← All changes
|
includes/widgets/Form_Builder/helpers/View_Submissions_Pro.php
+154
-72
51.1.14
→
51.1.87
View file →
| @@ -55,9 +55,9 @@ | ||
| 55 | 55 | </p> |
| 56 | 56 | <?php if (!king_addons_freemius()->can_use_premium_code__premium_only()): ?> |
| 57 | 57 | <div class="king-addons-pb-preview-buttons"> |
| 58 | 58 | <div class="kng-promo-btn-wrap"> |
| 59 | - <a href="https://kingaddons.com/pricing/?rel=king-addons-fb-submissions-page" target="_blank"> | |
| 59 | + <a href="https://kingaddons.com/pricing/?utm_source=king-addons-fb-submissions-page" target="_blank"> | |
| 60 | 60 | <div class="kng-promo-btn-txt"> |
| 61 | 61 | <?php esc_html_e('Unlock Premium Features & 650+ Templates Today!', 'king-addons'); ?> |
| 62 | 62 | </div> |
| 63 | 63 | <img width="16px" |
| @@ -81,8 +81,9 @@ | ||
| 81 | 81 | global $post; |
| 82 | 82 | |
| 83 | 83 | |
| 84 | 84 | if (isset($post) && $post->post_type === $post_type) { |
| 85 | + $form_page_id = absint(get_post_meta($post->ID, 'king_addons_form_page_id', true)); | |
| 85 | 86 | |
| 86 | 87 | // Check if Pro constants are defined before using them |
| 87 | 88 | if (defined('KING_ADDONS_PRO_URL') && defined('KING_ADDONS_PRO_VERSION')) { |
| 88 | 89 | wp_enqueue_style('king-addons-form-builder-submissions-css', KING_ADDONS_PRO_URL . 'assets/css/king-addons-submissions.css', [], KING_ADDONS_VERSION); |
| @@ -95,19 +96,19 @@ | ||
| 95 | 96 | wp_localize_script( |
| 96 | 97 | 'king-addons-form-builder-submissions-js', |
| 97 | 98 | 'KingAddonsSubmissions', |
| 98 | 99 | [ |
| 99 | - 'ajaxurl' => admin_url('admin-ajax.php'), | |
| 100 | - 'resturl' => get_rest_url() . 'king-addons/v1', | |
| 100 | + 'ajaxurl' => esc_url_raw(admin_url('admin-ajax.php')), | |
| 101 | + 'resturl' => esc_url_raw(get_rest_url() . 'king-addons/v1'), | |
| 101 | 102 | 'nonce' => wp_create_nonce('king-addons-submissions-js'), |
| 102 | - 'form_name' => get_post_meta($post->ID, 'king_addons_form_name', true), | |
| 103 | - 'form_id' => get_post_meta($post->ID, 'king_addons_form_id', true), | |
| 104 | - 'form_page' => get_post_meta($post->ID, 'king_addons_form_page', true), | |
| 105 | - 'form_page_id' => get_post_meta($post->ID, 'king_addons_form_page_id', true), | |
| 106 | - 'form_page_url' => get_permalink(get_post_meta($post->ID, 'king_addons_form_page_id', true)), | |
| 107 | - 'form_page_editor' => admin_url('post.php?post=' . get_post_meta($post->ID, 'king_addons_form_page_id', true) . '&action=elementor'), | |
| 108 | - 'form_agent' => get_post_meta($post->ID, 'king_addons_user_agent', true), | |
| 109 | - 'agent_ip' => get_post_meta($post->ID, 'king_addons_user_ip', true), | |
| 103 | + 'form_name' => sanitize_text_field(get_post_meta($post->ID, 'king_addons_form_name', true)), | |
| 104 | + 'form_id' => sanitize_key(get_post_meta($post->ID, 'king_addons_form_id', true)), | |
| 105 | + 'form_page' => sanitize_text_field(get_post_meta($post->ID, 'king_addons_form_page', true)), | |
| 106 | + 'form_page_id' => $form_page_id, | |
| 107 | + 'form_page_url' => $form_page_id ? esc_url_raw(get_permalink($form_page_id)) : '', | |
| 108 | + 'form_page_editor' => $form_page_id ? esc_url_raw(admin_url('post.php?post=' . $form_page_id . '&action=elementor')) : '', | |
| 109 | + 'form_agent' => sanitize_textarea_field(get_post_meta($post->ID, 'king_addons_user_agent', true)), | |
| 110 | + 'agent_ip' => sanitize_text_field(get_post_meta($post->ID, 'king_addons_user_ip', true)), | |
| 110 | 111 | 'post_created' => date('F j, Y g:i a', strtotime($post->post_date)), |
| 111 | 112 | 'post_updated' => date('F j, Y g:i a', strtotime($post->post_modified)), |
| 112 | 113 | ] |
| 113 | 114 | ); |
| @@ -137,11 +138,20 @@ | ||
| 137 | 138 | |
| 138 | 139 | public function king_addons_meta_box_callback($post, $metabox) |
| 139 | 140 | { |
| 140 | 141 | echo '<button class="king-addons-edit-submissions button button-primary">' . esc_html__('Edit', 'king-addons') . '</button>'; |
| 142 | + $this->render_payment_block($post); | |
| 141 | 143 | foreach (get_post_meta($post->ID) as $key => $value) { |
| 142 | 144 | |
| 143 | - $exclude = ['king_addons_form_id', 'king_addons_form_name', 'king_addons_form_page', 'king_addons_form_page_id', 'king_addons_user_agent', 'king_addons_user_ip', 'king_addons_submission_read_status', '_edit_lock', '_edit_last']; | |
| 145 | + $exclude = [ | |
| 146 | + 'king_addons_form_id', 'king_addons_form_name', 'king_addons_form_page', 'king_addons_form_page_id', | |
| 147 | + 'king_addons_user_agent', 'king_addons_user_ip', 'king_addons_submission_read_status', | |
| 148 | + '_edit_lock', '_edit_last', | |
| 149 | + 'king_addons_payment_status', 'king_addons_payment_provider', 'king_addons_payment_txn_id', | |
| 150 | + 'king_addons_payment_amount', 'king_addons_payment_currency', 'king_addons_payment_time', | |
| 151 | + 'king_addons_payment_events', 'king_addons_paypal_order_id', 'king_addons_stripe_session_id', | |
| 152 | + 'king_addons_payment_expected_amount', 'king_addons_payment_expected_currency', | |
| 153 | + ]; | |
| 144 | 154 | |
| 145 | 155 | if (in_array($key, $exclude)) { |
| 146 | 156 | continue; |
| 147 | 157 | } |
| @@ -146,64 +156,65 @@ | ||
| 146 | 156 | continue; |
| 147 | 157 | } |
| 148 | 158 | |
| 149 | 159 | echo '<div class="king-addons-submissions-wrap">'; |
| 150 | - if (is_serialized($value[0])) { | |
| 160 | + $meta_value = $value[0]; | |
| 151 | 161 | |
| 152 | - | |
| 153 | - if ($value[0]) { | |
| 154 | - $value = unserialize($value[0]); | |
| 162 | + if (is_serialized($meta_value)) { | |
| 163 | + $unserialized = maybe_unserialize($meta_value); | |
| 164 | + if (is_array($unserialized)) { | |
| 165 | + $value = $unserialized; | |
| 166 | + } else { | |
| 167 | + $value = [$meta_value]; | |
| 155 | 168 | } |
| 169 | + } | |
| 156 | 170 | |
| 157 | - $prefix = "form_field-"; | |
| 158 | - $key_title = !empty($value[2]) ? $value[2] : ucfirst(str_replace($prefix, "", $key)); | |
| 171 | + $prefix = "form_field-"; | |
| 172 | + $key_title = !empty($value[2]) ? esc_html($value[2]) : esc_html(ucfirst(str_replace($prefix, "", $key))); | |
| 159 | 173 | |
| 160 | - if (str_contains($key, '_action_')) { | |
| 161 | - $prefix = '_action_king_addons_form_builder_'; | |
| 162 | - $label = ucfirst(substr($key, strpos($key, $prefix) + strlen($prefix))); | |
| 163 | - echo '<label>' . $label . '</label>'; | |
| 164 | - echo '<p class="notice notice-' . $value['status'] . '">' . ucfirst($value['message']) . '</p>'; | |
| 165 | - } elseif ('file' == $value[0]) { | |
| 166 | - echo '<label for="' . $key . '">' . $key_title . ' </label>'; | |
| 167 | - if (is_array($value[1])) { | |
| 168 | - foreach ($value[1] as $index => $file) { | |
| 169 | - echo '<a id="' . $key . '_' . $index . '" target="_blank" href="' . $file . '">' . $file . '</a>'; | |
| 170 | - } | |
| 174 | + if (str_contains($key, '_action_')) { | |
| 175 | + $prefix = '_action_king_addons_form_builder_'; | |
| 176 | + $label = ucfirst(substr($key, strpos($key, $prefix) + strlen($prefix))); | |
| 177 | + echo '<label>' . esc_html($label) . '</label>'; | |
| 178 | + $status = isset($value['status']) ? sanitize_html_class($value['status']) : ''; | |
| 179 | + $message = isset($value['message']) ? esc_html(ucfirst($value['message'])) : ''; | |
| 180 | + echo '<p class="notice notice-' . esc_attr($status) . '">' . $message . '</p>'; | |
| 181 | + } elseif (isset($value[0]) && 'file' === $value[0]) { | |
| 182 | + echo '<label for="' . esc_attr($key) . '">' . $key_title . ' </label>'; | |
| 183 | + if (is_array($value[1])) { | |
| 184 | + foreach ($value[1] as $index => $file) { | |
| 185 | + $file_url = esc_url($file); | |
| 186 | + echo '<a id="' . esc_attr($key . '_' . $index) . '" target="_blank" href="' . $file_url . '">' . $file_url . '</a>'; | |
| 171 | 187 | } |
| 172 | - } elseif ('textarea' == $value[0]) { | |
| 173 | - echo '<label for="' . $key . '">' . $key_title . ' </label>'; | |
| 174 | - echo '<textarea id="' . $key . '">' . $value[1] . '</textarea>'; | |
| 175 | - } else { | |
| 176 | - if ($value[0] === 'radio' || $value[0] === 'checkbox') { | |
| 177 | - echo '<label for="' . $key . '" class="' . $key . '">' . $key_title . ' </label>'; | |
| 178 | - foreach ($value[1] as $index => $item) { | |
| 179 | - $checked = $item[1] == 'true' ? 'checked' : ''; | |
| 180 | - echo '<input class="king-addons-inline" type="' . $value[0] . '" name="' . $item[2] . '" id="' . $item[3] . '" value="' . $item[0] . '" ' . $checked . '>'; | |
| 181 | - echo '<label class="king-addons-inline" for="' . $item[2] . '">' . $item[0] . ' </label>'; | |
| 182 | - } | |
| 183 | - } else { | |
| 184 | - if ($value[0] == 'select') { | |
| 185 | - if (is_array($value[1])) { | |
| 186 | - $value[1] = implode(",", $value[1]); | |
| 187 | - } | |
| 188 | - | |
| 189 | - echo '<label for="' . $key . '">' . $key_title . ' </label>'; | |
| 190 | - echo '<input type="text" id="' . $key . '" value="' . $value[1] . '">'; | |
| 191 | - | |
| 192 | - } else { | |
| 193 | - echo '<label for="' . $key . '">' . $key_title . ' </label>'; | |
| 194 | - // Use 'text' if type is empty, and sanitize attributes | |
| 195 | - $type_attr = ! empty( $value[0] ) ? $value[0] : 'text'; | |
| 196 | - echo '<input type="' . esc_attr( $type_attr ) . '" id="' . esc_attr( $key ) . '" value="' . esc_attr( $value[1] ) . '">'; | |
| 197 | - } | |
| 188 | + } | |
| 189 | + } elseif (isset($value[0]) && 'textarea' === $value[0]) { | |
| 190 | + echo '<label for="' . esc_attr($key) . '">' . $key_title . ' </label>'; | |
| 191 | + $text_value = isset($value[1]) ? esc_textarea($value[1]) : ''; | |
| 192 | + echo '<textarea id="' . esc_attr($key) . '">' . $text_value . '</textarea>'; | |
| 193 | + } elseif (isset($value[0]) && ('radio' === $value[0] || 'checkbox' === $value[0])) { | |
| 194 | + echo '<label for="' . esc_attr($key) . '" class="' . esc_attr($key) . '">' . $key_title . ' </label>'; | |
| 195 | + if (is_array($value[1])) { | |
| 196 | + foreach ($value[1] as $index => $item) { | |
| 197 | + $checked = (!empty($item[1]) && 'true' === $item[1]) ? 'checked' : ''; | |
| 198 | + $input_value = isset($item[0]) ? esc_attr($item[0]) : ''; | |
| 199 | + $input_name = isset($item[2]) ? esc_attr($item[2]) : ''; | |
| 200 | + $input_id = isset($item[3]) ? esc_attr($item[3]) : esc_attr($key . '_' . $index); | |
| 201 | + echo '<input class="king-addons-inline" type="' . esc_attr($value[0]) . '" name="' . $input_name . '" id="' . $input_id . '" value="' . $input_value . '" ' . $checked . '>'; | |
| 202 | + echo '<label class="king-addons-inline" for="' . $input_name . '">' . esc_html($item[0] ?? '') . ' </label>'; | |
| 198 | 203 | } |
| 199 | 204 | } |
| 205 | + } elseif (isset($value[0]) && 'select' === $value[0]) { | |
| 206 | + $select_value = $value[1]; | |
| 207 | + if (is_array($select_value)) { | |
| 208 | + $select_value = implode(",", $select_value); | |
| 209 | + } | |
| 210 | + echo '<label for="' . esc_attr($key) . '">' . $key_title . ' </label>'; | |
| 211 | + echo '<input type="text" id="' . esc_attr($key) . '" value="' . esc_attr($select_value) . '">'; | |
| 200 | 212 | } else { |
| 201 | - $prefix = "form_field-"; | |
| 202 | - $key_title = !empty($value[2]) ? $value[2] : ucfirst(str_replace($prefix, "", $key)); | |
| 203 | - | |
| 204 | - echo '<label for="' . $key . '">' . $key_title . ' </label>'; | |
| 205 | - echo '<input type="text" id="' . $key . '" value="' . $value[0] . '">'; | |
| 213 | + $type_attr = !empty($value[0]) ? $value[0] : 'text'; | |
| 214 | + $input_val = isset($value[1]) ? $value[1] : (isset($value[0]) ? $value[0] : ''); | |
| 215 | + echo '<label for="' . esc_attr($key) . '">' . $key_title . ' </label>'; | |
| 216 | + echo '<input type="' . esc_attr($type_attr) . '" id="' . esc_attr($key) . '" value="' . esc_attr($input_val) . '">'; | |
| 206 | 217 | } |
| 207 | 218 | echo '</div>'; |
| 208 | 219 | } |
| 209 | 220 | |
| @@ -209,8 +220,48 @@ | ||
| 209 | 220 | |
| 210 | 221 | |
| 211 | 222 | } |
| 212 | 223 | |
| 224 | + /** | |
| 225 | + * Payment status block on the submission card. | |
| 226 | + * | |
| 227 | + * @param \WP_Post $post Submission. | |
| 228 | + * | |
| 229 | + * @return void | |
| 230 | + */ | |
| 231 | + private function render_payment_block($post): void | |
| 232 | + { | |
| 233 | + $status = sanitize_key((string) get_post_meta($post->ID, 'king_addons_payment_status', true)); | |
| 234 | + if ('' === $status) { | |
| 235 | + return; | |
| 236 | + } | |
| 237 | + | |
| 238 | + $provider = sanitize_key((string) get_post_meta($post->ID, 'king_addons_payment_provider', true)); | |
| 239 | + $txn = sanitize_text_field((string) get_post_meta($post->ID, 'king_addons_payment_txn_id', true)); | |
| 240 | + $amount = get_post_meta($post->ID, 'king_addons_payment_amount', true); | |
| 241 | + $currency = sanitize_text_field((string) get_post_meta($post->ID, 'king_addons_payment_currency', true)); | |
| 242 | + $time = absint(get_post_meta($post->ID, 'king_addons_payment_time', true)); | |
| 243 | + | |
| 244 | + echo '<div class="king-addons-submissions-wrap">'; | |
| 245 | + echo '<label>' . esc_html__('Payment', 'king-addons') . '</label>'; | |
| 246 | + echo '<p>'; | |
| 247 | + echo esc_html($status); | |
| 248 | + if ('' !== $provider) { | |
| 249 | + echo ' · ' . esc_html($provider); | |
| 250 | + } | |
| 251 | + if ('' !== (string) $amount) { | |
| 252 | + echo ' · ' . esc_html((string) $amount . ' ' . $currency); | |
| 253 | + } | |
| 254 | + if ('' !== $txn) { | |
| 255 | + echo ' · ' . esc_html($txn); | |
| 256 | + } | |
| 257 | + if ($time) { | |
| 258 | + echo ' · ' . esc_html(date_i18n(get_option('date_format') . ' ' . get_option('time_format'), $time)); | |
| 259 | + } | |
| 260 | + echo '</p>'; | |
| 261 | + echo '</div>'; | |
| 262 | + } | |
| 263 | + | |
| 213 | 264 | public function register_post_type_king_addons_submissions() |
| 214 | 265 | { |
| 215 | 266 | $labels = [ |
| 216 | 267 | 'name' => esc_html__('Form Submissions', 'king-addons'), |
| @@ -250,8 +301,9 @@ | ||
| 250 | 301 | |
| 251 | 302 | |
| 252 | 303 | $columns['main'] = __('Main', 'king-addons'); |
| 253 | 304 | $columns['action_status'] = __('Action Status', 'king-addons'); |
| 305 | + $columns['payment'] = __('Payment', 'king-addons'); | |
| 254 | 306 | $columns['form_id'] = __('Form', 'king-addons'); |
| 255 | 307 | $columns['page'] = __('Page', 'king-addons'); |
| 256 | 308 | $columns['post_id'] = __('ID', 'king-addons'); |
| 257 | 309 | $columns['read_status'] = __('Read Status'); |
| @@ -270,8 +322,9 @@ | ||
| 270 | 322 | { |
| 271 | 323 | $submission = get_post($post_id); |
| 272 | 324 | $submission_meta = get_post_meta($post_id); |
| 273 | 325 | $action_status = 'success'; |
| 326 | + $main_key = ''; | |
| 274 | 327 | |
| 275 | 328 | foreach ($submission_meta as $key => $value) { |
| 276 | 329 | if (str_contains($key, 'form_field-email')) { |
| 277 | 330 | $main_key = $key; |
| @@ -285,37 +338,60 @@ | ||
| 285 | 338 | } |
| 286 | 339 | |
| 287 | 340 | switch ($column) { |
| 288 | 341 | case 'main': |
| 342 | + $main_value = ''; | |
| 343 | + if ($main_key !== '') { | |
| 344 | + $main_meta = get_post_meta($post_id, $main_key, true); | |
| 345 | + $main_value = is_array($main_meta) && isset($main_meta[1]) ? $main_meta[1] : $main_meta; | |
| 346 | + } | |
| 289 | 347 | |
| 290 | 348 | echo sprintf( |
| 291 | 349 | '<a href="%s" title="%s">%s</a>', |
| 292 | 350 | esc_url(admin_url('post.php?post=' . $post_id . '&action=edit')), |
| 293 | - __('View', 'king-addons'), | |
| 294 | - __(get_post_meta($post_id, $main_key, true)[1], 'king-addons') | |
| 351 | + esc_attr__('View', 'king-addons'), | |
| 352 | + esc_html($main_value) | |
| 295 | 353 | ); |
| 296 | 354 | break; |
| 297 | 355 | |
| 298 | 356 | case 'action_status': |
| 299 | 357 | |
| 300 | - echo $action_status; | |
| 358 | + echo esc_html($action_status); | |
| 301 | 359 | break; |
| 302 | 360 | |
| 361 | + case 'payment': | |
| 362 | + $pay_status = sanitize_key((string) get_post_meta($post_id, 'king_addons_payment_status', true)); | |
| 363 | + if ('' === $pay_status) { | |
| 364 | + echo '—'; | |
| 365 | + break; | |
| 366 | + } | |
| 367 | + $pay_amount = get_post_meta($post_id, 'king_addons_payment_amount', true); | |
| 368 | + $pay_currency = sanitize_text_field((string) get_post_meta($post_id, 'king_addons_payment_currency', true)); | |
| 369 | + echo esc_html($pay_status); | |
| 370 | + if ('' !== (string) $pay_amount) { | |
| 371 | + echo ' ' . esc_html((string) $pay_amount . ' ' . $pay_currency); | |
| 372 | + } | |
| 373 | + break; | |
| 374 | + | |
| 303 | 375 | case 'form_id': |
| 304 | - echo '<a href="' . admin_url('post.php?post=' . get_post_meta($post_id, 'king_addons_form_page_id', true) . '&action=elementor') . '" target="_blank">'; | |
| 305 | - echo get_post_meta($post_id, 'king_addons_form_name', true); | |
| 376 | + $form_page_id = absint(get_post_meta($post_id, 'king_addons_form_page_id', true)); | |
| 377 | + $form_name = sanitize_text_field(get_post_meta($post_id, 'king_addons_form_name', true)); | |
| 378 | + echo '<a href="' . esc_url($form_page_id ? admin_url('post.php?post=' . $form_page_id . '&action=elementor') : '#') . '" target="_blank" rel="noopener noreferrer">'; | |
| 379 | + echo esc_html($form_name); | |
| 306 | 380 | echo '</a>'; |
| 307 | 381 | break; |
| 308 | 382 | |
| 309 | 383 | case 'page': |
| 310 | - echo '<a href="' . get_permalink(get_post_meta($post_id, 'king_addons_form_page_id', true)) . '" target="_blank">'; | |
| 311 | - echo get_post_meta($post_id, 'king_addons_form_page', true); | |
| 384 | + $form_page_id = absint(get_post_meta($post_id, 'king_addons_form_page_id', true)); | |
| 385 | + $form_page = sanitize_text_field(get_post_meta($post_id, 'king_addons_form_page', true)); | |
| 386 | + echo '<a href="' . esc_url($form_page_id ? get_permalink($form_page_id) : '#') . '" target="_blank" rel="noopener noreferrer">'; | |
| 387 | + echo esc_html($form_page); | |
| 312 | 388 | echo '</a>'; |
| 313 | 389 | break; |
| 314 | 390 | |
| 315 | 391 | case 'post_id': |
| 316 | 392 | |
| 317 | - echo $submission->ID; | |
| 393 | + echo esc_html(absint($submission->ID)); | |
| 318 | 394 | break; |
| 319 | 395 | |
| 320 | 396 | case 'read_status': |
| 321 | 397 | $read_status = get_post_meta($post_id, 'king_addons_submission_read_status', true); |
| @@ -320,17 +396,16 @@ | ||
| 320 | 396 | case 'read_status': |
| 321 | 397 | $read_status = get_post_meta($post_id, 'king_addons_submission_read_status', true); |
| 322 | 398 | |
| 323 | 399 | if ($read_status == '1') { |
| 324 | - echo '<span class="king-addons-button king-addons-submission-read">' . __('Read') . '</span>'; | |
| 400 | + echo '<span class="king-addons-button king-addons-submission-read">' . esc_html__('Read', 'king-addons') . '</span>'; | |
| 325 | 401 | } else { |
| 326 | - echo '<span class="king-addons-button king-addons-submission-unread">' . __('Unread') . '</span>'; | |
| 402 | + echo '<span class="king-addons-button king-addons-submission-unread">' . esc_html__('Unread', 'king-addons') . '</span>'; | |
| 327 | 403 | } |
| 328 | 404 | break; |
| 329 | 405 | |
| 330 | 406 | case 'custom_date': |
| 331 | - | |
| 332 | - echo get_post_meta($post_id, 'custom_date_key', true); | |
| 407 | + echo esc_html((string) get_post_meta($post_id, 'custom_date_key', true)); | |
| 333 | 408 | break; |
| 334 | 409 | } |
| 335 | 410 | } |
| 336 | 411 | |
| @@ -342,8 +417,12 @@ | ||
| 342 | 417 | |
| 343 | 418 | $post_id = intval($_POST['post_id']); |
| 344 | 419 | $read_status = $_POST['read_status'] === '1' ? '1' : '0'; |
| 345 | 420 | |
| 421 | + if (!current_user_can('edit_post', $post_id)) { | |
| 422 | + wp_send_json_error('Insufficient permissions'); | |
| 423 | + } | |
| 424 | + | |
| 346 | 425 | update_post_meta($post_id, 'king_addons_submission_read_status', $read_status); |
| 347 | 426 | |
| 348 | 427 | wp_send_json_success(); |
| 349 | 428 | } |
| @@ -358,8 +437,11 @@ | ||
| 358 | 437 | if (isset($_GET['post']) && !empty($_GET['post'])) { |
| 359 | 438 | $post_id = intval($_GET['post']); |
| 360 | 439 | $post = get_post($post_id); |
| 361 | 440 | |
| 441 | + if (!$post || !current_user_can('edit_post', $post_id)) { | |
| 442 | + return; | |
| 443 | + } | |
| 362 | 444 | |
| 363 | 445 | update_post_meta($post_id, 'king_addons_submission_read_status', '1'); |
| 364 | 446 | } |
| 365 | 447 | } |