← All changes | app/Controllers/Admin/Ajax/AdminSettings.php +46 -13 2.1.3 → 2.1.13 View file →

		@@ -24,15 +24,14 @@
24	24	/**
25	25	* Construct function
26	26	*/
27	27	private function __construct() {
28		- add_action( 'wp_ajax_rtsb_settings_fields', [ $this, 'get_settings_fields' ] );
29		- add_action( 'wp_ajax_rtsb_settings_data', [ $this, 'get_settings_data' ] );
	28	+ // add_action( 'wp_ajax_rtsb_settings_fields', [ $this, 'get_settings_fields' ] );
	29	+ // add_action( 'wp_ajax_rtsb_settings_data', [ $this, 'get_settings_data' ] );
30	30	add_action( 'wp_ajax_rtsb_save_settings_data', [ $this, 'save_settings_data' ] );
31	31	add_action( 'wp_ajax_rtsb_toggle_modules_activation', [ $this, 'toggle_modules' ] );
32	32
33	33	add_action( 'wp_ajax_rtsb_get_multiselect_data', [ $this, 'get_multiselect_data' ] );
34		-
35	34	}
36	35
37	36	/**
38	37	* Get settings fields
		@@ -39,8 +38,12 @@
39	38	*
40	39	* @return void
41	40	*/
42	41	public function get_multiselect_data() {
	42	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
	43	+ wp_send_json_error( esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ) );
	44	+ }
	45	+
43	46	$func_with_param = sanitize_text_field( $_REQUEST['func_with_param'] ?? '' );
44	47	$s = sanitize_text_field( $_REQUEST['s'] ?? '' );
45	48	$decodedString = stripslashes( $func_with_param );
46	49	$functionArray = json_decode( $decodedString, true );
		@@ -61,12 +64,12 @@
61	64	* Get settings fields
62	65	*
63	66	* @return void
64	67	*/
65		- public function get_settings_fields() {
66		- $data = Settings::instance()->get_fields();
67		- wp_send_json_success( $data );
68		- }
	68	+ // public function get_settings_fields() {
	69	+ // $data = Settings::instance()->get_fields();
	70	+ // wp_send_json_success( $data );
	71	+ // }
69	72
70	73	/**
71	74	* Get settings Data
72	75	*
		@@ -82,19 +85,41 @@
82	85	*
83	86	* @return void
84	87	*/
85	88	public function save_settings_data() {
	89	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
	90	+ wp_send_json_error( esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ) );
	91	+ }
	92	+
86	93	$section_id = isset( $_POST['section_id'] ) ? sanitize_text_field( wp_unslash( $_POST['section_id'] ) ) : '';
87	94	$block_id = isset( $_POST['block_id'] ) ? sanitize_text_field( wp_unslash( $_POST['block_id'] ) ) : '';
88		- $rawOptions = isset( $_POST['options'] ) ? $_POST['options'] : []; // Fns::set_options Sanitized all array values Before saving.
89		- $status = Fns::set_options( $section_id, $block_id, $rawOptions );
	95	+ // Fns::set_options Sanitized all array values Before saving.
	96	+ $rawOptions = $_POST['options'] ?? []; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	97	+
	98	+ $sections = Settings::instance()->get_sections();
	99	+ $options = [];
	100	+ if ( ! empty( $sections[ $section_id ]['list'][ $block_id ]['fields'] ) ) {
	101	+ $fields = $sections[ $section_id ]['list'][ $block_id ]['fields'];
	102	+ $db_options = Fns::get_options( $section_id, $block_id );
	103	+ foreach ( $fields as $field_id => $field ) {
	104	+ if ( ! array_key_exists( $field_id, $db_options ) ) {
	105	+ $type = 'array' === gettype( $field['value'] ) ? [] : '';
	106	+ $options[ $field_id ] = ! empty( $field['value'] ) ? $field['value'] : $type;
	107	+ }
	108	+ }
	109	+ }
	110	+
	111	+ $rawOptions = wp_parse_args( $rawOptions, $options );
	112	+
	113	+ $status = Fns::set_options( $section_id, $block_id, $rawOptions );
	114	+
90	115	if ( boolval( $status['status'] ) ) {
	116	+ do_action( 'rtsb/after/saved/settings/success/' . $section_id . '/' . $block_id, $rawOptions );
91	117	do_action( 'rtsb/after/saved/settings/success', $section_id, $block_id, $rawOptions );
92	118	wp_send_json_success( $status );
93	119	} else {
94	120	wp_send_json_error( $status );
95	121	}
96		-
97	122	}
98	123
99	124	/**
100	125	* Toggle modules
		@@ -101,11 +126,20 @@
101	126	*
102	127	* @return void
103	128	*/
104	129	public function toggle_modules() {
	130	+
	131	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
	132	+ wp_send_json_error(
	133	+ [
	134	+ 'message' => esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ),
	135	+ ]
	136	+ );
	137	+ }
	138	+
105	139	$section_id = isset( $_POST['section_id'] ) ? sanitize_text_field( wp_unslash( $_POST['section_id'] ) ) : '';
106	140	$module_ids = isset( $_POST['module_ids'] ) ? array_map( 'sanitize_text_field', $_POST['module_ids'] ) : [];
107		- $type = isset( $_POST['type'] ) && $_POST['type'] === 'active' ? 'active' : false;
	141	+ $type = isset( $_POST['type'] ) && 'active' === sanitize_text_field( wp_unslash( $_POST['type'] ) ) ? 'active' : false;
108	142
109	143	if ( ! $section_id || empty( $module_ids ) ) {
110	144	wp_send_json_error(
111	145	[
		@@ -112,8 +146,9 @@
112	146	'message' => esc_html__( 'Section , block or options may be empty', 'shopbuilder' ),
113	147	]
114	148	);
115	149	}
	150	+
116	151	$sections = Settings::instance()->get_sections();
117	152	if ( empty( $sections[ $section_id ] ) ) {
118	153	wp_send_json_error(
119	154	[
		@@ -145,7 +180,5 @@
145	180	'sections' => $sections,
146	181	]
147	182	);
148	183	}
149		-
150		-
151	184	}