← All changes
|
app/Services/Integrations/Elementor/ElementorIntegration.php
+21
-13
1.7.0
→
2.5.0
View file →
| @@ -19,12 +19,10 @@ | ||
| 19 | 19 | add_action('elementor/editor/before_enqueue_scripts', [$this, 'editorScripts']); |
| 20 | 20 | add_action('elementor/editor/after_enqueue_scripts', [$this, 'editorScripts']); |
| 21 | 21 | |
| 22 | 22 | add_action('wp_ajax_get_calendar_events', [$this, 'ajaxGetCalendarEvents']); |
| 23 | - add_action('wp_ajax_nopriv_get_calendar_events', [$this, 'ajaxGetCalendarEvents']); | |
| 24 | 23 | |
| 25 | 24 | add_action('wp_ajax_get_event_hash', [$this, 'ajaxGetEventHash']); |
| 26 | - add_action('wp_ajax_nopriv_get_event_hash', [$this, 'ajaxGetEventHash']); | |
| 27 | 25 | } |
| 28 | 26 | |
| 29 | 27 | public function editorScripts() |
| 30 | 28 | { |
| @@ -63,9 +61,9 @@ | ||
| 63 | 61 | |
| 64 | 62 | public function addElementorCategory() |
| 65 | 63 | { |
| 66 | 64 | \Elementor\Plugin::instance()->elements_manager->add_category('fluentbooking', [ |
| 67 | - 'title' => __('FluentBooking', 'fluent-booking-pro'), | |
| 65 | + 'title' => __('FluentBooking', 'fluent-booking'), | |
| 68 | 66 | ], 1); |
| 69 | 67 | } |
| 70 | 68 | |
| 71 | 69 | /** |
| @@ -96,21 +94,25 @@ | ||
| 96 | 94 | $this->registerFluentBookingCustomGroupSelect($controls_manager); |
| 97 | 95 | } |
| 98 | 96 | |
| 99 | 97 | public function ajaxGetCalendarEvents() { |
| 100 | - if (!isset($_POST['security']) || !wp_verify_nonce($_POST['security'], 'calendar_events_nonce')) { | |
| 101 | - wp_send_json_error(['message' => __('Nonce verification failed', 'fluent-booking-pro')]); | |
| 98 | + if (!isset($_POST['security']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['security'])), 'calendar_events_nonce')) { | |
| 99 | + wp_send_json_error(['message' => __('Nonce verification failed', 'fluent-booking')]); | |
| 102 | 100 | exit; |
| 103 | 101 | } |
| 104 | 102 | |
| 103 | + if (!current_user_can('edit_posts')) { | |
| 104 | + wp_send_json_error(['message' => __('You do not have permission to perform this action', 'fluent-booking')]); | |
| 105 | + exit; | |
| 106 | + } | |
| 107 | + | |
| 105 | 108 | if (!isset($_POST['cal_id'])) { |
| 106 | - wp_send_json_error(['message' => __('No calendar ID provided', 'fluent-booking-pro')]); | |
| 109 | + wp_send_json_error(['message' => __('No calendar ID provided', 'fluent-booking')]); | |
| 107 | 110 | } |
| 108 | 111 | |
| 109 | 112 | $calId = intval($_POST['cal_id']); |
| 110 | - $events = []; // Fetch events using your getCalendarEvents method or similar | |
| 113 | + $events = []; | |
| 111 | 114 | |
| 112 | - // Example of fetching events (you need to replace this with your actual method) | |
| 113 | 115 | $events = $this->getCalendarEvents($calId); |
| 114 | 116 | |
| 115 | 117 | wp_send_json_success($events); |
| 116 | 118 | } |
| @@ -115,19 +117,24 @@ | ||
| 115 | 117 | wp_send_json_success($events); |
| 116 | 118 | } |
| 117 | 119 | |
| 118 | 120 | public function ajaxGetEventHash() { |
| 119 | - if (!isset($_POST['security']) || !wp_verify_nonce($_POST['security'], 'calendar_events_nonce')) { | |
| 120 | - wp_send_json_error(['message' => __('Nonce verification failed', 'fluent-booking-pro')]); | |
| 121 | + if (!isset($_POST['security']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['security'])), 'calendar_events_nonce')) { | |
| 122 | + wp_send_json_error(['message' => __('Nonce verification failed', 'fluent-booking')]); | |
| 121 | 123 | exit; |
| 122 | 124 | } |
| 123 | 125 | |
| 124 | - $eventId = intval($_POST['event_id']); | |
| 126 | + if (!current_user_can('edit_posts')) { | |
| 127 | + wp_send_json_error(['message' => __('You do not have permission to perform this action', 'fluent-booking')]); | |
| 128 | + exit; | |
| 129 | + } | |
| 125 | 130 | |
| 131 | + $eventId = isset($_POST['event_id']) ? intval($_POST['event_id']) : null; | |
| 132 | + | |
| 126 | 133 | $event = CalendarSlot::find($eventId); |
| 127 | 134 | |
| 128 | 135 | if (!$event) { |
| 129 | - wp_send_json_error(['message' => __('Event not found', 'fluent-booking-pro')]); | |
| 136 | + wp_send_json_error(['message' => __('Event not found', 'fluent-booking')]); | |
| 130 | 137 | exit; |
| 131 | 138 | } |
| 132 | 139 | |
| 133 | 140 | $eventHash = $event->hash; |
| @@ -150,9 +157,10 @@ | ||
| 150 | 157 | $filePath = __DIR__ . $relativePath; |
| 151 | 158 | if (file_exists($filePath)) { |
| 152 | 159 | require_once($filePath); |
| 153 | 160 | } else { |
| 154 | - throw new \Exception(sprintf(__("File not found: %s", "fluent-booking-pro"), $filePath)); | |
| 161 | + /* translators: %s: File path */ | |
| 162 | + throw new \Exception(esc_html(sprintf(__('File not found: %s', 'fluent-booking'), $filePath))); | |
| 155 | 163 | } |
| 156 | 164 | } |
| 157 | 165 | |
| 158 | 166 | private function registerFluentBookingCustomGroupSelect($controls_manager) |