← All changes | classes/Visualizer/Module/Chart.php +79 -45 3.10.12 → 3.11.15 View file →

		@@ -374,13 +374,13 @@
374	374	* @since 1.0.0
375	375	*
376	376	* @access private
377	377	*
378		- * @param WP_Post $chart The chart object.
	378	+ * @param WP_Post|null $chart The chart object.
379	379	*
380	380	* @return array The array of chart data.
381	381	*/
382		- private function _getChartArray( WP_Post $chart = null ) {
	382	+ private function _getChartArray( $chart = null ) {
383	383	if ( is_null( $chart ) ) {
384	384	$chart = $this->_chart;
385	385	}
386	386	$type = get_post_meta( $chart->ID, Visualizer_Plugin::CF_CHART_TYPE, true );
		@@ -523,8 +523,12 @@
523	523	*
524	524	* @access public
525	525	*/
526	526	public function renderChartPages() {
	527	+ if ( ! current_user_can( 'edit_posts' ) ) {
	528	+ wp_die( __( 'You do not have permission to access this page.', 'visualizer' ) );
	529	+ }
	530	+
527	531	defined( 'IFRAME_REQUEST' ) || define( 'IFRAME_REQUEST', 1 );
528	532	if ( ! defined( 'ET_BUILDER_PRODUCT_VERSION' ) && function_exists( 'et_get_theme_version' ) ) {
529	533	define( 'ET_BUILDER_PRODUCT_VERSION', et_get_theme_version() );
530	534	}
		@@ -570,35 +574,33 @@
570	574
571	575	do_action( 'visualizer_pro_new_chart_defaults', $chart_id );
572	576	}
573	577	} else {
574		- if ( current_user_can( 'edit_posts' ) ) {
575		- $parent_chart_id = isset( $_GET['parent_chart_id'] ) ? filter_var( $_GET['parent_chart_id'], FILTER_VALIDATE_INT ) : '';
576		- $success = false;
577		- if ( $parent_chart_id ) {
578		- $parent_chart = get_post( $parent_chart_id );
579		- $success = $parent_chart && $parent_chart->post_type === Visualizer_Plugin::CPT_VISUALIZER;
580		- }
581		- if ( $success ) {
582		- $new_chart_id = wp_insert_post(
583		- array(
584		- 'post_type' => Visualizer_Plugin::CPT_VISUALIZER,
585		- 'post_title' => 'Visualization',
586		- 'post_author' => get_current_user_id(),
587		- 'post_status' => $parent_chart->post_status,
588		- 'post_content' => $parent_chart->post_content,
589		- )
590		- );
	578	+ $parent_chart_id = isset( $_GET['parent_chart_id'] ) ? filter_var( $_GET['parent_chart_id'], FILTER_VALIDATE_INT ) : '';
	579	+ $success = false;
	580	+ if ( $parent_chart_id ) {
	581	+ $parent_chart = get_post( $parent_chart_id );
	582	+ $success = $parent_chart && $parent_chart->post_type === Visualizer_Plugin::CPT_VISUALIZER;
	583	+ }
	584	+ if ( $success ) {
	585	+ $new_chart_id = wp_insert_post(
	586	+ array(
	587	+ 'post_type' => Visualizer_Plugin::CPT_VISUALIZER,
	588	+ 'post_title' => 'Visualization',
	589	+ 'post_author' => get_current_user_id(),
	590	+ 'post_status' => $parent_chart->post_status,
	591	+ 'post_content' => $parent_chart->post_content,
	592	+ )
	593	+ );
591	594
592		- if ( is_wp_error( $new_chart_id ) ) {
593		- do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Error while cloning chart %d = %s', $parent_chart_id, print_r( $new_chart_id, true ) ), 'error', __FILE__, __LINE__ );
594		- } else {
595		- $post_meta = get_post_meta( $parent_chart_id );
596		- $chart_id = $new_chart_id;
597		- foreach ( $post_meta as $key => $value ) {
598		- if ( strpos( $key, 'visualizer-' ) !== false ) {
599		- add_post_meta( $new_chart_id, $key, maybe_unserialize( $value[0] ) );
600		- }
	595	+ if ( is_wp_error( $new_chart_id ) ) {
	596	+ do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Error while cloning chart %d = %s', $parent_chart_id, print_r( $new_chart_id, true ) ), 'error', __FILE__, __LINE__ );
	597	+ } else {
	598	+ $post_meta = get_post_meta( $parent_chart_id );
	599	+ $chart_id = $new_chart_id;
	600	+ foreach ( $post_meta as $key => $value ) {
	601	+ if ( strpos( $key, 'visualizer-' ) !== false ) {
	602	+ add_post_meta( $new_chart_id, $key, maybe_unserialize( $value[0] ) );
601	603	}
602	604	}
603	605	}
604	606	}
		@@ -751,9 +753,9 @@
751	753	'lineWrapping' => true,
752	754	'dragDrop' => false,
753	755	'matchBrackets' => true,
754	756	'autoCloseBrackets' => true,
755		- 'extraKeys' => array( 'Ctrl-Space' => 'autocomplete' ),
	757	+ 'extraKeys' => array( 'Shift-Space' => 'autocomplete' ),
756	758	'hintOptions' => array( 'tables' => $table_col_mapping ),
757	759	),
758	760	)
759	761	);
		@@ -787,9 +789,12 @@
787	789	update_option( 'visualizer-map-api-key', $_POST['map_api_key'] );
788	790	}
789	791
790	792	if ( $_SERVER['REQUEST_METHOD'] === 'POST' && isset( $_GET['nonce'] ) && wp_verify_nonce( $_GET['nonce'] ) ) {
791		- if ( $this->_chart->post_status === 'auto-draft' ) {
	793	+ $is_canceled = isset( $_POST['cancel'] ) && 1 === intval( $_POST['cancel'] );
	794	+ $is_newly_created = $this->_chart->post_status === 'auto-draft';
	795	+
	796	+ if ( $is_newly_created && ! $is_canceled ) {
792	797	$this->_chart->post_status = 'publish';
793	798
794	799	// ensure that a revision is not created. If a revision is created it will have the proper data and the parent of the revision will have default data.
795	800	// we do not want any difference in data so disable revisions temporarily.
		@@ -797,9 +802,9 @@
797	802
798	803	wp_update_post( $this->_chart->to_array() );
799	804	}
800	805	// save meta data only when it is NOT being canceled.
801		- if ( ! ( isset( $_POST['cancel'] ) && 1 === intval( $_POST['cancel'] ) ) ) {
	806	+ if ( ! $is_canceled ) {
802	807	update_post_meta( $this->_chart->ID, Visualizer_Plugin::CF_SETTINGS, $_POST );
803	808
804	809	// we will keep a parameter called 'internal_title' that will be set to the given title or, if empty, the chart ID
805	810	// this will help in searching with the chart id.
		@@ -873,12 +878,13 @@
873	878	'visualizer',
874	879	array(
875	880	'l10n' => array(
876	881	'invalid_source' => esc_html__( 'You have entered an invalid URL. Please provide a valid URL.', 'visualizer' ),
877		- 'loading' => esc_html__( 'Loading...', 'visualizer' ),
878		- 'json_error' => esc_html__( 'An error occured in fetching data.', 'visualizer' ),
879		- 'select_columns' => esc_html__( 'Please select a few columns to include in the chart.', 'visualizer' ),
880		- 'save_settings' => __( 'You have modified the chart\'s settings. To modify the source/data again, you must save this chart and reopen it for editing. If you continue without saving the chart, you may lose your changes.', 'visualizer' ),
	882	+ 'loading' => esc_html__( 'Loading...', 'visualizer' ),
	883	+ 'json_error' => esc_html__( 'An error occured in fetching data.', 'visualizer' ),
	884	+ 'select_columns' => esc_html__( 'Please select a few columns to include in the chart.', 'visualizer' ),
	885	+ 'save_settings' => __( 'You have modified the chart\'s settings. To modify the source/data again, you must save this chart and reopen it for editing. If you continue without saving the chart, you may lose your changes.', 'visualizer' ),
	886	+ 'copied' => __( 'The data has been copied to your clipboard. Hit Ctrl-V/Cmd-V in your spreadsheet editor to paste the data.', 'visualizer' ),
881	887	),
882	888	'charts' => array(
883	889	'canvas' => $data,
884	890	'id' => $this->_chart->ID,
		@@ -922,11 +928,10 @@
922	928	if ( filter_input( INPUT_GET, 'library', FILTER_VALIDATE_BOOLEAN ) ) {
923	929	$render->button = filter_input( INPUT_GET, 'action' ) === Visualizer_Plugin::ACTION_EDIT_CHART
924	930	? esc_html__( 'Save Chart', 'visualizer' )
925	931	: esc_html__( 'Create Chart', 'visualizer' );
926		- if ( filter_input( INPUT_GET, 'action' ) === Visualizer_Plugin::ACTION_EDIT_CHART ) {
927		- $render->cancel_button = esc_html__( 'Cancel', 'visualizer' );
928		- }
	932	+
	933	+ $render->cancel_button = esc_html__( 'Cancel', 'visualizer' );
929	934	} else {
930	935	$render->button = esc_attr__( 'Insert Chart', 'visualizer' );
931	936	}
932	937
		@@ -949,9 +954,9 @@
949	954	* @access private
950	955	*/
951	956	private function _handleTypesPage() {
952	957	// process post request
953		- if ( $_SERVER['REQUEST_METHOD'] === 'POST' && wp_verify_nonce( filter_input( INPUT_POST, 'nonce' ) ) ) {
	958	+ if ( $_SERVER['REQUEST_METHOD'] === 'POST' && wp_verify_nonce( filter_input( INPUT_POST, 'nonce' ), 'visualizer-upload-data' ) ) {
954	959	$type = filter_input( INPUT_POST, 'type' );
955	960	$library = filter_input( INPUT_POST, 'chart-library' );
956	961	if ( Visualizer_Module_Admin::checkChartStatus( $type ) ) {
957	962	if ( empty( $library ) ) {
		@@ -1135,9 +1140,13 @@
1135	1140	// otherwise, assume this is a normal web request.
1136	1141	$can_die = ! ( defined( 'VISUALIZER_DO_NOT_DIE' ) && VISUALIZER_DO_NOT_DIE );
1137	1142
1138	1143	// validate nonce
1139		- if ( ! isset( $_GET['nonce'] ) || ! wp_verify_nonce( $_GET['nonce'] ) ) {
	1144	+ if (
	1145	+ ! isset( $_GET['nonce'] ) ||
	1146	+ ! wp_verify_nonce( $_GET['nonce'], 'visualizer-upload-data' ) ||
	1147	+ ! current_user_can( 'edit_posts' )
	1148	+ ) {
1140	1149	if ( ! $can_die ) {
1141	1150	return;
1142	1151	}
1143	1152	status_header( 403 );
		@@ -1146,9 +1155,14 @@
1146	1155
1147	1156	// check chart, if chart exists
1148	1157	// do not use filter_input as it does not work for phpunit test cases, use filter_var instead
1149	1158	$chart_id = isset( $_GET['chart'] ) ? filter_var( $_GET['chart'], FILTER_VALIDATE_INT ) : '';
1150		- if ( ! $chart_id || ! ( $chart = get_post( $chart_id ) ) || $chart->post_type !== Visualizer_Plugin::CPT_VISUALIZER ) {
	1159	+ if (
	1160	+ ! $chart_id ||
	1161	+ ! ( $chart = get_post( $chart_id ) ) ||
	1162	+ $chart->post_type !== Visualizer_Plugin::CPT_VISUALIZER ||
	1163	+ ! current_user_can( 'edit_post', $chart_id )
	1164	+ ) {
1151	1165	if ( ! $can_die ) {
1152	1166	return;
1153	1167	}
1154	1168	status_header( 400 );
		@@ -1420,16 +1434,24 @@
1420	1434	*/
1421	1435	public function getQueryData() {
1422	1436	check_ajax_referer( Visualizer_Plugin::ACTION_FETCH_DB_DATA . Visualizer_Plugin::VERSION, 'security' );
1423	1437
1424		- if ( ! current_user_can( 'edit_posts' ) ) {
	1438	+ if ( ! current_user_can( 'administrator' ) ) {
1425	1439	wp_send_json_error( array( 'msg' => __( 'Action not allowed for this user.', 'visualizer' ) ) );
1426	1440	}
	1441	+ if ( ! is_super_admin() ) {
	1442	+ wp_send_json_error( array( 'msg' => __( 'Action not allowed for this user.', 'visualizer' ) ) );
	1443	+ }
1427	1444
	1445	+ if ( ! Visualizer_Module::is_pro() ) {
	1446	+ wp_send_json_error( array( 'msg' => __( 'Feature is not available.', 'visualizer' ) ) );
	1447	+ }
	1448	+
1428	1449	$params = wp_parse_args( $_POST['params'] );
1429	1450	$chart_id = filter_var( $params['chart_id'], FILTER_VALIDATE_INT );
	1451	+ $query = trim( $params['query'], ';' );
1430	1452
1431		- $source = new Visualizer_Source_Query( stripslashes( $params['query'] ), $chart_id, $params );
	1453	+ $source = new Visualizer_Source_Query( stripslashes( $query ), $chart_id, $params );
1432	1454	$html = $source->fetch( true );
1433	1455	$error = $source->get_error();
1434	1456	if ( ! empty( $error ) ) {
1435	1457	wp_send_json_error( array( 'msg' => $error ) );
		@@ -1444,8 +1466,19 @@
1444	1466	*/
1445	1467	public function saveQuery() {
1446	1468	check_ajax_referer( Visualizer_Plugin::ACTION_SAVE_DB_QUERY . Visualizer_Plugin::VERSION, 'security' );
1447	1469
	1470	+ if ( ! current_user_can( 'administrator' ) ) {
	1471	+ wp_send_json_error( array( 'msg' => __( 'Action not allowed for this user.', 'visualizer' ) ) );
	1472	+ }
	1473	+ if ( ! is_super_admin() ) {
	1474	+ wp_send_json_error( array( 'msg' => __( 'Action not allowed for this user.', 'visualizer' ) ) );
	1475	+ }
	1476	+
	1477	+ if ( ! Visualizer_Module::is_pro() ) {
	1478	+ wp_send_json_error( array( 'msg' => __( 'Feature is not available.', 'visualizer' ) ) );
	1479	+ }
	1480	+
1448	1481	$chart_id = filter_input(
1449	1482	INPUT_GET,
1450	1483	'chart',
1451	1484	FILTER_VALIDATE_INT,
		@@ -1474,13 +1507,14 @@
1474	1507
1475	1508	$render = new Visualizer_Render_Page_Update();
1476	1509	if ( $chart_id ) {
1477	1510	$params = wp_parse_args( $_POST['params'] );
1478		- $source = new Visualizer_Source_Query( stripslashes( $params['query'] ), $chart_id, $params );
	1511	+ $query = trim( $params['query'], ';' );
	1512	+ $source = new Visualizer_Source_Query( stripslashes( $query ), $chart_id, $params );
1479	1513	$source->fetch( false );
1480	1514	$error = $source->get_error();
1481	1515	if ( empty( $error ) ) {
1482		- update_post_meta( $chart_id, Visualizer_Plugin::CF_DB_QUERY, stripslashes( $params['query'] ) );
	1516	+ update_post_meta( $chart_id, Visualizer_Plugin::CF_DB_QUERY, stripslashes( $query ) );
1483	1517	update_post_meta( $chart_id, Visualizer_Plugin::CF_SOURCE, $source->getSourceName() );
1484	1518	update_post_meta( $chart_id, Visualizer_Plugin::CF_SERIES, $source->getSeries() );
1485	1519	update_post_meta( $chart_id, Visualizer_Plugin::CF_DB_SCHEDULE, $hours );
1486	1520	update_post_meta( $chart_id, Visualizer_Plugin::CF_DEFAULT_DATA, 0 );