← All changes | modules/tiny-list/module.php +12 -2 4.2.3 → trunk View file →

		@@ -31,9 +31,15 @@
31	31	return $widgets;
32	32	}
33	33
34	34	public function callback_ajax_loadmore_posts() {
	35	+ // Verify the front-end nonce (sent by UltimatePostKitConfig.nonce) before
	36	+ // processing this public load-more request.
	37	+ if ( ! check_ajax_referer( 'upk-site', 'nonce', false ) ) {
	38	+ wp_send_json_error( array( 'message' => esc_html__( 'Security check failed.', 'ultimate-post-kit' ) ), 403 );
	39	+ }
35	40
	41	+
36	42	$settings = [];
37	43
38	44	if ( isset( $_POST['settings'] ) && is_array( $_POST['settings'] ) ) {
39	45	$settings = map_deep( wp_unslash( $_POST['settings'] ), 'sanitize_text_field' );
		@@ -56,8 +62,11 @@
56	62	],
57	63	$settings
58	64	);
59	65
	66	+ // Fill display flags the request may have omitted (see trait) before the render loop reads them.
	67	+ $settings = array_merge( $this->loadmore_display_defaults(), $settings );
	68	+
60	69	$ajaxposts = $this->query_args( $settings );
61	70
62	71	ob_start();
63	72	$found_posts = false;
		@@ -88,11 +97,12 @@
88	97	<?php if ( $settings['show_image'] === 'yes' ) : ?>
89	98	<img class="upk-img" src="<?php echo esc_url( $image_src ); ?>" alt="<?php echo esc_attr( $title ); ?>">
90	99	<?php endif; ?>
91	100
92		- <?php if ( ! empty( $settings['show_item_icon']['value'] ) ) : ?>
	101	+ <?php $upk_item_icon = ultimate_post_kit_sanitize_request_icon( $settings['show_item_icon'] ?? null ); ?>
	102	+ <?php if ( $upk_item_icon ) : ?>
93	103	<div class="upk-title-icon">
94		- <?php \Elementor\Icons_Manager::render_icon( $settings['show_item_icon'], [ 'aria-hidden' => 'true', 'class' => 'fa-fw' ] ); ?>
	104	+ <?php \Elementor\Icons_Manager::render_icon( $upk_item_icon, [ 'aria-hidden' => 'true', 'class' => 'fa-fw' ] ); ?>
95	105	</div>
96	106	<?php endif; ?>
97	107
98	108	<?php if ( ! isset( $settings['show_title'] ) || $settings['show_title'] === 'yes' ) : ?>