← All changes | modules/elite-grid/module.php +17 -13 4.1.15 → 4.5.6 View file →

		@@ -31,9 +31,15 @@
31	31	return $widgets;
32	32	}
33	33
34	34	public function callback_ajax_loadmore_posts() {
	35	+ // Verify the front-end nonce (sent by UltimatePostKitConfig.nonce) before
	36	+ // processing this public load-more request.
	37	+ if ( ! check_ajax_referer( 'upk-site', 'nonce', false ) ) {
	38	+ wp_send_json_error( array( 'message' => esc_html__( 'Security check failed.', 'ultimate-post-kit' ) ), 403 );
	39	+ }
35	40
	41	+
36	42	$settings = [];
37	43
38	44	if ( isset( $_POST['settings'] ) && is_array( $_POST['settings'] ) ) {
39	45	$settings = map_deep( wp_unslash( $_POST['settings'] ), 'sanitize_text_field' );
		@@ -56,8 +62,11 @@
56	62	],
57	63	$settings
58	64	);
59	65
	66	+ // Fill display flags the request may have omitted (see trait) before the render loop reads them.
	67	+ $settings = array_merge( $this->loadmore_display_defaults(), $settings );
	68	+
60	69	$ajaxposts = $this->query_args($settings);
61	70
62	71	ob_start();
63	72	$found_posts = false;
		@@ -80,15 +89,10 @@
80	89
81	90	$image_src = wp_get_attachment_image_src( get_post_thumbnail_id(), 'large' );
82	91	$image_src = $image_src ? $image_src[0] : $placeholder;
83	92
84		- $onclick = '';
85		- if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) {
86		- $onclick = 'onclick="window.open(\'' . esc_url( $post_link ) . '\', \'_self\')"';
87		- }
88		-
89	93	?>
90		- <div <?php echo $onclick; ?> class="upk-item">
	94	+ <div <?php if ( ! empty( $settings['global_link'] ) && $settings['global_link'] === 'yes' ) { printf( 'onclick="window.open(\'%s\', \'_self\')"', esc_url( $post_link ) ); } ?> class="upk-item">
91	95	<div class="upk-item-box">
92	96	<div class="upk-image-wrap">
93	97	<div class="upk-main-image">
94	98	<img class="upk-img" src="<?php echo esc_url($image_src); ?>" alt="<?php echo esc_attr($title); ?>">
		@@ -100,16 +104,16 @@
100	104	<?php echo get_avatar(get_the_author_meta('ID'), 48); ?>
101	105	</div>
102	106	<div class="upk-author-info-warp">
103	107	<span class="author-name">
104		- <a class="name" href="<?php echo $author_url; ?>">
105		- <?php echo $author_name; ?>
	108	+ <a class="name" href="<?php echo esc_url( $author_url ); ?>">
	109	+ <?php echo esc_html( $author_name ); ?>
106	110	</a>
107	111	</span>
108	112	<span class="author-depertment">
109	113	<?php
110	114	$aid = get_the_author_meta('ID');
111		- echo ucwords(get_user_role($aid));
	115	+ echo esc_html( get_user_role( $aid ) );
112	116	?>
113	117	</span>
114	118	</div>
115	119	</div>
		@@ -150,9 +154,9 @@
150	154	</div>
151	155	<?php endif; ?>
152	156
153	157	<?php if ($settings['show_category'] === 'yes') : ?>
154		- <div class="upk-category"><?php echo upk_get_category($post_type); ?></div>
	158	+ <div class="upk-category"><?php echo wp_kses_post( upk_get_category($post_type) ); ?></div>
155	159	<?php endif; ?>
156	160	</div>
157	161	<?php endif; ?>
158	162	</div>
		@@ -161,9 +165,9 @@
161	165	<div>
162	166	<?php if (!isset($settings['show_title']) || $settings['show_title'] === 'yes') : ?>
163	167	<<?php echo esc_attr( $title_tag ); ?> class="upk-title">
164	168	<a
165		- href="<?php echo $post_link; ?>"
	169	+ href="<?php echo esc_url( $post_link ); ?>"
166	170	title="<?php echo esc_attr($title); ?>"
167	171	class="title-animation-<?php echo esc_attr($settings['title_style']); ?>"
168	172	<?php echo $settings['upk_link_new_tab'] === 'yes' ? 'target="_blank"' : ''; ?>
169	173	>
		@@ -178,9 +182,9 @@
178	182	<?php
179	183	echo esc_html(
180	184	wp_trim_words(
181	185	get_the_excerpt(),
182		- absint($settings['excerpt_length'] ?? 20)
	186	+ ultimate_post_kit_clamp_excerpt_length($settings['excerpt_length'] ?? 20, 20)
183	187	)
184	188	);
185	189	?>
186	190	</div>
		@@ -193,9 +197,9 @@
193	197	$settings['show_reading_time'] === 'yes'
194	198	) : ?>
195	199	<div class="upk-meta-list upk-flex upk-flex-middle">
196	200	<?php if ($settings['show_category'] === 'yes') : ?>
197		- <div class="upk-category"><?php echo upk_get_category($post_type); ?></div>
	201	+ <div class="upk-category"><?php echo wp_kses_post( upk_get_category($post_type) ); ?></div>
198	202	<?php endif; ?>
199	203
200	204	<?php if ($settings['show_date'] === 'yes') : ?>
201	205	<div class="upk-date">