← All changes | classes/class-collections.php +16 -48 trunk → 1.5 View file →

		@@ -137,26 +137,8 @@
137	137	else
138	138	return false; // no binds, don't check.
139	139	}
140	140
141		- // When MB PRO is configured to output CSS via file.
142		- static function outputFileCSS()
143		- {
144		- $collection_id = intval($_GET['id']);
145		- $doc_id = intval($_GET['doc']);
146		- $collection = new collection($collection_id);
147		- $css = $collection->getDisplayCSS($doc_id);
148		- header( "Content-type: text/css; charset: UTF-8" );
149		-
150		- if ($css)
151		- {
152		- header( "Content-type: text/css; charset: UTF-8" );
153		- echo $css;
154		- }
155		- exit();
156		-
157		- }
158		-
159	141	/* Try to find the current place we are at in the site ( front / blog / page etc ) .*/
160	142	protected static function getCurrentHook()
161	143	{
162	144	$hook = '';
		@@ -193,10 +175,10 @@
193	175	$hook = 'display_' . $this_post_type;
194	176	}
195	177
196	178	}
	179	+
197	180
198		-
199	181	return $hook;
200	182	}
201	183
202	184	static function doContentHooks($content)
		@@ -285,9 +267,8 @@
285	267
286	268	$collection_id = intval($post_form["collection_id"]);
287	269
288	270	$admin = MB()->getClass('admin');
289		- $collection = new collection();
290	271
291	272
292	273	if (! Install::isPro() && $collection_id == 0)
293	274	{
		@@ -296,9 +277,9 @@
296	277	{
297	278	$result = array(
298	279	"error" => true,
299	280	);
300		- $collection->endAjaxRequest($result);
	281	+ $admin->endAjaxRequest($result);
301	282	}
302	283	}
303	284
304	285
		@@ -314,8 +295,9 @@
314	295	"new_nonce" => 0,
315	296	"title" => __("Saved!","mbsocial"),
316	297	);
317	298
	299	+ $collection = new collection();
318	300	$collection->set($collection_id);
319	301
320	302	// this can be a new id (!)
321	303	$collection_id = $collection->save($post_form);
		@@ -326,9 +308,9 @@
326	308	// $result["data"]["reload"] = apply_filters("collections_ajax_force_reload",$force_reload);
327	309
328	310	// $result["title"] = $result_title["success"];
329	311
330		- $collection->endAjaxRequest($result);
	312	+ $admin->endAjaxRequest($result);
331	313	}
332	314
333	315	static function ajax_remove_collection()
334	316	{
		@@ -334,11 +316,9 @@
334	316	{
335	317	$admin = MB()->getClass('admin');
336	318
337	319	$collection_id = intval($_POST['param']);
338		- $collection = new collection();
339	320
340		-
341	321	$url = admin_url('?page=maxbuttons-social');
342	322
343	323	$result = array(
344	324	'error' => false,
		@@ -352,14 +332,15 @@
352	332	$where_format = array("%d");
353	333	$wpdb->delete($table, $where, $where_format);
354	334
355	335
356		- $collection->endAjaxRequest($result);
	336	+ $admin->endAjaxRequest($result);
357	337
358	338	}
359	339
360	340	static function ajax_action_front()
361	341	{
	342	+
362	343	// only for trivial front page actions!
363	344	self::ajax_action(array("ajax_nopriv" => true));
364	345	}
365	346
		@@ -368,8 +349,9 @@
368	349	ob_start();
369	350	$defaults = array("ajax_nopriv" => false);
370	351	$args = wp_parse_args($args, $defaults);
371	352
	353	+
372	354	$admin = MB()->getClass('admin');
373	355
374	356	$nonce = isset($_POST["nonce"]) ? $_POST["nonce"] : false;
375	357	$block_name = sanitize_text_field($_POST["block_name"]);
		@@ -376,31 +358,14 @@
376	358	$block_action = sanitize_text_field($_POST["block_action"]);
377	359	$block_data = (isset($_POST["block_data"])) ? $_POST["block_data"] : '';
378	360	$action = sanitize_text_field($_POST["action"]);
379	361
380		- // Weirdly only one, but security, lets checks this without changing other code too much
381		- $possible_actions =['mbsocial_get_count'];
382		-
383	362	$collection_id = intval($_POST["collection_id"]);
384		- $collection = new collection($collection_id);
	363	+ // $collection_type = sanitize_text_field($_POST["collection_type"]);
385	364
386		- if (false === in_array($action, $possible_actions))
	365	+ if(! $args["ajax_nopriv"])
387	366	{
388		- $result["error"] = true;
389		- $result["body"] = __("Bad Action","maxbuttons");
390		- $result["result"] = false;
391		- $result["title"] = __("Security error","maxbuttons");
392		- $result["data"] = array("id" => $collection_id);
393		-
394		- $collection->endAjaxRequest($result);
395		- }
396		-
397		-
398		- // $collection_type = sanitize_text_field($_POST["collection_type"]);
399		-
400		- //if(! $args["ajax_nopriv"])
401		- //{
402		- if (! wp_verify_nonce($nonce, "maxsocial_ajax_action-" . $collection_id))
	367	+ if (! wp_verify_nonce($nonce, $action . "-" . $collection_id))
403	368	{
404	369	$result["error"] = true;
405	370	$result["body"] = __("Nonce not verified","maxbuttons");
406	371	$result["result"] = false;
		@@ -406,12 +371,12 @@
406	371	$result["result"] = false;
407	372	$result["title"] = __("Security error","maxbuttons");
408	373	$result["data"] = array("id" => $collection_id);
409	374
410		- $collection->endAjaxRequest($result);
	375	+ $admin->endAjaxRequest($result);
411	376
412	377	}
413		- //}
	378	+ }
414	379
415	380	$result = array(
416	381	"error" => false,
417	382	"body" => '',
		@@ -419,13 +384,16 @@
419	384	"data" => array(),
420	385	"new_nonce" => 0,
421	386	);
422	387
	388	+ $collection = new collection($collection_id);
	389	+
423	390	$result = $collection->doBlockAjax($result, $block_name, $block_action, $block_data);
424	391
425	392	//ob_end_clean(); // prevent PHP errors from breaking JSON response.
426	393
427		- $collection->endAjaxRequest($result);
	394	+ $admin->endAjaxRequest($result);
	395	+ $results = $collection->get_meta($name, 'collection_name');
428	396	}
429	397
430	398
431	399	public static function ajax_refreshblock()