← All changes | classes/Visualizer/Render/Layout.php +53 -41 3.7.6 → 3.7.7 View file →

		@@ -127,15 +127,17 @@
127	127	* @access public
128	128	*/
129	129	public static function _renderJsonScreen( $args ) {
130	130	$id = $args[1];
131		- $action = add_query_arg(
132		- array(
133		- 'action' => Visualizer_Plugin::ACTION_JSON_SET_DATA,
134		- 'security' => wp_create_nonce( Visualizer_Plugin::ACTION_JSON_SET_DATA . Visualizer_Plugin::VERSION ),
135		- 'chart' => $id,
136		- ),
137		- admin_url( 'admin-ajax.php' )
	131	+ $action = esc_url(
	132	+ add_query_arg(
	133	+ array(
	134	+ 'action' => Visualizer_Plugin::ACTION_JSON_SET_DATA,
	135	+ 'security' => wp_create_nonce( Visualizer_Plugin::ACTION_JSON_SET_DATA . Visualizer_Plugin::VERSION ),
	136	+ 'chart' => $id,
	137	+ ),
	138	+ admin_url( 'admin-ajax.php' )
	139	+ )
138	140	);
139	141
140	142	$url = get_post_meta( $id, Visualizer_Plugin::CF_JSON_URL, true );
141	143	$root = get_post_meta( $id, Visualizer_Plugin::CF_JSON_ROOT, true );
		@@ -305,15 +307,17 @@
305	307	* @access public
306	308	*/
307	309	public static function _renderSimpleEditorScreen( $args ) {
308	310	$chart_id = $args[1];
309		- $action = add_query_arg(
310		- array(
311		- 'action' => Visualizer_Plugin::ACTION_UPLOAD_DATA,
312		- 'nonce' => wp_create_nonce(),
313		- 'chart' => $chart_id,
314		- ),
315		- admin_url( 'admin-ajax.php' )
	311	+ $action = esc_url(
	312	+ add_query_arg(
	313	+ array(
	314	+ 'action' => Visualizer_Plugin::ACTION_UPLOAD_DATA,
	315	+ 'nonce' => wp_create_nonce(),
	316	+ 'chart' => $chart_id,
	317	+ ),
	318	+ admin_url( 'admin-ajax.php' )
	319	+ )
316	320	);
317	321	?>
318	322	<div class="viz-simple-editor">
319	323	<div class="viz-simple-editor-type viz-table-editor">
		@@ -581,15 +585,15 @@
581	585	<ul class="viz-group-wrapper full-height">
582	586	<li class="viz-group open" id="vz-chart-settings">
583	587	<ul class="viz-group-content">
584	588	<ul class="viz-group-wrapper">
585		- <form id="settings-form" action="<?php echo add_query_arg( 'nonce', wp_create_nonce() ); ?>" method="post">
	589	+ <form id="settings-form" action="<?php echo esc_url( add_query_arg( 'nonce', wp_create_nonce() ) ); ?>" method="post">
586	590	<input type="hidden" id="chart-img" name="chart-img">
587	591	<?php echo $sidebar; ?>
588	592	<?php self::_renderPermissions( $args ); ?>
589	593	<input type="hidden" name="save" value="1">
590	594	</form>
591		- <form id="cancel-form" action="<?php echo add_query_arg( 'nonce', wp_create_nonce() ); ?>" method="post">
	595	+ <form id="cancel-form" action="<?php echo esc_url( add_query_arg( 'nonce', wp_create_nonce() ) ); ?>" method="post">
592	596	<input type="hidden" name="cancel" value="1">
593	597	</form>
594	598	</ul>
595	599	</ul>
		@@ -653,15 +657,17 @@
653	657	*/
654	658	public static function _renderTabBasic( $args ) {
655	659	$chart_id = $args[1];
656	660
657		- $upload_link = add_query_arg(
658		- array(
659		- 'action' => Visualizer_Plugin::ACTION_UPLOAD_DATA,
660		- 'nonce' => wp_create_nonce(),
661		- 'chart' => $chart_id,
662		- ),
663		- admin_url( 'admin-ajax.php' )
	661	+ $upload_link = esc_url(
	662	+ add_query_arg(
	663	+ array(
	664	+ 'action' => Visualizer_Plugin::ACTION_UPLOAD_DATA,
	665	+ 'nonce' => wp_create_nonce(),
	666	+ 'chart' => $chart_id,
	667	+ ),
	668	+ admin_url( 'admin-ajax.php' )
	669	+ )
664	670	);
665	671
666	672	// this will allow us to open the correct source tab by default.
667	673	$source_of_chart = strtolower( get_post_meta( $chart_id, Visualizer_Plugin::CF_SOURCE, true ) );
		@@ -814,14 +820,16 @@
814	820	<p class="viz-group-description"><?php _e( 'You can import here data from your previously created charts', 'visualizer' ); ?></p>
815	821	<form>
816	822	<select name="vz-import-from-chart" id="chart-id" class="visualizer-select">
817	823	<?php
818		- $fetch_link = add_query_arg(
819		- array(
820		- 'action' => Visualizer_Module::is_pro() ? Visualizer_Pro::ACTION_FETCH_DATA : '',
821		- 'nonce' => wp_create_nonce(),
822		- ),
823		- admin_url( 'admin-ajax.php' )
	824	+ $fetch_link = esc_url(
	825	+ add_query_arg(
	826	+ array(
	827	+ 'action' => Visualizer_Module::is_pro() ? Visualizer_Pro::ACTION_FETCH_DATA : '',
	828	+ 'nonce' => wp_create_nonce(),
	829	+ ),
	830	+ admin_url( 'admin-ajax.php' )
	831	+ )
824	832	);
825	833	$query_args_charts = array(
826	834	'post_type' => Visualizer_Plugin::CPT_VISUALIZER,
827	835	'posts_per_page' => 300,
		@@ -861,14 +869,16 @@
861	869	</div>
862	870	</li>
863	871
864	872	<?php
865		- $save_filter = add_query_arg(
866		- array(
867		- 'action' => Visualizer_Plugin::ACTION_SAVE_FILTER_QUERY,
868		- 'security' => wp_create_nonce( Visualizer_Plugin::ACTION_SAVE_FILTER_QUERY . Visualizer_Plugin::VERSION ),
869		- 'chart' => $chart_id,
870		- ), admin_url( 'admin-ajax.php' )
	873	+ $save_filter = esc_url(
	874	+ add_query_arg(
	875	+ array(
	876	+ 'action' => Visualizer_Plugin::ACTION_SAVE_FILTER_QUERY,
	877	+ 'security' => wp_create_nonce( Visualizer_Plugin::ACTION_SAVE_FILTER_QUERY . Visualizer_Plugin::VERSION ),
	878	+ 'chart' => $chart_id,
	879	+ ), admin_url( 'admin-ajax.php' )
	880	+ )
871	881	);
872	882	?>
873	883	<!-- import from WordPress -->
874	884	<li class="viz-group visualizer_source_query_wp <?php echo apply_filters( 'visualizer_pro_upsell_class', 'only-pro-feature', 'import-wp' ); ?> ">
		@@ -910,14 +920,16 @@
910	920	</div>
911	921	</li>
912	922
913	923	<?php
914		- $save_query = add_query_arg(
915		- array(
916		- 'action' => Visualizer_Plugin::ACTION_SAVE_DB_QUERY,
917		- 'security' => wp_create_nonce( Visualizer_Plugin::ACTION_SAVE_DB_QUERY . Visualizer_Plugin::VERSION ),
918		- 'chart' => $chart_id,
919		- ), admin_url( 'admin-ajax.php' )
	924	+ $save_query = esc_url(
	925	+ add_query_arg(
	926	+ array(
	927	+ 'action' => Visualizer_Plugin::ACTION_SAVE_DB_QUERY,
	928	+ 'security' => wp_create_nonce( Visualizer_Plugin::ACTION_SAVE_DB_QUERY . Visualizer_Plugin::VERSION ),
	929	+ 'chart' => $chart_id,
	930	+ ), admin_url( 'admin-ajax.php' )
	931	+ )
920	932	);
921	933	?>
922	934	<!-- import from db -->
923	935	<li class="viz-group visualizer_source_query <?php echo apply_filters( 'visualizer_pro_upsell_class', 'only-pro-feature', 'db-query' ); ?>">