| @@ -1,8 +1,9 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | namespace WPDataAccess\Data_Apps { |
| 4 | 4 | |
| 5 | + use WPDataAccess\API\WPDA_API_Core; | |
| 5 | 6 | use WPDataAccess\API\WPDA_Apps; |
| 6 | 7 | use WPDataAccess\Plugin_Table_Models\WPDA_App_Apps_Model; |
| 7 | 8 | use WPDataAccess\Plugin_Table_Models\WPDA_App_Model; |
| 8 | 9 | use WPDataAccess\WPDA; |
| @@ -59,13 +60,18 @@ | ||
| 59 | 60 | if ( ! $this->send_feedback() ) { |
| 60 | 61 | return; |
| 61 | 62 | } |
| 62 | 63 | |
| 63 | - $this->show_feedback( __( 'Invalid app id', 'wp-data-access' ) ); | |
| 64 | + $this->show_feedback( __( 'Not authorized', 'wp-data-access' ) ); | |
| 64 | 65 | return; |
| 65 | 66 | } |
| 66 | 67 | |
| 67 | 68 | if ( ! $this->user_can_access( $app ) ) { |
| 69 | + if ( $this->pwa ) { | |
| 70 | + esc_html_e( 'Not authorized', 'wp-data-access' ); | |
| 71 | + return; | |
| 72 | + } | |
| 73 | + | |
| 68 | 74 | if ( ! $this->send_feedback() ) { |
| 69 | 75 | return; |
| 70 | 76 | } |
| 71 | 77 | |
| @@ -110,8 +116,13 @@ | ||
| 110 | 116 | break; |
| 111 | 117 | case '6': |
| 112 | 118 | // Chart |
| 113 | 119 | $app_type_class = 'pp-container-chart'; |
| 120 | + break; | |
| 121 | + case '7': | |
| 122 | + // Chart | |
| 123 | + $app_type_class = 'pp-container-dashboard'; | |
| 124 | + break; | |
| 114 | 125 | } |
| 115 | 126 | ?> |
| 116 | 127 | |
| 117 | 128 | <div class="wpda-pp-container"> |
| @@ -126,14 +137,27 @@ | ||
| 126 | 137 | data-filter_field_value="<?php echo esc_attr( $this->filter_field_value ); ?>" |
| 127 | 138 | <?php |
| 128 | 139 | } |
| 129 | 140 | |
| 130 | - if ( 0 < count( $this->shortcode_args ) ) { | |
| 131 | - ?> | |
| 132 | - data-shortcode_field_name="<?php echo implode( ',', array_keys( $this->shortcode_args ) ); ?>" | |
| 133 | - data-shortcode_field_value="<?php echo implode( ',', array_values( $this->shortcode_args ) ); ?>" | |
| 134 | - <?php | |
| 135 | - } | |
| 141 | + if ( 0 < count( $this->shortcode_args ) ) { | |
| 142 | + $field_names = array(); | |
| 143 | + $field_values = array(); | |
| 144 | + foreach ( $this->shortcode_args as $key => $value ) { | |
| 145 | + // Sanitize field name | |
| 146 | + $field_names[] = WPDA_API_Core::sanitize_db_identifier( $key ); | |
| 147 | + // Sanitize field value | |
| 148 | + $sanitized_value = sanitize_text_field( $value ); | |
| 149 | + $sanitized_value = wp_strip_all_tags( $sanitized_value ); | |
| 150 | + $sanitized_value = str_replace( array( '"', "'", '`' ), '', $sanitized_value ); | |
| 151 | + $sanitized_value = str_replace( array( '<', '>' ), '', $sanitized_value ); | |
| 152 | + $sanitized_value = str_replace( '=', '', $sanitized_value ); | |
| 153 | + $field_values[] = $sanitized_value; | |
| 154 | + } | |
| 155 | + ?> | |
| 156 | + data-shortcode_field_name="<?php echo esc_attr( implode( ',', $field_names) ); ?>" | |
| 157 | + data-shortcode_field_value="<?php echo esc_attr( implode( ',', $field_values ) ); ?>" | |
| 158 | + <?php | |
| 159 | + } | |
| 136 | 160 | ?> |
| 137 | 161 | ></div> |
| 138 | 162 | </div> |
| 139 | 163 | |
| @@ -157,9 +181,9 @@ | ||
| 157 | 181 | ?> |
| 158 | 182 | |
| 159 | 183 | <?php |
| 160 | 184 | |
| 161 | - $this->add_client( $this->app_id ); | |
| 185 | + $this->add_client('app', $this->app_id ); | |
| 162 | 186 | |
| 163 | 187 | } |
| 164 | 188 | |
| 165 | 189 | private function user_can_access( $app ) { |
| @@ -202,9 +226,9 @@ | ||
| 202 | 226 | ) { |
| 203 | 227 | // Check user login |
| 204 | 228 | $user_login = WPDA::get_current_user_login(); |
| 205 | 229 | if ( ! in_array( $user_login, $app_settings['rest_api']['authorized_users'] ) ) { |
| 206 | - return false; | |
| 230 | + return false; | |
| 207 | 231 | } |
| 208 | 232 | } |
| 209 | 233 | } |
| 210 | 234 | |
