> format.', 'charitable' ); |
| 87 | 91 | $redirect_link = admin_url( 'admin.php?page=charitable-tools&tab=import&sub_tab=charitable' ); |
| 88 | 92 | wp_safe_redirect( $redirect_link ); |
| @@ -136,9 +140,9 @@ | ||
| 136 | 140 | $campaign_id = wp_insert_post( $campaign_data ); |
| 137 | 141 | |
| 138 | 142 | foreach ( $data['meta'] as $meta_import_id => $meta_to_import ) { |
| 139 | 143 | if ( is_serialized( $meta_to_import['meta_value'] ) ) { |
| 140 | - $data_to_import = unserialize( $meta_to_import['meta_value'] ); | |
| 144 | + $data_to_import = unserialize( $meta_to_import['meta_value'], array( 'allowed_classes' => false ) ); | |
| 141 | 145 | } else { |
| 142 | 146 | $data_to_import = $meta_to_import['meta_value']; |
| 143 | 147 | } |
| 144 | 148 | add_post_meta( $campaign_id, $meta_to_import['meta_key'], $data_to_import ); |
| @@ -301,8 +305,12 @@ | ||
| 301 | 305 | if ( ! isset( $_POST['charitable_nonce'] ) || ! wp_verify_nonce( $_POST['charitable_nonce'], 'import_donations' ) ) { // phpcs:ignore |
| 302 | 306 | return; |
| 303 | 307 | } |
| 304 | 308 | |
| 309 | + if ( ! current_user_can( 'manage_charitable_settings' ) ) { | |
| 310 | + return; | |
| 311 | + } | |
| 312 | + | |
| 305 | 313 | if ( ! $this->has_json_extension( 'import_donations' ) ) { |
| 306 | 314 | $this->add_update_message( __( 'Sorry, but Charitable import files must be in <code>.json</code> format.', 'charitable' ), 'error' ); |
| 307 | 315 | $redirect_link = admin_url( 'admin.php?page=charitable-tools&tab=import&sub_tab=charitable' ); |
| 308 | 316 | wp_safe_redirect( $redirect_link ); |
| @@ -388,17 +396,17 @@ | ||
| 388 | 396 | |
| 389 | 397 | // import meta. |
| 390 | 398 | foreach ( $donation_data['meta'] as $meta_import_id => $meta_to_import ) { |
| 391 | 399 | if ( is_serialized( $meta_to_import['meta_value'] ) ) { |
| 392 | - $data_to_import = unserialize( $meta_to_import['meta_value'] ); // phpcs:ignore | |
| 400 | + $data_to_import = unserialize( $meta_to_import['meta_value'], array( 'allowed_classes' => false ) ); // phpcs:ignore | |
| 393 | 401 | } else { |
| 394 | 402 | $data_to_import = $meta_to_import['meta_value']; |
| 395 | 403 | } |
| 396 | 404 | if ( $meta_to_import['meta_key'] === 'donor' ) { |
| 397 | - $donor_data = unserialize( $meta_to_import['meta_value'] ); // phpcs:ignore | |
| 405 | + $donor_data = unserialize( $meta_to_import['meta_value'], array( 'allowed_classes' => false ) ); // phpcs:ignore | |
| 398 | 406 | } |
| 399 | 407 | if ( $meta_to_import['meta_key'] === '_donation_log' ) { |
| 400 | - $donation_log = unserialize( $meta_to_import['meta_value'] ); // phpcs:ignore | |
| 408 | + $donation_log = unserialize( $meta_to_import['meta_value'], array( 'allowed_classes' => false ) ); // phpcs:ignore | |
| 401 | 409 | } |
| 402 | 410 | |
| 403 | 411 | add_post_meta( $donation_id, $meta_to_import['meta_key'], $data_to_import ); |
| 404 | 412 | } |
| @@ -525,15 +533,15 @@ | ||
| 525 | 533 | public function get_donor_id( $donor_data ) { |
| 526 | 534 | |
| 527 | 535 | global $wpdb; |
| 528 | 536 | |
| 529 | - $email = esc_html( $donor_data['email'] ); | |
| 537 | + $email = ! empty( $donor_data['email'] ) ? $donor_data['email'] : ''; | |
| 530 | 538 | |
| 531 | 539 | // update custom table. |
| 532 | 540 | $table = $wpdb->prefix . 'charitable_donors'; |
| 533 | 541 | |
| 534 | 542 | // try finding if they still exist first. |
| 535 | - $donor_id = $wpdb->get_var( "SELECT donor_id FROM $table WHERE email = '$email'" ); // phpcs:ignore | |
| 543 | + $donor_id = $wpdb->get_var( $wpdb->prepare( "SELECT donor_id FROM {$table} WHERE email = %s", $email ) ); // phpcs:ignore | |
| 536 | 544 | |
| 537 | 545 | // if not, create it in the table. |
| 538 | 546 | if ( $donor_id === null ) { |
| 539 | 547 | |