← All changes | app/Controllers/Admin/Ajax/AdminSettings.php +52 -26 2.1.3 → 3.2.6 View file →

		@@ -2,10 +2,11 @@
2	2
3	3	namespace RadiusTheme\SB\Controllers\Admin\Ajax;
4	4
5	5	use RadiusTheme\SB\Helpers\Fns;
	6	+use RadiusTheme\SB\Helpers\Cache;
	7	+use RadiusTheme\SB\Models\Settings;
6	8	use RadiusTheme\SB\Models\DataModel;
7		-use RadiusTheme\SB\Models\Settings;
8	9	use RadiusTheme\SB\Traits\SingletonTrait;
9	10
10	11	// Do not allow directly accessing this file.
11	12	if ( ! defined( 'ABSPATH' ) ) {
		@@ -24,15 +25,11 @@
24	25	/**
25	26	* Construct function
26	27	*/
27	28	private function __construct() {
28		- add_action( 'wp_ajax_rtsb_settings_fields', [ $this, 'get_settings_fields' ] );
29		- add_action( 'wp_ajax_rtsb_settings_data', [ $this, 'get_settings_data' ] );
30	29	add_action( 'wp_ajax_rtsb_save_settings_data', [ $this, 'save_settings_data' ] );
31	30	add_action( 'wp_ajax_rtsb_toggle_modules_activation', [ $this, 'toggle_modules' ] );
32		-
33	31	add_action( 'wp_ajax_rtsb_get_multiselect_data', [ $this, 'get_multiselect_data' ] );
34		-
35	32	}
36	33
37	34	/**
38	35	* Get settings fields
		@@ -39,10 +36,14 @@
39	36	*
40	37	* @return void
41	38	*/
42	39	public function get_multiselect_data() {
43		- $func_with_param = sanitize_text_field( $_REQUEST['func_with_param'] ?? '' );
44		- $s = sanitize_text_field( $_REQUEST['s'] ?? '' );
	40	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
	41	+ wp_send_json_error( esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ) );
	42	+ }
	43	+
	44	+ $func_with_param = sanitize_text_field( $_REQUEST['func_with_param'] ?? '' ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	45	+ $s = sanitize_text_field( $_REQUEST['s'] ?? '' ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
45	46	$decodedString = stripslashes( $func_with_param );
46	47	$functionArray = json_decode( $decodedString, true );
47	48	$className = $functionArray[0];
48	49	$methodName = $functionArray[1];
		@@ -49,9 +50,9 @@
49	50	$argument = $functionArray[2] ?? [];
50	51	$result = [];
51	52	$params = [];
52	53	if ( class_exists( $className ) && method_exists( $className, $methodName ) ) {
53		- $params[] = $s; // Modify this array with your parameters
	54	+ $params[] = $s;
54	55	$params[] = $argument;
55	56	$result = call_user_func_array( [ $className, $methodName ], $params );
56	57	}
57	58	wp_send_json_success( $result );
		@@ -57,18 +58,8 @@
57	58	wp_send_json_success( $result );
58	59	}
59	60
60	61	/**
61		- * Get settings fields
62		- *
63		- * @return void
64		- */
65		- public function get_settings_fields() {
66		- $data = Settings::instance()->get_fields();
67		- wp_send_json_success( $data );
68		- }
69		-
70		- /**
71	62	* Get settings Data
72	63	*
73	64	* @return void
74	65	*/
		@@ -82,19 +73,44 @@
82	73	*
83	74	* @return void
84	75	*/
85	76	public function save_settings_data() {
	77	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
	78	+ wp_send_json_error( esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ) );
	79	+ }
	80	+
86	81	$section_id = isset( $_POST['section_id'] ) ? sanitize_text_field( wp_unslash( $_POST['section_id'] ) ) : '';
87	82	$block_id = isset( $_POST['block_id'] ) ? sanitize_text_field( wp_unslash( $_POST['block_id'] ) ) : '';
88		- $rawOptions = isset( $_POST['options'] ) ? $_POST['options'] : []; // Fns::set_options Sanitized all array values Before saving.
89		- $status = Fns::set_options( $section_id, $block_id, $rawOptions );
	83	+ // Fns::set_options Sanitized all array values Before saving.
	84	+ $rawOptions = $_POST['options'] ?? []; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	85	+
	86	+ $sections = Settings::instance()->get_sections();
	87	+ $options = [];
	88	+ if ( ! empty( $sections[ $section_id ]['list'][ $block_id ]['fields'] ) ) {
	89	+ $fields = $sections[ $section_id ]['list'][ $block_id ]['fields'];
	90	+ $db_options = Fns::get_options( $section_id, $block_id );
	91	+ foreach ( $fields as $field_id => $field ) {
	92	+ if ( ! array_key_exists( $field_id, $db_options ) ) {
	93	+ $type = 'array' === gettype( $field['value'] ) ? [] : '';
	94	+ $options[ $field_id ] = ! empty( $field['value'] ) ? $field['value'] : $type;
	95	+ }
	96	+ }
	97	+ }
	98	+
	99	+ $rawOptions = wp_parse_args( $rawOptions, $options );
	100	+
	101	+ $status = Fns::set_options( $section_id, $block_id, $rawOptions );
	102	+
90	103	if ( boolval( $status['status'] ) ) {
	104	+ do_action( 'rtsb/after/saved/settings/success/' . $section_id . '/' . $block_id, $rawOptions );
91	105	do_action( 'rtsb/after/saved/settings/success', $section_id, $block_id, $rawOptions );
	106	+
	107	+ Cache::clear_asset_cache();
	108	+
92	109	wp_send_json_success( $status );
93	110	} else {
94	111	wp_send_json_error( $status );
95	112	}
96		-
97	113	}
98	114
99	115	/**
100	116	* Toggle modules
		@@ -101,11 +117,20 @@
101	117	*
102	118	* @return void
103	119	*/
104	120	public function toggle_modules() {
	121	+
	122	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
	123	+ wp_send_json_error(
	124	+ [
	125	+ 'message' => esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ),
	126	+ ]
	127	+ );
	128	+ }
	129	+
105	130	$section_id = isset( $_POST['section_id'] ) ? sanitize_text_field( wp_unslash( $_POST['section_id'] ) ) : '';
106		- $module_ids = isset( $_POST['module_ids'] ) ? array_map( 'sanitize_text_field', $_POST['module_ids'] ) : [];
107		- $type = isset( $_POST['type'] ) && $_POST['type'] === 'active' ? 'active' : false;
	131	+ $module_ids = isset( $_POST['module_ids'] ) ? array_map( 'sanitize_text_field', $_POST['module_ids'] ) : []; //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	132	+ $type = isset( $_POST['type'] ) && 'active' === sanitize_text_field( wp_unslash( $_POST['type'] ) ) ? 'active' : false;
108	133
109	134	if ( ! $section_id || empty( $module_ids ) ) {
110	135	wp_send_json_error(
111	136	[
		@@ -112,8 +137,9 @@
112	137	'message' => esc_html__( 'Section , block or options may be empty', 'shopbuilder' ),
113	138	]
114	139	);
115	140	}
	141	+
116	142	$sections = Settings::instance()->get_sections();
117	143	if ( empty( $sections[ $section_id ] ) ) {
118	144	wp_send_json_error(
119	145	[
		@@ -126,9 +152,9 @@
126	152	if ( isset( $sections[ $section_id ]['list'][ $module_id ] ) ) {
127	153	if ( isset( $sections[ $section_id ]['list'][ $module_id ]['package'] ) && 'pro-disabled' === $sections[ $section_id ]['list'][ $module_id ]['package'] ) {
128	154	continue;
129	155	}
130		- if ( $type === 'active' ) {
	156	+ if ( 'active' === $type ) {
131	157	$options[ $module_id ]['active'] = 'on';
132	158	$sections[ $section_id ]['list'][ $module_id ]['active'] = 'on';
133	159	} else {
134	160	$options[ $module_id ]['active'] = '';
		@@ -134,11 +160,13 @@
134	160	$options[ $module_id ]['active'] = '';
135	161	$sections[ $section_id ]['list'][ $module_id ]['active'] = '';
136	162	}
137	163	}
	164	+ do_action( 'rtsb/before/save/options', $section_id, $module_id, $options[ $module_id ] ?? [] );
138	165	}
139	166
140	167	DataModel::source()->set_option( $section_id, $options );
	168	+ Cache::clear_asset_cache();
141	169
142	170	wp_send_json_success(
143	171	[
144	172	'message' => esc_html__( 'Successfully Saved', 'shopbuilder' ),
		@@ -145,7 +173,5 @@
145	173	'sections' => $sections,
146	174	]
147	175	);
148	176	}
149		-
150		-
151	177	}