← All changes | modules/alter-grid/module.php +21 -16 4.1.10 → 4.5.6 View file →

		@@ -32,9 +32,15 @@
32	32	return $widgets;
33	33	}
34	34
35	35	public function callback_ajax_loadmore_posts() {
	36	+ // Verify the front-end nonce (sent by UltimatePostKitConfig.nonce) before
	37	+ // processing this public load-more request.
	38	+ if ( ! check_ajax_referer( 'upk-site', 'nonce', false ) ) {
	39	+ wp_send_json_error( array( 'message' => esc_html__( 'Security check failed.', 'ultimate-post-kit' ) ), 403 );
	40	+ }
36	41
	42	+
37	43	$settings = [];
38	44
39	45	if ( isset( $_POST['settings'] ) && is_array( $_POST['settings'] ) ) {
40	46	$settings = map_deep( wp_unslash( $_POST['settings'] ), 'sanitize_text_field' );
		@@ -57,8 +63,11 @@
57	63	],
58	64	$settings
59	65	);
60	66
	67	+ // Fill display flags the request may have omitted (see trait) before the render loop reads them.
	68	+ $settings = array_merge( $this->loadmore_display_defaults(), $settings );
	69	+
61	70	$ajaxposts = $this->query_args($settings);
62	71
63	72	ob_start();
64	73	$found_posts = false;
		@@ -82,15 +91,10 @@
82	91
83	92	$image_src = wp_get_attachment_image_src( get_post_thumbnail_id(), 'large' );
84	93	$image_src = $image_src ? $image_src[0] : $placeholder;
85	94
86		- $onclick = '';
87		- if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) {
88		- $onclick = 'onclick="window.open(\'' . esc_url( $post_link ) . '\', \'_self\')"';
89		- }
90		-
91	95	?>
92		- <div <?php echo $onclick; ?> class="upk-item">
	96	+ <div <?php if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) { printf( 'onclick="window.open(\'%s\', \'_self\')"', esc_url( $post_link ) ); } ?> class="upk-item">
93	97	<div class="upk-item-box">
94	98	<div class="upk-img-wrap">
95	99	<div class="upk-main-img">
96	100	<img
		@@ -98,9 +102,9 @@
98	102	src="<?php echo esc_url( $image_src ); ?>"
99	103	alt="<?php echo esc_attr( $title ); ?>"
100	104	>
101	105	<?php if ( $settings['readmore_type'] === 'on_image' ) : ?>
102		- <a href="<?php echo $post_link; ?>" class="upk-readmore-on-image">
	106	+ <a href="<?php echo esc_url( $post_link ); ?>" class="upk-readmore-on-image">
103	107	<span class="upk-readmore-icon"><span></span></span>
104	108	</a>
105	109	<?php endif; ?>
106	110
		@@ -105,9 +109,9 @@
105	109	<?php endif; ?>
106	110
107	111	<?php if ( $settings['show_post_format'] === 'yes' ) : ?>
108	112	<div class="upk-post-format">
109		- <a href="<?php echo $post_link; ?>">
	113	+ <a href="<?php echo esc_url( $post_link ); ?>">
110	114	<?php
111	115	if ( has_post_format( 'aside' ) ) :
112	116	echo '<i class="upk-icon-aside" aria-hidden="true"></i>';
113	117	elseif ( has_post_format( 'gallery' ) ) :
		@@ -139,9 +143,9 @@
139	143	<div class="upk-content">
140	144	<div>
141	145	<?php if ( $settings['show_category'] === 'yes' ) : ?>
142	146	<div class="upk-category">
143		- <?php echo upk_get_category( $post_type ); ?>
	147	+ <?php echo wp_kses_post( upk_get_category( $post_type ) ); ?>
144	148	</div>
145	149	<?php endif; ?>
146	150
147	151	<?php if ( ! isset( $settings['show_title'] ) || $settings['show_title'] === 'yes' ) : ?>
		@@ -146,9 +150,9 @@
146	150
147	151	<?php if ( ! isset( $settings['show_title'] ) || $settings['show_title'] === 'yes' ) : ?>
148	152	<<?php echo esc_attr( $title_tag ); ?> class="upk-title">
149	153	<a
150		- href="<?php echo $post_link; ?>"
	154	+ href="<?php echo esc_url( $post_link ); ?>"
151	155	title="<?php echo esc_attr( $title ); ?>"
152	156	class="title-animation-<?php echo esc_attr( $settings['title_style'] ); ?>"
153	157	<?php echo $settings['upk_link_new_tab'] === 'yes' ? 'target="_blank"' : ''; ?>
154	158	>
		@@ -163,9 +167,9 @@
163	167	<?php
164	168	echo esc_html(
165	169	wp_trim_words(
166	170	get_the_excerpt(),
167		- absint( $settings['excerpt_length'] ?? 20 ),
	171	+ ultimate_post_kit_clamp_excerpt_length( $settings['excerpt_length'] ?? 20, 20 ),
168	172	'...'
169	173	)
170	174	);
171	175	?>
		@@ -171,13 +175,14 @@
171	175	?>
172	176	</div>
173	177
174	178	<?php if ( $settings['readmore_type'] === 'classic' ) : ?>
175		- <a href="<?php echo $post_link; ?>" class="upk-readmore upk-display-inline-block">
	179	+ <a href="<?php echo esc_url( $post_link ); ?>" class="upk-readmore upk-display-inline-block">
176	180	<?php echo esc_html( $readmore_text ); ?>
177		- <?php if ( $settings['readmore_icon']['value'] ) : ?>
	181	+ <?php $upk_readmore_icon = ultimate_post_kit_sanitize_request_icon( $settings['readmore_icon'] ?? null ); ?>
	182	+ <?php if ( $upk_readmore_icon ) : ?>
178	183	<span class="upk-button-icon-align-<?php echo esc_attr( $settings['readmore_icon_align'] ); ?>">
179		- <?php Icons_Manager::render_icon( $settings['readmore_icon'], [ 'aria-hidden' => 'true', 'class' => 'fa-fw' ] ); ?>
	184	+ <?php Icons_Manager::render_icon( $upk_readmore_icon, [ 'aria-hidden' => 'true', 'class' => 'fa-fw' ] ); ?>
180	185	</span>
181	186	<?php endif; ?>
182	187	</a>
183	188	<?php endif; ?>
		@@ -192,10 +197,10 @@
192	197	<div class="upk-meta">
193	198
194	199	<?php if ( $settings['show_author'] === 'yes' ) : ?>
195	200	<div class="upk-blog-author" data-separator="<?php echo esc_attr( $meta_sep ); ?>">
196		- <a class="author-name" href="<?php echo $author_url; ?>">
197		- <?php echo $author_name; ?>
	201	+ <a class="author-name" href="<?php echo esc_url( $author_url ); ?>">
	202	+ <?php echo esc_html( $author_name ); ?>
198	203	</a>
199	204	</div>
200	205	<?php endif; ?>
201	206