← All changes
|
includes/admin/projects/open_project/wppm_edit_project_status.php
+7
-5
1.0.0
→
6.0.7
View file →
| @@ -2,11 +2,12 @@ | ||
| 2 | 2 | if ( ! defined( 'ABSPATH' ) ) { |
| 3 | 3 | exit; // Exit if accessed directly |
| 4 | 4 | } |
| 5 | 5 | global $wpdb,$wppmfunction,$current_user; |
| 6 | -$project_id = isset($_POST['id']) ? sanitize_text_field($_POST['id']) : '' ; | |
| 7 | -if (!(($current_user->ID && $current_user->has_cap('manage_options')) || $wppmfunction->has_project_permission('change_project_status',$project_id))) {exit;} | |
| 6 | +$project_id = isset($_POST['id']) ? intval(sanitize_text_field(wp_unslash($_POST['id']))) : '' ; | |
| 8 | 7 | $project_data = $wppmfunction->get_project($project_id); |
| 8 | +$wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true ); | |
| 9 | +if (!(($current_user->ID && $current_user->has_cap('manage_options')) || $wppmfunction->has_project_permission('change_project_status',$project_id) || ($project_data['created_by']==$current_user->ID && $wppm_current_user_capability=='wppm_manager') || $wppm_current_user_capability=='wppm_admin')) {exit;} | |
| 9 | 10 | $statuses = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_project_statuses"); |
| 10 | 11 | $status_id = $project_data['status']; |
| 11 | 12 | ob_start(); |
| 12 | 13 | ?> |
| @@ -25,9 +26,10 @@ | ||
| 25 | 26 | </select> |
| 26 | 27 | </div> |
| 27 | 28 | <?php do_action('wppm_after_edit_change_project_status',$project_id);?> |
| 28 | 29 | <input type="hidden" name="action" value="wppm_set_change_project_status" /> |
| 29 | - <input type="hidden" id="wppm_project_id" name="project_id" value="<?php echo htmlentities(esc_attr($project_id)); ?>" /> | |
| 30 | + <input type="hidden" name="_ajax_nonce" value="<?php echo esc_attr( wp_create_nonce( 'wppm_set_change_project_status' ) ); ?>"> | |
| 31 | + <input type="hidden" id="wppm_project_id" name="project_id" value="<?php echo (esc_attr($project_id)); ?>" /> | |
| 30 | 32 | |
| 31 | 33 | |
| 32 | 34 | </form> |
| 33 | 35 | <?php |
| @@ -35,9 +37,9 @@ | ||
| 35 | 37 | |
| 36 | 38 | ob_start(); |
| 37 | 39 | ?> |
| 38 | 40 | <button type="button" class="btn wppm_popup_close" onclick="wppm_modal_close();"><?php echo esc_html_e('Close','taskbuilder');?></button> |
| 39 | -<button type="button" class="btn wppm_popup_action" onclick="wppm_set_change_project_status(<?php echo htmlentities(esc_attr($project_id))?>);"><?php echo esc_html_e('Save','taskbuilder');?></button> | |
| 41 | +<button type="button" class="btn wppm_popup_action" onclick="wppm_set_change_project_status(<?php echo esc_js($project_id)?>);"><?php echo esc_html_e('Save','taskbuilder');?></button> | |
| 40 | 42 | <?php |
| 41 | 43 | $footer = ob_get_clean(); |
| 42 | 44 | |
| 43 | 45 | $output = array( |
| @@ -44,5 +46,5 @@ | ||
| 44 | 46 | 'body' => $body, |
| 45 | 47 | 'footer' => $footer |
| 46 | 48 | ); |
| 47 | 49 | |
| 48 | -echo json_encode($output); | |
| 50 | +echo wp_json_encode($output); | |