← All changes
|
Core/Admin/Logtivity_Dismiss_Notice_Controller.php
+11
-5
3.3.8
→
3.3.10
View file →
| @@ -36,9 +36,8 @@ | ||
| 36 | 36 | ]; |
| 37 | 37 | |
| 38 | 38 | public function __construct() |
| 39 | 39 | { |
| 40 | - add_action('wp_ajax_nopriv_logtivity_dismiss_notice', [$this, 'dismiss']); | |
| 41 | 40 | add_action('wp_ajax_logtivity_dismiss_notice', [$this, 'dismiss']); |
| 42 | 41 | } |
| 43 | 42 | |
| 44 | 43 | /** |
| @@ -53,15 +52,22 @@ | ||
| 53 | 52 | * @return void |
| 54 | 53 | */ |
| 55 | 54 | public function dismiss(): void |
| 56 | 55 | { |
| 56 | + check_ajax_referer('logtivity_dismiss_notice'); | |
| 57 | + | |
| 57 | 58 | if (!current_user_can(Logtivity::ACCESS_SETTINGS)) { |
| 58 | - wp_die(__('You do not have sufficient permissions to access this page.')); | |
| 59 | + wp_die(esc_html__('You do not have sufficient permissions to access this page.', 'logtivity')); | |
| 59 | 60 | } |
| 60 | 61 | |
| 61 | - $postType = sanitize_text_field($_POST['postType'] ?? null); | |
| 62 | - if (in_array($postType, $this->notices)) { | |
| 63 | - $dismissUntil = sanitize_text_field($_POST['dismissUntil'] ?? null); | |
| 62 | + $postType = isset($_POST['postType']) | |
| 63 | + ? sanitize_text_field(wp_unslash($_POST['postType'])) | |
| 64 | + : null; | |
| 65 | + | |
| 66 | + if (in_array($postType, $this->notices, true)) { | |
| 67 | + $dismissUntil = isset($_POST['dismissUntil']) | |
| 68 | + ? sanitize_text_field(wp_unslash($_POST['dismissUntil'])) | |
| 69 | + : null; | |
| 64 | 70 | |
| 65 | 71 | if ($dismissUntil) { |
| 66 | 72 | set_transient( |
| 67 | 73 | 'dismissed-' . $postType, |