← All changes | admin/class-convertkit-admin-bulk-edit.php +24 -20 2.3.1 → 3.4.3 View file →

		@@ -33,26 +33,20 @@
33	33	* @since 1.9.8.0
34	34	*/
35	35	public function enqueue_assets() {
36	36
37		- // Bail if we cannot determine the screen.
38		- if ( ! function_exists( 'get_current_screen' ) ) {
39		- return;
40		- }
41		-
42	37	// Bail if we're not on a Post Type Edit screen.
43		- $screen = get_current_screen();
44		- if ( $screen->base !== 'edit' ) {
	38	+ if ( convertkit_get_current_screen( 'base' ) !== 'edit' ) {
45	39	return;
46	40	}
47	41
48	42	// Bail if the Post isn't a supported Post Type.
49		- if ( ! in_array( $screen->post_type, convertkit_get_supported_post_types(), true ) ) {
	43	+ if ( ! in_array( convertkit_get_current_screen( 'post_type' ), convertkit_get_supported_post_types(), true ) ) {
50	44	return;
51	45	}
52	46
53	47	// Enqueue JS.
54		- wp_enqueue_script( 'convertkit-bulk-edit', CONVERTKIT_PLUGIN_URL . 'resources/backend/js/bulk-edit.js', array( 'jquery' ), CONVERTKIT_PLUGIN_VERSION, true );
	48	+ wp_enqueue_script( 'convertkit-bulk-edit', CONVERTKIT_PLUGIN_URL . 'resources/backend/js/bulk-edit.js', array(), CONVERTKIT_PLUGIN_VERSION, true );
55	49
56	50	// Output Bulk Edit fields in the footer of the Administration screen.
57	51	add_action( 'in_admin_footer', array( $this, 'bulk_edit_fields' ), 10 );
58	52
		@@ -77,14 +71,20 @@
77	71	return;
78	72	}
79	73
80	74	// Bail if the nonce verification fails.
81		- if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['wp-convertkit-save-meta-nonce'] ) ), 'wp-convertkit-save-meta' ) ) {
	75	+ if ( ! wp_verify_nonce( sanitize_key( wp_unslash( $_REQUEST['wp-convertkit-save-meta-nonce'] ) ), 'wp-convertkit-save-meta' ) ) {
82	76	return;
83	77	}
84	78
	79	+ // Bail if the Post Type or Post IDs are not specified.
	80	+ if ( ! isset( $_REQUEST['post_type'] ) || ! isset( $_REQUEST['post'] ) ) {
	81	+ return;
	82	+ }
	83	+
85	84	// Bail if the Post isn't a supported Post Type.
86		- if ( ! in_array( sanitize_text_field( $_REQUEST['post_type'] ), convertkit_get_supported_post_types(), true ) ) {
	85	+ $post_type = sanitize_text_field( wp_unslash( $_REQUEST['post_type'] ) );
	86	+ if ( ! in_array( $post_type, convertkit_get_supported_post_types(), true ) ) {
87	87	return;
88	88	}
89	89
90	90	// Bail if no ConvertKit settings were included in the Bulk Edit request.
		@@ -92,17 +92,17 @@
92	92	return;
93	93	}
94	94
95	95	// Get Post Type object.
96		- $post_type = get_post_type_object( $_REQUEST['post_type'] );
	96	+ $post_type_object = get_post_type_object( $post_type );
97	97
98	98	// Bail if the logged in user cannot edit Pages/Posts.
99		- if ( ! current_user_can( $post_type->cap->edit_posts ) ) {
	99	+ if ( ! current_user_can( $post_type_object->cap->edit_posts ) ) {
100	100	wp_die(
101	101	sprintf(
102	102	/* translators: Post Type name */
103	103	esc_html__( 'Sorry, you are not allowed to edit %s.', 'convertkit' ),
104		- esc_html( $post_type->name )
	104	+ esc_html( $post_type_object->name )
105	105	)
106	106	);
107	107	}
108	108
		@@ -110,9 +110,16 @@
110	110	$post_ids = array_map( 'intval', (array) $_REQUEST['post'] );
111	111
112	112	// Iterate through each Post, updating its settings.
113	113	foreach ( $post_ids as $post_id ) {
114		- WP_ConvertKit()->get_class( 'admin_post' )->save_post_settings( $post_id, $_REQUEST['wp-convertkit'] );
	114	+ // Skip Posts the current user cannot edit.
	115	+ // The post type's edit_posts capability checked above does not grant
	116	+ // permission to edit every Post of that type.
	117	+ if ( ! current_user_can( 'edit_post', $post_id ) ) {
	118	+ continue;
	119	+ }
	120	+
	121	+ WP_ConvertKit()->get_class( 'admin_post' )->save_post_settings( $post_id, wp_unslash( $_REQUEST['wp-convertkit'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
115	122	}
116	123
117	124	}
118	125
		@@ -127,9 +134,9 @@
127	134	public function bulk_edit_fields() {
128	135
129	136	// Don't output Bulk Edit fields if the API settings have not been defined.
130	137	$settings = new ConvertKit_Settings();
131		- if ( ! $settings->has_api_key_and_secret() ) {
	138	+ if ( ! $settings->has_access_and_refresh_token() ) {
132	139	return;
133	140	}
134	141
135	142	// Initialize Restrict Content Settings class.
		@@ -162,13 +169,10 @@
162	169	// Bail if the bulk action isn't edit.
163	170	if ( $bulk_action !== 'edit' ) {
164	171	return false;
165	172	}
166		- if ( ! array_key_exists( 'bulk_edit', $_REQUEST ) ) { // phpcs:ignore WordPress.Security.NonceVerification
167		- return false;
168		- }
169	173
170		- return true;
	174	+ return filter_has_var( INPUT_GET, 'bulk_edit' );
171	175
172	176	}
173	177
174	178	}