| @@ -2,9 +2,9 @@ | ||
| 2 | 2 | /** |
| 3 | 3 | * Plugin Name: Event Post |
| 4 | 4 | * Plugin URI: https://event-post.com?mtm_campaign=wp-plugin&mtm_kwd=event-post&mtm_medium=dashboard&mtm_source=plugin-uri |
| 5 | 5 | * Description: Add calendar and/or geolocation metadata on any posts. |
| 6 | - * Version: 6.1.1 | |
| 6 | + * Version: 6.1.2 | |
| 7 | 7 | * Author: N.O.U.S. Open Useful and Simple |
| 8 | 8 | * Contributors: bastho, sabrinaleroy, unecologeek, agencenous |
| 9 | 9 | * Author URI: https://apps.avecnous.eu/?mtm_campaign=wp-plugin&mtm_kwd=event-post&mtm_medium=dashboard&mtm_source=author |
| 10 | 10 | * License: GPLv2 |
| @@ -43,12 +43,15 @@ | ||
| 43 | 43 | */ |
| 44 | 44 | class EventPost { |
| 45 | 45 | /** |
| 46 | 46 | * The current version |
| 47 | - * | |
| 48 | - * @var array | |
| 47 | + * | |
| 48 | + * Must be kept in sync with the `Version:` plugin header above: `bin/bump` | |
| 49 | + * only rewrites header-style declarations, not this literal. | |
| 50 | + * | |
| 51 | + * @var string | |
| 49 | 52 | */ |
| 50 | - public $version = '5.9.2'; | |
| 53 | + public $version = '6.1.2'; | |
| 51 | 54 | |
| 52 | 55 | // -------------------------------------------------------------------------------- |
| 53 | 56 | // Post metas |
| 54 | 57 | |
| @@ -2499,9 +2502,9 @@ | ||
| 2499 | 2502 | * |
| 2500 | 2503 | * @return void |
| 2501 | 2504 | */ |
| 2502 | 2505 | function inline_save(){ |
| 2503 | - $post_id = filter_input(INPUT_POST, 'post_ID', FILTER_SANITIZE_NUMBER_INT); | |
| 2506 | + $post_id = absint(filter_input(INPUT_POST, 'post_ID', FILTER_SANITIZE_NUMBER_INT)); | |
| 2504 | 2507 | $this->save_postdata($post_id); |
| 2505 | 2508 | } |
| 2506 | 2509 | /** |
| 2507 | 2510 | * When the post is saved, saves our custom data |
| @@ -2514,9 +2517,14 @@ | ||
| 2514 | 2517 | if (defined('DOING_AUTOSAVE') && DOING_AUTOSAVE){ |
| 2515 | 2518 | return; |
| 2516 | 2519 | } |
| 2517 | 2520 | |
| 2518 | - if (!wp_verify_nonce(filter_input(INPUT_POST, 'eventpost_nonce'), plugin_basename(__FILE__))){ | |
| 2521 | + if (!wp_verify_nonce((string) filter_input(INPUT_POST, 'eventpost_nonce'), plugin_basename(__FILE__))){ | |
| 2522 | + return; | |
| 2523 | + } | |
| 2524 | + | |
| 2525 | + $post_id = absint($post_id); | |
| 2526 | + if (!$post_id || !current_user_can('edit_post', $post_id)) { | |
| 2519 | 2527 | return; |
| 2520 | 2528 | } |
| 2521 | 2529 | |
| 2522 | 2530 | // Clean color or no color |
