| @@ -1,8 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /** |
| 3 | 3 | * @package FireBox |
| 4 | - * @version 3.1.10 Free | |
| 4 | + * @version 3.1.14 Free | |
| 5 | 5 | * |
| 6 | 6 | * @author FirePlugins <[email protected]> |
| 7 | 7 | * @link https://www.fireplugins.com |
| 8 | 8 | * @copyright Copyright © 2026 FirePlugins All Rights Reserved |
| @@ -626,8 +626,17 @@ | ||
| 626 | 626 | $box->ID = ''; |
| 627 | 627 | $box->post_title = 'Copy of ' . $box->post_title; |
| 628 | 628 | $box->post_status = 'draft'; |
| 629 | 629 | |
| 630 | + /** | |
| 631 | + * The copy belongs to whoever duplicates, never the source author — the same | |
| 632 | + * rule the importer applies. The PHP and custom-JavaScript gates are a | |
| 633 | + * function of the post author, so keeping the source author would let a copy | |
| 634 | + * of a higher-privileged user's campaign keep running code its new owner is | |
| 635 | + * not allowed to write. | |
| 636 | + */ | |
| 637 | + $box->post_author = get_current_user_id(); | |
| 638 | + | |
| 630 | 639 | $factory = new \FPFramework\Base\Factory(); |
| 631 | 640 | |
| 632 | 641 | $tz = wp_timezone(); |
| 633 | 642 | $date_without_tz = $factory->getDate(); |
| @@ -661,8 +670,16 @@ | ||
| 661 | 670 | * @return void |
| 662 | 671 | */ |
| 663 | 672 | public static function resetBoxStats($box_ids) |
| 664 | 673 | { |
| 674 | + // These ids are concatenated into raw IN() clauses below, so cast them here rather | |
| 675 | + // than trusting every caller to do it. | |
| 676 | + $box_ids = array_filter(array_map('intval', (array) $box_ids)); | |
| 677 | + if (empty($box_ids)) | |
| 678 | + { | |
| 679 | + return; | |
| 680 | + } | |
| 681 | + | |
| 665 | 682 | $logs_table = firebox()->tables->boxlog->getFullTableName(); |
| 666 | 683 | $logs_details_table = firebox()->tables->boxlogdetails->getFullTableName(); |
| 667 | 684 | |
| 668 | 685 | // delete box logs details |
