← All changes | inc/class-children.php +129 -17 5.11.1 → 6.1.2 View file →

		@@ -2,14 +2,16 @@
2	2	/**
3	3	* Manage sub events
4	4	*
5	5	* @package event-post
6		- * @version 5.11.1
	6	+ * @version 6.1.2
7	7	* @since 4.3
8	8	*/
9	9
10	10	namespace EventPost;
11	11
	12	+if ( ! defined( 'ABSPATH' ) ) exit;
	13	+
12	14	$Children = new Children();
13	15
14	16	/**
15	17	* Manage child events
		@@ -51,8 +53,9 @@
51	53	return;
52	54	}
53	55
54	56	add_filter('eventpost_retreive', array(&$this, 'retreive'));
	57	+ add_filter('eventpost_get_items', array(&$this, 'hide_children_of_unpublished'));
55	58	add_filter('eventpost_get_post_types', array(&$this, 'get_post_types'));
56	59	add_filter('eventpost_contentbar', array(&$this, 'display_single'), 3, 2);
57	60
58	61	add_action('eventpost_add_custom_box', array(&$this, 'add_custom_box'));
		@@ -175,9 +178,13 @@
175	178	*
176	179	* @return bool
177	180	*/
178	181	function _delete_child($child_id){
179		- return wp_delete_post( $child_id, true );
	182	+ $child = get_post($child_id);
	183	+ if(!$child || $child->post_type !== $this->POST_TYPE){
	184	+ return false;
	185	+ }
	186	+ return wp_delete_post( $child->ID, true );
180	187	}
181	188
182	189	/**
183	190	* Syncs a child
		@@ -211,17 +218,21 @@
211	218	global $EventPost;
212	219	if(!is_numeric($post_id)){
213	220	return false;
214	221	}
	222	+ $parent = get_post($post_id);
	223	+ if(!$parent || $parent->post_type === $this->POST_TYPE){
	224	+ return false;
	225	+ }
215	226
216	227	$id = wp_insert_post(array(
217	228	'post_type'=>$this->POST_TYPE,
218		- 'post_parent'=>$post_id,
	229	+ 'post_parent'=>$parent->ID,
219	230	'post_status'=>'publish',
220	231	'post_mime_type'=>'text/calendar',
221	232	));
222	233
223		- if(!is_numeric($id)){
	234	+ if(!is_numeric($id) || !$id){
224	235	return false;
225	236	}
226	237	if ($EventPost->settings['children_sync_tax']) {
227	238	$this->_sync_child($id);
		@@ -289,19 +300,43 @@
289	300	*/
290	301	function retreive($event){
291	302	global $EventPost;
292	303	if($event->post_type == $this->POST_TYPE && $event->post_parent){
	304	+ $event->root_ID = $event->post_parent;
	305	+ $parent_status = get_post_status($event->post_parent);
	306	+ if(!$parent_status || !is_post_status_viewable($parent_status)){
	307	+ $event->post_status = $parent_status ? $parent_status : 'private';
	308	+ return $event;
	309	+ }
293	310	$parent = $EventPost->retreive($event->post_parent);
294		- $event->root_ID = $event->post_parent;
295	311	$event->post_title = $parent->post_title;
296	312	$event->permalink = $parent->permalink;
297		- $event->post_content = $parent->post_content;
298		- $event->description = $parent->description;
	313	+ if(empty($parent->post_password)){
	314	+ $event->post_content = $parent->post_content;
	315	+ $event->description = $parent->description;
	316	+ }
299	317	}
300	318	return $event;
301	319	}
302	320
	321	+ /**
	322	+ * Removes from public lists the children whose parent is not publicly readable
	323	+ *
	324	+ * @param array $events
	325	+ *
	326	+ * @return array
	327	+ */
	328	+ function hide_children_of_unpublished($events){
	329	+ if(!is_array($events)){
	330	+ return $events;
	331	+ }
	332	+ $post_type = $this->POST_TYPE;
	333	+ return array_values(array_filter($events, function($event) use ($post_type){
	334	+ return !(is_object($event) && $event->post_type === $post_type && $event->post_status !== 'publish');
	335	+ }));
	336	+ }
303	337
	338	+
304	339	/* -------------------- VIEWS ----------------------- */
305	340
306	341	/**
307	342	* Shows notices
		@@ -306,9 +341,9 @@
306	341	/**
307	342	* Shows notices
308	343	*/
309	344	function notice(){
310		- if(false === $notice = filter_input(INPUT_GET, 'eventpost_child_notice')){
	345	+ if(false == $notice = filter_input(INPUT_GET, 'eventpost_child_notice')){
311	346	return;
312	347	}
313	348	$notices = array(
314	349	'add_failed'=>array('warning', __( 'An error occured while creating a child event...', 'event-post' )),
		@@ -325,24 +360,68 @@
325	360	<?php
326	361	}
327	362
328	363	function check_admin_legitimity(){
329		- if (!wp_verify_nonce(filter_input(INPUT_GET, 'eventpost_children_nonce'), 'eventpost_children_nonce') ){
330		- wp_die(esc_html__('Invalid link', 'event-post'));
	364	+ if (!wp_verify_nonce((string) filter_input(INPUT_GET, 'eventpost_children_nonce'), 'eventpost_children_nonce') ){
	365	+ wp_die(esc_html__('Invalid link', 'event-post'), '', array('response' => 403));
331	366	}
332	367	}
333	368
334	369	/**
	370	+ * Checks that the current user is allowed to add children to a post
	371	+ *
	372	+ * @param int $post_id
	373	+ *
	374	+ * @return bool
	375	+ */
	376	+ function can_add_child($post_id){
	377	+ $post_id = absint($post_id);
	378	+ return $post_id > 0 && get_post($post_id) && current_user_can('edit_post', $post_id);
	379	+ }
	380	+
	381	+ /**
	382	+ * Checks that the current user is allowed to delete a child of a post
	383	+ *
	384	+ * @param int $post_id
	385	+ * @param int $child_id
	386	+ *
	387	+ * @return bool
	388	+ */
	389	+ function can_delete_child($post_id, $child_id){
	390	+ $child = get_post(absint($child_id));
	391	+ return $child
	392	+ && $child->post_type === $this->POST_TYPE
	393	+ && (int) $child->post_parent === absint($post_id)
	394	+ && current_user_can('edit_post', $child->post_parent)
	395	+ && current_user_can('delete_post', $child->ID);
	396	+ }
	397	+
	398	+ /**
	399	+ * Checks nonce for AJAX requests and answers in JSON on failure
	400	+ *
	401	+ * @return void
	402	+ */
	403	+ function check_ajax_legitimity(){
	404	+ if (!check_ajax_referer('eventpost_children_nonce', 'eventpost_children_nonce', false)) {
	405	+ wp_send_json(array('success'=>false, 'message'=>__('Invalid link', 'event-post')), 403);
	406	+ }
	407	+ }
	408	+
	409	+ /**
335	410	* Triggers child add on form submission
336		- *
	411	+ *
337	412	* @return void
338	413	*/
339	414	function add_child_admin_post(){
340	415	$this->check_admin_legitimity();
341	416
342		- if(false === $post_id = filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT)){
	417	+ $post_id = absint(filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT));
	418	+ if(!$post_id){
343	419	wp_die(esc_html__('No post ID given...', 'event-post'));
344	420	}
	421	+ if(!$this->can_add_child($post_id)){
	422	+ wp_die(esc_html__('Sorry, you are not allowed to edit this item.', 'event-post'), '', array('response' => 403));
	423	+ }
345	424
346	425	if(false !== $child_id = $this->_add_child($post_id)){
347	426	wp_redirect(admin_url('post.php?post='.$child_id.'&action=edit&post_type=eventpost'));
348	427	}
		@@ -351,11 +430,17 @@
351	430	}
352	431	exit;
353	432	}
354	433	function add_child_ajax(){
355		- if(false === $post_id = filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT)){
356		- wp_die(__('No post ID given...', 'event-post'));
	434	+ $this->check_ajax_legitimity();
	435	+
	436	+ $post_id = absint(filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT));
	437	+ if(!$post_id){
	438	+ wp_send_json(array('success'=>false, 'message'=>__('No post ID given...', 'event-post')), 400);
357	439	}
	440	+ if(!$this->can_add_child($post_id)){
	441	+ wp_send_json(array('success'=>false, 'message'=>__('Sorry, you are not allowed to edit this item.', 'event-post')), 403);
	442	+ }
358	443
359	444	if(false !== $child_id = $this->_add_child($post_id)){
360	445	wp_send_json(array(
361	446	'success'=>true,
		@@ -372,16 +457,21 @@
372	457	}
373	458
374	459	function delete_child_admin_post(){
375	460	$this->check_admin_legitimity();
376		- if(false === $post_id = filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT)){
	461	+ $post_id = absint(filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT));
	462	+ if(!$post_id){
377	463	wp_die(esc_html__('No post ID given...', 'event-post'));
378	464	}
379		- if(false === $child_id = filter_input(INPUT_GET, 'child_id', FILTER_SANITIZE_NUMBER_INT)){
	465	+ $child_id = absint(filter_input(INPUT_GET, 'child_id', FILTER_SANITIZE_NUMBER_INT));
	466	+ if(!$child_id){
380	467	wp_die(esc_html__('No child ID given...', 'event-post'));
381	468	}
	469	+ if(!$this->can_delete_child($post_id, $child_id)){
	470	+ wp_die(esc_html__('Sorry, you are not allowed to delete this item.', 'event-post'), '', array('response' => 403));
	471	+ }
382	472
383		- if(false !== $this->_delete_child($child_id)){
	473	+ if($this->_delete_child($child_id)){
384	474	wp_redirect(admin_url('post.php?post='.$post_id.'&action=edit&eventpost_child_notice=delete_success'));
385	475	}
386	476	else{
387	477	wp_redirect(admin_url('post.php?post='.$post_id.'&action=edit&eventpost_child_notice=delete_failed'));
		@@ -386,8 +476,30 @@
386	476	else{
387	477	wp_redirect(admin_url('post.php?post='.$post_id.'&action=edit&eventpost_child_notice=delete_failed'));
388	478	}
389	479	exit;
	480	+ }
	481	+
	482	+ /**
	483	+ * Deletes a child event from an AJAX request
	484	+ *
	485	+ * @return void
	486	+ */
	487	+ function delete_child_ajax(){
	488	+ $this->check_ajax_legitimity();
	489	+
	490	+ $post_id = absint(filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT));
	491	+ $child_id = absint(filter_input(INPUT_GET, 'child_id', FILTER_SANITIZE_NUMBER_INT));
	492	+ if(!$post_id || !$child_id){
	493	+ wp_send_json(array('success'=>false, 'message'=>__('No child ID given...', 'event-post')), 400);
	494	+ }
	495	+ if(!$this->can_delete_child($post_id, $child_id)){
	496	+ wp_send_json(array('success'=>false, 'message'=>__('Sorry, you are not allowed to delete this item.', 'event-post')), 403);
	497	+ }
	498	+
	499	+ wp_send_json(array(
	500	+ 'success'=>(bool) $this->_delete_child($child_id),
	501	+ ));
390	502	}
391	503
392	504	/**
393	505	* Settings form