← All changes | includes/classes/Ajax.php +63 -4 1.2.5 → trunk View file →

		@@ -1,6 +1,8 @@
1	1	<?php
2	2	namespace EverCompare;
	3	+
	4	+defined( 'ABSPATH' ) || exit;
3	5	/**
4	6	* Ajax handlers class
5	7	*/
6	8	class Ajax {
		@@ -34,8 +36,16 @@
34	36	// Remove Ajax Callback
35	37	add_action( 'wp_ajax_ever_compare_remove_from_compare', [ $this, 'remove_from_compare' ] );
36	38	add_action( 'wp_ajax_nopriv_ever_compare_remove_from_compare', [ $this,'remove_from_compare' ] );
37	39
	40	+ // Get Nonce endpoint (no nonce verification needed)
	41	+ add_action( 'wp_ajax_ever_compare_get_nonce', [ $this, 'get_nonce' ] );
	42	+ add_action( 'wp_ajax_nopriv_ever_compare_get_nonce', [ $this, 'get_nonce' ] );
	43	+
	44	+ // Get Table endpoint
	45	+ add_action( 'wp_ajax_ever_compare_get_table', [ $this, 'get_table' ] );
	46	+ add_action( 'wp_ajax_nopriv_ever_compare_get_table', [ $this, 'get_table' ] );
	47	+
38	48	}
39	49
40	50	/**
41	51	* [add_to_compare] Product add ajax callback
		@@ -40,10 +50,13 @@
40	50	/**
41	51	* [add_to_compare] Product add ajax callback
42	52	*/
43	53	public function add_to_compare(){
44		- $id = sanitize_text_field( $_GET['id'] );
45		- \EverCompare\Frontend\Manage_Compare::instance()->add_to_compare( $id );
	54	+ check_ajax_referer('ever_compare_nonce', 'nonce');
	55	+ if(!empty($_GET['id'])) {
	56	+ $id = absint( $_GET['id'] );
	57	+ \EverCompare\Frontend\Manage_Compare::instance()->add_to_compare( $id );
	58	+ }
46	59	}
47	60
48	61	/**
49	62	* [remove_from_compare] Product delete ajax callback
		@@ -49,9 +62,55 @@
49	62	* [remove_from_compare] Product delete ajax callback
50	63	* @return [void]
51	64	*/
52	65	public function remove_from_compare(){
53		- $id = sanitize_text_field( $_GET['id'] );
54		- \EverCompare\Frontend\Manage_Compare::instance()->remove_from_compare( $id );
	66	+ check_ajax_referer('ever_compare_nonce', 'nonce');
	67	+ if(!empty($_GET['id'])) {
	68	+ $id = absint( $_GET['id'] );
	69	+ \EverCompare\Frontend\Manage_Compare::instance()->remove_from_compare( $id );
	70	+ }
	71	+ }
	72	+
	73	+ /**
	74	+ * [get_nonce] Return a fresh nonce for AJAX operations
	75	+ * @return [void]
	76	+ */
	77	+ public function get_nonce(){
	78	+ wp_send_json( array(
	79	+ 'nonce' => wp_create_nonce( 'ever_compare_nonce' ),
	80	+ ) );
	81	+ }
	82	+
	83	+ /**
	84	+ * [get_table] Return compare table HTML for given product IDs
	85	+ * @return [void]
	86	+ */
	87	+ public function get_table(){
	88	+ $ids = array();
	89	+ if ( ! empty( $_GET['ids'] ) ) {
	90	+ $raw_ids = sanitize_text_field( wp_unslash( $_GET['ids'] ) );
	91	+ $ids = array_filter( array_map( 'absint', explode( ',', $raw_ids ) ) );
	92	+ $ids = array_slice( $ids, 0, \EverCompare\Frontend\Manage_Compare::instance()->max_limit );
	93	+ }
	94	+
	95	+ if ( empty( $ids ) ) {
	96	+ wp_send_json( array(
	97	+ 'table' => '',
	98	+ 'count' => 0,
	99	+ ) );
	100	+ }
	101	+
	102	+ $cookie_name = \EverCompare\Frontend\Manage_Compare::instance()->get_cookie_name();
	103	+ $_COOKIE[ $cookie_name ] = wp_json_encode( $ids );
	104	+
	105	+ ob_start();
	106	+ \EverCompare\Frontend\Manage_Compare::instance()->get_response_html();
	107	+ $table_html = ob_get_clean();
	108	+
	109	+ wp_send_json( array(
	110	+ 'table' => $table_html,
	111	+ 'count' => count( $ids ),
	112	+ 'products' => $ids,
	113	+ ) );
55	114	}
56	115
57	116	}