← All changes | includes/ultimate-post-kit-category-image.php +19 -2 4.1.9 → 4.5.6 View file →

		@@ -1,5 +1,10 @@
1	1	<?php
	2	+
	3	+if (!defined('ABSPATH')) {
	4	+ exit; // Exit if accessed directly.
	5	+}
	6	+
2	7	if (!class_exists('Ultimate_Post_Kit_Category_Image')) {
3	8	class Ultimate_Post_Kit_Category_Image {
4	9	public function __construct() {
5	10	add_action('category_add_form_fields', [$this, 'add_new_category_image'], 10, 2);
		@@ -23,10 +28,16 @@
23	28	</div>
24	29	<?php
25	30	}
26	31	public function save_category_image($term_id) {
	32	+ if (!current_user_can('manage_categories')) {
	33	+ return;
	34	+ }
	35	+ if (!isset($_POST['_wpnonce_add-tag']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['_wpnonce_add-tag'])), 'add-tag')) {
	36	+ return;
	37	+ }
27	38	if (isset($_POST['upk-category-image-id']) && '' !== $_POST['upk-category-image-id']) {
28		- $image = sanitize_key($_POST['upk-category-image-id']);
	39	+ $image = sanitize_key(wp_unslash($_POST['upk-category-image-id']));
29	40	add_term_meta($term_id, 'upk-category-image-id', $image, true);
30	41	}
31	42	}
32	43	public function edit_category_image($term) { ?>
		@@ -51,10 +62,16 @@
51	62	<?php
52	63	}
53	64
54	65	public function updated_category_image($term_id) {
	66	+ if (!current_user_can('manage_categories')) {
	67	+ return;
	68	+ }
	69	+ if (!isset($_POST['_wpnonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['_wpnonce'])), 'update-tag_' . $term_id)) {
	70	+ return;
	71	+ }
55	72	if (isset($_POST['upk-category-image-id']) && '' !== $_POST['upk-category-image-id']) {
56		- $image = sanitize_key($_POST['upk-category-image-id']);
	73	+ $image = sanitize_key(wp_unslash($_POST['upk-category-image-id']));
57	74	update_term_meta($term_id, 'upk-category-image-id', $image);
58	75	} else {
59	76	update_term_meta($term_id, 'upk-category-image-id', '');
60	77	}