← All changes
|
admin/views/sp-framework/classes/metabox.class.php
+68
-120
2.4.20
→
2.2.10
View file →
| @@ -1,63 +1,24 @@ | ||
| 1 | -<?php | |
| 1 | +<?php if ( ! defined( 'ABSPATH' ) ) { | |
| 2 | + die; | |
| 3 | +} // Cannot access directly. | |
| 2 | 4 | /** |
| 3 | - * The metabox class of the plugin. | |
| 4 | 5 | * |
| 5 | - * @package Smart_Post_Show | |
| 6 | - * @subpackage Smart_Post_Show/views/sp-framework/classes | |
| 6 | + * Metabox Class | |
| 7 | + * | |
| 8 | + * @since 1.0.0 | |
| 9 | + * @version 1.0.0 | |
| 7 | 10 | */ |
| 8 | - | |
| 9 | -if ( ! defined( 'ABSPATH' ) ) { | |
| 10 | - die; | |
| 11 | -} // Cannot access directly. | |
| 12 | - | |
| 13 | 11 | if ( ! class_exists( 'SP_PC_Metabox' ) ) { |
| 14 | - /** | |
| 15 | - * | |
| 16 | - * Metabox Class | |
| 17 | - * | |
| 18 | - * @since 1.0.0 | |
| 19 | - * @version 1.0.0 | |
| 20 | - */ | |
| 21 | 12 | class SP_PC_Metabox extends SP_PC_Abstract { |
| 22 | 13 | |
| 23 | - /** | |
| 24 | - * Property. | |
| 25 | - * | |
| 26 | - * @var string | |
| 27 | - */ | |
| 28 | - public $unique = ''; | |
| 29 | - /** | |
| 30 | - * Properties for metabox. | |
| 31 | - * | |
| 32 | - * @var string | |
| 33 | - */ | |
| 34 | - public $abstract = 'metabox'; | |
| 35 | - /** | |
| 36 | - * Pre fields property. | |
| 37 | - * | |
| 38 | - * @var array | |
| 39 | - */ | |
| 14 | + // constants. | |
| 15 | + public $unique = ''; | |
| 16 | + public $abstract = 'metabox'; | |
| 40 | 17 | public $pre_fields = array(); |
| 41 | - | |
| 42 | - /** | |
| 43 | - * Sections. | |
| 44 | - * | |
| 45 | - * @var array | |
| 46 | - */ | |
| 47 | - public $sections = array(); | |
| 48 | - /** | |
| 49 | - * Post Types. | |
| 50 | - * | |
| 51 | - * @var array | |
| 52 | - */ | |
| 53 | - public $post_type = array(); | |
| 54 | - /** | |
| 55 | - * Arguments. | |
| 56 | - * | |
| 57 | - * @var array | |
| 58 | - */ | |
| 59 | - public $args = array( | |
| 18 | + public $sections = array(); | |
| 19 | + public $post_type = array(); | |
| 20 | + public $args = array( | |
| 60 | 21 | 'title' => '', |
| 61 | 22 | 'post_type' => 'post', |
| 62 | 23 | 'data_type' => 'serialize', |
| 63 | 24 | 'context' => 'advanced', |
| @@ -153,11 +114,9 @@ | ||
| 153 | 114 | $saved_post_format = ( ! empty( $saved_post_format ) ) ? $saved_post_format : 'default'; |
| 154 | 115 | |
| 155 | 116 | $classes[] = 'spf-post-formats'; |
| 156 | 117 | |
| 157 | - /** | |
| 158 | - * Sanitize post format for standard to default. | |
| 159 | - */ | |
| 118 | + // Sanitize post format for standard to default. | |
| 160 | 119 | if ( ( $key = array_search( 'standard', $this->post_formats ) ) !== false ) { |
| 161 | 120 | $this->post_formats[ $key ] = 'default'; |
| 162 | 121 | } |
| 163 | 122 | |
| @@ -209,14 +168,9 @@ | ||
| 209 | 168 | } |
| 210 | 169 | |
| 211 | 170 | } |
| 212 | 171 | |
| 213 | - /** | |
| 214 | - * Get default value. | |
| 215 | - * | |
| 216 | - * @param array $field The field value. | |
| 217 | - * @return mixed | |
| 218 | - */ | |
| 172 | + // get default value. | |
| 219 | 173 | public function get_default( $field ) { |
| 220 | 174 | |
| 221 | 175 | // $default = ( isset( $this->args['defaults'][ $field['id'] ] ) ) ? $this->args['defaults'][ $field['id'] ] : ''; |
| 222 | 176 | $default = ( isset( $field['id'] ) && isset( $this->args['defaults'][ $field['id'] ] ) ) ? $this->args['defaults'][ $field['id'] ] : null; |
| @@ -239,9 +193,9 @@ | ||
| 239 | 193 | $value = null; |
| 240 | 194 | |
| 241 | 195 | if ( is_object( $post ) && ! empty( $field['id'] ) ) { |
| 242 | 196 | |
| 243 | - if ( 'serialize' !== $this->args['data_type'] ) { | |
| 197 | + if ( $this->args['data_type'] !== 'serialize' ) { | |
| 244 | 198 | $meta = get_post_meta( $post->ID, $field['id'] ); |
| 245 | 199 | $value = ( isset( $meta[0] ) ) ? $meta[0] : null; |
| 246 | 200 | } else { |
| 247 | 201 | $meta = get_post_meta( $post->ID, $this->unique, true ); |
| @@ -248,9 +202,9 @@ | ||
| 248 | 202 | $value = ( isset( $meta[ $field['id'] ] ) ) ? $meta[ $field['id'] ] : null; |
| 249 | 203 | } |
| 250 | 204 | } |
| 251 | 205 | |
| 252 | - $default = ( isset( $field['id'] ) ) ? $this->get_default( $field ) : ''; | |
| 206 | + $default = $this->get_default( $field ); | |
| 253 | 207 | $value = ( isset( $value ) ) ? $value : $default; |
| 254 | 208 | |
| 255 | 209 | return $value; |
| 256 | 210 | |
| @@ -258,10 +212,10 @@ | ||
| 258 | 212 | |
| 259 | 213 | /** |
| 260 | 214 | * Add metabox content |
| 261 | 215 | * |
| 262 | - * @param object $post The post. | |
| 263 | - * @param array $callback The callback function. | |
| 216 | + * @param array $post The post. | |
| 217 | + * @param array $callback The callback function. | |
| 264 | 218 | * @return void |
| 265 | 219 | */ |
| 266 | 220 | public function add_meta_box_content( $post, $callback ) { |
| 267 | 221 | |
| @@ -266,14 +220,14 @@ | ||
| 266 | 220 | public function add_meta_box_content( $post, $callback ) { |
| 267 | 221 | |
| 268 | 222 | global $post; |
| 269 | 223 | |
| 270 | - $has_nav = ( count( $this->sections ) > 1 && 'side' !== $this->args['context'] ) ? true : false; | |
| 224 | + $has_nav = ( count( $this->sections ) > 1 && $this->args['context'] !== 'side' ) ? true : false; | |
| 271 | 225 | $show_all = ( ! $has_nav ) ? ' spf-show-all' : ''; |
| 272 | 226 | $errors = ( is_object( $post ) ) ? get_post_meta( $post->ID, '_spf_errors', true ) : array(); |
| 273 | 227 | $errors = ( ! empty( $errors ) ) ? $errors : array(); |
| 274 | 228 | $theme = ( $this->args['theme'] ) ? ' spf-theme-' . $this->args['theme'] : ''; |
| 275 | - // $class = ( $this->args['class'] ) ? ' ' . $this->args['class'] : ''; | |
| 229 | +//$class = ( $this->args['class'] ) ? ' ' . $this->args['class'] : ''; | |
| 276 | 230 | |
| 277 | 231 | if ( is_object( $post ) && ! empty( $errors ) ) { |
| 278 | 232 | delete_post_meta( $post->ID, '_spf_errors' ); |
| 279 | 233 | } |
| @@ -279,15 +233,15 @@ | ||
| 279 | 233 | } |
| 280 | 234 | |
| 281 | 235 | wp_nonce_field( 'spf_pcp_metabox_nonce', 'spf_pcp_metabox_nonce' . $this->unique ); |
| 282 | 236 | |
| 283 | - echo '<div class="spf spf-metabox' . esc_attr( $theme ) . '">'; | |
| 237 | + echo '<div class="spf spf-metabox' . $theme . '">'; | |
| 284 | 238 | |
| 285 | - echo '<div class="spf-wrapper' . esc_attr( $show_all ) . '">'; | |
| 239 | + echo '<div class="spf-wrapper' . $show_all . '">'; | |
| 286 | 240 | |
| 287 | 241 | if ( $has_nav ) { |
| 288 | 242 | |
| 289 | - echo '<div class="spf-nav spf-nav-metabox" data-unique="' . esc_attr( $this->unique ) . '">'; | |
| 243 | + echo '<div class="spf-nav spf-nav-metabox" data-unique="' . $this->unique . '">'; | |
| 290 | 244 | |
| 291 | 245 | echo '<ul>'; |
| 292 | 246 | $tab_key = 1; |
| 293 | 247 | foreach ( $this->sections as $section ) { |
| @@ -292,11 +246,11 @@ | ||
| 292 | 246 | $tab_key = 1; |
| 293 | 247 | foreach ( $this->sections as $section ) { |
| 294 | 248 | |
| 295 | 249 | $tab_error = ( ! empty( $errors['sections'][ $tab_key ] ) ) ? '<i class="spf-label-error spf-error">!</i>' : ''; |
| 296 | - $tab_icon = ( ! empty( $section['icon'] ) ) ? '<i class="spf-icon ' . esc_attr( $section['icon'] ) . '"></i>' : ''; | |
| 250 | + $tab_icon = ( ! empty( $section['icon'] ) ) ? '<i class="spf-icon ' . $section['icon'] . '"></i>' : ''; | |
| 297 | 251 | // Added li class to hide when needs, -ShapedPlugin. |
| 298 | - echo '<li class="menu-item_' . esc_attr( $this->unique ) . '_' . esc_attr( $tab_key ) . '"><a href="#" data-section="' . esc_attr( $this->unique ) . '_' . esc_attr( $tab_key ) . '">' . wp_kses_post( $tab_icon ) . esc_html( $section['title'] ) . esc_html( $tab_error ) . '</a></li>'; | |
| 252 | + echo '<li class="menu-item_' . $this->unique . '_' . $tab_key . '"><a href="#" data-section="' . $this->unique . '_' . $tab_key . '">' . $tab_icon . $section['title'] . $tab_error . '</a></li>'; | |
| 299 | 253 | |
| 300 | 254 | $tab_key++; |
| 301 | 255 | } |
| 302 | 256 | echo '</ul>'; |
| @@ -314,14 +268,14 @@ | ||
| 314 | 268 | foreach ( $this->sections as $section ) { |
| 315 | 269 | |
| 316 | 270 | $onload = ( ! $has_nav ) ? ' spf-onload' : ''; |
| 317 | 271 | |
| 318 | - echo '<div id="spf-section-' . esc_attr( $this->unique ) . '_' . esc_attr( $section_key ) . '" class="spf-section' . esc_attr( $onload ) . '">'; | |
| 272 | + echo '<div id="spf-section-' . $this->unique . '_' . $section_key . '" class="spf-section' . $onload . '">'; | |
| 319 | 273 | |
| 320 | 274 | $section_icon = ( ! empty( $section['icon'] ) ) ? '<i class="spf-icon ' . $section['icon'] . '"></i>' : ''; |
| 321 | 275 | $section_title = ( ! empty( $section['title'] ) ) ? $section['title'] : ''; |
| 322 | 276 | |
| 323 | - echo ( $section_title || $section_icon ) ? '<div class="spf-section-title"><h3>' . esc_html( $section_icon ) . esc_html( $section_title ) . '</h3></div>' : ''; | |
| 277 | + echo ( $section_title || $section_icon ) ? '<div class="spf-section-title"><h3>' . $section_icon . $section_title . '</h3></div>' : ''; | |
| 324 | 278 | |
| 325 | 279 | if ( ! empty( $section['fields'] ) ) { |
| 326 | 280 | |
| 327 | 281 | foreach ( $section['fields'] as $field ) { |
| @@ -334,9 +288,9 @@ | ||
| 334 | 288 | |
| 335 | 289 | } |
| 336 | 290 | } else { |
| 337 | 291 | |
| 338 | - echo '<div class="spf-no-option spf-text-muted">' . esc_html__( 'No option provided by developer.', 'post-carousel' ) . '</div>'; | |
| 292 | + echo '<div class="spf-no-option spf-text-muted">' . esc_html__( 'No option provided by developer.', 'smart-post-show' ) . '</div>'; | |
| 339 | 293 | |
| 340 | 294 | } |
| 341 | 295 | |
| 342 | 296 | echo '</div>'; |
| @@ -344,9 +298,9 @@ | ||
| 344 | 298 | $section_key++; |
| 345 | 299 | } |
| 346 | 300 | |
| 347 | 301 | echo '</div>'; |
| 348 | - echo '<a class="btn btn-success" id="spsp-show-preview" data-id="' . esc_attr( $post->ID ) . '"href=""><i class="fa fa-eye"></i> Show Preview</a>'; | |
| 302 | + | |
| 349 | 303 | echo '<div class="clear"></div>'; |
| 350 | 304 | |
| 351 | 305 | if ( ! empty( $this->args['show_restore'] ) ) { |
| 352 | 306 | |
| @@ -351,11 +305,11 @@ | ||
| 351 | 305 | if ( ! empty( $this->args['show_restore'] ) ) { |
| 352 | 306 | |
| 353 | 307 | echo '<div class="spf-restore-wrapper">'; |
| 354 | 308 | echo '<label>'; |
| 355 | - echo '<input type="checkbox" name="' . esc_attr( $this->unique ) . '[_restore]" />'; | |
| 356 | - echo '<span class="button spf-button-restore">' . esc_html__( 'Restore', 'post-carousel' ) . '</span>'; | |
| 357 | - echo '<span class="button spf-button-cancel">' . sprintf( '<small>( %s )</small> %s', esc_html__( 'update post for restore ', 'post-carousel' ), esc_html__( 'Cancel', 'post-carousel' ) ) . '</span>'; | |
| 309 | + echo '<input type="checkbox" name="' . $this->unique . '[_restore]" />'; | |
| 310 | + echo '<span class="button spf-button-restore">' . esc_html__( 'Restore', 'smart-post-show' ) . '</span>'; | |
| 311 | + echo '<span class="button spf-button-cancel">' . sprintf( '<small>( %s )</small> %s', esc_html__( 'update post for restore ', 'smart-post-show' ), esc_html__( 'Cancel', 'smart-post-show' ) ) . '</span>'; | |
| 358 | 312 | echo '</label>'; |
| 359 | 313 | echo '</div>'; |
| 360 | 314 | |
| 361 | 315 | } |
| @@ -379,21 +333,19 @@ | ||
| 379 | 333 | * @return statement |
| 380 | 334 | */ |
| 381 | 335 | public function save_meta_box( $post_id ) { |
| 382 | 336 | |
| 383 | - $count = 1; | |
| 384 | - $data = array(); | |
| 385 | - $errors = array(); | |
| 386 | - $noncekey = 'spf_pcp_metabox_nonce' . $this->unique; | |
| 387 | - $nonce = ( ! empty( $_POST[ $noncekey ] ) ) ? sanitize_text_field( wp_unslash( $_POST[ $noncekey ] ) ) : ''; | |
| 388 | - if ( ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) || ! wp_verify_nonce( $nonce, 'spf_pcp_metabox_nonce' ) ) { | |
| 337 | + if ( ! wp_verify_nonce( spf_get_var( 'spf_pcp_metabox_nonce' . $this->unique ), 'spf_pcp_metabox_nonce' ) ) { | |
| 389 | 338 | return $post_id; |
| 390 | 339 | } |
| 391 | 340 | |
| 392 | - // XSS ok. | |
| 393 | - // No worries, This "POST" requests is sanitizing in the below foreach. | |
| 394 | - $request = ( ! empty( $_POST[ $this->unique ] ) ) ? $_POST[ $this->unique ] : array(); // phpcs:ignore | |
| 341 | + if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) { | |
| 342 | + return $post_id; | |
| 343 | + } | |
| 395 | 344 | |
| 345 | + $errors = array(); | |
| 346 | + $request = spf_get_var( $this->unique ); | |
| 347 | + | |
| 396 | 348 | if ( ! empty( $request ) ) { |
| 397 | 349 | |
| 398 | 350 | // ignore _nonce. |
| 399 | 351 | if ( isset( $request['_nonce'] ) ) { |
| @@ -408,42 +360,38 @@ | ||
| 408 | 360 | |
| 409 | 361 | foreach ( $section['fields'] as $field ) { |
| 410 | 362 | |
| 411 | 363 | if ( ! empty( $field['id'] ) ) { |
| 412 | - $field_id = $field['id']; | |
| 413 | - $field_value = isset( $request[ $field_id ] ) ? $request[ $field_id ] : ''; | |
| 414 | 364 | |
| 415 | - // Sanitize "post" request of field. | |
| 416 | - if ( ! isset( $field['sanitize'] ) ) { | |
| 365 | + // sanitize. | |
| 366 | + if ( ! empty( $field['sanitize'] ) ) { | |
| 417 | 367 | |
| 418 | - if ( is_array( $field_value ) ) { | |
| 419 | - $data[ $field_id ] = wp_kses_post_deep( $field_value ); | |
| 420 | - } else { | |
| 421 | - $data[ $field_id ] = wp_kses_post( $field_value ); | |
| 422 | - } | |
| 423 | - } elseif ( isset( $field['sanitize'] ) && is_callable( $field['sanitize'] ) ) { | |
| 368 | + $sanitize = $field['sanitize']; | |
| 369 | + $value_sanitize = isset( $request[ $field['id'] ] ) ? $request[ $field['id'] ] : ''; | |
| 370 | + $request[ $field['id'] ] = call_user_func( $sanitize, $value_sanitize ); | |
| 424 | 371 | |
| 425 | - $data[ $field_id ] = call_user_func( $field['sanitize'], $field_value ); | |
| 426 | - | |
| 427 | - } else { | |
| 428 | - | |
| 429 | - $data[ $field_id ] = $field_value; | |
| 430 | - | |
| 431 | 372 | } |
| 432 | 373 | |
| 433 | - // Validate "post" request of field. | |
| 434 | - if ( isset( $field['validate'] ) && is_callable( $field['validate'] ) ) { | |
| 374 | + // validate. | |
| 375 | + if ( ! empty( $field['validate'] ) ) { | |
| 435 | 376 | |
| 436 | - $has_validated = call_user_func( $field['validate'], $field_value ); | |
| 377 | + $validate = $field['validate']; | |
| 378 | + $value_validate = isset( $request[ $field['id'] ] ) ? $request[ $field['id'] ] : ''; | |
| 379 | + $has_validated = call_user_func( $validate, $value_validate ); | |
| 437 | 380 | |
| 438 | 381 | if ( ! empty( $has_validated ) ) { |
| 439 | 382 | |
| 440 | - $errors['sections'][ $count ] = true; | |
| 441 | - $errors['fields'][ $field_id ] = $has_validated; | |
| 442 | - $data[ $field_id ] = $this->get_meta_value( $field ); | |
| 383 | + $errors['sections'][ $section_key ] = true; | |
| 384 | + $errors['fields'][ $field['id'] ] = $has_validated; | |
| 385 | + $request[ $field['id'] ] = $this->get_meta_value( $field ); | |
| 443 | 386 | |
| 444 | 387 | } |
| 445 | 388 | } |
| 389 | + | |
| 390 | + // auto sanitize. | |
| 391 | + if ( ! isset( $request[ $field['id'] ] ) || is_null( $request[ $field['id'] ] ) ) { | |
| 392 | + $request[ $field['id'] ] = ''; | |
| 393 | + } | |
| 446 | 394 | } |
| 447 | 395 | } |
| 448 | 396 | } |
| 449 | 397 | |
| @@ -449,16 +397,16 @@ | ||
| 449 | 397 | |
| 450 | 398 | $section_key++; |
| 451 | 399 | } |
| 452 | 400 | } |
| 453 | - $data = apply_filters( "spf_{$this->unique}_save", $data, $post_id, $this ); | |
| 401 | + $request = apply_filters( "spf_{$this->unique}_save", $request, $post_id, $this ); | |
| 454 | 402 | |
| 455 | - do_action( "spf_{$this->unique}_save_before", $data, $post_id, $this ); | |
| 403 | + do_action( "spf_{$this->unique}_save_before", $request, $post_id, $this ); | |
| 456 | 404 | |
| 457 | - if ( empty( $data ) || ! empty( $request['_restore'] ) ) { | |
| 405 | + if ( empty( $request ) || ! empty( $request['_restore'] ) ) { | |
| 458 | 406 | |
| 459 | - if ( 'serialize' !== $this->args['data_type'] ) { | |
| 460 | - foreach ( $data as $key => $value ) { | |
| 407 | + if ( $this->args['data_type'] !== 'serialize' ) { | |
| 408 | + foreach ( $request as $key => $value ) { | |
| 461 | 409 | delete_post_meta( $post_id, $key ); |
| 462 | 410 | } |
| 463 | 411 | } else { |
| 464 | 412 | delete_post_meta( $post_id, $this->unique ); |
| @@ -464,14 +412,14 @@ | ||
| 464 | 412 | delete_post_meta( $post_id, $this->unique ); |
| 465 | 413 | } |
| 466 | 414 | } else { |
| 467 | 415 | |
| 468 | - if ( 'serialize' !== $this->args['data_type'] ) { | |
| 469 | - foreach ( $data as $key => $value ) { | |
| 416 | + if ( $this->args['data_type'] !== 'serialize' ) { | |
| 417 | + foreach ( $request as $key => $value ) { | |
| 470 | 418 | update_post_meta( $post_id, $key, $value ); |
| 471 | 419 | } |
| 472 | 420 | } else { |
| 473 | - update_post_meta( $post_id, $this->unique, $data ); | |
| 421 | + update_post_meta( $post_id, $this->unique, $request ); | |
| 474 | 422 | } |
| 475 | 423 | |
| 476 | 424 | if ( ! empty( $errors ) ) { |
| 477 | 425 | update_post_meta( $post_id, '_spf_errors', $errors ); |
| @@ -477,10 +425,10 @@ | ||
| 477 | 425 | update_post_meta( $post_id, '_spf_errors', $errors ); |
| 478 | 426 | } |
| 479 | 427 | } |
| 480 | 428 | |
| 481 | - do_action( "spf_{$this->unique}_saved", $data, $post_id, $this ); | |
| 429 | + do_action( "spf_{$this->unique}_saved", $request, $post_id, $this ); | |
| 482 | 430 | |
| 483 | - do_action( "spf_{$this->unique}_save_after", $data, $post_id, $this ); | |
| 431 | + do_action( "spf_{$this->unique}_save_after", $request, $post_id, $this ); | |
| 484 | 432 | } |
| 485 | 433 | } |
| 486 | 434 | } |