← All changes | admin/class-convertkit-admin-bulk-edit.php +19 -16 3.3.3 → 2.4.7 View file →

		@@ -33,15 +33,21 @@
33	33	* @since 1.9.8.0
34	34	*/
35	35	public function enqueue_assets() {
36	36
	37	+ // Bail if we cannot determine the screen.
	38	+ if ( ! function_exists( 'get_current_screen' ) ) {
	39	+ return;
	40	+ }
	41	+
37	42	// Bail if we're not on a Post Type Edit screen.
38		- if ( convertkit_get_current_screen( 'base' ) !== 'edit' ) {
	43	+ $screen = get_current_screen();
	44	+ if ( $screen->base !== 'edit' ) {
39	45	return;
40	46	}
41	47
42	48	// Bail if the Post isn't a supported Post Type.
43		- if ( ! in_array( convertkit_get_current_screen( 'post_type' ), convertkit_get_supported_post_types(), true ) ) {
	49	+ if ( ! in_array( $screen->post_type, convertkit_get_supported_post_types(), true ) ) {
44	50	return;
45	51	}
46	52
47	53	// Enqueue JS.
		@@ -71,20 +77,14 @@
71	77	return;
72	78	}
73	79
74	80	// Bail if the nonce verification fails.
75		- if ( ! wp_verify_nonce( sanitize_key( wp_unslash( $_REQUEST['wp-convertkit-save-meta-nonce'] ) ), 'wp-convertkit-save-meta' ) ) {
	81	+ if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['wp-convertkit-save-meta-nonce'] ) ), 'wp-convertkit-save-meta' ) ) {
76	82	return;
77	83	}
78	84
79		- // Bail if the Post Type or Post IDs are not specified.
80		- if ( ! isset( $_REQUEST['post_type'] ) || ! isset( $_REQUEST['post'] ) ) {
81		- return;
82		- }
83		-
84	85	// Bail if the Post isn't a supported Post Type.
85		- $post_type = sanitize_text_field( wp_unslash( $_REQUEST['post_type'] ) );
86		- if ( ! in_array( $post_type, convertkit_get_supported_post_types(), true ) ) {
	86	+ if ( ! in_array( sanitize_text_field( $_REQUEST['post_type'] ), convertkit_get_supported_post_types(), true ) ) {
87	87	return;
88	88	}
89	89
90	90	// Bail if no ConvertKit settings were included in the Bulk Edit request.
		@@ -92,17 +92,17 @@
92	92	return;
93	93	}
94	94
95	95	// Get Post Type object.
96		- $post_type_object = get_post_type_object( $post_type );
	96	+ $post_type = get_post_type_object( $_REQUEST['post_type'] );
97	97
98	98	// Bail if the logged in user cannot edit Pages/Posts.
99		- if ( ! current_user_can( $post_type_object->cap->edit_posts ) ) {
	99	+ if ( ! current_user_can( $post_type->cap->edit_posts ) ) {
100	100	wp_die(
101	101	sprintf(
102	102	/* translators: Post Type name */
103	103	esc_html__( 'Sorry, you are not allowed to edit %s.', 'convertkit' ),
104		- esc_html( $post_type_object->name )
	104	+ esc_html( $post_type->name )
105	105	)
106	106	);
107	107	}
108	108
		@@ -110,9 +110,9 @@
110	110	$post_ids = array_map( 'intval', (array) $_REQUEST['post'] );
111	111
112	112	// Iterate through each Post, updating its settings.
113	113	foreach ( $post_ids as $post_id ) {
114		- WP_ConvertKit()->get_class( 'admin_post' )->save_post_settings( $post_id, wp_unslash( $_REQUEST['wp-convertkit'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	114	+ WP_ConvertKit()->get_class( 'admin_post' )->save_post_settings( $post_id, $_REQUEST['wp-convertkit'] );
115	115	}
116	116
117	117	}
118	118
		@@ -127,9 +127,9 @@
127	127	public function bulk_edit_fields() {
128	128
129	129	// Don't output Bulk Edit fields if the API settings have not been defined.
130	130	$settings = new ConvertKit_Settings();
131		- if ( ! $settings->has_access_and_refresh_token() ) {
	131	+ if ( ! $settings->has_api_key_and_secret() ) {
132	132	return;
133	133	}
134	134
135	135	// Initialize Restrict Content Settings class.
		@@ -162,10 +162,13 @@
162	162	// Bail if the bulk action isn't edit.
163	163	if ( $bulk_action !== 'edit' ) {
164	164	return false;
165	165	}
	166	+ if ( ! array_key_exists( 'bulk_edit', $_REQUEST ) ) { // phpcs:ignore WordPress.Security.NonceVerification
	167	+ return false;
	168	+ }
166	169
167		- return filter_has_var( INPUT_GET, 'bulk_edit' );
	170	+ return true;
168	171
169	172	}
170	173
171	174	}