← All changes
|
admin/classes/admin-options/class-merchant-settings-saver.php
+12
-0
2.3.0
→
2.3.2
View file →
| @@ -45,8 +45,14 @@ | ||
| 45 | 45 | if ( ! self::verify_save_request() ) { |
| 46 | 46 | return; |
| 47 | 47 | } |
| 48 | 48 | |
| 49 | + // A locked section is read-only: its inputs are disabled in the UI, and | |
| 50 | + // this guard is what makes that a boundary rather than a courtesy. | |
| 51 | + if ( ! empty( $settings['locked'] ) ) { | |
| 52 | + return; | |
| 53 | + } | |
| 54 | + | |
| 49 | 55 | self::maybe_decode_json_payload(); |
| 50 | 56 | |
| 51 | 57 | $save = ! empty( $_POST['merchant_save'] ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- verified in verify_save_request(). |
| 52 | 58 | $reset = ! empty( $_POST['merchant_reset'] ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- verified in verify_save_request(). |
| @@ -122,8 +128,14 @@ | ||
| 122 | 128 | continue; |
| 123 | 129 | } |
| 124 | 130 | |
| 125 | 131 | if ( ! merchant_is_pro_active() && isset( $field['pro'] ) && $field['pro'] === true ) { |
| 132 | + continue; | |
| 133 | + } | |
| 134 | + | |
| 135 | + // A locked field renders disabled, so the browser never posts it — | |
| 136 | + // falling through would sanitize nothing back over the stored value. | |
| 137 | + if ( ! empty( $field['locked'] ) ) { | |
| 126 | 138 | continue; |
| 127 | 139 | } |
| 128 | 140 | |
| 129 | 141 | $value = null; |