| @@ -169,19 +169,15 @@ | ||
| 169 | 169 | |
| 170 | 170 | /** |
| 171 | 171 | * resetAvatar method will restore a Support Staff avatar |
| 172 | 172 | * For a successful upload it's required to send file object, Support Staff id and the user type(Support Staff) |
| 173 | - * | |
| 174 | - * No Agent type-hint here: route-model binding resolves inside the | |
| 175 | - * permission callback, before any policy runs, which lets unauthenticated | |
| 176 | - * callers probe agent ID existence (FS-PERM-001). Resolve after auth. | |
| 177 | - * @param int|string $agent | |
| 173 | + * @param Agent $agent | |
| 174 | + * @param $agent_id | |
| 178 | 175 | * @return array |
| 179 | 176 | */ |
| 180 | - public function resetAvatar($agent) | |
| 177 | + public function resetAvatar(Agent $agent) | |
| 181 | 178 | { |
| 182 | 179 | try { |
| 183 | - $agent = Agent::findOrFail((int) $agent); | |
| 184 | 180 | $agent->restoreAvatar(); |
| 185 | 181 | |
| 186 | 182 | return [ |
| 187 | 183 | 'message' => __('Support Staff avatar reset to gravatar default', 'fluent-support') |
| @@ -227,11 +223,9 @@ | ||
| 227 | 223 | 'restrictions' => $this->sanitizeRestrictions($request->get('restrictions')), |
| 228 | 224 | ]; |
| 229 | 225 | |
| 230 | 226 | if ($request->has('agent_signature')) { |
| 231 | - // Already unslashed at the request boundary; sanitize only, so literal | |
| 232 | - // backslashes in the signature survive. | |
| 233 | - $data['agent_signature'] = wp_kses_post($request->get('agent_signature', '')); | |
| 227 | + $data['agent_signature'] = wp_kses_post(wp_unslash($request->get('agent_signature', ''))); | |
| 234 | 228 | } |
| 235 | 229 | |
| 236 | 230 | if ($request->has('agent_signature_enabled')) { |
| 237 | 231 | $data['agent_signature_enabled'] = $request->get('agent_signature_enabled') === 'yes' ? 'yes' : 'no'; |
