__('You do not have permission to install plugins.', 'pagelayer')));
}
$slug = !empty($_REQUEST['plugin']) ? sanitize_text_field(wp_unslash($_REQUEST['plugin'])) : '';
if(empty($slug)){
wp_send_json_error(array('message' => __('Plugin slug is required.', 'pagelayer')));
}
require_once ABSPATH . 'wp-admin/includes/plugin-install.php';
require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
require_once ABSPATH . 'wp-admin/includes/plugin.php';
require_once ABSPATH . 'wp-admin/includes/file.php';
// Initialize WP_Filesystem - required before Plugin_Upgrader can write files
$creds = request_filesystem_credentials(site_url() . '/wp-admin/', '', false, false, null);
if(!WP_Filesystem($creds)){
wp_send_json_error(array('message' => __('Could not initialize filesystem. Please check file permissions.', 'pagelayer')));
}
$api = plugins_api('plugin_information', array('slug' => $slug, 'fields' => array('sections' => false)));
if(is_wp_error($api)){
wp_send_json_error(array('message' => $api->get_error_message()));
}
// Use Automatic_Upgrader_Skin (silent); buffer any stray output to keep response clean JSON
$skin = new \Automatic_Upgrader_Skin();
$upgrader = new \Plugin_Upgrader($skin);
ob_start();
$result = $upgrader->install($api->download_link);
ob_end_clean();
if(is_wp_error($result)){
wp_send_json_error(array('message' => $result->get_error_message()));
}
if($result === false || $result === null){
$error_msgs = $skin->get_upgrade_messages();
$msg = !empty($error_msgs) ? implode(' ', $error_msgs) : __('Plugin installation failed. Please check file permissions.', 'pagelayer');
wp_send_json_error(array('message' => $msg));
}
$all_plugins = get_plugins();
$installed_plugin = '';
foreach($all_plugins as $path => $data){
if(strpos($path, $slug . '/') === 0){
$installed_plugin = $path;
break;
}
}
if(empty($installed_plugin)){
wp_send_json_error(array('message' => __('Plugin installed but could not be located for activation.', 'pagelayer')));
}
$result = activate_plugin($installed_plugin);
if(is_wp_error($result)){
wp_send_json_error(array('message' => $result->get_error_message()));
}
wp_send_json_success(array('message' => __('Plugin installed and activated successfully.', 'pagelayer')));
}
add_action('wp_ajax_pagelayer_activate_plugin', 'pagelayer_activate_recommended_plugin');
function pagelayer_activate_recommended_plugin(){
check_ajax_referer('pagelayer_recommended_plugins', 'security');
if(!current_user_can('activate_plugins')){
wp_send_json_error(array('message' => __('You do not have permission to activate plugins.', 'pagelayer')));
}
$slug = !empty($_REQUEST['plugin']) ? sanitize_text_field(wp_unslash($_REQUEST['plugin'])) : '';
if(empty($slug)){
wp_send_json_error(array('message' => __('Plugin slug is required.', 'pagelayer')));
}
if(!function_exists('get_plugins')){
require_once ABSPATH . 'wp-admin/includes/plugin.php';
}
$all_plugins = get_plugins();
$plugin_path = '';
foreach($all_plugins as $path => $data){
if(strpos($path, $slug . '/') === 0){
$plugin_path = $path;
break;
}
}
if(empty($plugin_path)){
wp_send_json_error(array('message' => __('Plugin not found.', 'pagelayer')));
}
$result = activate_plugin($plugin_path);
if(is_wp_error($result)){
wp_send_json_error(array('message' => $result->get_error_message()));
}
wp_send_json_success(array('message' => __('Plugin activated successfully.', 'pagelayer')));
}
// AI Agents Connection AJAX handlers
// NOTE: These must be registered BEFORE the pagelayer_nonce gate below,
// because they use their own nonce (pagelayer_mcp_nonce) or basic auth.
add_action('wp_ajax_pagelayer_mcp_generate_app_password', 'pagelayer_mcp_generate_app_password');
add_action('wp_ajax_pagelayer_mcp_adapter_action', 'pagelayer_mcp_adapter_action');
add_action('wp_ajax_pagelayer_mcp_test_connection', 'pagelayer_mcp_test_connection');
add_action('wp_ajax_pagelayer_mcp_save_test_status', 'pagelayer_mcp_save_test_status');
add_action('wp_ajax_pagelayer_mcp_save_image_api_key', 'pagelayer_mcp_save_image_api_key');
// Verifies, without any HTTP round trip, the two things a loopback request would
// have proved: that the supplied Application Password authenticates this user,
// and that the Pagelayer abilities are registered. Used when the loopback itself
// fails (cURL timeout etc.) so the panel can still tell the user where they stand.
function pagelayer_mcp_verify_locally($username, $password) {
$result = array('password_ok' => false, 'abilities' => 0, 'message' => '');
if(!class_exists('WP_Application_Passwords')){
$result['message'] = __('Application Passwords are not supported on this WordPress version.', 'pagelayer');
return $result;
}
$user = get_user_by('login', $username);
if(!$user && is_email($username)){
$user = get_user_by('email', $username);
}
if(!$user){
$result['message'] = sprintf(__('No user named "%s" exists on this site.', 'pagelayer'), $username);
return $result;
}
// Core strips non-alphanumerics before comparing, so the password works with
// or without the readability spaces (see wp_authenticate_application_password).
$stripped = preg_replace('/[^a-z\d]/i', '', $password);
foreach(\WP_Application_Passwords::get_user_application_passwords($user->ID) as $item){
if(\WP_Application_Passwords::check_password($stripped, $item['password'])){
$result['password_ok'] = true;
break;
}
}
if(function_exists('wp_get_abilities')){
foreach(wp_get_abilities() as $name => $ability){
$name = is_string($name) ? $name : '';
if(strpos($name, 'pagelayer-') === 0){
$result['abilities']++;
}
}
}
if($result['password_ok']){
$result['message'] = sprintf(
__('Checked locally instead: your Application Password IS valid for "%1$s", and %2$d Pagelayer abilities are registered.', 'pagelayer'),
$username,
$result['abilities']
);
}else{
$result['message'] = sprintf(
__('Checked locally instead: the supplied Application Password does NOT match any password stored for "%s" — generate a new one below.', 'pagelayer'),
$username
);
}
return $result;
}
function pagelayer_mcp_test_connection() {
include_once(PAGELAYER_DIR.'/main/abilities.php');
check_ajax_referer('pagelayer_mcp_nonce', 'nonce');
if(!current_user_can('manage_options')){
wp_send_json_error(__('You do not have permission to test the connection.', 'pagelayer'));
}
$start = microtime(true);
$url = trailingslashit(home_url()) . ltrim(Pagelayer_Abilities::$ABILITIES_ENDPOINT, '/');
$username = isset($_POST['username']) ? sanitize_text_field(wp_unslash($_POST['username'])) : '';
$password = isset($_POST['password']) ? sanitize_text_field(wp_unslash($_POST['password'])) : '';
// Application Passwords are silently inert unless the site is on HTTPS or the
// environment type is "local" (wp_is_application_passwords_supported()). WP
// still hands out a password string in that state, so the only symptom is a
// 401 on every request — check it up front instead of blaming the password.
if(function_exists('wp_is_application_passwords_available') && !wp_is_application_passwords_available()){
$message = sprintf(
__('Application Passwords are disabled on this site, so every request is treated as anonymous (HTTP 401). WordPress only enables them over HTTPS or when the environment type is "local". This site reports %1$s and environment type "%2$s". Either serve the site over HTTPS, or add define(\'WP_ENVIRONMENT_TYPE\', \'local\'); to wp-config.php for a development site.', 'pagelayer'),
is_ssl() ? 'HTTPS' : 'HTTP',
function_exists('wp_get_environment_type') ? wp_get_environment_type() : 'unknown'
);
Pagelayer_Abilities::save_test_connection_status(false, $message);
wp_send_json_error(['message' => $message]);
}
$response = wp_remote_get($url, [
// wp_remote_get() defaults to a 5s timeout, which a local dev stack will
// blow through on a loopback request (TLS handshake plus a full second
// WordPress bootstrap, often with WP_DEBUG on).
'timeout' => 20,
'headers' => [
'Accept' => 'application/json',
'Authorization' => 'Basic ' . base64_encode($username . ':' . $password),
],
'sslverify' => false,
]);
$elapsed = round((microtime(true) - $start) * 1000);
if(is_wp_error($response)){
// The loopback never completed, so it told us nothing about the HTTP path.
// Verify in-process what we actually can — that the Application Password
// is valid and the abilities are registered — and say plainly which part
// is still unverified, instead of reporting a flat failure.
$local = pagelayer_mcp_verify_locally($username, $password);
$message = sprintf(
__('Could not complete the loopback request to %1$s (%2$s). %3$s %4$s', 'pagelayer'),
$url,
$response->get_error_message(),
$local['message'],
__('A loopback failure is usually the local server itself, not your setup: many dev stacks run too few PHP workers to serve a second request while this one is still open, so the site cannot call itself. Your AI client connects from outside and is not affected. Confirm from a terminal with: curl -ik -u "USERNAME:APP PASSWORD" ', 'pagelayer') . $url
);
Pagelayer_Abilities::save_test_connection_status(false, $message);
wp_send_json_error([
'message' => $message,
'local_check' => $local,
'loopback_failed' => true,
]);
}
$code = wp_remote_retrieve_response_code($response);
$body = json_decode(wp_remote_retrieve_body($response), true);
if($code >= 200 && $code < 300 && is_array($body)){
$pagelayer_abilities = 0;
foreach($body as $ability){
$name = isset($ability['name']) ? $ability['name'] : (isset($ability['id']) ? $ability['id'] : '');
if(is_string($name) && strpos($name, 'pagelayer-') === 0){
$pagelayer_abilities++;
}
}
$message = sprintf(__('Authenticated with your Application Password and discovered %1$d Pagelayer abilities in %2$dms. Your site is ready to connect.', 'pagelayer'), $pagelayer_abilities, $elapsed);
Pagelayer_Abilities::save_test_connection_status(true, $message);
wp_send_json_success([
'message' => $message,
'abilities' => $pagelayer_abilities,
'elapsed_ms' => $elapsed,
]);
}
// A 401 means the request arrived with no authenticated user at all; a 403
// means it authenticated but lacked the capability. Those need different fixes.
if($code === 401){
$auth_header_seen = (bool) (function_exists('wp_get_authorization_header') ? wp_get_authorization_header() : (!empty($_SERVER['HTTP_AUTHORIZATION']) || !empty($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])));
$message = __('The abilities endpoint treated the request as anonymous (HTTP 401), so the Application Password never authenticated. The two usual causes are: (1) the password was revoked or mistyped — generate a new one below; or (2) your web server is stripping the Authorization header before PHP sees it. For Apache, ensure the "RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]" line is present in .htaccess and that AllowOverride permits it. For nginx/FastCGI, ensure the Authorization header is forwarded to PHP-FPM.', 'pagelayer');
if(!$auth_header_seen){
$message .= ' ' . __('Note: this admin request itself arrived without an Authorization header, which is normal here but means the stripping check is inconclusive — test with curl -u user:app-password against the endpoint to confirm.', 'pagelayer');
}
Pagelayer_Abilities::save_test_connection_status(false, $message);
wp_send_json_error([
'message' => $message,
]);
}
if($code === 403){
$message = __('The Application Password authenticated, but the account was refused (HTTP 403). Check that this user still has the required capabilities, and that no security plugin is blocking REST API requests.', 'pagelayer');
Pagelayer_Abilities::save_test_connection_status(false, $message);
wp_send_json_error([
'message' => $message,
]);
}
$message = sprintf(__('The abilities endpoint responded with status %1$d. Check the MCP Adapter is active and try again.', 'pagelayer'), $code);
Pagelayer_Abilities::save_test_connection_status(false, $message);
wp_send_json_error([
'message' => $message,
]);
}
function pagelayer_mcp_save_test_status() {
include_once(PAGELAYER_DIR.'/main/abilities.php');
check_ajax_referer('pagelayer_mcp_nonce', 'nonce');
if(!current_user_can('manage_options')){
wp_send_json_error(__('You do not have permission to do that.', 'pagelayer'));
}
$ok = !empty($_POST['ok']);
$message = !empty($_POST['message']) ? sanitize_text_field(wp_unslash($_POST['message'])) : '';
Pagelayer_Abilities::save_test_connection_status($ok, $message);
wp_send_json_success();
}
function pagelayer_mcp_save_image_api_key() {
check_ajax_referer('pagelayer_mcp_nonce', 'nonce');
if(!current_user_can('manage_options')){
wp_send_json_error(array('message' => __('You do not have permission to do that.', 'pagelayer')));
}
$provider = !empty($_POST['provider']) ? sanitize_key(wp_unslash($_POST['provider'])) : '';
$api_key = !empty($_POST['api_key']) ? sanitize_text_field(wp_unslash($_POST['api_key'])) : '';
if(empty($api_key)){
wp_send_json_error(array('message' => __('An API key is required.', 'pagelayer')));
}
if($provider !== 'pexels'){
wp_send_json_error(array('message' => __('Unsupported image provider.', 'pagelayer')));
}
update_option('pagelayer_pexels_api_key', $api_key, false);
wp_send_json_success(array('message' => __('Image search API key saved.', 'pagelayer')));
}
function pagelayer_mcp_generate_app_password() {
include_once(PAGELAYER_DIR.'/main/abilities.php');
check_ajax_referer('pagelayer_mcp_nonce', 'nonce');
if(!current_user_can('manage_options')){
wp_send_json_error('Unauthorized');
}
$user_id = get_current_user_id();
if(!class_exists('WP_Application_Passwords')){
wp_send_json_error('Application Passwords not supported in this WP version.');
}
// WP_Application_Passwords::create_new_application_password() does NOT check
// availability, so without this the UI happily issues a password that
// wp_authenticate_application_password() will always reject — a "Generated"
// checkmark followed by a permanent 401.
if(function_exists('wp_is_application_passwords_available') && !wp_is_application_passwords_available()){
wp_send_json_error(sprintf(
__('Application Passwords are disabled on this site, so a generated password could never authenticate. WordPress enables them only over HTTPS or when the environment type is "local". This site reports %1$s and environment type "%2$s". Serve the site over HTTPS, or add define(\'WP_ENVIRONMENT_TYPE\', \'local\'); to wp-config.php for a development site.', 'pagelayer'),
is_ssl() ? 'HTTPS' : 'HTTP',
function_exists('wp_get_environment_type') ? wp_get_environment_type() : 'unknown'
));
}
$passwords = \WP_Application_Passwords::get_user_application_passwords($user_id);
foreach($passwords as $app){
if(!empty($app['app_id']) && $app['app_id'] === Pagelayer_Abilities::$APP_PASSWORD_APP_ID){
\WP_Application_Passwords::delete_application_password($user_id, $app['uuid']);
}
}
$new_password = \WP_Application_Passwords::create_new_application_password($user_id, array(
'name' => Pagelayer_Abilities::$APP_PASSWORD_NAME,
'app_id' => Pagelayer_Abilities::$APP_PASSWORD_APP_ID,
));
if(is_wp_error($new_password)){
wp_send_json_error($new_password->get_error_message());
}
wp_send_json_success(array('password' => $new_password[0]));
}
function pagelayer_mcp_adapter_action() {
include_once(PAGELAYER_DIR.'/main/abilities.php');
check_ajax_referer('pagelayer_mcp_nonce', 'nonce');
if(!current_user_can('manage_options')){
wp_send_json_error('Unauthorized');
}
$type = isset($_POST['type']) ? sanitize_text_field($_POST['type']) : '';
if(!function_exists('get_plugins')){
require_once ABSPATH . 'wp-admin/includes/plugin.php';
}
if ($type === 'install') {
include_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
include_once ABSPATH . 'wp-admin/includes/file.php';
// The MCP Adapter is hosted on GitHub, not WordPress.org, so fetch the download URL from the GitHub API
$download_url = Pagelayer_Abilities::get_mcp_adapter_download_url();
$upgrader = new \Plugin_Upgrader(new \Automatic_Upgrader_Skin());
$installed = $upgrader->install($download_url);
if(is_wp_error($installed)){
wp_send_json_error($installed->get_error_message());
}elseif(!$installed){
wp_send_json_error('Installation failed. The MCP Adapter plugin is downloaded from GitHub. Please check your server can reach github.com.');
}
$plugin_file = Pagelayer_Abilities::get_installed_mcp_adapter_file();
if($plugin_file){
activate_plugin($plugin_file);
wp_send_json_success('Installed and activated');
}
wp_send_json_success('Installed but not activated');
} elseif ($type === 'activate') {
$plugin_file = Pagelayer_Abilities::get_installed_mcp_adapter_file();
if($plugin_file){
$result = activate_plugin($plugin_file);
if(is_wp_error($result)){
wp_send_json_error($result->get_error_message());
}
wp_send_json_success('Activated');
}
wp_send_json_error('Plugin not found');
}
wp_send_json_error('Invalid action');
}
// Is the nonce there ?
if(empty($_REQUEST['pagelayer_nonce'])){
return;
}
pagelayer_memory_limit(128);
// The ajax handler
add_action('wp_ajax_pagelayer_wp_widget', 'pagelayer_wp_widget_ajax');
function pagelayer_wp_widget_ajax(){
global $pagelayer;
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
if(!current_user_can('edit_theme_options')){
$ret['error'][] = __pl('no_permission');
pagelayer_json_output($ret);
}
pagelayer_load_shortcodes();
header('Content-Type: application/json');
$ret = [];
$tag = @$_POST['tag'];
//pagelayer_print($pagelayer->shortcodes[$tag]);
// No tag ?
if(empty($pagelayer->shortcodes[$tag])){
$ret['error'][] = __pl('no_tag');
pagelayer_json_output($ret);
}
// Include the widgets
$widgets = ABSPATH . 'site-admin/includes/widgets.php';
$widgets = file_exists($widgets) ? $widgets : ABSPATH . 'wp-admin/includes/widgets.php';
require_once($widgets);
$class = $pagelayer->shortcodes[$tag]['widget'];
// Check the widget class exists ?
if(empty($class) || !class_exists($class)){
$ret['error'][] = __pl('no_widget_class');
pagelayer_json_output($ret);
}
$instance = [];
$widget = new $class();
$widget->_set('pagelayer-widget-1234567890');
// Is there any existing data ?
if(!empty($_POST['widget_data'])){
$json = json_decode(stripslashes($_POST['widget_data']), true);
//pagelayer_print($json);die();
if(!empty($json)){
$instance = $json;
}
}
// Are there any form values ?
if(!empty($_POST['values'])){
parse_str(stripslashes($_POST['values']), $data);
//pagelayer_print($data);die();
// Any data ?
if(!empty($data)){
// Rss widget checkboxes fix
if(!empty($data['widget-rss'])){
$data['widget-rss']['pagelayer-widget-1234567890']['show_summary'] = empty($data['widget-rss']['pagelayer-widget-1234567890']['show_summary'])? 0 : 1;
$data['widget-rss']['pagelayer-widget-1234567890']['show_author'] = empty($data['widget-rss']['pagelayer-widget-1234567890']['show_author'])? 0 : 1;
$data['widget-rss']['pagelayer-widget-1234567890']['show_date'] = empty($data['widget-rss']['pagelayer-widget-1234567890']['show_date'])? 0 : 1;
}
// First key is useless
$data = current($data);
// Do we still have valid data ?
if(!empty($data)){
// 2nd key is useless and just over-ride instance
$instance = current($data);
}
}
}
// Settings instance For Text widget
if($widget->id_base == 'text'){
$instance['visual'] = false;
$instance['legacy'] = false;
}
// Get the form
ob_start();
$widget->form($instance);
$ret['form'] = ob_get_contents();
ob_end_clean();
// Get the html
ob_start();
$widget->widget([], $instance);
$ret['html'] = ob_get_contents();
ob_end_clean();
// Widget data to set
if(!empty($instance)){
$ret['widget_data'] = $instance;
}
// Custom html widget form elements
if(!empty($widget) && $widget->name=='Custom HTML'){
$custom_html = explode('>', $ret['form']);
$custom_html[0] = ''.$custom_html[0];
$custom_html[0] = str_replace('type="hidden"', 'type="text"',$custom_html[0]);
$custom_html[1] = ''.$custom_html[1];
$custom_html[1] = str_replace('hidden', '', $custom_html[1]);
$ret['form'] = implode('>', $custom_html);
}
pagelayer_json_output($ret);
}
// Build with AI — wrappers; generation/settings logic lives in Pagelayer_AI_Controller
add_action('wp_ajax_pagelayer_ai_generate', 'pagelayer_ai_generate');
function pagelayer_ai_generate(){
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
$done = [];
if(!current_user_can('edit_posts')){
$done['error'][] = __pl('no_permission');
pagelayer_json_output($done);
}
$ctrl = Pagelayer_AI_Controller::get_instance();
$res = $ctrl->process_generate();
if(is_wp_error($res)){
$done['error'] = $res->get_error_message();
pagelayer_json_output($done);
}
$done = is_array($res) ? $res : [];
if(!isset($done['success'])){
$done['success'] = true;
}
pagelayer_json_output($done);
}
add_action('wp_ajax_pagelayer_ai_settings', 'pagelayer_ai_settings');
function pagelayer_ai_settings(){
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
$done = [];
if(!current_user_can('edit_posts')){
$done['error'][] = __pl('no_permission');
pagelayer_json_output($done);
}
$ctrl = Pagelayer_AI_Controller::get_instance();
$res = $ctrl->process_get_settings();
if(is_wp_error($res)){
$done['error'] = $res->get_error_message();
pagelayer_json_output($done);
}
$done = is_array($res) ? $res : [];
if(!isset($done['success'])){
$done['success'] = true;
}
pagelayer_json_output($done);
}
add_action('wp_ajax_pagelayer_ai_save_settings', 'pagelayer_ai_save_settings');
function pagelayer_ai_save_settings(){
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
$done = [];
if(!current_user_can('edit_posts')){
$done['error'][] = __pl('no_permission');
pagelayer_json_output($done);
}
$ctrl = Pagelayer_AI_Controller::get_instance();
$res = $ctrl->process_save_settings();
if(is_wp_error($res)){
$done['error'] = $res->get_error_message();
pagelayer_json_output($done);
}
$done = is_array($res) ? $res : [];
if(!isset($done['success'])){
$done['success'] = true;
}
pagelayer_json_output($done);
}
// Update Post content
add_action('wp_ajax_pagelayer_save_content', 'pagelayer_save_content');
function pagelayer_save_content(){
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
$content = $_POST['pagelayer_update_content'];
$postID = (int) $_GET['postID'];
if(empty($postID)){
$msg['error'] = __pl('invalid_post_id');
pagelayer_json_output($msg);
}
$_post = get_post($postID);
// Post found ?
if(empty($_post)){
$msg['error'] = __pl('invalid_post_id');
pagelayer_json_output($msg);
}
// Get the post type and its capabilities
$post_type = $_post->post_type;
$post_type_obj = get_post_type_object($post_type);
// Are you allowed to edit ?
if(!pagelayer_user_can_edit($postID)){
$msg['error'][] = __pl('no_permission');
pagelayer_json_output($msg);
}
// Check if the post exists
if(!empty($postID)){
$content = base64_decode($content);
/*if(!pagelayer_is_utf8($content)){
$content = utf8_encode($content);
}*/
$is_xss = pagelayer_xss_content($content);
if(!pagelayer_user_can_add_js_content() && strlen($is_xss) > 0){
$msg['error'][] = __pl('xss_found').' - '.$is_xss;
pagelayer_json_output($msg);
}
// Is comment mode?
if(pagelayer_is_comment_mode()){
global $pagelayer_comment_errors, $pagelayer_comment_alerts;
$content = pagelayer_extract_comment_atts($postID, $content);
}
// Add slash to save data in post
$content = wp_slash($content);
$post = array(
'ID' => $postID,
'post_content' => $content,
);
// Any properties ?
$allowed = ['post_title', 'post_name', 'post_excerpt', 'post_status', 'post_password', 'post_date', 'post_parent', 'menu_order'];
foreach($allowed as $k){
if(isset($_REQUEST[$k])){
$post[$k] = sanitize_text_field($_REQUEST[$k]);
}
}
// Restrict contributors from setting 'publish' or modifying unauthorized fields
$current_user_can_publish = current_user_can($post_type_obj->cap->publish_posts);
if(!$current_user_can_publish){
if(!in_array($post['post_status'], ['draft', 'pending'])){
$post['post_status'] = 'pending'; // Force pending status
}
}
if(!empty($post['post_password'])){
if($_REQUEST['post_sticky'] == true){
$msg['error'] = __pl('post_pass_with_sticky_err');
pagelayer_json_output($msg);
}
// Prevent unauthorized password protection
$can_protect = current_user_can($post_type_obj->cap->edit_private_posts);
if(!$can_protect){
$msg['error'][] = __pl('no_permission_to_set_password');
pagelayer_json_output($msg);
}
}
// Prevent unauthorized modification of `post_author`
if(isset($_REQUEST['post_author']) && $_REQUEST['post_author'] != $_post->post_author){
$edit_others_posts = current_user_can($post_type_obj->cap->edit_others_posts);
if($edit_others_posts){
$post['post_author'] = (int) $_REQUEST['post_author'];
}else{
$msg['error'][] = __pl('no_permission_to_change_author');
pagelayer_json_output($msg);
}
}
$post['comment_status'] = !empty($_REQUEST['comment_status']) ? 'open' : 'closed';
$post['ping_status'] = !empty($_REQUEST['ping_status']) ? 'open' : 'closed';
$post['post_status'] = empty($post['post_status']) ? $_post->post_status : $post['post_status'];
if(!empty($post['post_status']) && $post['post_status'] == 'publish'){
// Allowed to publish pages ?
if($_post->post_type == 'page' && !current_user_can('publish_pages')){
$msg['error'][] = __pl('no_publish_permission');
pagelayer_json_output($msg);
}
// Allowed to publish posts ?
if($_post->post_type == 'post' && !current_user_can('publish_posts')){
$post['post_status'] = 'pending';
}
}
if(!empty($post['post_password'])){
$post['post_password'] = (in_array($post['post_status'], array('pass_protected', 'publish')) ? $post['post_password'] : '');
$post['post_status'] = 'publish';
}else{
$post['post_status'] = ($post['post_status'] == 'pass_protected') ? 'publish' : $post['post_status'];
$post['post_password'] = '';
}
// Set post GMT time
if(!empty($post['post_date']) && '0000-00-00 00:00:00' !== $post['post_date']){
$post['post_date_gmt'] = get_gmt_from_date( $post['post_date'] );
if( in_array($post['post_status'], array('future', 'publish')) && $_post->post_date_gmt === '0000-00-00 00:00:00' ){
$post['edit_date'] = true;
}
}
$_REQUEST['featured_image'] = (int) $_REQUEST['featured_image'];
if(!empty($_REQUEST['featured_image'])){
set_post_thumbnail($postID, $_REQUEST['featured_image']);
}else{
delete_post_thumbnail($postID);
}
if(!isset($_REQUEST['post_category'])){
$_REQUEST['post_category'] = '';
}
if(!isset($_REQUEST['post_tags'])){
$_REQUEST['post_tags'] = '';
}
if($_post->post_type == 'post'){
$post['post_category'] = pagelayer_sanitize_text_field($_REQUEST['post_category']);
$post['tags_input'] = pagelayer_sanitize_text_field($_REQUEST['post_tags']);
}else{
$cat_name = pagelayer_post_type_category($_post->post_type);
if($cat_name){
$post['tax_input'][$cat_name] = pagelayer_sanitize_text_field($_REQUEST['post_category']);
}
$tag_name = pagelayer_post_type_tag($_post->post_type);
if($tag_name){
$post['tax_input'][$tag_name] = pagelayer_sanitize_text_field($_REQUEST['post_tags']);
}
}
if(isset($_REQUEST['post_sticky']) && !empty($_REQUEST['post_sticky'])){
stick_post( $postID );
}else{
if(is_sticky($postID)){
unstick_post( $postID );
}
}
// Any contact templates ?
if(!empty($_REQUEST['contacts']) && current_user_can('activate_plugins')){
update_post_meta($postID, 'pagelayer_contact_templates', $_REQUEST['contacts']);
}else{
delete_post_meta($postID, 'pagelayer_contact_templates');
}
// Save copyright
if(isset($_REQUEST['copyright']) && current_user_can('manage_options')){
update_option('pagelayer-copyright', wp_unslash($_REQUEST['copyright']));
}
// Apply a filter
$post = apply_filters('pagelayer_save_content', $post);
// Update the post into the database
$ret = wp_update_post($post, true);
// Render the post
//update_post_meta($postID, 'pagelayer_rendered_post', pagelayer_get_post_content($postID));
if (is_wp_error($ret)) {
$errors = $ret->get_error_messages();
$msg['error'] = __pl('post_update_err').' : '.implode('', $errors);
}else{
// Get the updated post
$_post = get_post($postID);
// Is this a Pagelayer post
$data = get_post_meta($postID, 'pagelayer-data', true);
if(empty($data)){
// Convert to pagelayer accessed post
if(!add_post_meta($postID, 'pagelayer-data', time(), true)){
update_post_meta($postID, 'pagelayer-data', time());
}
}
if(!empty($pagelayer_comment_alerts)){
$msg['comment_alerts'] = $pagelayer_comment_alerts;
}
if(!empty($pagelayer_comment_errors)){
$msg['error'][] = 'Comment Mode errrors found !';
$msg['comment_errors'] = $pagelayer_comment_errors;
}
$msg['success'] = __pl('post_update_success');
}
}else{
$msg['error'] = __pl('post_update_err');
}
$msg['post_status'] = (empty($_post->post_password)) ? $_post->post_status : 'pass_protected';
// Save global widgets data
if(!empty($_REQUEST['global_widgets'])){
pagelayer_save_templ_content(true);
}
// Save nav menu data
if(!empty($_REQUEST['pagelayer_nav_items']) && current_user_can('edit_theme_options')){
$menu_items = (array) $_REQUEST['pagelayer_nav_items'];
foreach($menu_items as $items){
pagelayer_save_nav_menu_items($items);
}
}
// Save Customizer data
if(!empty($_REQUEST['pagelayer_customizer_options']) && current_user_can('edit_theme_options')){
$customizer_options = wp_unslash($_REQUEST['pagelayer_customizer_options']);
$customizer_options = json_decode($customizer_options, true);
// Add current post type
$customizer_options['pagelayer_current_post_type'] = $_post->post_type;
pagelayer_save_customizer_options($customizer_options);
}
pagelayer_json_output($msg);
}
// Save sections and global sections
add_action('wp_ajax_pagelayer_save_templ_content', 'pagelayer_save_templ_content');
function pagelayer_save_templ_content($echo = false){
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
if ( ! current_user_can( get_post_type_object( 'pagelayer-template' )->cap->create_posts ) ) {
$ret['error'][$g_post_id] = __pl('no_permission');
pagelayer_json_output($ret);
return false;
}
// Are you allowed to edit ?
if(!pagelayer_user_can_edit($_REQUEST['postID'])){
$msg['error'][] = __pl('no_permission');
pagelayer_json_output($msg);
}
$ret = array();
// Save global widgets data
if(empty($_REQUEST['global_widgets'])){
$ret['error'][] = 'No widgets given';
pagelayer_json_output($ret);
return false;
}
$global_widgets = $_REQUEST['global_widgets'];
foreach($global_widgets as $key => $value){
$g_post_id = (int) $value['post_id'];
// Are you allowed to edit ?
if(!empty($g_post_id) && !pagelayer_user_can_edit($g_post_id)){
$ret['error'][$g_post_id] = __pl('no_permission').' : '.$g_post_id;
continue;
}
// Decode base64 data
$value['content'] = base64_decode($value['content']);
$is_xss = pagelayer_xss_content($value['content']);
if(!current_user_can('manage_options') && strlen($is_xss) > 0){
$ret['error'][$g_post_id] = __pl('xss_found').' - '.$is_xss;
pagelayer_json_output($ret);
}
// Add slash to save data in post
$value['content'] = wp_slash($value['content']);
// We need to create the post
if(empty($value['post_id'])){
$g_ret = wp_insert_post([
'post_type' => 'pagelayer-template',
'post_title' => $value['title'],
'post_content' => $value['content'],
'post_status' => 'publish',
'comment_status' => 'closed',
'ping_status' => 'closed'
]);
$g_post_id = $g_ret;
// Save our template metas
update_post_meta($g_post_id, 'pagelayer_template_type', $value['type']);
update_post_meta($g_post_id, 'pagelayer-data', time());
}else if(!empty($value['content'])){
// Save global widget content
$post = array(
'ID' => $g_post_id,
'post_title' => $value['title'],
'post_content' => $value['content'],
);
wp_update_post($post);
}
if(is_wp_error($g_post_id)){
$ret['error'][$g_post_id] = __pl('template_update_err');
}else{
$ret['success'][$g_post_id] = __pl('template_update_success');
}
}
if(!$echo){
pagelayer_json_output($ret);
}else{
return $ret;
}
}
// Update the Site Title
add_action('wp_ajax_pagelayer_set_jscss_giver', 'pagelayer_set_jscss_giver');
function pagelayer_set_jscss_giver(){
global $wpdb;
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
if( !current_user_can('manage_options') ){
$ret['error'] = __pl('no_permission');
pagelayer_json_output($ret);
}
$val = (int) @$_REQUEST['set'];
if(in_array($val, [1, -1])){
update_option('pagelayer_enable_giver', $val);
}
$ret['success'] = 1;
pagelayer_json_output($ret);
}
// Shortcodes Widget Handler
add_action('wp_ajax_pagelayer_do_shortcodes', 'pagelayer_do_shortcodes');
function pagelayer_do_shortcodes(){
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
if(!current_user_can('edit_posts')){// TODO : WooCommerce
$ret['error'][] = __pl('no_permission');
pagelayer_json_output($ret);
}
$data = '';
if(isset($_REQUEST['shortcode_data'])){
$data = stripslashes($_REQUEST['shortcode_data']);
}
// Load shortcodes
pagelayer_load_shortcodes();
$data = pagelayer_the_content($data);
// Create the HTML object
$node = pagelayerQuery::parseStr($data);
$node->query('.pagelayer-ele')->removeClass('pagelayer-ele');
echo $node->html();
wp_die();
}
// Give the JS
add_action('wp_ajax_pagelayer_givejs', 'pagelayer_givejs');
function pagelayer_givejs(){
global $pagelayer;
// WordPress adds the Expires header in all AJAX calls. We need to remove it for cache to work
header_remove("Expires");
header_remove("Cache-Control");
// Load shortcodes
pagelayer_load_shortcodes();
// Load font options
pagelayer_load_font_options();
// Pagelayer Template Loading Mechanism
include_once(PAGELAYER_DIR.'/js/givejs.php');
exit();
}
add_action('wp_ajax_pagelayer_givecss', 'pagelayer_givecss');
add_action('wp_ajax_nopriv_pagelayer_givecss', 'pagelayer_givecss');
function pagelayer_givecss(){
global $pagelayer;
// WordPress adds the Expires header in all AJAX calls. We need to remove it for cache to work
header_remove("Expires");
header_remove("Cache-Control");
// Pagelayer Template Loading Mechanism
include_once(PAGELAYER_DIR.'/css/givecss.php');
exit();
}
// Shortcodes Widget Handler
add_action('wp_ajax_pagelayer_get_section_shortcodes', 'pagelayer_get_section_shortcodes');
function pagelayer_get_section_shortcodes(){
global $pagelayer;
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
if(!current_user_can('edit_posts')){
$ret['error'][] = __pl('no_permission');
pagelayer_json_output($ret);
}
$data = '';
if(isset($_REQUEST['pagelayer_section_id'])){
$get_url = PAGELAYER_API.'/library.php?give_id='.sanitize_text_field($_REQUEST['pagelayer_section_id']).(!empty($pagelayer->license['license']) ? '&license='.$pagelayer->license['license'] : '').'&url='.rawurlencode(site_url());
// For SitePad users
if(function_exists('get_softaculous_file')){
$get_url = get_softaculous_file($get_url, 1);
}
$fetch = wp_remote_get($get_url, array('timeout' => 60));
if ( is_array( $fetch ) && ! is_wp_error( $fetch ) && isset( $fetch['body'] ) ) {
$data = json_decode( $fetch['body'], true ); // use the content
}else{
$data['error'] = __pl('The response was malformed');
pagelayer_json_output($data);
}
}
if(isset($_REQUEST['postID'])){
$post_id = (int) $_REQUEST['postID'];
if(!empty($post_id)){
$post = get_post( $post_id );
// Need to make the reviews post global
if ( !empty( $post ) ) {
$GLOBALS['post'] = $post;
$GLOBALS['wp_query'] = new WP_Query([
'post_type' => $GLOBALS['post']->post_type,
'post__in' => array($post_id),
]);
}
}
}
// Upload the images if any in the shortcode
preg_match_all('/"'.preg_quote('{{pl_lib_images}}', '/').'([^"]*)"/is', $data['code'], $matches);
foreach($matches[0] as $k => $v){
$image_url = trim($v, '"\'');
$urls[$image_url] = $image_url;
}
foreach($urls as $k => $image_url){
$file = basename($image_url);
$id = 0;
// Upload this
if(!empty($data[$file])){
$id = pagelayer_upload_media($file, base64_decode($data[$file]));
if(!empty($id)){
$data['code'] = str_replace('"'.$image_url.'"', '"'.$id.'"', $data['code']);
}
}
}
// Load shortcodes
pagelayer_load_shortcodes();
if(!empty($data['code'])){
$data['code'] = pagelayer_the_content($data['code'], true);
}
pagelayer_json_output($data);
}
// Shortcodes Widget Handler
add_action('wp_ajax_pagelayer_get_section_blocks', 'pagelayer_get_section_blocks');
function pagelayer_get_section_blocks(){
global $pagelayer;
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
if(!current_user_can('edit_posts')){
$ret['error'][] = __pl('no_permission');
pagelayer_json_output($ret);
}
$data = '';
if(isset($_REQUEST['pagelayer_section_id'])){
$get_url = PAGELAYER_API.'/library.php?give_id='.sanitize_text_field($_REQUEST['pagelayer_section_id']).(!empty($pagelayer->license['license']) ? '&license='.$pagelayer->license['license'] : '').'&url='.rawurlencode(site_url());
// For SitePad users
if(function_exists('get_softaculous_file')){
$get_url = get_softaculous_file($get_url, 1);
}
$fetch = wp_remote_get($get_url, array('timeout' => 60));
if ( is_array( $fetch ) && ! is_wp_error( $fetch ) && isset( $fetch['body'] ) ) {
$data = json_decode( $fetch['body'], true ); // use the content
}else{
$data['error'] = __pl('The response was malformed');
pagelayer_json_output($data);
}
}
// Upload the images if any in the shortcode
preg_match_all('/"'.preg_quote('{{pl_lib_images}}', '/').'([^"]*)"/is', $data['code'], $matches);
foreach($matches[0] as $k => $v){
$image_url = trim($v, '"\'');
$urls[$image_url] = $image_url;
}
foreach($urls as $k => $image_url){
$file = basename($image_url);
$id = 0;
// Upload this
if(!empty($data[$file])){
$id = pagelayer_upload_media($file, base64_decode($data[$file]));
if(!empty($id)){
$data['code'] = str_replace('"'.$image_url.'"', '"'.$id.'"', $data['code']);
}
}
}
if ( false !== strpos( $data['code'], '[pl_' ) ) {
// Load shortcodes
pagelayer_load_shortcodes();
// Load Parse Shortcodes
include_once(PAGELAYER_DIR.'/main/parse-shortcodes.php');
$data['code'] = pagelayer_do_shortcode_to_block($data['code']);
}
$data['code'] = pagelayer_add_tmp_atts($data['code']);
pagelayer_json_output($data);
}
// Get the Site Title
add_action('wp_ajax_pagelayer_fetch_site_title', 'pagelayer_fetch_site_title');
function pagelayer_fetch_site_title(){
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
echo get_bloginfo('name');
wp_die();
}
// Update the Site Title
add_action('wp_ajax_pagelayer_update_site_title', 'pagelayer_update_site_title');
function pagelayer_update_site_title(){
global $wpdb;
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
$site_title = $_POST['site_title'];
if(!current_user_can('manage_options')){
$ret['error'][] = __pl('no_permission');
pagelayer_json_output($ret);
}
update_option('blogname', $site_title);
wp_die();
}
// Show the SideBars
add_action('wp_ajax_pagelayer_fetch_sidebar', 'pagelayer_fetch_sidebar');
function pagelayer_fetch_sidebar(){
global $wp_registered_sidebars;
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
// Create a list
$pagelayer_wp_widgets = array();
foreach($wp_registered_sidebars as $v){
$pagelayer_wp_widgets[$v['id']] = $v['name'];
}
$id = @$_REQUEST['sidebar'];
if(function_exists('dynamic_sidebar') && !empty($pagelayer_wp_widgets[$id])) {
ob_start();
dynamic_sidebar($id);
$result = ob_get_clean();
}else{
$result = __pl('no_widget_area');
}
echo $result;
wp_die();
}
// Show the primary menu !
add_action('wp_ajax_pagelayer_fetch_primary_menu', 'pagelayer_fetch_primary_menu');
function pagelayer_fetch_primary_menu(){
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
if(isset($_POST['nav_list'])){
$_POST['nav_list'] = (int) $_POST['nav_list'];
// Load Pagelayer nav menu walker
include_once(PAGELAYER_DIR.'/main/nav_walker.php');
$postID = (int) $_REQUEST['postID'];
// To on live mode
$GLOBALS['post'] = get_post($postID);
$GLOBALS['wp_query'] = new WP_Query([
'post_type' => $GLOBALS['post']->post_type,
'post__in' => array($postID),
]);
// Load short
pagelayer_load_shortcodes();
wp_nav_menu([
'menu' => wp_get_nav_menu_object($_POST['nav_list']),
'menu_id' => $_POST["nav_list"],
'menu_class' => 'pagelayer-wp_menu-ul',
'walker' => new Pagelayer_Walker_Nav_Menu(),
//'theme_location' => 'primary',
'echo' => true,
]);
}
wp_die();
}
// Save post revision
add_action('wp_ajax_pagelayer_create_post_autosave', 'pagelayer_create_post_autosave');
function pagelayer_create_post_autosave(){
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
$ret = array();
$postID = (int) $_GET['postID'];
$content = $_REQUEST['pagelayer_post_content'];
// Decode base64 data
$content = base64_decode($content);
$content = wp_slash($content);
// Are you allowed to edit ?
if(!pagelayer_user_can_edit($postID)){
$ret['error'][] = __pl('no_permission');
pagelayer_json_output($ret);
}
if(empty($postID)){
$ret['error'] = __pl('invalid_post_id');
}else{
$post = array(
'post_ID' => $postID,
'post_content' => $content,
);
$ret['id'] = wp_create_post_autosave($post);
}
$ret['url'] = get_preview_post_link($postID);
pagelayer_json_output($ret);
}
// Get post revision
add_action('wp_ajax_pagelayer_get_revision', 'pagelayer_get_revision');
function pagelayer_get_revision(){
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
$ret = array();
$postID = (int) $_GET['postID'];
// Are you allowed to edit ?
if(!pagelayer_user_can_edit($postID)){
$ret['error'][] = __pl('no_permission');
pagelayer_json_output($ret);
}
if(empty($postID)){
$ret['error'] = __pl('invalid_post_id');
}else{
$ret = pagelayer_get_post_revision_by_id($postID);
}
pagelayer_json_output($ret);
}
// Apply post revision
add_action('wp_ajax_pagelayer_apply_revision', 'pagelayer_apply_revision');
function pagelayer_apply_revision(){
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
$revisionID = (int) $_REQUEST['revisionID'];
$parID = wp_get_post_parent_id($revisionID);
$ret = array();
if(empty($parID)){
$parID = $revisionID;
}
// Are you allowed to edit ?
if(!pagelayer_user_can_edit($parID)){
$ret['error'][] = __pl('no_permission');
pagelayer_json_output($ret);
}
if(empty($revisionID)){
$ret['error'] = __pl('invalid_post_id');
}else{
$post = get_post( $revisionID );
if ( empty( $post ) ) {
$ret['error'] = __pl('invalid_revision');
pagelayer_json_output($ret);
}
// Need to make the reviews post global
$GLOBALS['post'] = $post;
$GLOBALS['wp_query'] = new WP_Query([
'post_type' => $GLOBALS['post']->post_type,
'post__in' => array($parID),
]);
// Need to reload the shortcodes
pagelayer_load_shortcodes();
$ret['id'] = $revisionID;
$ret['content'] = pagelayer_the_content($post->post_content, true);
if(is_wp_error($post)) {
$ret['error'] = __pl('rev_load_error');
}else{
$ret['success'] = __pl('rev_load_success');
}
wp_reset_postdata();
}
pagelayer_json_output($ret);
}
// Get post revision
add_action('wp_ajax_pagelayer_delete_revision', 'pagelayer_delete_revision');
function pagelayer_delete_revision() {
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
$revisionID = (int) $_REQUEST['revisionID'];
$parID = wp_get_post_parent_id($revisionID);
$ret = array();
// Are you allowed to edit ?
if(!pagelayer_user_can_edit($parID)){
$ret['error'][] = __pl('no_permission');
pagelayer_json_output($ret);
}
if(empty($revisionID)){
$ret['error'] = __pl('invalid_post_id');
}else{
$revision = get_post( $revisionID );
if ( empty( $revision ) ) {
$ret['error'] = __pl('invalid_revision');
}else{
if ( ! current_user_can( 'delete_post', $parID ) ) {
$ret['error'] = __pl('access_denied');
pagelayer_json_output($ret);
}
$deleted = wp_delete_post_revision( $revision->ID );
if ( ! $deleted || is_wp_error( $deleted ) ) {
$ret['error'] = __pl('delete_rev_error');
}else{
$ret['success'] = __pl('delete_rev_success');
}
}
}
pagelayer_json_output($ret);
}
// Get post navigation
add_action('wp_ajax_pagelayer_post_nav', 'pagelayer_post_nav');
function pagelayer_post_nav() {
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
if(!isset($_REQUEST['data']) || !isset($_REQUEST['postID'])){
return;
}
$el['atts'] = $_REQUEST['data'];
$post = get_post($_REQUEST['postID']);
// Need to make this post global
$GLOBALS['post'] = $post;
$in_same_term = false;
$taxonomies = 'category';
$title = '';
$arrows_list = $el['atts']['arrows_list'];
if($el['atts']['in_same_term']){
$in_same_term = true;
$taxonomies = $el['atts']['taxonomies'];
}
if($el['atts']['post_title']){
$title = '%title';
}
$next_label = '
'.$el["atts"]["next_label"].''.$title.'
';
$prev_label = '
'.$el["atts"]["prev_label"].''.$title.'
';
$el['atts']['next_link'] = get_next_post_link('%link', $next_label, $in_same_term, '', $taxonomies);
$el['atts']['prev_link'] = get_previous_post_link('%link', $prev_label, $in_same_term, '', $taxonomies );
pagelayer_json_output($el);
}
// Get post comment template
add_action('wp_ajax_pagelayer_post_comment', 'pagelayer_post_comment');
function pagelayer_post_comment() {
global $post;
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
if(!isset($_REQUEST['postID'])){
return true;
}
$GLOBALS['post'] = get_post($_REQUEST['postID']);
$GLOBALS['withcomments'] = true;
// Load shortcodes
pagelayer_load_shortcodes();
$el = [];
pagelayer_sc_post_comment($el);
echo $el['atts']['post_comment'];
wp_die();
}
// Get post comment template
add_action('wp_ajax_pagelayer_post_info', 'pagelayer_post_info');
function pagelayer_post_info() {
global $post;
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
if(!isset($_REQUEST['postID']) || !isset($_REQUEST['el'])){
return true;
}
$el['atts'] = $_REQUEST['el'];
$GLOBALS['post'] = get_post($_REQUEST['postID']);
// Load shortcodes
pagelayer_load_shortcodes();
pagelayer_sc_post_info_list($el);
pagelayer_json_output($el['atts']);
}
// Get the Featured Image
add_action('wp_ajax_pagelayer_fetch_featured_img', 'pagelayer_fetch_featured_img');
function pagelayer_fetch_featured_img(){
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
$id = get_post_thumbnail_id( (int) $_POST['post_id'] );
$img = [];
if(empty($id)){
pagelayer_json_output($img);
}
$img = pagelayer_image($id);
pagelayer_json_output($img);
}
// Get the postfolio posts
add_action('wp_ajax_pagelayer_fetch_posts', 'pagelayer_fetch_posts');
function pagelayer_fetch_posts(){
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
// This ajax call is only used during post/page editing
if(!current_user_can('edit_posts')){
echo __pl('no_permission');
wp_die();
}
$sanitized_post = pagelayer_sanitize_posts_data($_POST);
echo pagelayer_widget_posts($sanitized_post);
wp_die();
}
// Get the Posts
add_action('wp_ajax_pagelayer_posts_data', 'pagelayer_posts_data');
function pagelayer_posts_data(){
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
// This ajax call is only used during post/page editing
if(!current_user_can('edit_posts')){
echo __pl('no_permission');
wp_die();
}
// Load shortcodes
pagelayer_load_shortcodes();
$sanitized_post = pagelayer_sanitize_posts_data($_POST, false);
echo pagelayer_posts($sanitized_post);
wp_die();
}
// Get the Posts
add_action('wp_ajax_pagelayer_archive_posts_data', 'pagelayer_archive_posts_data');
function pagelayer_archive_posts_data(){
// Some AJAX security
check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
// Set excerpt length
if(!empty($_POST['atts']['exc_length'])){
$exc_length = (int) $_POST['atts']['exc_length'];
add_filter( 'excerpt_length', function($length) use($exc_length){
return $exc_length;
}, 999 );
}
// Load shortcodes
pagelayer_load_shortcodes();
foreach($_POST['atts'] as $k => $v){
$v = pagelayer_maybe_implode($v);
$r[] = esc_html($k).'="'.pagelayer_escapeHTML($v).'"';
}
$string = implode(' ', $r);
if(preg_match('/\]/is', $string)){
die('Hacking Attempt');
}
$sc = '[pl_archive_posts '.$string.'][/pl_archive_posts]';
echo pagelayer_the_content($sc);
wp_die();
}
// Handle Contact Form Data
add_action('wp_ajax_pagelayer_contact_submit', 'pagelayer_contact_submit');
add_action('wp_ajax_nopriv_pagelayer_contact_submit', 'pagelayer_contact_submit' );
function pagelayer_contact_submit(){
// Some AJAX security
check_ajax_referer('pagelayer_global', 'pagelayer_nonce');
// A filter to short circuit this contact form
$continue = apply_filters('pagelayer_contact_submit_start', 1);
if(empty($continue)){
return false;
}
$formdata = wp_unslash($_POST);
// NOTE : NEVER add anything to $formdata except $_POST vars
if(isset($_POST['g-recaptcha-response']) ){
if(!pagelayer_captcha_verify()){
$wp['failed'] = get_option('pagelayer_recaptcha_failed', __pl('cap_ver_fail'));
pagelayer_json_output($wp);
}
unset($formdata['g-recaptcha-response']);
}
// Unset the nonce
unset($formdata['pagelayer_nonce']);
$to_mail = get_option('pagelayer_cf_to_email');
$from_mail = get_option('pagelayer_cf_from_email');
$subject = get_option('pagelayer_cf_subject');
$additional_headers = get_option('pagelayer_cf_headers');
$reply_to = '';
$body = '';
$headers = '';
$custom_templ = array();
$use_custom = false;
$use_html = false;
$pagelayer_id = sanitize_text_field($formdata['cfa-pagelayer-id']);
if(isset($formdata['cfa-custom-template']) && !empty($formdata['cfa-post-id'])){
$post_id = (int) $formdata['cfa-post-id'];
if(!empty($post_id) && ( get_post_status( $post_id ) === 'publish' || current_user_can('publish_posts') )){
$contact_array = get_post_meta($post_id, 'pagelayer_contact_templates', true);
if(!empty($contact_array) && !empty($contact_array[$pagelayer_id])){
$custom_templ = $contact_array[$pagelayer_id];
$use_custom = true;
}
}
}
if($use_custom && !empty($custom_templ)){
if(!empty($custom_templ['to_email'])){
$to_mail = $custom_templ['to_email'];
}
if(!empty($custom_templ['from_email'])){
$from_mail = $custom_templ['from_email'];
}
if(!empty($custom_templ['cont_subject'])){
$subject = $custom_templ['cont_subject'];
}
if(!empty($custom_templ['cont_header'])){
$additional_headers = $custom_templ['cont_header'];
}
if(!empty($custom_templ['cont_body'])){
$body = $custom_templ['cont_body'];
}
if(!empty($custom_templ['cont_use_html'])){
$use_html = true;
$headers .= "Content-Type: text/html\n";
}
}
if(!empty($from_mail)){
$headers .= "From: $from_mail\n";
}
if ( !empty($additional_headers) ) {
$headers .= $additional_headers . "\n";
}
if ( empty($body) ) {
// Make the email content
foreach($formdata as $k => $i){
$not_allow = ['cfa-pagelayer-id', 'cfa-redirect', 'cfa-post-id', 'cfa-custom-template', 'pagelayer-contact-submit'];
if(in_array($k, $not_allow)){
continue;
}
$body .= sanitize_text_field($k)."\t : \t $".$k."\n";
}
$body .= "\n\n --\n This e-mail was sent from a contact form (".get_home_url().")";
}
// Add attachment
if(!empty($_FILES)){
add_action('phpmailer_init', 'pagelayer_cf_email_attachment', 10, 1);
}
$sanitized_data = array();
// If we are using HTML, then we should escape html as well
foreach($formdata as $k => $i){
if(is_array($i)){
$i = pagelayer_flat_join($i);
}
$i = pagelayer_esc_crlf($i);
if(!empty($use_html)){
$i = esc_html($i);
}
// Sanitize text field
$i = sanitize_text_field($i);
// Record a reply to if it is to be used
if(is_email($i) && empty($reply_to)){
$reply_to = $i;
}
$sanitized_data[$k] = $i;
}
// Dow we have a reply to in the headers ?
if(!preg_match('/reply\-to/is', $headers) && !empty($reply_to)){
$headers .= "Reply-To: $reply_to\n";
}
// Add Site Title as option in formdata
$sanitized_data['site_title'] = get_bloginfo( 'name' );
// Do parse a variables
$to_mail = pagelayer_replace_vars($to_mail, $sanitized_data, '$');
$from_mail = pagelayer_replace_vars($from_mail, $sanitized_data, '$');
$subject = pagelayer_replace_vars($subject, $sanitized_data, '$');
$headers = pagelayer_replace_vars($headers, $sanitized_data, '$');
$body = pagelayer_replace_vars($body, $sanitized_data, '$');
if ( $use_html && ! preg_match( '%\s].*