| @@ -169,15 +169,19 @@ | ||
| 169 | 169 | |
| 170 | 170 | /** |
| 171 | 171 | * resetAvatar method will restore a Support Staff avatar |
| 172 | 172 | * For a successful upload it's required to send file object, Support Staff id and the user type(Support Staff) |
| 173 | - * @param Agent $agent | |
| 174 | - * @param $agent_id | |
| 173 | + * | |
| 174 | + * No Agent type-hint here: route-model binding resolves inside the | |
| 175 | + * permission callback, before any policy runs, which lets unauthenticated | |
| 176 | + * callers probe agent ID existence (FS-PERM-001). Resolve after auth. | |
| 177 | + * @param int|string $agent | |
| 175 | 178 | * @return array |
| 176 | 179 | */ |
| 177 | - public function resetAvatar(Agent $agent) | |
| 180 | + public function resetAvatar($agent) | |
| 178 | 181 | { |
| 179 | 182 | try { |
| 183 | + $agent = Agent::findOrFail((int) $agent); | |
| 180 | 184 | $agent->restoreAvatar(); |
| 181 | 185 | |
| 182 | 186 | return [ |
| 183 | 187 | 'message' => __('Support Staff avatar reset to gravatar default', 'fluent-support') |
| @@ -223,9 +227,11 @@ | ||
| 223 | 227 | 'restrictions' => $this->sanitizeRestrictions($request->get('restrictions')), |
| 224 | 228 | ]; |
| 225 | 229 | |
| 226 | 230 | if ($request->has('agent_signature')) { |
| 227 | - $data['agent_signature'] = wp_kses_post(wp_unslash($request->get('agent_signature', ''))); | |
| 231 | + // Already unslashed at the request boundary; sanitize only, so literal | |
| 232 | + // backslashes in the signature survive. | |
| 233 | + $data['agent_signature'] = wp_kses_post($request->get('agent_signature', '')); | |
| 228 | 234 | } |
| 229 | 235 | |
| 230 | 236 | if ($request->has('agent_signature_enabled')) { |
| 231 | 237 | $data['agent_signature_enabled'] = $request->get('agent_signature_enabled') === 'yes' ? 'yes' : 'no'; |
