| @@ -107,9 +107,10 @@ | ||
| 107 | 107 | register_rest_route( |
| 108 | 108 | 'visualizer/v' . VISUALIZER_REST_VERSION, |
| 109 | 109 | '/action/(?P<chart>\d+)/(?P<type>.+)/', |
| 110 | 110 | array( |
| 111 | - 'methods' => 'GET', | |
| 111 | + // POST is required for save/cancel, GET for all others | |
| 112 | + 'methods' => array( 'POST', 'GET' ), | |
| 112 | 113 | 'args' => array( |
| 113 | 114 | 'chart' => array( |
| 114 | 115 | 'required' => true, |
| 115 | 116 | 'sanitize_callback' => function( $param ) { |
| @@ -118,13 +119,19 @@ | ||
| 118 | 119 | ), |
| 119 | 120 | 'type' => array( |
| 120 | 121 | 'required' => true, |
| 121 | 122 | 'type' => 'string', |
| 122 | - 'enum' => array_keys( $this->get_actions() ), | |
| 123 | + 'enum' => array_merge( array( 'save', 'cancel' ), array_keys( $this->get_actions() ) ), | |
| 123 | 124 | ), |
| 124 | 125 | ), |
| 125 | 126 | 'permission_callback' => function ( WP_REST_Request $request ) { |
| 126 | 127 | $chart_id = filter_var( sanitize_text_field( $request->get_param( 'chart' ), FILTER_VALIDATE_INT ) ); |
| 128 | + if ( ! empty( $chart_id ) && in_array( $request->get_param( 'type' ), array( 'save', 'cancel' ), true ) ) { | |
| 129 | + // let save and cancel go without any check as past version of pro | |
| 130 | + // did not send the X-WP-Nonce | |
| 131 | + // we can change this at a later date. | |
| 132 | + return true; | |
| 133 | + } | |
| 127 | 134 | return ! empty( $chart_id ) && apply_filters( 'visualizer_pro_show_chart', true, $chart_id ); |
| 128 | 135 | }, |
| 129 | 136 | 'callback' => array( $this, 'perform_action' ), |
| 130 | 137 | ) |
