← All changes | modules/alice-grid/module.php +12 -9 4.0.9 → 4.5.6 View file →

		@@ -32,8 +32,14 @@
32	32	return $widgets;
33	33	}
34	34
35	35	public function callback_ajax_loadmore_posts() {
	36	+ // Verify the front-end nonce (sent by UltimatePostKitConfig.nonce) before
	37	+ // processing this public load-more request.
	38	+ if ( ! check_ajax_referer( 'upk-site', 'nonce', false ) ) {
	39	+ wp_send_json_error( array( 'message' => esc_html__( 'Security check failed.', 'ultimate-post-kit' ) ), 403 );
	40	+ }
	41	+
36	42
37	43	$settings = [];
38	44
39	45	if ( isset( $_POST['settings'] ) && is_array( $_POST['settings'] ) ) {
		@@ -55,8 +61,11 @@
55	61	],
56	62	$settings
57	63	);
58	64
	65	+ // Fill display flags the request may have omitted (see trait) before the render loop reads them.
	66	+ $settings = array_merge( $this->loadmore_display_defaults(), $settings );
	67	+
59	68	$ajaxposts = $this->query_args($settings);
60	69
61	70	ob_start();
62	71	$found_posts = false;
		@@ -77,16 +86,10 @@
77	86	$placeholder_image_src = \Elementor\Utils::get_placeholder_image_src();
78	87	$image_src = wp_get_attachment_image_src( get_post_thumbnail_id(), 'large' );
79	88	$image_src = $image_src ? $image_src[0] : $placeholder_image_src;
80	89
81		- $onclick = '';
82		-
83		- if (!empty($settings['global_link']) && $settings['global_link'] === 'yes') {
84		- $onclick = ' onclick="window.open(\'' . $post_link . '\', \'_self\')"';
85		- }
86		-
87	90	?>
88		- <div <?php echo $onclick; ?> class="upk-item">
	91	+ <div <?php if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) { printf( 'onclick="window.open(\'%s\', \'_self\')"', esc_url( $post_link ) ); } ?> class="upk-item">
89	92	<div class="upk-item-box">
90	93
91	94	<div class="upk-img-wrap">
92	95	<img class="upk-img" src="<?php echo esc_url( $image_src ); ?>" alt="<?php echo esc_attr( $title ); ?>">
		@@ -93,9 +96,9 @@
93	96	</div>
94	97
95	98	<?php if ( isset( $settings['show_category'] ) && 'yes' === $settings['show_category'] ) : ?>
96	99	<div class="upk-category">
97		- <?php echo upk_get_category( $settings['post_source'] ); ?>
	100	+ <?php echo wp_kses_post( upk_get_category( $settings['posts_source'] ?? 'post' ) ); ?>
98	101	</div>
99	102	<?php endif; ?>
100	103
101	104	<div class="upk-content">
		@@ -162,9 +165,9 @@
162	165	) :
163	166	$speed = isset( $settings['avg_reading_speed'] ) ? (int) $settings['avg_reading_speed'] : 200;
164	167	?>
165	168	<div class="upk-reading-time" data-separator="<?php echo esc_attr( $settings['meta_separator'] ); ?>">
166		- <?php echo esc_html( ultimate_post_kit_reading_time( get_the_content(), $speed ) ); ?>
	169	+ <?php echo esc_html( ultimate_post_kit_reading_time( get_the_content(), $speed, $settings['hide_seconds'] ?? 'no', $settings['hide_minutes'] ?? 'no' ) ); ?>
167	170	</div>
168	171	<?php endif; ?>
169	172	</div>
170	173	<?php endif; ?>