← All changes | app/Controllers/Admin/Ajax/AdminSettings.php +34 -21 2.1.5 → 3.2.6 View file →

		@@ -2,10 +2,11 @@
2	2
3	3	namespace RadiusTheme\SB\Controllers\Admin\Ajax;
4	4
5	5	use RadiusTheme\SB\Helpers\Fns;
	6	+use RadiusTheme\SB\Helpers\Cache;
	7	+use RadiusTheme\SB\Models\Settings;
6	8	use RadiusTheme\SB\Models\DataModel;
7		-use RadiusTheme\SB\Models\Settings;
8	9	use RadiusTheme\SB\Traits\SingletonTrait;
9	10
10	11	// Do not allow directly accessing this file.
11	12	if ( ! defined( 'ABSPATH' ) ) {
		@@ -24,13 +25,10 @@
24	25	/**
25	26	* Construct function
26	27	*/
27	28	private function __construct() {
28		- add_action( 'wp_ajax_rtsb_settings_fields', [ $this, 'get_settings_fields' ] );
29		- add_action( 'wp_ajax_rtsb_settings_data', [ $this, 'get_settings_data' ] );
30	29	add_action( 'wp_ajax_rtsb_save_settings_data', [ $this, 'save_settings_data' ] );
31	30	add_action( 'wp_ajax_rtsb_toggle_modules_activation', [ $this, 'toggle_modules' ] );
32		-
33	31	add_action( 'wp_ajax_rtsb_get_multiselect_data', [ $this, 'get_multiselect_data' ] );
34	32	}
35	33
36	34	/**
		@@ -38,10 +36,14 @@
38	36	*
39	37	* @return void
40	38	*/
41	39	public function get_multiselect_data() {
42		- $func_with_param = sanitize_text_field( $_REQUEST['func_with_param'] ?? '' );
43		- $s = sanitize_text_field( $_REQUEST['s'] ?? '' );
	40	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
	41	+ wp_send_json_error( esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ) );
	42	+ }
	43	+
	44	+ $func_with_param = sanitize_text_field( $_REQUEST['func_with_param'] ?? '' ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	45	+ $s = sanitize_text_field( $_REQUEST['s'] ?? '' ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
44	46	$decodedString = stripslashes( $func_with_param );
45	47	$functionArray = json_decode( $decodedString, true );
46	48	$className = $functionArray[0];
47	49	$methodName = $functionArray[1];
		@@ -48,9 +50,9 @@
48	50	$argument = $functionArray[2] ?? [];
49	51	$result = [];
50	52	$params = [];
51	53	if ( class_exists( $className ) && method_exists( $className, $methodName ) ) {
52		- $params[] = $s; // Modify this array with your parameters
	54	+ $params[] = $s;
53	55	$params[] = $argument;
54	56	$result = call_user_func_array( [ $className, $methodName ], $params );
55	57	}
56	58	wp_send_json_success( $result );
		@@ -56,18 +58,8 @@
56	58	wp_send_json_success( $result );
57	59	}
58	60
59	61	/**
60		- * Get settings fields
61		- *
62		- * @return void
63		- */
64		- public function get_settings_fields() {
65		- $data = Settings::instance()->get_fields();
66		- wp_send_json_success( $data );
67		- }
68		-
69		- /**
70	62	* Get settings Data
71	63	*
72	64	* @return void
73	65	*/
		@@ -81,11 +73,16 @@
81	73	*
82	74	* @return void
83	75	*/
84	76	public function save_settings_data() {
	77	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
	78	+ wp_send_json_error( esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ) );
	79	+ }
	80	+
85	81	$section_id = isset( $_POST['section_id'] ) ? sanitize_text_field( wp_unslash( $_POST['section_id'] ) ) : '';
86	82	$block_id = isset( $_POST['block_id'] ) ? sanitize_text_field( wp_unslash( $_POST['block_id'] ) ) : '';
87		- $rawOptions = isset( $_POST['options'] ) ? $_POST['options'] : []; // Fns::set_options Sanitized all array values Before saving.
	83	+ // Fns::set_options Sanitized all array values Before saving.
	84	+ $rawOptions = $_POST['options'] ?? []; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
88	85
89	86	$sections = Settings::instance()->get_sections();
90	87	$options = [];
91	88	if ( ! empty( $sections[ $section_id ]['list'][ $block_id ]['fields'] ) ) {
		@@ -103,9 +100,13 @@
103	100
104	101	$status = Fns::set_options( $section_id, $block_id, $rawOptions );
105	102
106	103	if ( boolval( $status['status'] ) ) {
	104	+ do_action( 'rtsb/after/saved/settings/success/' . $section_id . '/' . $block_id, $rawOptions );
107	105	do_action( 'rtsb/after/saved/settings/success', $section_id, $block_id, $rawOptions );
	106	+
	107	+ Cache::clear_asset_cache();
	108	+
108	109	wp_send_json_success( $status );
109	110	} else {
110	111	wp_send_json_error( $status );
111	112	}
		@@ -116,11 +117,20 @@
116	117	*
117	118	* @return void
118	119	*/
119	120	public function toggle_modules() {
	121	+
	122	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
	123	+ wp_send_json_error(
	124	+ [
	125	+ 'message' => esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ),
	126	+ ]
	127	+ );
	128	+ }
	129	+
120	130	$section_id = isset( $_POST['section_id'] ) ? sanitize_text_field( wp_unslash( $_POST['section_id'] ) ) : '';
121		- $module_ids = isset( $_POST['module_ids'] ) ? array_map( 'sanitize_text_field', $_POST['module_ids'] ) : [];
122		- $type = isset( $_POST['type'] ) && $_POST['type'] === 'active' ? 'active' : false;
	131	+ $module_ids = isset( $_POST['module_ids'] ) ? array_map( 'sanitize_text_field', $_POST['module_ids'] ) : []; //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	132	+ $type = isset( $_POST['type'] ) && 'active' === sanitize_text_field( wp_unslash( $_POST['type'] ) ) ? 'active' : false;
123	133
124	134	if ( ! $section_id || empty( $module_ids ) ) {
125	135	wp_send_json_error(
126	136	[
		@@ -127,8 +137,9 @@
127	137	'message' => esc_html__( 'Section , block or options may be empty', 'shopbuilder' ),
128	138	]
129	139	);
130	140	}
	141	+
131	142	$sections = Settings::instance()->get_sections();
132	143	if ( empty( $sections[ $section_id ] ) ) {
133	144	wp_send_json_error(
134	145	[
		@@ -141,9 +152,9 @@
141	152	if ( isset( $sections[ $section_id ]['list'][ $module_id ] ) ) {
142	153	if ( isset( $sections[ $section_id ]['list'][ $module_id ]['package'] ) && 'pro-disabled' === $sections[ $section_id ]['list'][ $module_id ]['package'] ) {
143	154	continue;
144	155	}
145		- if ( $type === 'active' ) {
	156	+ if ( 'active' === $type ) {
146	157	$options[ $module_id ]['active'] = 'on';
147	158	$sections[ $section_id ]['list'][ $module_id ]['active'] = 'on';
148	159	} else {
149	160	$options[ $module_id ]['active'] = '';
		@@ -149,11 +160,13 @@
149	160	$options[ $module_id ]['active'] = '';
150	161	$sections[ $section_id ]['list'][ $module_id ]['active'] = '';
151	162	}
152	163	}
	164	+ do_action( 'rtsb/before/save/options', $section_id, $module_id, $options[ $module_id ] ?? [] );
153	165	}
154	166
155	167	DataModel::source()->set_option( $section_id, $options );
	168	+ Cache::clear_asset_cache();
156	169
157	170	wp_send_json_success(
158	171	[
159	172	'message' => esc_html__( 'Successfully Saved', 'shopbuilder' ),