← All changes | app/Controllers/Admin/Ajax/AdminSettings.php +24 -29 2.1.7 → 3.2.6 View file →

		@@ -2,10 +2,11 @@
2	2
3	3	namespace RadiusTheme\SB\Controllers\Admin\Ajax;
4	4
5	5	use RadiusTheme\SB\Helpers\Fns;
	6	+use RadiusTheme\SB\Helpers\Cache;
	7	+use RadiusTheme\SB\Models\Settings;
6	8	use RadiusTheme\SB\Models\DataModel;
7		-use RadiusTheme\SB\Models\Settings;
8	9	use RadiusTheme\SB\Traits\SingletonTrait;
9	10
10	11	// Do not allow directly accessing this file.
11	12	if ( ! defined( 'ABSPATH' ) ) {
		@@ -24,13 +25,10 @@
24	25	/**
25	26	* Construct function
26	27	*/
27	28	private function __construct() {
28		- // add_action( 'wp_ajax_rtsb_settings_fields', [ $this, 'get_settings_fields' ] );
29		- // add_action( 'wp_ajax_rtsb_settings_data', [ $this, 'get_settings_data' ] );
30	29	add_action( 'wp_ajax_rtsb_save_settings_data', [ $this, 'save_settings_data' ] );
31	30	add_action( 'wp_ajax_rtsb_toggle_modules_activation', [ $this, 'toggle_modules' ] );
32		-
33	31	add_action( 'wp_ajax_rtsb_get_multiselect_data', [ $this, 'get_multiselect_data' ] );
34	32	}
35	33
36	34	/**
		@@ -38,14 +36,14 @@
38	36	*
39	37	* @return void
40	38	*/
41	39	public function get_multiselect_data() {
42		- if ( ! Fns::verify_nonce() || ! current_user_can( 'manage_options' ) ) {
	40	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
43	41	wp_send_json_error( esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ) );
44	42	}
45	43
46		- $func_with_param = sanitize_text_field( $_REQUEST['func_with_param'] ?? '' );
47		- $s = sanitize_text_field( $_REQUEST['s'] ?? '' );
	44	+ $func_with_param = sanitize_text_field( $_REQUEST['func_with_param'] ?? '' ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	45	+ $s = sanitize_text_field( $_REQUEST['s'] ?? '' ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
48	46	$decodedString = stripslashes( $func_with_param );
49	47	$functionArray = json_decode( $decodedString, true );
50	48	$className = $functionArray[0];
51	49	$methodName = $functionArray[1];
		@@ -52,9 +50,9 @@
52	50	$argument = $functionArray[2] ?? [];
53	51	$result = [];
54	52	$params = [];
55	53	if ( class_exists( $className ) && method_exists( $className, $methodName ) ) {
56		- $params[] = $s; // Modify this array with your parameters
	54	+ $params[] = $s;
57	55	$params[] = $argument;
58	56	$result = call_user_func_array( [ $className, $methodName ], $params );
59	57	}
60	58	wp_send_json_success( $result );
		@@ -60,18 +58,8 @@
60	58	wp_send_json_success( $result );
61	59	}
62	60
63	61	/**
64		- * Get settings fields
65		- *
66		- * @return void
67		- */
68		-// public function get_settings_fields() {
69		-// $data = Settings::instance()->get_fields();
70		-// wp_send_json_success( $data );
71		-// }
72		-
73		- /**
74	62	* Get settings Data
75	63	*
76	64	* @return void
77	65	*/
		@@ -85,16 +73,17 @@
85	73	*
86	74	* @return void
87	75	*/
88	76	public function save_settings_data() {
	77	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
	78	+ wp_send_json_error( esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ) );
	79	+ }
	80	+
89	81	$section_id = isset( $_POST['section_id'] ) ? sanitize_text_field( wp_unslash( $_POST['section_id'] ) ) : '';
90	82	$block_id = isset( $_POST['block_id'] ) ? sanitize_text_field( wp_unslash( $_POST['block_id'] ) ) : '';
91		- $rawOptions = isset( $_POST['options'] ) ? $_POST['options'] : []; // Fns::set_options Sanitized all array values Before saving.
	83	+ // Fns::set_options Sanitized all array values Before saving.
	84	+ $rawOptions = $_POST['options'] ?? []; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
92	85
93		- if ( ! Fns::verify_nonce() || ! current_user_can( 'manage_options' ) ) {
94		- wp_send_json_error( esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ) );
95		- }
96		-
97	86	$sections = Settings::instance()->get_sections();
98	87	$options = [];
99	88	if ( ! empty( $sections[ $section_id ]['list'][ $block_id ]['fields'] ) ) {
100	89	$fields = $sections[ $section_id ]['list'][ $block_id ]['fields'];
		@@ -111,9 +100,13 @@
111	100
112	101	$status = Fns::set_options( $section_id, $block_id, $rawOptions );
113	102
114	103	if ( boolval( $status['status'] ) ) {
	104	+ do_action( 'rtsb/after/saved/settings/success/' . $section_id . '/' . $block_id, $rawOptions );
115	105	do_action( 'rtsb/after/saved/settings/success', $section_id, $block_id, $rawOptions );
	106	+
	107	+ Cache::clear_asset_cache();
	108	+
116	109	wp_send_json_success( $status );
117	110	} else {
118	111	wp_send_json_error( $status );
119	112	}
		@@ -125,13 +118,9 @@
125	118	* @return void
126	119	*/
127	120	public function toggle_modules() {
128	121
129		- $section_id = isset( $_POST['section_id'] ) ? sanitize_text_field( wp_unslash( $_POST['section_id'] ) ) : '';
130		- $module_ids = isset( $_POST['module_ids'] ) ? array_map( 'sanitize_text_field', $_POST['module_ids'] ) : [];
131		- $type = isset( $_POST['type'] ) && $_POST['type'] === 'active' ? 'active' : false;
132		-
133		- if ( ! Fns::verify_nonce() || ! current_user_can( 'manage_options' ) ) {
	122	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) || ! current_user_can( 'manage_options' ) ) {
134	123	wp_send_json_error(
135	124	[
136	125	'message' => esc_html__( 'Security error: Insufficient permissions.', 'shopbuilder' ),
137	126	]
		@@ -137,8 +126,12 @@
137	126	]
138	127	);
139	128	}
140	129
	130	+ $section_id = isset( $_POST['section_id'] ) ? sanitize_text_field( wp_unslash( $_POST['section_id'] ) ) : '';
	131	+ $module_ids = isset( $_POST['module_ids'] ) ? array_map( 'sanitize_text_field', $_POST['module_ids'] ) : []; //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	132	+ $type = isset( $_POST['type'] ) && 'active' === sanitize_text_field( wp_unslash( $_POST['type'] ) ) ? 'active' : false;
	133	+
141	134	if ( ! $section_id || empty( $module_ids ) ) {
142	135	wp_send_json_error(
143	136	[
144	137	'message' => esc_html__( 'Section , block or options may be empty', 'shopbuilder' ),
		@@ -159,9 +152,9 @@
159	152	if ( isset( $sections[ $section_id ]['list'][ $module_id ] ) ) {
160	153	if ( isset( $sections[ $section_id ]['list'][ $module_id ]['package'] ) && 'pro-disabled' === $sections[ $section_id ]['list'][ $module_id ]['package'] ) {
161	154	continue;
162	155	}
163		- if ( $type === 'active' ) {
	156	+ if ( 'active' === $type ) {
164	157	$options[ $module_id ]['active'] = 'on';
165	158	$sections[ $section_id ]['list'][ $module_id ]['active'] = 'on';
166	159	} else {
167	160	$options[ $module_id ]['active'] = '';
		@@ -167,11 +160,13 @@
167	160	$options[ $module_id ]['active'] = '';
168	161	$sections[ $section_id ]['list'][ $module_id ]['active'] = '';
169	162	}
170	163	}
	164	+ do_action( 'rtsb/before/save/options', $section_id, $module_id, $options[ $module_id ] ?? [] );
171	165	}
172	166
173	167	DataModel::source()->set_option( $section_id, $options );
	168	+ Cache::clear_asset_cache();
174	169
175	170	wp_send_json_success(
176	171	[
177	172	'message' => esc_html__( 'Successfully Saved', 'shopbuilder' ),