| @@ -152,16 +152,27 @@ | ||
| 152 | 152 | 'enum' => array_merge( array( 'save', 'cancel' ), array_keys( $this->get_actions() ) ), |
| 153 | 153 | ), |
| 154 | 154 | ), |
| 155 | 155 | 'permission_callback' => function ( WP_REST_Request $request ) { |
| 156 | - $chart_id = filter_var( sanitize_text_field( $request->get_param( 'chart' ), FILTER_VALIDATE_INT ) ); | |
| 157 | - if ( ! empty( $chart_id ) && in_array( $request->get_param( 'type' ), array( 'save', 'cancel' ), true ) ) { | |
| 158 | - // let save and cancel go without any check as past version of pro | |
| 159 | - // did not send the X-WP-Nonce | |
| 160 | - // we can change this at a later date. | |
| 161 | - return true; | |
| 156 | + $chart_id = absint( $request->get_param( 'chart' ) ); | |
| 157 | + if ( ! $chart_id ) { | |
| 158 | + return false; | |
| 162 | 159 | } |
| 163 | - return ! empty( $chart_id ) && apply_filters( 'visualizer_pro_show_chart', true, $chart_id ); | |
| 160 | + | |
| 161 | + $chart = get_post( $chart_id ); | |
| 162 | + if ( ! $chart || Visualizer_Plugin::CPT_VISUALIZER !== $chart->post_type ) { | |
| 163 | + return false; | |
| 164 | + } | |
| 165 | + | |
| 166 | + if ( in_array( $request->get_param( 'type' ), array( 'save', 'cancel' ), true ) ) { | |
| 167 | + return current_user_can( 'edit_post', $chart_id ); | |
| 168 | + } | |
| 169 | + | |
| 170 | + if ( 'publish' !== $chart->post_status ) { | |
| 171 | + return current_user_can( 'edit_post', $chart_id ); | |
| 172 | + } | |
| 173 | + | |
| 174 | + return apply_filters( 'visualizer_pro_show_chart', true, $chart_id ); | |
| 164 | 175 | }, |
| 165 | 176 | 'callback' => array( $this, 'perform_action' ), |
| 166 | 177 | ) |
| 167 | 178 | ); |
| @@ -791,16 +802,22 @@ | ||
| 791 | 802 | } |
| 792 | 803 | |
| 793 | 804 | function visualizerLoadScripts() { |
| 794 | 805 | document.querySelectorAll("script[data-visualizer-script]").forEach(function(elem) { |
| 795 | - jQuery.getScript( elem.getAttribute("data-visualizer-script") ) | |
| 796 | - .done( function( script, textStatus ) { | |
| 797 | - elem.setAttribute("src", elem.getAttribute("data-visualizer-script")); | |
| 798 | - elem.removeAttribute("data-visualizer-script"); | |
| 806 | + // Replace the placeholder with a real script tag using async=false: | |
| 807 | + // scripts download in parallel but execute in insertion order, which | |
| 808 | + // preserves the WordPress dependency order. Parallel jQuery.getScript | |
| 809 | + // calls could execute render-facade.js before the chart renderer had | |
| 810 | + // registered its render event listener, leaving charts blank. | |
| 811 | + var script = document.createElement("script"); | |
| 812 | + script.src = elem.getAttribute("data-visualizer-script"); | |
| 813 | + script.async = false; | |
| 814 | + script.onload = function() { | |
| 799 | 815 | setTimeout( function() { |
| 800 | 816 | visualizerRefreshChart(); |
| 801 | 817 | } ); |
| 802 | - } ); | |
| 818 | + }; | |
| 819 | + elem.parentNode.replaceChild(script, elem); | |
| 803 | 820 | }); |
| 804 | 821 | } |
| 805 | 822 | |
| 806 | 823 | function visualizerRefreshChart() { |
