← All changes | modules/hazel-grid/module.php +14 -8 4.0.9 → 4.5.6 View file →

		@@ -31,9 +31,15 @@
31	31	return $widgets;
32	32	}
33	33
34	34	public function callback_ajax_loadmore_posts() {
	35	+ // Verify the front-end nonce (sent by UltimatePostKitConfig.nonce) before
	36	+ // processing this public load-more request.
	37	+ if ( ! check_ajax_referer( 'upk-site', 'nonce', false ) ) {
	38	+ wp_send_json_error( array( 'message' => esc_html__( 'Security check failed.', 'ultimate-post-kit' ) ), 403 );
	39	+ }
35	40
	41	+
36	42	$settings = [];
37	43
38	44	if ( isset( $_POST['settings'] ) && is_array( $_POST['settings'] ) ) {
39	45	$settings = map_deep( wp_unslash( $_POST['settings'] ), 'sanitize_text_field' );
		@@ -56,8 +62,11 @@
56	62	],
57	63	$settings
58	64	);
59	65
	66	+ // Fill display flags the request may have omitted (see trait) before the render loop reads them.
	67	+ $settings = array_merge( $this->loadmore_display_defaults(), $settings );
	68	+
60	69	$ajaxposts = $this->query_args($settings);
61	70
62	71	ob_start();
63	72	$found_posts = false;
		@@ -80,15 +89,10 @@
80	89	$image_src = $image_src ? $image_src[0] : $placeholder;
81	90	$meta_sep = $settings['meta_separator'] ?? '-';
82	91	$title_tag = Utils::get_valid_html_tag($settings['title_tags']);
83	92
84		- $onclick = '';
85		- if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) {
86		- $onclick = 'onclick="window.open(\'' . esc_url( $post_link ) . '\', \'_self\')"';
87		- }
88		-
89	93	?>
90		- <div <?php echo $onclick; ?> class="upk-item">
	94	+ <div <?php if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) { printf( 'onclick="window.open(\'%s\', \'_self\')"', esc_url( $post_link ) ); } ?> class="upk-item">
91	95	<div class="upk-item-box">
92	96	<img class="upk-img" src="<?php echo esc_url( $image_src ); ?>" alt="<?php echo esc_attr( $title ); ?>">
93	97
94	98	<div class="upk-content">
		@@ -93,9 +97,9 @@
93	97
94	98	<div class="upk-content">
95	99	<?php if ( $settings['show_category'] === 'yes' ) : ?>
96	100	<div class="upk-category">
97		- <?php echo upk_get_category( $post_type ); ?>
	101	+ <?php echo wp_kses_post( upk_get_category( $post_type ) ); ?>
98	102	</div>
99	103	<?php endif; ?>
100	104
101	105	<?php if ( ! isset( $settings['show_title'] ) || $settings['show_title'] === 'yes' ) : ?>
		@@ -168,9 +172,11 @@
168	172	<div class="upk-reading-time" data-separator="<?php echo esc_html( $meta_sep ); ?>">
169	173	<?php echo esc_html(
170	174	ultimate_post_kit_reading_time(
171	175	get_the_content(),
172		- $settings['avg_reading_speed'] ?? 200
	176	+ $settings['avg_reading_speed'],
	177	+ $settings['hide_seconds'] ?? 'no',
	178	+ $settings['hide_minutes'] ?? 'no'
173	179	)
174	180	); ?>
175	181	</div>
176	182	<?php endif; ?>