← All changes | classes/Visualizer/Module/Chart.php +42 -31 3.11.14 → 3.11.15 View file →

		@@ -374,13 +374,13 @@
374	374	* @since 1.0.0
375	375	*
376	376	* @access private
377	377	*
378		- * @param WP_Post $chart The chart object.
	378	+ * @param WP_Post|null $chart The chart object.
379	379	*
380	380	* @return array The array of chart data.
381	381	*/
382		- private function _getChartArray( WP_Post $chart = null ) {
	382	+ private function _getChartArray( $chart = null ) {
383	383	if ( is_null( $chart ) ) {
384	384	$chart = $this->_chart;
385	385	}
386	386	$type = get_post_meta( $chart->ID, Visualizer_Plugin::CF_CHART_TYPE, true );
		@@ -523,8 +523,12 @@
523	523	*
524	524	* @access public
525	525	*/
526	526	public function renderChartPages() {
	527	+ if ( ! current_user_can( 'edit_posts' ) ) {
	528	+ wp_die( __( 'You do not have permission to access this page.', 'visualizer' ) );
	529	+ }
	530	+
527	531	defined( 'IFRAME_REQUEST' ) || define( 'IFRAME_REQUEST', 1 );
528	532	if ( ! defined( 'ET_BUILDER_PRODUCT_VERSION' ) && function_exists( 'et_get_theme_version' ) ) {
529	533	define( 'ET_BUILDER_PRODUCT_VERSION', et_get_theme_version() );
530	534	}
		@@ -570,35 +574,33 @@
570	574
571	575	do_action( 'visualizer_pro_new_chart_defaults', $chart_id );
572	576	}
573	577	} else {
574		- if ( current_user_can( 'edit_posts' ) ) {
575		- $parent_chart_id = isset( $_GET['parent_chart_id'] ) ? filter_var( $_GET['parent_chart_id'], FILTER_VALIDATE_INT ) : '';
576		- $success = false;
577		- if ( $parent_chart_id ) {
578		- $parent_chart = get_post( $parent_chart_id );
579		- $success = $parent_chart && $parent_chart->post_type === Visualizer_Plugin::CPT_VISUALIZER;
580		- }
581		- if ( $success ) {
582		- $new_chart_id = wp_insert_post(
583		- array(
584		- 'post_type' => Visualizer_Plugin::CPT_VISUALIZER,
585		- 'post_title' => 'Visualization',
586		- 'post_author' => get_current_user_id(),
587		- 'post_status' => $parent_chart->post_status,
588		- 'post_content' => $parent_chart->post_content,
589		- )
590		- );
	578	+ $parent_chart_id = isset( $_GET['parent_chart_id'] ) ? filter_var( $_GET['parent_chart_id'], FILTER_VALIDATE_INT ) : '';
	579	+ $success = false;
	580	+ if ( $parent_chart_id ) {
	581	+ $parent_chart = get_post( $parent_chart_id );
	582	+ $success = $parent_chart && $parent_chart->post_type === Visualizer_Plugin::CPT_VISUALIZER;
	583	+ }
	584	+ if ( $success ) {
	585	+ $new_chart_id = wp_insert_post(
	586	+ array(
	587	+ 'post_type' => Visualizer_Plugin::CPT_VISUALIZER,
	588	+ 'post_title' => 'Visualization',
	589	+ 'post_author' => get_current_user_id(),
	590	+ 'post_status' => $parent_chart->post_status,
	591	+ 'post_content' => $parent_chart->post_content,
	592	+ )
	593	+ );
591	594
592		- if ( is_wp_error( $new_chart_id ) ) {
593		- do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Error while cloning chart %d = %s', $parent_chart_id, print_r( $new_chart_id, true ) ), 'error', __FILE__, __LINE__ );
594		- } else {
595		- $post_meta = get_post_meta( $parent_chart_id );
596		- $chart_id = $new_chart_id;
597		- foreach ( $post_meta as $key => $value ) {
598		- if ( strpos( $key, 'visualizer-' ) !== false ) {
599		- add_post_meta( $new_chart_id, $key, maybe_unserialize( $value[0] ) );
600		- }
	595	+ if ( is_wp_error( $new_chart_id ) ) {
	596	+ do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Error while cloning chart %d = %s', $parent_chart_id, print_r( $new_chart_id, true ) ), 'error', __FILE__, __LINE__ );
	597	+ } else {
	598	+ $post_meta = get_post_meta( $parent_chart_id );
	599	+ $chart_id = $new_chart_id;
	600	+ foreach ( $post_meta as $key => $value ) {
	601	+ if ( strpos( $key, 'visualizer-' ) !== false ) {
	602	+ add_post_meta( $new_chart_id, $key, maybe_unserialize( $value[0] ) );
601	603	}
602	604	}
603	605	}
604	606	}
		@@ -952,9 +954,9 @@
952	954	* @access private
953	955	*/
954	956	private function _handleTypesPage() {
955	957	// process post request
956		- if ( $_SERVER['REQUEST_METHOD'] === 'POST' && wp_verify_nonce( filter_input( INPUT_POST, 'nonce' ) ) ) {
	958	+ if ( $_SERVER['REQUEST_METHOD'] === 'POST' && wp_verify_nonce( filter_input( INPUT_POST, 'nonce' ), 'visualizer-upload-data' ) ) {
957	959	$type = filter_input( INPUT_POST, 'type' );
958	960	$library = filter_input( INPUT_POST, 'chart-library' );
959	961	if ( Visualizer_Module_Admin::checkChartStatus( $type ) ) {
960	962	if ( empty( $library ) ) {
		@@ -1138,9 +1140,13 @@
1138	1140	// otherwise, assume this is a normal web request.
1139	1141	$can_die = ! ( defined( 'VISUALIZER_DO_NOT_DIE' ) && VISUALIZER_DO_NOT_DIE );
1140	1142
1141	1143	// validate nonce
1142		- if ( ! isset( $_GET['nonce'] ) || ! wp_verify_nonce( $_GET['nonce'] ) ) {
	1144	+ if (
	1145	+ ! isset( $_GET['nonce'] ) ||
	1146	+ ! wp_verify_nonce( $_GET['nonce'], 'visualizer-upload-data' ) ||
	1147	+ ! current_user_can( 'edit_posts' )
	1148	+ ) {
1143	1149	if ( ! $can_die ) {
1144	1150	return;
1145	1151	}
1146	1152	status_header( 403 );
		@@ -1149,9 +1155,14 @@
1149	1155
1150	1156	// check chart, if chart exists
1151	1157	// do not use filter_input as it does not work for phpunit test cases, use filter_var instead
1152	1158	$chart_id = isset( $_GET['chart'] ) ? filter_var( $_GET['chart'], FILTER_VALIDATE_INT ) : '';
1153		- if ( ! $chart_id || ! ( $chart = get_post( $chart_id ) ) || $chart->post_type !== Visualizer_Plugin::CPT_VISUALIZER ) {
	1159	+ if (
	1160	+ ! $chart_id ||
	1161	+ ! ( $chart = get_post( $chart_id ) ) ||
	1162	+ $chart->post_type !== Visualizer_Plugin::CPT_VISUALIZER ||
	1163	+ ! current_user_can( 'edit_post', $chart_id )
	1164	+ ) {
1154	1165	if ( ! $can_die ) {
1155	1166	return;
1156	1167	}
1157	1168	status_header( 400 );