← All changes | app/Hooks/Handlers/DataExporter.php +7 -3 1.10.0 → 2.4.5 View file →

		@@ -16,9 +16,13 @@
16	16	$request = Helper::FluentSupport('request');
17	17	$from_date = $request->getSafe('from_date', 'sanitize_text_field');
18	18	$to_date = $request->getSafe('to_date', 'sanitize_text_field');
19	19	$columns = $request->get('columns', []);
	20	+ $columns = is_array($columns) ? array_map('sanitize_text_field', $columns) : [];
20	21	$agents = $request->get('agents', []);
	22	+ // Normalize both caller shapes (array or comma-joined string) before agentSummary()'s explode(',', $agent).
	23	+ $agentIds = is_array($agents) ? $agents : explode(',', (string) $agents);
	24	+ $agents = implode(',', array_filter(array_map('intval', $agentIds)));
21	25	if (empty($columns)) {
22	26	$columns = Helper::getExportOptions();
23	27	}
24	28	$columns = $this->defineColumns($columns);
		@@ -86,10 +90,10 @@
86	90	private function verifyRequest()
87	91	{
88	92	$permission = 'fst_view_all_reports';
89	93
90		- if ( ! isset($_REQUEST['_wpnonce']) || ! wp_verify_nonce($_REQUEST['_wpnonce'], 'fluent-support') ) {
91		- wp_die('Security check failed');
	94	+ if ( ! isset($_REQUEST['_wpnonce']) || ! wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['_wpnonce'])), 'fluent-support') ) {
	95	+ wp_die(esc_html__('Security check failed.', 'fluent-support'));
92	96	}
93	97
94	98	if ( PermissionManager::currentUserCan($permission) ) {
95	99	return true;
		@@ -94,8 +98,8 @@
94	98	if ( PermissionManager::currentUserCan($permission) ) {
95	99	return true;
96	100	}
97	101
98		- wp_die('You do not have permission');
	102	+ wp_die(esc_html__('You do not have permission to export this data.', 'fluent-support'));
99	103	}
100	104
101	105	}