← All changes | classes/class-collections.php +47 -15 1.7 → 1.30 View file →

		@@ -137,8 +137,26 @@
137	137	else
138	138	return false; // no binds, don't check.
139	139	}
140	140
	141	+ // When MB PRO is configured to output CSS via file.
	142	+ static function outputFileCSS()
	143	+ {
	144	+ $collection_id = intval($_GET['id']);
	145	+ $doc_id = intval($_GET['doc']);
	146	+ $collection = new collection($collection_id);
	147	+ $css = $collection->getDisplayCSS($doc_id);
	148	+ header( "Content-type: text/css; charset: UTF-8" );
	149	+
	150	+ if ($css)
	151	+ {
	152	+ header( "Content-type: text/css; charset: UTF-8" );
	153	+ echo $css;
	154	+ }
	155	+ exit();
	156	+
	157	+ }
	158	+
141	159	/* Try to find the current place we are at in the site ( front / blog / page etc ) .*/
142	160	protected static function getCurrentHook()
143	161	{
144	162	$hook = '';
		@@ -267,8 +285,9 @@
267	285
268	286	$collection_id = intval($post_form["collection_id"]);
269	287
270	288	$admin = MB()->getClass('admin');
	289	+ $collection = new collection();
271	290
272	291
273	292	if (! Install::isPro() && $collection_id == 0)
274	293	{
		@@ -277,9 +296,9 @@
277	296	{
278	297	$result = array(
279	298	"error" => true,
280	299	);
281		- $admin->endAjaxRequest($result);
	300	+ $collection->endAjaxRequest($result);
282	301	}
283	302	}
284	303
285	304
		@@ -295,9 +314,8 @@
295	314	"new_nonce" => 0,
296	315	"title" => __("Saved!","mbsocial"),
297	316	);
298	317
299		- $collection = new collection();
300	318	$collection->set($collection_id);
301	319
302	320	// this can be a new id (!)
303	321	$collection_id = $collection->save($post_form);
		@@ -308,9 +326,9 @@
308	326	// $result["data"]["reload"] = apply_filters("collections_ajax_force_reload",$force_reload);
309	327
310	328	// $result["title"] = $result_title["success"];
311	329
312		- $admin->endAjaxRequest($result);
	330	+ $collection->endAjaxRequest($result);
313	331	}
314	332
315	333	static function ajax_remove_collection()
316	334	{
		@@ -316,9 +334,11 @@
316	334	{
317	335	$admin = MB()->getClass('admin');
318	336
319	337	$collection_id = intval($_POST['param']);
	338	+ $collection = new collection();
320	339
	340	+
321	341	$url = admin_url('?page=maxbuttons-social');
322	342
323	343	$result = array(
324	344	'error' => false,
		@@ -332,15 +352,14 @@
332	352	$where_format = array("%d");
333	353	$wpdb->delete($table, $where, $where_format);
334	354
335	355
336		- $admin->endAjaxRequest($result);
	356	+ $collection->endAjaxRequest($result);
337	357
338	358	}
339	359
340	360	static function ajax_action_front()
341	361	{
342		-
343	362	// only for trivial front page actions!
344	363	self::ajax_action(array("ajax_nopriv" => true));
345	364	}
346	365
		@@ -349,9 +368,8 @@
349	368	ob_start();
350	369	$defaults = array("ajax_nopriv" => false);
351	370	$args = wp_parse_args($args, $defaults);
352	371
353		-
354	372	$admin = MB()->getClass('admin');
355	373
356	374	$nonce = isset($_POST["nonce"]) ? $_POST["nonce"] : false;
357	375	$block_name = sanitize_text_field($_POST["block_name"]);
		@@ -358,14 +376,31 @@
358	376	$block_action = sanitize_text_field($_POST["block_action"]);
359	377	$block_data = (isset($_POST["block_data"])) ? $_POST["block_data"] : '';
360	378	$action = sanitize_text_field($_POST["action"]);
361	379
	380	+ // Weirdly only one, but security, lets checks this without changing other code too much
	381	+ $possible_actions =['mbsocial_get_count'];
	382	+
362	383	$collection_id = intval($_POST["collection_id"]);
	384	+ $collection = new collection($collection_id);
	385	+
	386	+ if (false === in_array($action, $possible_actions))
	387	+ {
	388	+ $result["error"] = true;
	389	+ $result["body"] = __("Bad Action","maxbuttons");
	390	+ $result["result"] = false;
	391	+ $result["title"] = __("Security error","maxbuttons");
	392	+ $result["data"] = array("id" => $collection_id);
	393	+
	394	+ $collection->endAjaxRequest($result);
	395	+ }
	396	+
	397	+
363	398	// $collection_type = sanitize_text_field($_POST["collection_type"]);
364	399
365		- if(! $args["ajax_nopriv"])
366		- {
367		- if (! wp_verify_nonce($nonce, $action . "-" . $collection_id))
	400	+ //if(! $args["ajax_nopriv"])
	401	+ //{
	402	+ if (! wp_verify_nonce($nonce, "maxsocial_ajax_action-" . $collection_id))
368	403	{
369	404	$result["error"] = true;
370	405	$result["body"] = __("Nonce not verified","maxbuttons");
371	406	$result["result"] = false;
		@@ -371,12 +406,12 @@
371	406	$result["result"] = false;
372	407	$result["title"] = __("Security error","maxbuttons");
373	408	$result["data"] = array("id" => $collection_id);
374	409
375		- $admin->endAjaxRequest($result);
	410	+ $collection->endAjaxRequest($result);
376	411
377	412	}
378		- }
	413	+ //}
379	414
380	415	$result = array(
381	416	"error" => false,
382	417	"body" => '',
		@@ -384,16 +419,13 @@
384	419	"data" => array(),
385	420	"new_nonce" => 0,
386	421	);
387	422
388		- $collection = new collection($collection_id);
389		-
390	423	$result = $collection->doBlockAjax($result, $block_name, $block_action, $block_data);
391	424
392	425	//ob_end_clean(); // prevent PHP errors from breaking JSON response.
393	426
394		- $admin->endAjaxRequest($result);
395		- $results = $collection->get_meta($name, 'collection_name');
	427	+ $collection->endAjaxRequest($result);
396	428	}
397	429
398	430
399	431	public static function ajax_refreshblock()