esc_html__( 'Security check failed.', 'ultimate-post-kit' ) ), 403 ); } // Security: Verify nonce if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'upk-site' ) ) { wp_send_json_error( [ 'message' => esc_html__( 'Security verification failed', 'ultimate-post-kit' ) ], 403 ); wp_die(); } $settings = []; if ( isset( $_POST['settings'] ) && is_array( $_POST['settings'] ) ) { $settings = map_deep( wp_unslash( $_POST['settings'] ), 'sanitize_text_field' ); } // NOTE: the request-derived values below are NOT the ones the query is built from. // query_args() is declared without parameters and re-reads $_POST['settings'] // itself, so anything merged into $settings here is discarded. The query is // constrained inside query_args(): post_status is pinned to 'publish', per_page // is clamped to 1..100, and post_type is restricted to publicly visible post // types by ultimate_post_kit_sanitize_public_post_type(). The defaults are kept // only so the render loop below has the keys it expects. $settings = array_merge( [ 'posts_source' => 'post', 'posts_orderby' => 'date', 'posts_order' => 'DESC', 'posts_ignore_sticky_posts' => 'no', 'posts_only_with_featured_image' => 'no', 'posts_select_date' => '', 'posts_exclude_by' => [], 'posts_include_by' => [], ], $settings ); $ajaxposts = $this->query_args( $settings ); ob_start(); $found_posts = false; if ($ajaxposts->have_posts()) : while ($ajaxposts->have_posts()) : $ajaxposts->the_post(); $found_posts = true; $title = get_the_title(); $post_link = esc_url(get_permalink()); $image_src = wp_get_attachment_image_url(get_post_thumbnail_id(), 'large'); $image_src = $image_src ? esc_url($image_src) : esc_url(\Elementor\Utils::get_placeholder_image_src()); $category = wp_kses_post(upk_get_category($post_type)); $author_url = esc_url(get_author_posts_url(get_the_author_meta('ID'))); $author_name = esc_html(get_the_author()); $title_tag = Utils::get_valid_html_tag($settings['title_tags'] ); $meta_separator = isset( $settings['meta_separator'] ) ? $settings['meta_separator'] : '|'; $date = ''; if (!empty($settings['human_diff_time']) && $settings['human_diff_time'] === 'yes') { $date = ultimate_post_kit_post_time_diff(($settings['human_diff_time_short'] === 'yes') ? 'short' : ''); } else { $date = esc_html(get_the_date()); } $format_icons = [ 'aside' => 'upk-icon-aside', 'gallery' => 'upk-icon-gallery', 'link' => 'upk-icon-link', 'image' => 'upk-icon-image', 'quote' => 'upk-icon-quote', 'status' => 'upk-icon-status', 'video' => 'upk-icon-video', 'audio' => 'upk-icon-music', 'chat' => 'upk-icon-chat', ]; $post_format_icon = isset($format_icons[get_post_format()]) ? $format_icons[get_post_format()] : 'upk-icon-post'; ?>