← All changes | inc/class-children.php +127 -17 6.0.0 → 6.1.2 View file →

		@@ -2,9 +2,9 @@
2	2	/**
3	3	* Manage sub events
4	4	*
5	5	* @package event-post
6		- * @version 6.0.0
	6	+ * @version 6.1.2
7	7	* @since 4.3
8	8	*/
9	9
10	10	namespace EventPost;
		@@ -53,8 +53,9 @@
53	53	return;
54	54	}
55	55
56	56	add_filter('eventpost_retreive', array(&$this, 'retreive'));
	57	+ add_filter('eventpost_get_items', array(&$this, 'hide_children_of_unpublished'));
57	58	add_filter('eventpost_get_post_types', array(&$this, 'get_post_types'));
58	59	add_filter('eventpost_contentbar', array(&$this, 'display_single'), 3, 2);
59	60
60	61	add_action('eventpost_add_custom_box', array(&$this, 'add_custom_box'));
		@@ -177,9 +178,13 @@
177	178	*
178	179	* @return bool
179	180	*/
180	181	function _delete_child($child_id){
181		- return wp_delete_post( $child_id, true );
	182	+ $child = get_post($child_id);
	183	+ if(!$child || $child->post_type !== $this->POST_TYPE){
	184	+ return false;
	185	+ }
	186	+ return wp_delete_post( $child->ID, true );
182	187	}
183	188
184	189	/**
185	190	* Syncs a child
		@@ -213,17 +218,21 @@
213	218	global $EventPost;
214	219	if(!is_numeric($post_id)){
215	220	return false;
216	221	}
	222	+ $parent = get_post($post_id);
	223	+ if(!$parent || $parent->post_type === $this->POST_TYPE){
	224	+ return false;
	225	+ }
217	226
218	227	$id = wp_insert_post(array(
219	228	'post_type'=>$this->POST_TYPE,
220		- 'post_parent'=>$post_id,
	229	+ 'post_parent'=>$parent->ID,
221	230	'post_status'=>'publish',
222	231	'post_mime_type'=>'text/calendar',
223	232	));
224	233
225		- if(!is_numeric($id)){
	234	+ if(!is_numeric($id) || !$id){
226	235	return false;
227	236	}
228	237	if ($EventPost->settings['children_sync_tax']) {
229	238	$this->_sync_child($id);
		@@ -291,19 +300,43 @@
291	300	*/
292	301	function retreive($event){
293	302	global $EventPost;
294	303	if($event->post_type == $this->POST_TYPE && $event->post_parent){
	304	+ $event->root_ID = $event->post_parent;
	305	+ $parent_status = get_post_status($event->post_parent);
	306	+ if(!$parent_status || !is_post_status_viewable($parent_status)){
	307	+ $event->post_status = $parent_status ? $parent_status : 'private';
	308	+ return $event;
	309	+ }
295	310	$parent = $EventPost->retreive($event->post_parent);
296		- $event->root_ID = $event->post_parent;
297	311	$event->post_title = $parent->post_title;
298	312	$event->permalink = $parent->permalink;
299		- $event->post_content = $parent->post_content;
300		- $event->description = $parent->description;
	313	+ if(empty($parent->post_password)){
	314	+ $event->post_content = $parent->post_content;
	315	+ $event->description = $parent->description;
	316	+ }
301	317	}
302	318	return $event;
303	319	}
304	320
	321	+ /**
	322	+ * Removes from public lists the children whose parent is not publicly readable
	323	+ *
	324	+ * @param array $events
	325	+ *
	326	+ * @return array
	327	+ */
	328	+ function hide_children_of_unpublished($events){
	329	+ if(!is_array($events)){
	330	+ return $events;
	331	+ }
	332	+ $post_type = $this->POST_TYPE;
	333	+ return array_values(array_filter($events, function($event) use ($post_type){
	334	+ return !(is_object($event) && $event->post_type === $post_type && $event->post_status !== 'publish');
	335	+ }));
	336	+ }
305	337
	338	+
306	339	/* -------------------- VIEWS ----------------------- */
307	340
308	341	/**
309	342	* Shows notices
		@@ -308,9 +341,9 @@
308	341	/**
309	342	* Shows notices
310	343	*/
311	344	function notice(){
312		- if(false === $notice = filter_input(INPUT_GET, 'eventpost_child_notice')){
	345	+ if(false == $notice = filter_input(INPUT_GET, 'eventpost_child_notice')){
313	346	return;
314	347	}
315	348	$notices = array(
316	349	'add_failed'=>array('warning', __( 'An error occured while creating a child event...', 'event-post' )),
		@@ -327,24 +360,68 @@
327	360	<?php
328	361	}
329	362
330	363	function check_admin_legitimity(){
331		- if (!wp_verify_nonce(filter_input(INPUT_GET, 'eventpost_children_nonce'), 'eventpost_children_nonce') ){
332		- wp_die(esc_html__('Invalid link', 'event-post'));
	364	+ if (!wp_verify_nonce((string) filter_input(INPUT_GET, 'eventpost_children_nonce'), 'eventpost_children_nonce') ){
	365	+ wp_die(esc_html__('Invalid link', 'event-post'), '', array('response' => 403));
333	366	}
334	367	}
335	368
336	369	/**
	370	+ * Checks that the current user is allowed to add children to a post
	371	+ *
	372	+ * @param int $post_id
	373	+ *
	374	+ * @return bool
	375	+ */
	376	+ function can_add_child($post_id){
	377	+ $post_id = absint($post_id);
	378	+ return $post_id > 0 && get_post($post_id) && current_user_can('edit_post', $post_id);
	379	+ }
	380	+
	381	+ /**
	382	+ * Checks that the current user is allowed to delete a child of a post
	383	+ *
	384	+ * @param int $post_id
	385	+ * @param int $child_id
	386	+ *
	387	+ * @return bool
	388	+ */
	389	+ function can_delete_child($post_id, $child_id){
	390	+ $child = get_post(absint($child_id));
	391	+ return $child
	392	+ && $child->post_type === $this->POST_TYPE
	393	+ && (int) $child->post_parent === absint($post_id)
	394	+ && current_user_can('edit_post', $child->post_parent)
	395	+ && current_user_can('delete_post', $child->ID);
	396	+ }
	397	+
	398	+ /**
	399	+ * Checks nonce for AJAX requests and answers in JSON on failure
	400	+ *
	401	+ * @return void
	402	+ */
	403	+ function check_ajax_legitimity(){
	404	+ if (!check_ajax_referer('eventpost_children_nonce', 'eventpost_children_nonce', false)) {
	405	+ wp_send_json(array('success'=>false, 'message'=>__('Invalid link', 'event-post')), 403);
	406	+ }
	407	+ }
	408	+
	409	+ /**
337	410	* Triggers child add on form submission
338		- *
	411	+ *
339	412	* @return void
340	413	*/
341	414	function add_child_admin_post(){
342	415	$this->check_admin_legitimity();
343	416
344		- if(false === $post_id = filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT)){
	417	+ $post_id = absint(filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT));
	418	+ if(!$post_id){
345	419	wp_die(esc_html__('No post ID given...', 'event-post'));
346	420	}
	421	+ if(!$this->can_add_child($post_id)){
	422	+ wp_die(esc_html__('Sorry, you are not allowed to edit this item.', 'event-post'), '', array('response' => 403));
	423	+ }
347	424
348	425	if(false !== $child_id = $this->_add_child($post_id)){
349	426	wp_redirect(admin_url('post.php?post='.$child_id.'&action=edit&post_type=eventpost'));
350	427	}
		@@ -353,11 +430,17 @@
353	430	}
354	431	exit;
355	432	}
356	433	function add_child_ajax(){
357		- if(false === $post_id = filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT)){
358		- wp_die(__('No post ID given...', 'event-post'));
	434	+ $this->check_ajax_legitimity();
	435	+
	436	+ $post_id = absint(filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT));
	437	+ if(!$post_id){
	438	+ wp_send_json(array('success'=>false, 'message'=>__('No post ID given...', 'event-post')), 400);
359	439	}
	440	+ if(!$this->can_add_child($post_id)){
	441	+ wp_send_json(array('success'=>false, 'message'=>__('Sorry, you are not allowed to edit this item.', 'event-post')), 403);
	442	+ }
360	443
361	444	if(false !== $child_id = $this->_add_child($post_id)){
362	445	wp_send_json(array(
363	446	'success'=>true,
		@@ -374,16 +457,21 @@
374	457	}
375	458
376	459	function delete_child_admin_post(){
377	460	$this->check_admin_legitimity();
378		- if(false === $post_id = filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT)){
	461	+ $post_id = absint(filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT));
	462	+ if(!$post_id){
379	463	wp_die(esc_html__('No post ID given...', 'event-post'));
380	464	}
381		- if(false === $child_id = filter_input(INPUT_GET, 'child_id', FILTER_SANITIZE_NUMBER_INT)){
	465	+ $child_id = absint(filter_input(INPUT_GET, 'child_id', FILTER_SANITIZE_NUMBER_INT));
	466	+ if(!$child_id){
382	467	wp_die(esc_html__('No child ID given...', 'event-post'));
383	468	}
	469	+ if(!$this->can_delete_child($post_id, $child_id)){
	470	+ wp_die(esc_html__('Sorry, you are not allowed to delete this item.', 'event-post'), '', array('response' => 403));
	471	+ }
384	472
385		- if(false !== $this->_delete_child($child_id)){
	473	+ if($this->_delete_child($child_id)){
386	474	wp_redirect(admin_url('post.php?post='.$post_id.'&action=edit&eventpost_child_notice=delete_success'));
387	475	}
388	476	else{
389	477	wp_redirect(admin_url('post.php?post='.$post_id.'&action=edit&eventpost_child_notice=delete_failed'));
		@@ -388,8 +476,30 @@
388	476	else{
389	477	wp_redirect(admin_url('post.php?post='.$post_id.'&action=edit&eventpost_child_notice=delete_failed'));
390	478	}
391	479	exit;
	480	+ }
	481	+
	482	+ /**
	483	+ * Deletes a child event from an AJAX request
	484	+ *
	485	+ * @return void
	486	+ */
	487	+ function delete_child_ajax(){
	488	+ $this->check_ajax_legitimity();
	489	+
	490	+ $post_id = absint(filter_input(INPUT_GET, 'post_id', FILTER_SANITIZE_NUMBER_INT));
	491	+ $child_id = absint(filter_input(INPUT_GET, 'child_id', FILTER_SANITIZE_NUMBER_INT));
	492	+ if(!$post_id || !$child_id){
	493	+ wp_send_json(array('success'=>false, 'message'=>__('No child ID given...', 'event-post')), 400);
	494	+ }
	495	+ if(!$this->can_delete_child($post_id, $child_id)){
	496	+ wp_send_json(array('success'=>false, 'message'=>__('Sorry, you are not allowed to delete this item.', 'event-post')), 403);
	497	+ }
	498	+
	499	+ wp_send_json(array(
	500	+ 'success'=>(bool) $this->_delete_child($child_id),
	501	+ ));
392	502	}
393	503
394	504	/**
395	505	* Settings form