← All changes | app/Controllers/Admin/Ajax/AdminSettings.php +17 -15 2.1.7 → 2.1.13 View file →

		@@ -38,9 +38,9 @@
38	38	*
39	39	* @return void
40	40	*/
41	41	public function get_multiselect_data() {
42		- if ( ! Fns::verify_nonce() || ! current_user_can( 'manage_options' ) ) {
	42	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
43	43	wp_send_json_error( esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ) );
44	44	}
45	45
46	46	$func_with_param = sanitize_text_field( $_REQUEST['func_with_param'] ?? '' );
		@@ -64,12 +64,12 @@
64	64	* Get settings fields
65	65	*
66	66	* @return void
67	67	*/
68		-// public function get_settings_fields() {
69		-// $data = Settings::instance()->get_fields();
70		-// wp_send_json_success( $data );
71		-// }
	68	+ // public function get_settings_fields() {
	69	+ // $data = Settings::instance()->get_fields();
	70	+ // wp_send_json_success( $data );
	71	+ // }
72	72
73	73	/**
74	74	* Get settings Data
75	75	*
		@@ -85,16 +85,17 @@
85	85	*
86	86	* @return void
87	87	*/
88	88	public function save_settings_data() {
	89	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
	90	+ wp_send_json_error( esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ) );
	91	+ }
	92	+
89	93	$section_id = isset( $_POST['section_id'] ) ? sanitize_text_field( wp_unslash( $_POST['section_id'] ) ) : '';
90	94	$block_id = isset( $_POST['block_id'] ) ? sanitize_text_field( wp_unslash( $_POST['block_id'] ) ) : '';
91		- $rawOptions = isset( $_POST['options'] ) ? $_POST['options'] : []; // Fns::set_options Sanitized all array values Before saving.
	95	+ // Fns::set_options Sanitized all array values Before saving.
	96	+ $rawOptions = $_POST['options'] ?? []; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
92	97
93		- if ( ! Fns::verify_nonce() || ! current_user_can( 'manage_options' ) ) {
94		- wp_send_json_error( esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ) );
95		- }
96		-
97	98	$sections = Settings::instance()->get_sections();
98	99	$options = [];
99	100	if ( ! empty( $sections[ $section_id ]['list'][ $block_id ]['fields'] ) ) {
100	101	$fields = $sections[ $section_id ]['list'][ $block_id ]['fields'];
		@@ -111,8 +112,9 @@
111	112
112	113	$status = Fns::set_options( $section_id, $block_id, $rawOptions );
113	114
114	115	if ( boolval( $status['status'] ) ) {
	116	+ do_action( 'rtsb/after/saved/settings/success/' . $section_id . '/' . $block_id, $rawOptions );
115	117	do_action( 'rtsb/after/saved/settings/success', $section_id, $block_id, $rawOptions );
116	118	wp_send_json_success( $status );
117	119	} else {
118	120	wp_send_json_error( $status );
		@@ -125,13 +127,9 @@
125	127	* @return void
126	128	*/
127	129	public function toggle_modules() {
128	130
129		- $section_id = isset( $_POST['section_id'] ) ? sanitize_text_field( wp_unslash( $_POST['section_id'] ) ) : '';
130		- $module_ids = isset( $_POST['module_ids'] ) ? array_map( 'sanitize_text_field', $_POST['module_ids'] ) : [];
131		- $type = isset( $_POST['type'] ) && $_POST['type'] === 'active' ? 'active' : false;
132		-
133		- if ( ! Fns::verify_nonce() || ! current_user_can( 'manage_options' ) ) {
	131	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
134	132	wp_send_json_error(
135	133	[
136	134	'message' => esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ),
137	135	]
		@@ -136,8 +134,12 @@
136	134	'message' => esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ),
137	135	]
138	136	);
139	137	}
	138	+
	139	+ $section_id = isset( $_POST['section_id'] ) ? sanitize_text_field( wp_unslash( $_POST['section_id'] ) ) : '';
	140	+ $module_ids = isset( $_POST['module_ids'] ) ? array_map( 'sanitize_text_field', $_POST['module_ids'] ) : [];
	141	+ $type = isset( $_POST['type'] ) && 'active' === sanitize_text_field( wp_unslash( $_POST['type'] ) ) ? 'active' : false;
140	142
141	143	if ( ! $section_id || empty( $module_ids ) ) {
142	144	wp_send_json_error(
143	145	[