← All changes | modules/scott-list/module.php +12 -9 4.0.9 → 4.5.6 View file →

		@@ -31,9 +31,15 @@
31	31	return $widgets;
32	32	}
33	33
34	34	public function callback_ajax_loadmore_posts() {
	35	+ // Verify the front-end nonce (sent by UltimatePostKitConfig.nonce) before
	36	+ // processing this public load-more request.
	37	+ if ( ! check_ajax_referer( 'upk-site', 'nonce', false ) ) {
	38	+ wp_send_json_error( array( 'message' => esc_html__( 'Security check failed.', 'ultimate-post-kit' ) ), 403 );
	39	+ }
35	40
	41	+
36	42	$settings = [];
37	43
38	44	if ( isset( $_POST['settings'] ) && is_array( $_POST['settings'] ) ) {
39	45	$settings = map_deep( wp_unslash( $_POST['settings'] ), 'sanitize_text_field' );
		@@ -54,8 +60,11 @@
54	60	],
55	61	$settings
56	62	);
57	63
	64	+ // Fill display flags the request may have omitted (see trait) before the render loop reads them.
	65	+ $settings = array_merge( $this->loadmore_display_defaults(), $settings );
	66	+
58	67	$ajaxposts = $this->query_args( $settings );
59	68
60	69	ob_start();
61	70	$found_posts = false;
		@@ -75,15 +84,10 @@
75	84	$image_src = $image_src ? $image_src[0] : $placeholder;
76	85
77	86	$title_tag = Utils::get_valid_html_tag($settings['title_tags']);
78	87
79		- $onclick = '';
80		- if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) {
81		- $onclick = 'onclick="window.open(\'' . esc_url( $post_link ) . '\', \'_self\')"';
82		- }
83		-
84	88	?>
85		- <div <?php echo $onclick; ?> class="upk-item">
	89	+ <div <?php if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) { printf( 'onclick="window.open(\'%s\', \'_self\')"', esc_url( $post_link ) ); } ?> class="upk-item">
86	90	<a class="upk-image-wrap" href="<?php echo esc_url( $post_link ); ?>">
87	91	<img src="<?php echo esc_url( $image_src ); ?>" alt="<?php echo esc_attr( $title ); ?>">
88	92	<span class="upk-img-overlay"></span>
89	93	</a>
		@@ -149,10 +153,9 @@
149	153
150	154	<?php if ( $settings['show_comments'] === 'yes' ) : ?>
151	155	<div data-separator="<?php echo esc_attr( $settings['meta_separator'] ?? '//' ); ?>">
152	156	<div class="upk-scott-comments">
153		- <?php echo get_comments_number( $post_id ); ?>
154		- <?php echo esc_html_x( 'Comments', 'Frontend', 'ultimate-post-kit' ); ?>
	157	+ <?php echo esc_html( $this->upk_get_formatted_comments_count( $post_id ) ); ?>
155	158	</div>
156	159	</div>
157	160	<?php endif; ?>
158	161
		@@ -157,9 +160,9 @@
157	160	<?php endif; ?>
158	161
159	162	<?php if ( _is_upk_pro_activated() && $settings['show_reading_time'] === 'yes' ) : ?>
160	163	<div class="upk-reading-time" data-separator="<?php echo esc_attr( $settings['meta_separator'] ?? '//' ); ?>">
161		- <?php echo esc_html( ultimate_post_kit_reading_time( get_the_content(), $settings['avg_reading_speed'] ?? 200 ) ); ?>
	164	+ <?php echo esc_html( ultimate_post_kit_reading_time( get_the_content(), $settings['avg_reading_speed'], $settings['hide_seconds'] ?? 'no', $settings['hide_minutes'] ?? 'no' ) ); ?>
162	165	</div>
163	166	<?php endif; ?>
164	167	</div>
165	168	<?php endif; ?>