| @@ -31,9 +31,15 @@ | ||
| 31 | 31 | return $widgets; |
| 32 | 32 | } |
| 33 | 33 | |
| 34 | 34 | public function callback_ajax_loadmore_posts() { |
| 35 | + // Verify the front-end nonce (sent by UltimatePostKitConfig.nonce) before | |
| 36 | + // processing this public load-more request. | |
| 37 | + if ( ! check_ajax_referer( 'upk-site', 'nonce', false ) ) { | |
| 38 | + wp_send_json_error( array( 'message' => esc_html__( 'Security check failed.', 'ultimate-post-kit' ) ), 403 ); | |
| 39 | + } | |
| 35 | 40 | |
| 41 | + | |
| 36 | 42 | $settings = []; |
| 37 | 43 | |
| 38 | 44 | if ( isset( $_POST['settings'] ) && is_array( $_POST['settings'] ) ) { |
| 39 | 45 | $settings = map_deep( wp_unslash( $_POST['settings'] ), 'sanitize_text_field' ); |
| @@ -54,8 +60,11 @@ | ||
| 54 | 60 | ], |
| 55 | 61 | $settings |
| 56 | 62 | ); |
| 57 | 63 | |
| 64 | + // Fill display flags the request may have omitted (see trait) before the render loop reads them. | |
| 65 | + $settings = array_merge( $this->loadmore_display_defaults(), $settings ); | |
| 66 | + | |
| 58 | 67 | $ajaxposts = $this->query_args( $settings ); |
| 59 | 68 | |
| 60 | 69 | ob_start(); |
| 61 | 70 | $found_posts = false; |
| @@ -75,15 +84,10 @@ | ||
| 75 | 84 | $image_src = $image_src ? $image_src[0] : $placeholder; |
| 76 | 85 | |
| 77 | 86 | $title_tag = Utils::get_valid_html_tag($settings['title_tags']); |
| 78 | 87 | |
| 79 | - $onclick = ''; | |
| 80 | - if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) { | |
| 81 | - $onclick = 'onclick="window.open(\'' . esc_url( $post_link ) . '\', \'_self\')"'; | |
| 82 | - } | |
| 83 | - | |
| 84 | 88 | ?> |
| 85 | - <div <?php echo $onclick; ?> class="upk-item"> | |
| 89 | + <div <?php if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) { printf( 'onclick="window.open(\'%s\', \'_self\')"', esc_url( $post_link ) ); } ?> class="upk-item"> | |
| 86 | 90 | <a class="upk-image-wrap" href="<?php echo esc_url( $post_link ); ?>"> |
| 87 | 91 | <img src="<?php echo esc_url( $image_src ); ?>" alt="<?php echo esc_attr( $title ); ?>"> |
| 88 | 92 | <span class="upk-img-overlay"></span> |
| 89 | 93 | </a> |
| @@ -149,10 +153,9 @@ | ||
| 149 | 153 | |
| 150 | 154 | <?php if ( $settings['show_comments'] === 'yes' ) : ?> |
| 151 | 155 | <div data-separator="<?php echo esc_attr( $settings['meta_separator'] ?? '//' ); ?>"> |
| 152 | 156 | <div class="upk-scott-comments"> |
| 153 | - <?php echo get_comments_number( $post_id ); ?> | |
| 154 | - <?php echo esc_html_x( 'Comments', 'Frontend', 'ultimate-post-kit' ); ?> | |
| 157 | + <?php echo esc_html( $this->upk_get_formatted_comments_count( $post_id ) ); ?> | |
| 155 | 158 | </div> |
| 156 | 159 | </div> |
| 157 | 160 | <?php endif; ?> |
| 158 | 161 | |
