| @@ -152,27 +152,16 @@ | ||
| 152 | 152 | 'enum' => array_merge( array( 'save', 'cancel' ), array_keys( $this->get_actions() ) ), |
| 153 | 153 | ), |
| 154 | 154 | ), |
| 155 | 155 | 'permission_callback' => function ( WP_REST_Request $request ) { |
| 156 | - $chart_id = absint( $request->get_param( 'chart' ) ); | |
| 157 | - if ( ! $chart_id ) { | |
| 158 | - return false; | |
| 156 | + $chart_id = filter_var( sanitize_text_field( $request->get_param( 'chart' ), FILTER_VALIDATE_INT ) ); | |
| 157 | + if ( ! empty( $chart_id ) && in_array( $request->get_param( 'type' ), array( 'save', 'cancel' ), true ) ) { | |
| 158 | + // let save and cancel go without any check as past version of pro | |
| 159 | + // did not send the X-WP-Nonce | |
| 160 | + // we can change this at a later date. | |
| 161 | + return true; | |
| 159 | 162 | } |
| 160 | - | |
| 161 | - $chart = get_post( $chart_id ); | |
| 162 | - if ( ! $chart || Visualizer_Plugin::CPT_VISUALIZER !== $chart->post_type ) { | |
| 163 | - return false; | |
| 164 | - } | |
| 165 | - | |
| 166 | - if ( in_array( $request->get_param( 'type' ), array( 'save', 'cancel' ), true ) ) { | |
| 167 | - return current_user_can( 'edit_post', $chart_id ); | |
| 168 | - } | |
| 169 | - | |
| 170 | - if ( 'publish' !== $chart->post_status ) { | |
| 171 | - return current_user_can( 'edit_post', $chart_id ); | |
| 172 | - } | |
| 173 | - | |
| 174 | - return apply_filters( 'visualizer_pro_show_chart', true, $chart_id ); | |
| 163 | + return ! empty( $chart_id ) && apply_filters( 'visualizer_pro_show_chart', true, $chart_id ); | |
| 175 | 164 | }, |
| 176 | 165 | 'callback' => array( $this, 'perform_action' ), |
| 177 | 166 | ) |
| 178 | 167 | ); |
| @@ -802,22 +791,16 @@ | ||
| 802 | 791 | } |
| 803 | 792 | |
| 804 | 793 | function visualizerLoadScripts() { |
| 805 | 794 | document.querySelectorAll("script[data-visualizer-script]").forEach(function(elem) { |
| 806 | - // Replace the placeholder with a real script tag using async=false: | |
| 807 | - // scripts download in parallel but execute in insertion order, which | |
| 808 | - // preserves the WordPress dependency order. Parallel jQuery.getScript | |
| 809 | - // calls could execute render-facade.js before the chart renderer had | |
| 810 | - // registered its render event listener, leaving charts blank. | |
| 811 | - var script = document.createElement("script"); | |
| 812 | - script.src = elem.getAttribute("data-visualizer-script"); | |
| 813 | - script.async = false; | |
| 814 | - script.onload = function() { | |
| 795 | + jQuery.getScript( elem.getAttribute("data-visualizer-script") ) | |
| 796 | + .done( function( script, textStatus ) { | |
| 797 | + elem.setAttribute("src", elem.getAttribute("data-visualizer-script")); | |
| 798 | + elem.removeAttribute("data-visualizer-script"); | |
| 815 | 799 | setTimeout( function() { |
| 816 | 800 | visualizerRefreshChart(); |
| 817 | 801 | } ); |
| 818 | - }; | |
| 819 | - elem.parentNode.replaceChild(script, elem); | |
| 802 | + } ); | |
| 820 | 803 | }); |
| 821 | 804 | } |
| 822 | 805 | |
| 823 | 806 | function visualizerRefreshChart() { |
