| @@ -2,9 +2,9 @@ | ||
| 2 | 2 | /** |
| 3 | 3 | * Plugin Name: Event Post |
| 4 | 4 | * Plugin URI: https://event-post.com?mtm_campaign=wp-plugin&mtm_kwd=event-post&mtm_medium=dashboard&mtm_source=plugin-uri |
| 5 | 5 | * Description: Add calendar and/or geolocation metadata on any posts. |
| 6 | - * Version: 6.0.1 | |
| 6 | + * Version: 6.1.2 | |
| 7 | 7 | * Author: N.O.U.S. Open Useful and Simple |
| 8 | 8 | * Contributors: bastho, sabrinaleroy, unecologeek, agencenous |
| 9 | 9 | * Author URI: https://apps.avecnous.eu/?mtm_campaign=wp-plugin&mtm_kwd=event-post&mtm_medium=dashboard&mtm_source=author |
| 10 | 10 | * License: GPLv2 |
| @@ -43,12 +43,15 @@ | ||
| 43 | 43 | */ |
| 44 | 44 | class EventPost { |
| 45 | 45 | /** |
| 46 | 46 | * The current version |
| 47 | - * | |
| 48 | - * @var array | |
| 47 | + * | |
| 48 | + * Must be kept in sync with the `Version:` plugin header above: `bin/bump` | |
| 49 | + * only rewrites header-style declarations, not this literal. | |
| 50 | + * | |
| 51 | + * @var string | |
| 49 | 52 | */ |
| 50 | - public $version = '5.9.2'; | |
| 53 | + public $version = '6.1.2'; | |
| 51 | 54 | |
| 52 | 55 | // -------------------------------------------------------------------------------- |
| 53 | 56 | // Post metas |
| 54 | 57 | |
| @@ -1521,10 +1524,10 @@ | ||
| 1521 | 1524 | $datas_cat = $this->print_categories($post, $context); |
| 1522 | 1525 | $datas_loc = $this->print_location($post, $context); |
| 1523 | 1526 | $classes = array( |
| 1524 | 1527 | 'event_data', |
| 1525 | - 'status-'.strtolower(str_replace('Event', '', $event->status)), | |
| 1526 | - 'location-type-'.strtolower(str_replace('EventAttendanceMode', '', $event->attendance_mode)), | |
| 1528 | + 'status-'.strtolower(str_replace('Event', '', $post->status)), | |
| 1529 | + 'location-type-'.strtolower(str_replace('EventAttendanceMode', '', $post->attendance_mode)), | |
| 1527 | 1530 | $class |
| 1528 | 1531 | ); |
| 1529 | 1532 | if ($datas_date != '' || $datas_loc != '') { |
| 1530 | 1533 | $rgb = $this->hex2dec($post->color); |
| @@ -1684,8 +1687,11 @@ | ||
| 1684 | 1687 | public function list_events($atts, $id = 'event_list', $context='') { |
| 1685 | 1688 | $ep_settings = $this->settings; |
| 1686 | 1689 | $defaults = array( |
| 1687 | 1690 | 'nb' => 0, |
| 1691 | + 'nb_desktop' => 0, | |
| 1692 | + 'nb_tablet' => 0, | |
| 1693 | + 'nb_mobile' => 0, | |
| 1688 | 1694 | 'type' => 'div', |
| 1689 | 1695 | 'future' => true, |
| 1690 | 1696 | 'past' => false, |
| 1691 | 1697 | 'geo' => 0, |
| @@ -1728,9 +1734,9 @@ | ||
| 1728 | 1734 | $defaults[$int_key]=true; |
| 1729 | 1735 | } |
| 1730 | 1736 | $atts_old_nb = $defaults['nb']; |
| 1731 | 1737 | if($id == "event_timeline"){ |
| 1732 | - $atts_old_nb = $atts['nb']; | |
| 1738 | + $atts_old_nb = intval($atts['nb']); | |
| 1733 | 1739 | $atts['nb'] = -1; |
| 1734 | 1740 | } |
| 1735 | 1741 | |
| 1736 | 1742 | $atts = shortcode_atts(apply_filters('eventpost_params', $defaults, 'list_events', $context), $atts); |
| @@ -1743,9 +1749,9 @@ | ||
| 1743 | 1749 | $ret = ''; |
| 1744 | 1750 | $this->list_id++; |
| 1745 | 1751 | if (sizeof($events) > 0) { |
| 1746 | 1752 | if (!empty($title)) { |
| 1747 | - $ret .= esc_html($before_title) . esc_html($title) . esc_html($after_title); | |
| 1753 | + $ret .= wp_kses_post($before_title . esc_html($title) . $after_title); | |
| 1748 | 1754 | } |
| 1749 | 1755 | |
| 1750 | 1756 | $type = in_array($type, ['div', 'ul', 'ol']) ? $type : 'div'; |
| 1751 | 1757 | $child = in_array($type, ['ul', 'ol']) ? 'li' : 'div'; |
| @@ -1765,9 +1771,13 @@ | ||
| 1765 | 1771 | $next_arrow = '<div class="next"><span class="screen-reader-text">'.__('Next Events »', 'event-post')."</span></div>"; |
| 1766 | 1772 | if($atts_old_nb != 0){ |
| 1767 | 1773 | $item_child_style = 'width : '.((100/$atts_old_nb) - 2).'%;'; |
| 1768 | 1774 | } |
| 1769 | - $attributes .= ' data-nb="'.$atts_old_nb.'" data-filter="'.http_build_query($atts).'" '; | |
| 1775 | + $attributes .= ' data-nb="'.$atts_old_nb.'"'; | |
| 1776 | + $attributes .= ' data-nb-desktop="'.intval($atts['nb_desktop'] ?? 0).'"'; | |
| 1777 | + $attributes .= ' data-nb-tablet="'.intval($atts['nb_tablet'] ?? 0).'"'; | |
| 1778 | + $attributes .= ' data-nb-mobile="'.intval($atts['nb_mobile'] ?? 0).'"'; | |
| 1779 | + $attributes .= ' data-filter="'.http_build_query($atts).'" '; | |
| 1770 | 1780 | } |
| 1771 | 1781 | |
| 1772 | 1782 | if($id === 'event_timeline'){ |
| 1773 | 1783 | $previous_year = $atts['separate_years'] ? true : false; |
| @@ -1774,16 +1784,18 @@ | ||
| 1774 | 1784 | $previous_month = $atts['separate_months'] ? true : false; |
| 1775 | 1785 | } |
| 1776 | 1786 | |
| 1777 | 1787 | foreach ($events as $event) { |
| 1778 | - if($previous_year && $previous_year !== date('Y', $event->time_start)){ | |
| 1779 | - $html.= '<div class="event-timeline-separator event-timeline-year"><span class="event-timeline-year-text">'.date_i18n('Y', $event->time_start).'</span></div>'; | |
| 1780 | - $previous_year = date('Y', $event->time_start); | |
| 1788 | + if($id === 'event_timeline'){ | |
| 1789 | + if($previous_year && $previous_year !== date('Y', $event->time_start)){ | |
| 1790 | + $html.= '<div class="event-timeline-separator event-timeline-year"><span class="event-timeline-year-text">'.date_i18n('Y', $event->time_start).'</span></div>'; | |
| 1791 | + $previous_year = date('Y', $event->time_start); | |
| 1792 | + } | |
| 1793 | + if($previous_month && $previous_month !== date('Ym', $event->time_start)){ | |
| 1794 | + $html.= '<div class="event-timeline-separator event-timeline-month"><span class="event-timeline-month-text">'.date_i18n('F', $event->time_start).'</span>'.($previous_year ? '' : ' <span class="event-timeline-year-text">'.date_i18n('Y', $event->time_start).'</span>').'</div>'; | |
| 1795 | + $previous_month = date('Ym', $event->time_start); | |
| 1796 | + } | |
| 1781 | 1797 | } |
| 1782 | - if($previous_month && $previous_month !== date('Ym', $event->time_start)){ | |
| 1783 | - $html.= '<div class="event-timeline-separator event-timeline-month"><span class="event-timeline-month-text">'.date_i18n('F', $event->time_start).'</span>'.($previous_year ? '' : ' <span class="event-timeline-year-text">'.date_i18n('Y', $event->time_start).'</span>').'</div>'; | |
| 1784 | - $previous_month = date('Ym', $event->time_start); | |
| 1785 | - } | |
| 1786 | 1798 | $text_price = $this->get_price($event,true); |
| 1787 | 1799 | $class_item = array( |
| 1788 | 1800 | $this->is_future($event) ? 'event_future' : 'event_past', |
| 1789 | 1801 | 'status-'.strtolower(str_replace('Event', '', $event->status)), |
| @@ -1880,9 +1892,9 @@ | ||
| 1880 | 1892 | ]; |
| 1881 | 1893 | if(!empty($align)){ |
| 1882 | 1894 | $classes[] = 'align'.esc_attr($align); |
| 1883 | 1895 | } |
| 1884 | - if($previous_year || $previous_month){ | |
| 1896 | + if($id === 'event_timeline' && ($previous_year || $previous_month)){ | |
| 1885 | 1897 | $classes[] = 'has-time-separators'; |
| 1886 | 1898 | } |
| 1887 | 1899 | $ret.=str_replace( |
| 1888 | 1900 | array( |
| @@ -2490,9 +2502,9 @@ | ||
| 2490 | 2502 | * |
| 2491 | 2503 | * @return void |
| 2492 | 2504 | */ |
| 2493 | 2505 | function inline_save(){ |
| 2494 | - $post_id = filter_input(INPUT_POST, 'post_ID', FILTER_SANITIZE_NUMBER_INT); | |
| 2506 | + $post_id = absint(filter_input(INPUT_POST, 'post_ID', FILTER_SANITIZE_NUMBER_INT)); | |
| 2495 | 2507 | $this->save_postdata($post_id); |
| 2496 | 2508 | } |
| 2497 | 2509 | /** |
| 2498 | 2510 | * When the post is saved, saves our custom data |
| @@ -2505,12 +2517,17 @@ | ||
| 2505 | 2517 | if (defined('DOING_AUTOSAVE') && DOING_AUTOSAVE){ |
| 2506 | 2518 | return; |
| 2507 | 2519 | } |
| 2508 | 2520 | |
| 2509 | - if (!wp_verify_nonce(filter_input(INPUT_POST, 'eventpost_nonce'), plugin_basename(__FILE__))){ | |
| 2521 | + if (!wp_verify_nonce((string) filter_input(INPUT_POST, 'eventpost_nonce'), plugin_basename(__FILE__))){ | |
| 2510 | 2522 | return; |
| 2511 | 2523 | } |
| 2512 | 2524 | |
| 2525 | + $post_id = absint($post_id); | |
| 2526 | + if (!$post_id || !current_user_can('edit_post', $post_id)) { | |
| 2527 | + return; | |
| 2528 | + } | |
| 2529 | + | |
| 2513 | 2530 | // Clean color or no color |
| 2514 | 2531 | if (false !== $color = filter_input(INPUT_POST, $this->META_COLOR)) { |
| 2515 | 2532 | update_post_meta($post_id, $this->META_COLOR, sanitize_text_field($color)); |
| 2516 | 2533 | } |
| @@ -2728,12 +2745,12 @@ | ||
| 2728 | 2745 | $ret.=$annee; |
| 2729 | 2746 | // Translators: %s is the year |
| 2730 | 2747 | $ret.='</span><button data-date="' . date('Y-n', $next_year) . '" title="'.sprintf(__('Switch to %s', 'event-post'), date('Y', $next_year)).'" class="eventpost_cal_bt eventpost-cal-bt-next">»</button></span>'; |
| 2731 | 2748 | // Translators: %s is the month name |
| 2732 | - $ret.='<span class="eventpost-cal-month"><button data-date="' . date('Y-n', $prev_month) . '" title="'.sprintf(__('Switch to %s', 'event-post'), date_i18n('F Y', $prev_month)).'" class="eventpost_cal_bt eventpost-cal-bt-prev">«</button><span class="eventpost-cal-header-text">'; | |
| 2749 | + $ret.='<span class="eventpost-cal-month"><button data-date="' . date('Y-n', $prev_month) . '" title="'.sprintf(__('Switch to %s', 'event-post'), date_i18n('F Y', $prev_month)).'" class="eventpost_cal_bt eventpost-cal-bt-prev eventpost-cal-bt-prev-month">«</button><span class="eventpost-cal-header-text">'; | |
| 2733 | 2750 | $ret.=$this->NomDuMois[abs($mois)]; |
| 2734 | 2751 | // Translators: %s is the month name |
| 2735 | - $ret.='</span><button data-date="' . date('Y-n', $next_month) . '" title="'.sprintf(__('Switch to %s', 'event-post'), date_i18n('F Y', $next_month)).'" class="eventpost_cal_bt eventpost-cal-bt-next">»</button> </span>'; | |
| 2752 | + $ret.='</span><button data-date="' . date('Y-n', $next_month) . '" title="'.sprintf(__('Switch to %s', 'event-post'), date_i18n('F Y', $next_month)).'" class="eventpost_cal_bt eventpost-cal-bt-next eventpost-cal-bt-next-month">»</button> </span>'; | |
| 2736 | 2753 | $ret.='<span class="eventpost-cal-today"><button data-date="' . date('Y-n') . '" class="eventpost_cal_bt">' . __('Today', 'event-post') . '</button></span>'; |
| 2737 | 2754 | $ret.='</div>'; |
| 2738 | 2755 | } |
| 2739 | 2756 | $ret.='</th></tr><tr class="event_post_cal_days">'; |
| @@ -3197,13 +3214,16 @@ | ||
| 3197 | 3214 | if (in_array($format, $allowed_formats)) { |
| 3198 | 3215 | $export_file = plugin_dir_path(__FILE__) . 'inc/export/' . $format . '.php'; |
| 3199 | 3216 | if (is_numeric($event_id) && file_exists($export_file)) { |
| 3200 | 3217 | $event = $this->retreive($event_id); |
| 3218 | + if($event->post_status != 'publish'){ | |
| 3219 | + wp_die(esc_html__('Event not found.', 'event-post'), 404); | |
| 3220 | + } | |
| 3201 | 3221 | include $export_file; |
| 3202 | 3222 | exit; |
| 3203 | 3223 | } |
| 3204 | 3224 | } |
| 3205 | - wp_die(esc_html__('Invalid request.', 'event-post')); | |
| 3225 | + wp_die(esc_html__('Invalid request.', 'event-post'), 400); | |
| 3206 | 3226 | } |
| 3207 | 3227 | |
| 3208 | 3228 | |
| 3209 | 3229 | public function parse_request(){ |
