← All changes | app/Controllers/Admin/Ajax/ModalTemplate.php +46 -14 2.1.3 → 2.1.13 View file →

		@@ -37,9 +37,9 @@
37	37	* @return void
38	38	*/
39	39	public function response() {
40	40	$title = '<h2>' . esc_html__( 'Template Settings', 'shopbuilder' ) . '</h2>';
41		- if ( ! Fns::verify_nonce() ) {
	41	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) ) {
42	42	$return = [
43	43	'success' => false,
44	44	'title' => $title,
45	45	'content' => esc_html__( 'Session Expired...', 'shopbuilder' ),
		@@ -46,8 +46,17 @@
46	46	];
47	47	wp_send_json( $return );
48	48	}
49	49
	50	+ if ( ! current_user_can( 'manage_options' ) ) {
	51	+ $return = [
	52	+ 'success' => false,
	53	+ 'title' => $title,
	54	+ 'content' => esc_html__( 'Permission Denied...', 'shopbuilder' ),
	55	+ ];
	56	+ wp_send_json( $return );
	57	+ }
	58	+
50	59	add_filter( 'option_' . Uploads_Manager::UNFILTERED_FILE_UPLOADS_KEY, '__return_true' );
51	60	Plugin::$instance->files_manager->clear_cache();
52	61
53	62	// user capability check.
		@@ -54,14 +63,14 @@
54	63	$user = wp_get_current_user();
55	64	$allowed_roles = [ 'editor', 'administrator', 'author' ];
56	65
57	66	if ( ! array_intersect( $allowed_roles, $user->roles ) ) {
58		- wp_die( __( 'You don\'t have permission to perform this action', 'shopbuilder' ) );
	67	+ wp_die( esc_html__( 'You don\'t have permission to perform this action', 'shopbuilder' ) );
59	68	}
60	69
61	70	// Check if the user is not logged in and the provided 'user_id' in the request does not match the currently logged-in user's ID.
62	71	if ( ! is_user_logged_in() && $user->ID !== sanitize_text_field( $_REQUEST['user_id'] ) ) {
63		- wp_die( __( 'You don\'t have proper authorization to perform this action', 'shopbuilder' ) );
	72	+ wp_die( esc_html__( 'You don\'t have proper authorization to perform this action', 'shopbuilder' ) );
64	73	}
65	74
66	75	$post_id = isset( $_POST['post_id'] ) ? absint( $_POST['post_id'] ) : null;
67	76	$layout_id = isset( $_POST['layout_id'] ) ? absint( $_POST['layout_id'] ) : null;
		@@ -106,13 +115,12 @@
106	115	$post_args['body'] = [
107	116	'status' => $status,
108	117	];
109	118	$layoutRequest = wp_remote_post( rtsb()->BASE_API, $post_args );
110		-
111		- if ( is_wp_error( $layoutRequest ) ) {
112		- wp_send_json_error( [ 'messages' => $layoutRequest->get_error_messages() ] );
	119	+ $layoutData = [];
	120	+ if ( ! is_wp_error( $layoutRequest ) && ! empty( $layoutRequest['body'] ) ) {
	121	+ $layoutData = json_decode( $layoutRequest['body'], true );
113	122	}
114		- $layoutData = json_decode( $layoutRequest['body'], true );
115	123
116	124	ob_start();
117	125
118	126	?>
		@@ -154,9 +162,9 @@
154	162	}
155	163	?>
156	164	<label for="rtsb_product_page_preview"><?php esc_html_e( 'Select Product For Preview', 'shopbuilder' ); ?></label>
157	165	<select class="rtsb-field" id="rtsb_product_page_preview" name="rtsb_product_page_preview">
158		- <?php echo Fns::print_html( $default_items, true ); ?>
	166	+ <?php Fns::print_html( $default_items, true ); ?>
159	167	</select>
160	168	<p style="margin:0;"> This Product is only used for preview And Elementor edit page. </p>
161	169	</div>
162	170
		@@ -184,9 +192,9 @@
184	192	</label>
185	193	<select class="rtsb-field" id="rtsb_page_for_the_products" name="rtsb_page_for_the_products" multiple="multiple">
186	194	<?php Fns::print_html( $default_items, true ); ?>
187	195	</select>
188		- <p style="margin:0;"> The Products Display in this layout. <span style="display:inline-flex; gap :10px"> <?php echo ! empty( $default_items_link ) ? 'Visit: ' . $default_items_link : ''; ?> </span>
	196	+ <p style="margin:0;"> The Products Display in this layout. <span style="display:inline-flex; gap :10px"> <?php Fns::print_html( ! empty( $default_items_link ) ? 'Visit: ' . $default_items_link : '' ); ?> </span>
189	197	</p>
190	198	</div>
191	199
192	200	<div class="rtsb-categories-page-field rtsb-page-for-the-categories rtsb-tb-field-wraper <?php echo esc_attr( ! rtsb()->has_pro() ? 'pro-disable' : '' ); ?>" style="display:none;">
		@@ -218,9 +226,9 @@
218	226	</label>
219	227	<select class="rtsb-field" id="rtsb_page_for_the_categories" name="rtsb_page_for_the_categories" multiple="multiple">
220	228	<?php Fns::print_html( $default_items, true ); ?>
221	229	</select>
222		- <p style="margin:0;"> The Product Categories Display in this layout. <span style="display:inline-flex; gap :10px"> <?php echo ! empty( $default_items_link ) ? 'Visit: ' . $default_items_link : ''; ?> </span>
	230	+ <p style="margin:0;"> The Product Categories Display in this layout. <span style="display:inline-flex; gap :10px"> <?php Fns::print_html( ! empty( $default_items_link ) ? 'Visit: ' . $default_items_link : '' ); ?> </span>
223	231	</p>
224	232	</div>
225	233
226	234	<div class="rtsb-template-edit-with rtsb-tb-field-wraper">
		@@ -307,9 +315,17 @@
307	315	<?php esc_html_e( 'Save', 'shopbuilder' ); ?>
308	316	</button>
309	317	</div>
310	318	<div class="rtsb-tb-button-wrapper rtsb-tb-edit-button-wrapper">
311		- <a href="<?php echo esc_url( $url ); ?>" class="btn"> <?php esc_html_e( sprintf( 'Edit with %s', $edit_by ), 'shopbuilder' ); ?> </a>
	319	+ <a href="<?php echo esc_url( $url ); ?>" class="btn">
	320	+ <?php
	321	+ printf(
	322	+ /* translators: %s: Edit */
	323	+ esc_html__( 'Edit with %s', 'shopbuilder' ),
	324	+ esc_html( $edit_by )
	325	+ );
	326	+ ?>
	327	+ </a>
312	328	</div>
313	329	</div>
314	330	<?php
315	331	$footer = ob_get_clean();
		@@ -449,9 +465,9 @@
449	465	*
450	466	* @return void
451	467	*/
452	468	public function product_search() {
453		- if ( ! Fns::verify_nonce() ) {
	469	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) ) {
454	470	$return = [
455	471	'success' => false,
456	472	'content' => esc_html__( 'Session Expired...', 'shopbuilder' ),
457	473	];
		@@ -456,8 +472,15 @@
456	472	'content' => esc_html__( 'Session Expired...', 'shopbuilder' ),
457	473	];
458	474	wp_send_json( $return );
459	475	}
	476	+ if ( ! current_user_can( 'manage_options' ) ) {
	477	+ $return = [
	478	+ 'success' => false,
	479	+ 'content' => esc_html__( 'Permission Denied...', 'shopbuilder' ),
	480	+ ];
	481	+ wp_send_json( $return );
	482	+ }
460	483	global $wpdb;
461	484	$search = isset( $_REQUEST['search'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing
462	485	if ( empty( $search ) ) {
463	486	$return = [
		@@ -478,9 +501,9 @@
478	501	);
479	502
480	503	$_product = wp_cache_get( md5( $query ), 'rtsb-product-query' );
481	504	if ( false === $_product ) {
482		- $_product = $wpdb->get_results( $query );
	505	+ $_product = $wpdb->get_results( $query ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.PreparedSQL.NotPrepared
483	506	wp_cache_set( md5( $query ), $_product, 'rtsb-product-query' );
484	507	}
485	508
486	509	$product_list = [];
		@@ -501,9 +524,9 @@
501	524	* @return void
502	525	*/
503	526	public function category_search() {
504	527
505		- if ( ! Fns::verify_nonce() ) {
	528	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) ) {
506	529	$return = [
507	530	'success' => false,
508	531	'content' => esc_html__( 'Session Expired...', 'shopbuilder' ),
509	532	];
		@@ -508,8 +531,17 @@
508	531	'content' => esc_html__( 'Session Expired...', 'shopbuilder' ),
509	532	];
510	533	wp_send_json( $return );
511	534	}
	535	+
	536	+ if ( ! current_user_can( 'manage_options' ) ) {
	537	+ $return = [
	538	+ 'success' => false,
	539	+ 'content' => esc_html__( 'Permission Denied...', 'shopbuilder' ),
	540	+ ];
	541	+ wp_send_json( $return );
	542	+ }
	543	+
512	544	$search = isset( $_REQUEST['search'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['search'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing
513	545	$args = [
514	546	'taxonomy' => [ 'product_cat' ], // taxonomy name
515	547	'orderby' => 'name',