| @@ -1152,9 +1152,9 @@ | ||
| 1152 | 1152 | * @return string |
| 1153 | 1153 | */ |
| 1154 | 1154 | public function profile_slug( $slug = 'profile' ) { |
| 1155 | 1155 | if ( $page_id = uwp_get_page_id( 'profile_page', false ) ) { |
| 1156 | - if ( $_slug = get_page_uri( absint( $page_id ) ) ) { | |
| 1156 | + if ( $_slug = get_post_field( 'post_name', absint( $page_id ) ) ) { | |
| 1157 | 1157 | $slug = $_slug; |
| 1158 | 1158 | } |
| 1159 | 1159 | } |
| 1160 | 1160 | return apply_filters( 'uwp_rewrite_profile_slug', $slug ); |
| @@ -1508,19 +1508,10 @@ | ||
| 1508 | 1508 | * @package userswp |
| 1509 | 1509 | * @return void |
| 1510 | 1510 | */ |
| 1511 | 1511 | public function ajax_avatar_banner_upload() { |
| 1512 | - | |
| 1513 | - if ( ! isset( $_POST['security'] ) || ! wp_verify_nonce( $_POST['security'], 'uwp_avatar_banner_upload_nonce' ) ) { | |
| 1514 | - $result['error'] = aui()->alert( array( | |
| 1515 | - 'type' => 'danger', | |
| 1516 | - 'content' => __( "Security check failed.", "userswp" ) | |
| 1517 | - ) ); | |
| 1518 | - $return = json_encode( $result ); | |
| 1519 | - echo $return; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 1520 | - die(); | |
| 1521 | - } | |
| 1522 | - | |
| 1512 | + // Image upload handler | |
| 1513 | + // todo: security checks | |
| 1523 | 1514 | $type = strip_tags( esc_sql( $_POST['uwp_popup_type'] ) ); |
| 1524 | 1515 | $result = array(); |
| 1525 | 1516 | |
| 1526 | 1517 | if ( ! in_array( $type, array( 'banner', 'avatar' ) ) ) { |
| @@ -1772,10 +1763,8 @@ | ||
| 1772 | 1763 | uwp_get_template( $template ); |
| 1773 | 1764 | |
| 1774 | 1765 | $content_wrap = $design_style == 'bootstrap' ? '.uwp-profile-image-change-modal .modal-content' : '#uwp-popup-modal-wrap'; |
| 1775 | 1766 | $bg_color = apply_filters('uwp_crop_image_bg_color', '', $type); |
| 1776 | - | |
| 1777 | - $ajax_nonce = wp_create_nonce( 'uwp_avatar_banner_upload_nonce' ); | |
| 1778 | 1767 | ?> |
| 1779 | 1768 | |
| 1780 | 1769 | <script type="text/javascript"> |
| 1781 | 1770 | (function ($, window, undefined) { |
| @@ -1815,10 +1804,8 @@ | ||
| 1815 | 1804 | fd.append('<?php echo esc_attr( $type ); ?>', file); |
| 1816 | 1805 | // our AJAX identifier |
| 1817 | 1806 | fd.append('action', 'uwp_avatar_banner_upload'); |
| 1818 | 1807 | fd.append('uwp_popup_type', '<?php echo esc_attr( $type ); ?>'); |
| 1819 | - // Add nonce for security | |
| 1820 | - fd.append('security', '<?php echo esc_js( $ajax_nonce ); ?>'); | |
| 1821 | 1808 | |
| 1822 | 1809 | $("#progressBar").show().removeClass('d-none'); |
| 1823 | 1810 | |
| 1824 | 1811 | $.ajax({ |
| @@ -1865,10 +1852,9 @@ | ||
| 1865 | 1852 | trueSize: [uwp_true_width, uwp_true_height], |
| 1866 | 1853 | minSize: [uwp_full_width, uwp_full_height] |
| 1867 | 1854 | }); |
| 1868 | 1855 | } |
| 1869 | - }, | |
| 1870 | - | |
| 1856 | + } | |
| 1871 | 1857 | }); |
| 1872 | 1858 | }); |
| 1873 | 1859 | |
| 1874 | 1860 | function showProgress(evt) { |
