| @@ -54,17 +54,25 @@ | ||
| 54 | 54 | */ |
| 55 | 55 | public function enable_live_update() { |
| 56 | 56 | check_ajax_referer( $this->user_meta_key . '_nonce', 'nonce' ); |
| 57 | 57 | |
| 58 | - if ( ! current_user_can( $this->plugin->admin->view_cap ) ) { | |
| 59 | - wp_send_json_error( esc_html__( 'You do not have permission to do this.', 'stream' ) ); | |
| 58 | + $input = array( | |
| 59 | + 'checked' => FILTER_SANITIZE_FULL_SPECIAL_CHARS, | |
| 60 | + 'user' => FILTER_SANITIZE_FULL_SPECIAL_CHARS, | |
| 61 | + 'heartbeat' => FILTER_SANITIZE_FULL_SPECIAL_CHARS, | |
| 62 | + ); | |
| 63 | + | |
| 64 | + $input = filter_input_array( INPUT_POST, $input ); | |
| 65 | + | |
| 66 | + if ( false === $input ) { | |
| 67 | + wp_send_json_error( 'Error in live update checkbox' ); | |
| 60 | 68 | } |
| 61 | 69 | |
| 62 | - $checked = ( 'checked' === wp_stream_filter_input( INPUT_POST, 'checked' ) ) ? 'on' : 'off'; | |
| 70 | + $checked = ( 'checked' === $input['checked'] ) ? 'on' : 'off'; | |
| 63 | 71 | |
| 64 | - $user = get_current_user_id(); | |
| 72 | + $user = (int) $input['user']; | |
| 65 | 73 | |
| 66 | - if ( 'false' === wp_stream_filter_input( INPUT_POST, 'heartbeat' ) ) { | |
| 74 | + if ( 'false' === $input['heartbeat'] ) { | |
| 67 | 75 | update_user_meta( $user, $this->user_meta_key, 'off' ); |
| 68 | 76 | |
| 69 | 77 | wp_send_json_error( esc_html__( "Live updates could not be enabled because Heartbeat is not loaded.\n\nYour hosting provider or another plugin may have disabled it for performance reasons.", 'stream' ) ); |
| 70 | 78 | |
| @@ -174,16 +182,10 @@ | ||
| 174 | 182 | if ( ! isset( $data['wp-stream-heartbeat'] ) ) { |
| 175 | 183 | return $response; |
| 176 | 184 | } |
| 177 | 185 | |
| 178 | - // Ensure the current user is allowed to view Stream records before | |
| 179 | - // exposing any activity data through the Heartbeat API. | |
| 180 | - if ( ! current_user_can( $this->plugin->admin->view_cap ) ) { | |
| 181 | - return $response; | |
| 182 | - } | |
| 186 | + $enable_stream_update = ( 'off' !== get_user_meta( get_current_user_id(), $this->user_meta_key ) ); | |
| 183 | 187 | |
| 184 | - $enable_stream_update = ( 'off' !== get_user_meta( get_current_user_id(), $this->user_meta_key, true ) ); | |
| 185 | - | |
| 186 | 188 | // Register list table. |
| 187 | 189 | $this->list_table = new List_Table( |
| 188 | 190 | $this->plugin, |
| 189 | 191 | array( |
| @@ -197,9 +199,9 @@ | ||
| 197 | 199 | |
| 198 | 200 | if ( isset( $data['wp-stream-heartbeat'] ) && isset( $total_items ) ) { |
| 199 | 201 | $response['total_items'] = $total_items; |
| 200 | 202 | /* translators: %d: number of items (e.g. "42") */ |
| 201 | - $response['total_items_i18n'] = sprintf( _n( '%d item', '%d items', $total_items, 'stream' ), number_format_i18n( $total_items ) ); | |
| 203 | + $response['total_items_i18n'] = sprintf( _n( '%d item', '%d items', $total_items ), number_format_i18n( $total_items ) ); | |
| 202 | 204 | } |
| 203 | 205 | |
| 204 | 206 | if ( isset( $data['wp-stream-heartbeat'] ) && 'live-update' === $data['wp-stream-heartbeat'] && $enable_stream_update ) { |
| 205 | 207 | |
