| @@ -32,9 +32,15 @@ | ||
| 32 | 32 | return $widgets; |
| 33 | 33 | } |
| 34 | 34 | |
| 35 | 35 | public function callback_ajax_loadmore_posts() { |
| 36 | + // Verify the front-end nonce (sent by UltimatePostKitConfig.nonce) before | |
| 37 | + // processing this public load-more request. | |
| 38 | + if ( ! check_ajax_referer( 'upk-site', 'nonce', false ) ) { | |
| 39 | + wp_send_json_error( array( 'message' => esc_html__( 'Security check failed.', 'ultimate-post-kit' ) ), 403 ); | |
| 40 | + } | |
| 36 | 41 | |
| 42 | + | |
| 37 | 43 | $settings = []; |
| 38 | 44 | |
| 39 | 45 | if ( isset( $_POST['settings'] ) && is_array( $_POST['settings'] ) ) { |
| 40 | 46 | $settings = map_deep( wp_unslash( $_POST['settings'] ), 'sanitize_text_field' ); |
| @@ -57,8 +63,11 @@ | ||
| 57 | 63 | ], |
| 58 | 64 | $settings |
| 59 | 65 | ); |
| 60 | 66 | |
| 67 | + // Fill display flags the request may have omitted (see trait) before the render loop reads them. | |
| 68 | + $settings = array_merge( $this->loadmore_display_defaults(), $settings ); | |
| 69 | + | |
| 61 | 70 | $ajaxposts = $this->query_args( $settings ); |
| 62 | 71 | |
| 63 | 72 | ob_start(); |
| 64 | 73 | $found_posts = false; |
| @@ -175,11 +184,11 @@ | ||
| 175 | 184 | if (has_excerpt()) { |
| 176 | 185 | the_excerpt(); |
| 177 | 186 | } else { |
| 178 | 187 | if (function_exists('ultimate_post_kit_custom_excerpt')) { |
| 179 | - echo wp_kses_post(ultimate_post_kit_custom_excerpt(intval($settings['excerpt_length'] ?? 20), false, '')); | |
| 188 | + echo wp_kses_post(ultimate_post_kit_custom_excerpt(ultimate_post_kit_clamp_excerpt_length($settings['excerpt_length'] ?? 20, 20), false, '')); | |
| 180 | 189 | } else { |
| 181 | - echo esc_html(wp_trim_words(wp_strip_all_tags(get_the_content()), intval($settings['excerpt_length'] ?? 20))); | |
| 190 | + echo esc_html(wp_trim_words(wp_strip_all_tags(get_the_content()), ultimate_post_kit_clamp_excerpt_length($settings['excerpt_length'] ?? 20, 20))); | |
| 182 | 191 | } |
| 183 | 192 | } |
| 184 | 193 | ?> |
| 185 | 194 | </div> |
| @@ -192,11 +201,12 @@ | ||
| 192 | 201 | <?php if ($settings['show_readmore'] === 'yes') : ?> |
| 193 | 202 | <a href="<?php echo esc_url($post_link); ?>" class="upk-readmore" target="<?php echo esc_attr($settings['upk_link_new_tab'] === 'yes' ? '_blank' : '_self'); ?>"> |
| 194 | 203 | <span class="upk-flex upk-flex-middle"> |
| 195 | 204 | <?php echo esc_html($settings['readmore_text'] ?? __('Read More', 'ultimate-post-kit')); ?> |
| 196 | - <?php if ($settings['readmore_icon']['value']) : ?> | |
| 205 | + <?php $upk_readmore_icon = ultimate_post_kit_sanitize_request_icon($settings['readmore_icon'] ?? null); ?> | |
| 206 | + <?php if ($upk_readmore_icon) : ?> | |
| 197 | 207 | <span class="upk-readmore-btn-icon upk-flex-align-<?php echo esc_attr($settings['icon_align']); ?>"> |
| 198 | - <?php Icons_Manager::render_icon($settings['readmore_icon'], ['aria-hidden' => 'true', 'class' => 'fa-fw']); ?> | |
| 208 | + <?php Icons_Manager::render_icon($upk_readmore_icon, ['aria-hidden' => 'true', 'class' => 'fa-fw']); ?> | |
| 199 | 209 | </span> |
| 200 | 210 | <?php endif; ?> |
| 201 | 211 | </span> |
| 202 | 212 | </a> |
