← All changes | app/Hooks/Handlers/DataImporter.php +23 -3 1.10.01 → 2.5.0 View file →

		@@ -9,10 +9,16 @@
9	9	class DataImporter
10	10	{
11	11	public function importCalendar()
12	12	{
13		- if (!PermissionManager::userCan(['invite_team_members', 'manage_other_calendars'])) {
	13	+ if (!$this->verifyNonce()) {
14	14	wp_send_json_error([
	15	+ 'message' => __('Security check failed. Please refresh and try again.', 'fluent-booking'),
	16	+ ]);
	17	+ }
	18	+
	19	+ if (!PermissionManager::userCan(['manage_all_data', 'manage_other_calendars'])) {
	20	+ wp_send_json_error([
15	21	'message' => __('You are not authorized to import calendar', 'fluent-booking'),
16	22	]);
17	23	}
18	24
		@@ -19,9 +25,9 @@
19	25	$app = App::getInstance();
20	26
21	27	$data = $app->request->all();
22	28
23		- if (empty($data['type'] || empty($data['user_id'] || empty($data['author_timezone'])))) {
	29	+ if (empty($data['type']) || empty($data['user_id']) || empty($data['author_timezone'])) {
24	30	wp_send_json_error([
25	31	'message' => __('Please provide all required data', 'fluent-booking'),
26	32	]);
27	33	}
		@@ -43,10 +49,12 @@
43	49	'message' => __('Invalid file. Please provide a valid JSON file', 'fluent-booking'),
44	50	]);
45	51	}
46	52
47		- $calendar = CalendarService::createCalendar($calendarData, false, true);
	53	+ $useCurrentUser = !PermissionManager::userCan('manage_all_data');
48	54
	55	+ $calendar = CalendarService::createCalendar($calendarData, $useCurrentUser, true);
	56	+
49	57	if (is_wp_error($calendar)) {
50	58	wp_send_json_error([
51	59	'message' => $calendar->get_error_message(),
52	60	]);
		@@ -55,6 +63,18 @@
55	63	wp_send_json([
56	64	'success' => true,
57	65	'message' => __('Calendar imported successfully', 'fluent-booking'),
58	66	]);
	67	+ }
	68	+
	69	+ /**
	70	+ * Verify the request nonce for AJAX actions.
	71	+ *
	72	+ * @return bool
	73	+ */
	74	+ private function verifyNonce()
	75	+ {
	76	+ $nonce = isset($_REQUEST['nonce']) ? sanitize_text_field(wp_unslash($_REQUEST['nonce'])) : '';
	77	+
	78	+ return !empty($nonce) && wp_verify_nonce($nonce, 'fluent-booking');
59	79	}
60	80	}