| @@ -165,12 +165,25 @@ | ||
| 165 | 165 | * Inserts a template into the Gutenberg editor. |
| 166 | 166 | * |
| 167 | 167 | * @param mixed $data |
| 168 | 168 | * @param int $postId |
| 169 | + * @param array $settings | |
| 169 | 170 | * @return array |
| 170 | 171 | */ |
| 171 | - public function insert($data, $postId = 0) { | |
| 172 | - $data['content'] = Utils::import_and_replace_attachments($data['content'], $postId); | |
| 172 | + public function insert($data, $postId = 0, $settings = []) { | |
| 173 | + if ( ! empty( $settings ) && is_array( $settings ) && ! empty( $data['content'] ) && is_string( $data['content'] ) ) { | |
| 174 | + $data['content'] = \Templately\Core\Importer\Utils\GutenbergSettingsMerger::merge( $data['content'], $settings ); | |
| 175 | + } | |
| 176 | + | |
| 177 | + $data['content'] = Utils::import_and_replace_attachments( | |
| 178 | + $data['content'], | |
| 179 | + $postId, | |
| 180 | + [ | |
| 181 | + 'attachment_timeout' => 8, | |
| 182 | + 'attachment_retries' => 0, | |
| 183 | + 'attachment_deadline' => microtime( true ) + 20, | |
| 184 | + ] | |
| 185 | + ); | |
| 173 | 186 | return $data; |
| 174 | 187 | } |
| 175 | 188 | |
| 176 | 189 | /** |
| @@ -251,8 +264,16 @@ | ||
| 251 | 264 | public function update_gutenberg_hide_buttons() { |
| 252 | 265 | // Check nonce for security |
| 253 | 266 | check_ajax_referer( 'templately_nonce', 'nonce' ); |
| 254 | 267 | |
| 268 | + // The nonce alone is not authorization: `templately_nonce` is handed to | |
| 269 | + // every user who loads a Templately-enqueued screen, so without this any | |
| 270 | + // logged-in user could write the option. It toggles buttons in the block | |
| 271 | + // editor, so the people who use that editor are exactly the right gate. | |
| 272 | + if ( ! current_user_can( 'edit_posts' ) ) { | |
| 273 | + wp_send_json_error( [ 'message' => __( 'Insufficient permissions', 'templately' ) ], 403 ); | |
| 274 | + } | |
| 275 | + | |
| 255 | 276 | // Get the new value from the AJAX request |
| 256 | 277 | $hide_buttons = isset($_GET['hide_buttons']) ? sanitize_text_field($_GET['hide_buttons']) : ''; |
| 257 | 278 | |
| 258 | 279 | // Update the option |
| @@ -264,5 +285,5 @@ | ||
| 264 | 285 | wp_send_json_success([ |
| 265 | 286 | 'hide_buttons' => $hide_buttons, |
| 266 | 287 | ]); |
| 267 | 288 | } |
| 268 | -} | |
| 289 | +} | |
