← All changes | app/Controllers/Admin/Ajax/ModalTemplate.php +19 -12 2.1.7 → 2.1.13 View file →

		@@ -37,9 +37,9 @@
37	37	* @return void
38	38	*/
39	39	public function response() {
40	40	$title = '<h2>' . esc_html__( 'Template Settings', 'shopbuilder' ) . '</h2>';
41		- if ( ! Fns::verify_nonce() ) {
	41	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) ) {
42	42	$return = [
43	43	'success' => false,
44	44	'title' => $title,
45	45	'content' => esc_html__( 'Session Expired...', 'shopbuilder' ),
		@@ -63,14 +63,14 @@
63	63	$user = wp_get_current_user();
64	64	$allowed_roles = [ 'editor', 'administrator', 'author' ];
65	65
66	66	if ( ! array_intersect( $allowed_roles, $user->roles ) ) {
67		- wp_die( __( 'You don\'t have permission to perform this action', 'shopbuilder' ) );
	67	+ wp_die( esc_html__( 'You don\'t have permission to perform this action', 'shopbuilder' ) );
68	68	}
69	69
70	70	// Check if the user is not logged in and the provided 'user_id' in the request does not match the currently logged-in user's ID.
71	71	if ( ! is_user_logged_in() && $user->ID !== sanitize_text_field( $_REQUEST['user_id'] ) ) {
72		- wp_die( __( 'You don\'t have proper authorization to perform this action', 'shopbuilder' ) );
	72	+ wp_die( esc_html__( 'You don\'t have proper authorization to perform this action', 'shopbuilder' ) );
73	73	}
74	74
75	75	$post_id = isset( $_POST['post_id'] ) ? absint( $_POST['post_id'] ) : null;
76	76	$layout_id = isset( $_POST['layout_id'] ) ? absint( $_POST['layout_id'] ) : null;
		@@ -115,9 +115,9 @@
115	115	$post_args['body'] = [
116	116	'status' => $status,
117	117	];
118	118	$layoutRequest = wp_remote_post( rtsb()->BASE_API, $post_args );
119		- $layoutData = [];
	119	+ $layoutData = [];
120	120	if ( ! is_wp_error( $layoutRequest ) && ! empty( $layoutRequest['body'] ) ) {
121	121	$layoutData = json_decode( $layoutRequest['body'], true );
122	122	}
123	123
		@@ -162,9 +162,9 @@
162	162	}
163	163	?>
164	164	<label for="rtsb_product_page_preview"><?php esc_html_e( 'Select Product For Preview', 'shopbuilder' ); ?></label>
165	165	<select class="rtsb-field" id="rtsb_product_page_preview" name="rtsb_product_page_preview">
166		- <?php echo Fns::print_html( $default_items, true ); ?>
	166	+ <?php Fns::print_html( $default_items, true ); ?>
167	167	</select>
168	168	<p style="margin:0;"> This Product is only used for preview And Elementor edit page. </p>
169	169	</div>
170	170
		@@ -192,9 +192,9 @@
192	192	</label>
193	193	<select class="rtsb-field" id="rtsb_page_for_the_products" name="rtsb_page_for_the_products" multiple="multiple">
194	194	<?php Fns::print_html( $default_items, true ); ?>
195	195	</select>
196		- <p style="margin:0;"> The Products Display in this layout. <span style="display:inline-flex; gap :10px"> <?php echo ! empty( $default_items_link ) ? 'Visit: ' . $default_items_link : ''; ?> </span>
	196	+ <p style="margin:0;"> The Products Display in this layout. <span style="display:inline-flex; gap :10px"> <?php Fns::print_html( ! empty( $default_items_link ) ? 'Visit: ' . $default_items_link : '' ); ?> </span>
197	197	</p>
198	198	</div>
199	199
200	200	<div class="rtsb-categories-page-field rtsb-page-for-the-categories rtsb-tb-field-wraper <?php echo esc_attr( ! rtsb()->has_pro() ? 'pro-disable' : '' ); ?>" style="display:none;">
		@@ -226,9 +226,9 @@
226	226	</label>
227	227	<select class="rtsb-field" id="rtsb_page_for_the_categories" name="rtsb_page_for_the_categories" multiple="multiple">
228	228	<?php Fns::print_html( $default_items, true ); ?>
229	229	</select>
230		- <p style="margin:0;"> The Product Categories Display in this layout. <span style="display:inline-flex; gap :10px"> <?php echo ! empty( $default_items_link ) ? 'Visit: ' . $default_items_link : ''; ?> </span>
	230	+ <p style="margin:0;"> The Product Categories Display in this layout. <span style="display:inline-flex; gap :10px"> <?php Fns::print_html( ! empty( $default_items_link ) ? 'Visit: ' . $default_items_link : '' ); ?> </span>
231	231	</p>
232	232	</div>
233	233
234	234	<div class="rtsb-template-edit-with rtsb-tb-field-wraper">
		@@ -315,9 +315,17 @@
315	315	<?php esc_html_e( 'Save', 'shopbuilder' ); ?>
316	316	</button>
317	317	</div>
318	318	<div class="rtsb-tb-button-wrapper rtsb-tb-edit-button-wrapper">
319		- <a href="<?php echo esc_url( $url ); ?>" class="btn"> <?php esc_html_e( sprintf( 'Edit with %s', $edit_by ), 'shopbuilder' ); ?> </a>
	319	+ <a href="<?php echo esc_url( $url ); ?>" class="btn">
	320	+ <?php
	321	+ printf(
	322	+ /* translators: %s: Edit */
	323	+ esc_html__( 'Edit with %s', 'shopbuilder' ),
	324	+ esc_html( $edit_by )
	325	+ );
	326	+ ?>
	327	+ </a>
320	328	</div>
321	329	</div>
322	330	<?php
323	331	$footer = ob_get_clean();
		@@ -457,9 +465,9 @@
457	465	*
458	466	* @return void
459	467	*/
460	468	public function product_search() {
461		- if ( ! Fns::verify_nonce() ) {
	469	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) ) {
462	470	$return = [
463	471	'success' => false,
464	472	'content' => esc_html__( 'Session Expired...', 'shopbuilder' ),
465	473	];
		@@ -493,9 +501,9 @@
493	501	);
494	502
495	503	$_product = wp_cache_get( md5( $query ), 'rtsb-product-query' );
496	504	if ( false === $_product ) {
497		- $_product = $wpdb->get_results( $query );
	505	+ $_product = $wpdb->get_results( $query ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.PreparedSQL.NotPrepared
498	506	wp_cache_set( md5( $query ), $_product, 'rtsb-product-query' );
499	507	}
500	508
501	509	$product_list = [];
		@@ -516,9 +524,9 @@
516	524	* @return void
517	525	*/
518	526	public function category_search() {
519	527
520		- if ( ! Fns::verify_nonce() ) {
	528	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) ) {
521	529	$return = [
522	530	'success' => false,
523	531	'content' => esc_html__( 'Session Expired...', 'shopbuilder' ),
524	532	];
		@@ -523,9 +531,8 @@
523	531	'content' => esc_html__( 'Session Expired...', 'shopbuilder' ),
524	532	];
525	533	wp_send_json( $return );
526	534	}
527		-
528	535
529	536	if ( ! current_user_can( 'manage_options' ) ) {
530	537	$return = [
531	538	'success' => false,