← All changes | modules/amox-grid/module.php +12 -8 4.1.0 → 4.5.6 View file →

		@@ -32,9 +32,15 @@
32	32	return $widgets;
33	33	}
34	34
35	35	public function callback_ajax_loadmore_posts() {
	36	+ // Verify the front-end nonce (sent by UltimatePostKitConfig.nonce) before
	37	+ // processing this public load-more request.
	38	+ if ( ! check_ajax_referer( 'upk-site', 'nonce', false ) ) {
	39	+ wp_send_json_error( array( 'message' => esc_html__( 'Security check failed.', 'ultimate-post-kit' ) ), 403 );
	40	+ }
36	41
	42	+
37	43	$settings = [];
38	44
39	45	if ( isset( $_POST['settings'] ) && is_array( $_POST['settings'] ) ) {
40	46	$settings = map_deep( wp_unslash( $_POST['settings'] ), 'sanitize_text_field' );
		@@ -57,8 +63,11 @@
57	63	],
58	64	$settings
59	65	);
60	66
	67	+ // Fill display flags the request may have omitted (see trait) before the render loop reads them.
	68	+ $settings = array_merge( $this->loadmore_display_defaults(), $settings );
	69	+
61	70	$ajaxposts = $this->query_args( $settings );
62	71
63	72	ob_start();
64	73	$found_posts = false;
		@@ -75,15 +84,10 @@
75	84	$post_link = esc_url( get_permalink() );
76	85	$meta_sep = $settings['meta_separator'] ?? '.';
77	86	$title_tag = Utils::get_valid_html_tag($settings['title_tags']);
78	87
79		- $onclick = '';
80		- if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) {
81		- $onclick = 'onclick="window.open(\'' . esc_url( $post_link ) . '\', \'_self\')"';
82		- }
83		-
84	88	?>
85		- <div <?php echo $onclick; ?> class="upk-item">
	89	+ <div <?php if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) { printf( 'onclick="window.open(\'%s\', \'_self\')"', esc_url( $post_link ) ); } ?> class="upk-item">
86	90	<div class="upk-img-wrap">
87	91	<?php $this->render_image( get_post_thumbnail_id(), 'large' ); ?>
88	92	</div>
89	93
		@@ -146,10 +150,10 @@
146	150
147	151	<?php if ( $settings['show_comments'] === 'yes' ) : ?>
148	152	<div data-separator="<?php echo esc_html( $meta_sep ); ?>">
149	153	<div class="upk-comments upk-flex upk-flex-middle">
150		- <i class="upk-icon-post-comments"></i>
151		- <span><?php echo absint( get_comments_number() ); ?></span>
	154	+ <i class="upk-icon-post-comments" aria-hidden="true"></i>
	155	+ <span><?php echo esc_html( $this->upk_get_localized_comment_count( get_the_ID() ) ); ?></span>
152	156	</div>
153	157	</div>
154	158	<?php endif; ?>
155	159	</div>