← All changes | inc/class-children.php +145 -33 5.10.3 → 6.1.2 View file →

		@@ -2,14 +2,16 @@
2	2	/**
3	3	* Manage sub events
4	4	*
5	5	* @package event-post
6		- * @version 5.10.3
	6	+ * @version 6.1.2
7	7	* @since 4.3
8	8	*/
9	9
10	10	namespace EventPost;
11	11
	12	+if ( ! defined( 'ABSPATH' ) ) exit;
	13	+
12	14	$Children = new Children();
13	15
14	16	/**
15	17	* Manage child events
		@@ -51,8 +53,9 @@
51	53	return;
52	54	}
53	55
54	56	add_filter('eventpost_retreive', array(&$this, 'retreive'));
	57	+ add_filter('eventpost_get_items', array(&$this, 'hide_children_of_unpublished'));
55	58	add_filter('eventpost_get_post_types', array(&$this, 'get_post_types'));
56	59	add_filter('eventpost_contentbar', array(&$this, 'display_single'), 3, 2);
57	60
58	61	add_action('eventpost_add_custom_box', array(&$this, 'add_custom_box'));
		@@ -175,9 +178,13 @@
175	178	*
176	179	* @return bool
177	180	*/
178	181	function _delete_child($child_id){
179		- return wp_delete_post( $child_id, true );
	182	+ $child = get_post($child_id);
	183	+ if(!$child || $child->post_type !== $this->POST_TYPE){
	184	+ return false;
	185	+ }
	186	+ return wp_delete_post( $child->ID, true );
180	187	}
181	188
182	189	/**
183	190	* Syncs a child
		@@ -211,17 +218,21 @@
211	218	global $EventPost;
212	219	if(!is_numeric($post_id)){
213	220	return false;
214	221	}
	222	+ $parent = get_post($post_id);
	223	+ if(!$parent || $parent->post_type === $this->POST_TYPE){
	224	+ return false;
	225	+ }
215	226
216	227	$id = wp_insert_post(array(
217	228	'post_type'=>$this->POST_TYPE,
218		- 'post_parent'=>$post_id,
	229	+ 'post_parent'=>$parent->ID,
219	230	'post_status'=>'publish',
220	231	'post_mime_type'=>'text/calendar',
221	232	));
222	233
223		- if(!is_numeric($id)){
	234	+ if(!is_numeric($id) || !$id){
224	235	return false;
225	236	}
226	237	if ($EventPost->settings['children_sync_tax']) {
227	238	$this->_sync_child($id);
		@@ -289,19 +300,43 @@
289	300	*/
290	301	function retreive($event){
291	302	global $EventPost;
292	303	if($event->post_type == $this->POST_TYPE && $event->post_parent){
	304	+ $event->root_ID = $event->post_parent;
	305	+ $parent_status = get_post_status($event->post_parent);
	306	+ if(!$parent_status || !is_post_status_viewable($parent_status)){
	307	+ $event->post_status = $parent_status ? $parent_status : 'private';
	308	+ return $event;
	309	+ }
293	310	$parent = $EventPost->retreive($event->post_parent);
294		- $event->root_ID = $event->post_parent;
295	311	$event->post_title = $parent->post_title;
296	312	$event->permalink = $parent->permalink;
297		- $event->post_content = $parent->post_content;
298		- $event->description = $parent->description;
	313	+ if(empty($parent->post_password)){
	314	+ $event->post_content = $parent->post_content;
	315	+ $event->description = $parent->description;
	316	+ }
299	317	}
300	318	return $event;
301	319	}
302	320
	321	+ /**
	322	+ * Removes from public lists the children whose parent is not publicly readable
	323	+ *
	324	+ * @param array $events
	325	+ *
	326	+ * @return array
	327	+ */
	328	+ function hide_children_of_unpublished($events){
	329	+ if(!is_array($events)){
	330	+ return $events;
	331	+ }
	332	+ $post_type = $this->POST_TYPE;
	333	+ return array_values(array_filter($events, function($event) use ($post_type){
	334	+ return !(is_object($event) && $event->post_type === $post_type && $event->post_status !== 'publish');
	335	+ }));
	336	+ }
303	337
	338	+
304	339	/* -------------------- VIEWS ----------------------- */
305	340
306	341	/**
307	342	* Shows notices
		@@ -306,9 +341,9 @@
306	341	/**
307	342	* Shows notices
308	343	*/
309	344	function notice(){
310		- if(false === $notice = filter_input(INPUT_GET, 'eventpost_child_notice')){
	345	+ if(false == $notice = filter_input(INPUT_GET, 'eventpost_child_notice')){
311	346	return;
312	347	}
313	348	$notices = array(
314	349	'add_failed'=>array('warning', __( 'An error occured while creating a child event...', 'event-post' )),
		@@ -320,29 +355,73 @@
320	355	return;
321	356	}
322	357
323	358	?>
324		- <div class="notice-<?php echo $notices[$notice][0]; ?>"><p><?php echo $notices[$notice][1]; ?></p></div>
	359	+ <div class="notice-<?php echo esc_attr($notices[$notice][0]); ?>"><p><?php echo wp_kses_post($notices[$notice][1]); ?></p></div>
325	360	<?php
326	361	}
327	362
328	363	function check_admin_legitimity(){
329		- if (!wp_verify_nonce(filter_input(INPUT_GET, 'eventpost_children_nonce'), 'eventpost_children_nonce') ){
330		- wp_die(__('Invalid link', 'event-post'));
	364	+ if (!wp_verify_nonce((string) filter_input(INPUT_GET, 'eventpost_children_nonce'), 'eventpost_children_nonce') ){
	365	+ wp_die(esc_html__('Invalid link', 'event-post'), '', array('response' => 403));
331	366	}
332	367	}
333	368
334	369	/**
	370	+ * Checks that the current user is allowed to add children to a post
	371	+ *
	372	+ * @param int $post_id
	373	+ *
	374	+ * @return bool
	375	+ */
	376	+ function can_add_child($post_id){
	377	+ $post_id = absint($post_id);
	378	+ return $post_id > 0 && get_post($post_id) && current_user_can('edit_post', $post_id);
	379	+ }
	380	+
	381	+ /**
	382	+ * Checks that the current user is allowed to delete a child of a post
	383	+ *
	384	+ * @param int $post_id
	385	+ * @param int $child_id
	386	+ *
	387	+ * @return bool
	388	+ */
	389	+ function can_delete_child($post_id, $child_id){
	390	+ $child = get_post(absint($child_id));
	391	+ return $child
	392	+ && $child->post_type === $this->POST_TYPE
	393	+ && (int) $child->post_parent === absint($post_id)
	394	+ && current_user_can('edit_post', $child->post_parent)
	395	+ && current_user_can('delete_post', $child->ID);
	396	+ }
	397	+
	398	+ /**
	399	+ * Checks nonce for AJAX requests and answers in JSON on failure
	400	+ *
	401	+ * @return void
	402	+ */
	403	+ function check_ajax_legitimity(){
	404	+ if (!check_ajax_referer('eventpost_children_nonce', 'eventpost_children_nonce', false)) {
	405	+ wp_send_json(array('success'=>false, 'message'=>__('Invalid link', 'event-post')), 403);
	406	+ }
	407	+ }
	408	+
	409	+ /**
335	410	* Triggers child add on form submission
336		- *
	411	+ *
337	412	* @return void
338	413	*/
339	414	function add_child_admin_post(){
340	415	$this->check_admin_legitimity();
341	416
342		- if(false === $post_id = filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT)){
343		- wp_die(__('No post ID given...', 'event-post'));
	417	+ $post_id = absint(filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT));
	418	+ if(!$post_id){
	419	+ wp_die(esc_html__('No post ID given...', 'event-post'));
344	420	}
	421	+ if(!$this->can_add_child($post_id)){
	422	+ wp_die(esc_html__('Sorry, you are not allowed to edit this item.', 'event-post'), '', array('response' => 403));
	423	+ }
345	424
346	425	if(false !== $child_id = $this->_add_child($post_id)){
347	426	wp_redirect(admin_url('post.php?post='.$child_id.'&action=edit&post_type=eventpost'));
348	427	}
		@@ -351,11 +430,17 @@
351	430	}
352	431	exit;
353	432	}
354	433	function add_child_ajax(){
355		- if(false === $post_id = filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT)){
356		- wp_die(__('No post ID given...', 'event-post'));
	434	+ $this->check_ajax_legitimity();
	435	+
	436	+ $post_id = absint(filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT));
	437	+ if(!$post_id){
	438	+ wp_send_json(array('success'=>false, 'message'=>__('No post ID given...', 'event-post')), 400);
357	439	}
	440	+ if(!$this->can_add_child($post_id)){
	441	+ wp_send_json(array('success'=>false, 'message'=>__('Sorry, you are not allowed to edit this item.', 'event-post')), 403);
	442	+ }
358	443
359	444	if(false !== $child_id = $this->_add_child($post_id)){
360	445	wp_send_json(array(
361	446	'success'=>true,
		@@ -372,16 +457,21 @@
372	457	}
373	458
374	459	function delete_child_admin_post(){
375	460	$this->check_admin_legitimity();
376		- if(false === $post_id = filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT)){
377		- wp_die(__('No post ID given...', 'event-post'));
	461	+ $post_id = absint(filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT));
	462	+ if(!$post_id){
	463	+ wp_die(esc_html__('No post ID given...', 'event-post'));
378	464	}
379		- if(false === $child_id = filter_input(INPUT_GET, 'child_id', FILTER_SANITIZE_NUMBER_INT)){
380		- wp_die(__('No child ID given...', 'event-post'));
	465	+ $child_id = absint(filter_input(INPUT_GET, 'child_id', FILTER_SANITIZE_NUMBER_INT));
	466	+ if(!$child_id){
	467	+ wp_die(esc_html__('No child ID given...', 'event-post'));
381	468	}
	469	+ if(!$this->can_delete_child($post_id, $child_id)){
	470	+ wp_die(esc_html__('Sorry, you are not allowed to delete this item.', 'event-post'), '', array('response' => 403));
	471	+ }
382	472
383		- if(false !== $this->_delete_child($child_id)){
	473	+ if($this->_delete_child($child_id)){
384	474	wp_redirect(admin_url('post.php?post='.$post_id.'&action=edit&eventpost_child_notice=delete_success'));
385	475	}
386	476	else{
387	477	wp_redirect(admin_url('post.php?post='.$post_id.'&action=edit&eventpost_child_notice=delete_failed'));
		@@ -389,8 +479,30 @@
389	479	exit;
390	480	}
391	481
392	482	/**
	483	+ * Deletes a child event from an AJAX request
	484	+ *
	485	+ * @return void
	486	+ */
	487	+ function delete_child_ajax(){
	488	+ $this->check_ajax_legitimity();
	489	+
	490	+ $post_id = absint(filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT));
	491	+ $child_id = absint(filter_input(INPUT_GET, 'child_id', FILTER_SANITIZE_NUMBER_INT));
	492	+ if(!$post_id || !$child_id){
	493	+ wp_send_json(array('success'=>false, 'message'=>__('No child ID given...', 'event-post')), 400);
	494	+ }
	495	+ if(!$this->can_delete_child($post_id, $child_id)){
	496	+ wp_send_json(array('success'=>false, 'message'=>__('Sorry, you are not allowed to delete this item.', 'event-post')), 403);
	497	+ }
	498	+
	499	+ wp_send_json(array(
	500	+ 'success'=>(bool) $this->_delete_child($child_id),
	501	+ ));
	502	+ }
	503	+
	504	+ /**
393	505	* Settings form
394	506	*
395	507	* @param type $ep_settings
396	508	*/
		@@ -395,34 +507,34 @@
395	507	* @param type $ep_settings
396	508	*/
397	509	function settings_form($ep_settings) {
398	510	?>
399		- <h2><?php _e('Multi dates', 'event-post'); ?></h2>
	511	+ <h2><?php esc_html_e('Multi dates', 'event-post'); ?></h2>
400	512	<table class="form-table" id="eventpost-settings-table-children">
401	513	<tbody>
402	514	<tr>
403	515	<th>
404		- <?php _e('Enable children events', 'event-post') ?>
	516	+ <?php esc_html_e('Enable children events', 'event-post') ?>
405	517	</th>
406	518	<td>
407	519	<label for="children_enabled">
408	520	<input type="checkbox" name="ep_settings[children_enabled]" id="children_enabled" <?php if ($ep_settings['children_enabled'] == '1') {
409		- echo'checked';
	521	+ echo esc_attr('checked');
410	522	} ?> value="1">
411		- <?php _e('Allow event post to create children to events', 'event-post') ?>
	523	+ <?php esc_html_e('Allow event post to create children to events', 'event-post') ?>
412	524	</label>
413	525	</td>
414	526	</tr>
415	527	<tr>
416	528	<th>
417		- <?php _e('Synchronize taxonomies', 'event-post') ?>
	529	+ <?php esc_html_e('Synchronize taxonomies', 'event-post') ?>
418	530	</th>
419	531	<td>
420	532	<label for="children_sync_tax">
421	533	<input type="checkbox" name="ep_settings[children_sync_tax]" id="children_sync_tax" <?php if ($ep_settings['children_sync_tax'] == '1') {
422		- echo'checked';
	534	+ echo esc_attr('checked');
423	535	} ?> value="1">
424		- <?php _e('Make children herit all taxonomies (categories, tags, custom taxonomies...) from the original event.', 'event-post') ?>
	536	+ <?php esc_html_e('Make children herit all taxonomies (categories, tags, custom taxonomies...) from the original event.', 'event-post') ?>
425	537	</label>
426	538	</td>
427	539	</tr>
428	540
		@@ -442,9 +554,9 @@
442	554	?>
443	555	<a href="<?php echo admin_url('post.php?post='.$parent->ID.'&action=edit'); ?>" class="button button-default">
444	556	<i class="dashicons dashicons-arrow-left-alt"></i>
445	557	<?php // translators: %s represents the parent post title ?>
446		- <strong><?php printf(__('Back to %s', 'event-post'), esc_attr($parent->post_title)); ?></strong>
	558	+ <strong><?php printf(esc_html__('Back to %s', 'event-post'), esc_html($parent->post_title)); ?></strong>
447	559	</a>
448	560	<?php
449	561	}
450	562	}
		@@ -462,10 +574,10 @@
462	574	?>
463	575	<ul id="eventpost-children-list">
464	576	<?php foreach ($children as $child): ?>
465	577	<li>
466		- <?php echo $EventPost->get_singledate($child); ?>
467		- <?php echo $EventPost->get_singleloc($child); ?>
	578	+ <?php echo wp_kses($EventPost->get_singledate($child), EventPost()->kses_tags); ?>
	579	+ <?php echo wp_kses($EventPost->get_singleloc($child), EventPost()->kses_tags); ?>
468	580	<a class="button button-default eventpost-children-edit" href="<?php echo admin_url('post.php?post='.$child->ID.'&action=edit'); ?>" title="<?php _e('Edit child event', 'event-post'); ?>">
469	581	<i class="dashicons dashicons-edit"></i>
470	582	</a>
471	583	<a class="button button-default eventpost-children-delete" href="<?php echo wp_nonce_url(admin_url('admin-post.php?action=EventPostDeleteChild&post_id='.$post_id.'&child_id='.$child->ID), 'eventpost_children_nonce', 'eventpost_children_nonce'); ?>" title="<?php _e('Delete child event', 'event-post'); ?>">
		@@ -475,9 +587,9 @@
475	587	<?php endforeach; ?>
476	588	</ul>
477	589	<a class="button button-default eventpost-children-add" href="<?php echo wp_nonce_url(admin_url('admin-post.php?action=EventPostAddChild&post_id='.$post_id), 'eventpost_children_nonce', 'eventpost_children_nonce'); ?>">
478	590	<i class="dashicons dashicons-plus"></i>
479		- <?php _e('Add child event', 'event-post'); ?>
	591	+ <?php esc_html_e('Add child event', 'event-post'); ?>
480	592	</a>
481	593	<?php
482	594	}
483	595
		@@ -501,9 +613,9 @@
501	613	*/
502	614	public function columns_content($column_name, $post_id) {
503	615	if ($column_name == 'children_events') {
504	616	$nb = count($this->get($post_id));
505		- echo $nb ? '<p align="center">'.$nb.'</p>' : '';
	617	+ echo $nb ? '<p align="center">'.esc_html($nb).'</p>' : '';
506	618	}
507	619	}
508	620
509	621