← All changes | modules/amox-grid/module.php +9 -0 4.2.1 → 4.5.6 View file →

		@@ -32,9 +32,15 @@
32	32	return $widgets;
33	33	}
34	34
35	35	public function callback_ajax_loadmore_posts() {
	36	+ // Verify the front-end nonce (sent by UltimatePostKitConfig.nonce) before
	37	+ // processing this public load-more request.
	38	+ if ( ! check_ajax_referer( 'upk-site', 'nonce', false ) ) {
	39	+ wp_send_json_error( array( 'message' => esc_html__( 'Security check failed.', 'ultimate-post-kit' ) ), 403 );
	40	+ }
36	41
	42	+
37	43	$settings = [];
38	44
39	45	if ( isset( $_POST['settings'] ) && is_array( $_POST['settings'] ) ) {
40	46	$settings = map_deep( wp_unslash( $_POST['settings'] ), 'sanitize_text_field' );
		@@ -56,8 +62,11 @@
56	62	'posts_offset' => isset( $_POST['offset'] ) ? absint( $_POST['offset'] ) : 0,
57	63	],
58	64	$settings
59	65	);
	66	+
	67	+ // Fill display flags the request may have omitted (see trait) before the render loop reads them.
	68	+ $settings = array_merge( $this->loadmore_display_defaults(), $settings );
60	69
61	70	$ajaxposts = $this->query_args( $settings );
62	71
63	72	ob_start();