← All changes | classes/class-collections.php +33 -16 1.12 → trunk View file →

		@@ -141,10 +141,13 @@
141	141	// When MB PRO is configured to output CSS via file.
142	142	static function outputFileCSS()
143	143	{
144	144	$collection_id = intval($_GET['id']);
	145	+ $doc_id = intval($_GET['doc']);
145	146	$collection = new collection($collection_id);
146		- $css = $collection->getDisplayCSS();
	147	+ $css = $collection->getDisplayCSS($doc_id);
	148	+ header( "Content-type: text/css; charset: UTF-8" );
	149	+
147	150	if ($css)
148	151	{
149	152	header( "Content-type: text/css; charset: UTF-8" );
150	153	echo $css;
		@@ -282,8 +285,9 @@
282	285
283	286	$collection_id = intval($post_form["collection_id"]);
284	287
285	288	$admin = MB()->getClass('admin');
	289	+ $collection = new collection();
286	290
287	291
288	292	if (! Install::isPro() && $collection_id == 0)
289	293	{
		@@ -292,9 +296,9 @@
292	296	{
293	297	$result = array(
294	298	"error" => true,
295	299	);
296		- $admin->endAjaxRequest($result);
	300	+ $collection->endAjaxRequest($result);
297	301	}
298	302	}
299	303
300	304
		@@ -310,9 +314,8 @@
310	314	"new_nonce" => 0,
311	315	"title" => __("Saved!","mbsocial"),
312	316	);
313	317
314		- $collection = new collection();
315	318	$collection->set($collection_id);
316	319
317	320	// this can be a new id (!)
318	321	$collection_id = $collection->save($post_form);
		@@ -323,9 +326,9 @@
323	326	// $result["data"]["reload"] = apply_filters("collections_ajax_force_reload",$force_reload);
324	327
325	328	// $result["title"] = $result_title["success"];
326	329
327		- $admin->endAjaxRequest($result);
	330	+ $collection->endAjaxRequest($result);
328	331	}
329	332
330	333	static function ajax_remove_collection()
331	334	{
		@@ -331,9 +334,11 @@
331	334	{
332	335	$admin = MB()->getClass('admin');
333	336
334	337	$collection_id = intval($_POST['param']);
	338	+ $collection = new collection();
335	339
	340	+
336	341	$url = admin_url('?page=maxbuttons-social');
337	342
338	343	$result = array(
339	344	'error' => false,
		@@ -347,15 +352,14 @@
347	352	$where_format = array("%d");
348	353	$wpdb->delete($table, $where, $where_format);
349	354
350	355
351		- $admin->endAjaxRequest($result);
	356	+ $collection->endAjaxRequest($result);
352	357
353	358	}
354	359
355	360	static function ajax_action_front()
356	361	{
357		-
358	362	// only for trivial front page actions!
359	363	self::ajax_action(array("ajax_nopriv" => true));
360	364	}
361	365
		@@ -364,9 +368,8 @@
364	368	ob_start();
365	369	$defaults = array("ajax_nopriv" => false);
366	370	$args = wp_parse_args($args, $defaults);
367	371
368		-
369	372	$admin = MB()->getClass('admin');
370	373
371	374	$nonce = isset($_POST["nonce"]) ? $_POST["nonce"] : false;
372	375	$block_name = sanitize_text_field($_POST["block_name"]);
		@@ -373,14 +376,31 @@
373	376	$block_action = sanitize_text_field($_POST["block_action"]);
374	377	$block_data = (isset($_POST["block_data"])) ? $_POST["block_data"] : '';
375	378	$action = sanitize_text_field($_POST["action"]);
376	379
	380	+ // Weirdly only one, but security, lets checks this without changing other code too much
	381	+ $possible_actions =['mbsocial_get_count'];
	382	+
377	383	$collection_id = intval($_POST["collection_id"]);
	384	+ $collection = new collection($collection_id);
	385	+
	386	+ if (false === in_array($action, $possible_actions))
	387	+ {
	388	+ $result["error"] = true;
	389	+ $result["body"] = __("Bad Action","maxbuttons");
	390	+ $result["result"] = false;
	391	+ $result["title"] = __("Security error","maxbuttons");
	392	+ $result["data"] = array("id" => $collection_id);
	393	+
	394	+ $collection->endAjaxRequest($result);
	395	+ }
	396	+
	397	+
378	398	// $collection_type = sanitize_text_field($_POST["collection_type"]);
379	399
380		- if(! $args["ajax_nopriv"])
381		- {
382		- if (! wp_verify_nonce($nonce, $action . "-" . $collection_id))
	400	+ //if(! $args["ajax_nopriv"])
	401	+ //{
	402	+ if (! wp_verify_nonce($nonce, "maxsocial_ajax_action-" . $collection_id))
383	403	{
384	404	$result["error"] = true;
385	405	$result["body"] = __("Nonce not verified","maxbuttons");
386	406	$result["result"] = false;
		@@ -386,12 +406,12 @@
386	406	$result["result"] = false;
387	407	$result["title"] = __("Security error","maxbuttons");
388	408	$result["data"] = array("id" => $collection_id);
389	409
390		- $admin->endAjaxRequest($result);
	410	+ $collection->endAjaxRequest($result);
391	411
392	412	}
393		- }
	413	+ //}
394	414
395	415	$result = array(
396	416	"error" => false,
397	417	"body" => '',
		@@ -399,16 +419,13 @@
399	419	"data" => array(),
400	420	"new_nonce" => 0,
401	421	);
402	422
403		- $collection = new collection($collection_id);
404		-
405	423	$result = $collection->doBlockAjax($result, $block_name, $block_action, $block_data);
406	424
407	425	//ob_end_clean(); // prevent PHP errors from breaking JSON response.
408	426
409		- $admin->endAjaxRequest($result);
410		- $results = $collection->get_meta($name, 'collection_name');
	427	+ $collection->endAjaxRequest($result);
411	428	}
412	429
413	430
414	431	public static function ajax_refreshblock()