| @@ -464,10 +464,11 @@ | ||
| 464 | 464 | } |
| 465 | 465 | // Add search arguments to link to return to same page |
| 466 | 466 | foreach ( $_REQUEST as $key => $value ) { |
| 467 | 467 | if ( substr( $key, 0, 19 ) === 'wpda_search_column_' ) { |
| 468 | - $this->page_number_link .= "&{$key}={$value}"; | |
| 469 | - $this->page_number_item .= "<input type='hidden' name='{$key}' value='{$value}' />"; | |
| 468 | + $esc_attr = 'esc_attr'; | |
| 469 | + $this->page_number_link .= "&{$esc_attr( $key )}={$esc_attr( $value )}"; | |
| 470 | + $this->page_number_item .= "<input type='hidden' name='{$esc_attr( $key )}' value='{$esc_attr( $value )}' />"; | |
| 470 | 471 | } |
| 471 | 472 | } |
| 472 | 473 | // Check if button text "back to list" should be changed |
| 473 | 474 | if ( isset( $args['back_to_list_text'] ) && '' !== $args['back_to_list_text'] ) { |
| @@ -540,8 +541,12 @@ | ||
| 540 | 541 | if ( !wp_verify_nonce( $wp_nonce, $this->get_nonce_action() ) ) { |
| 541 | 542 | wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) ); |
| 542 | 543 | } |
| 543 | 544 | if ( 'new' === $this->action ) { |
| 545 | + global $wpda_project_mode; | |
| 546 | + if ( 'on' !== WPDA::get_option( WPDA::OPTION_BE_ALLOW_INSERT ) || isset( $wpda_project_mode['allow_insert'] ) && ('off' === $wpda_project_mode['allow_insert'] || 'only' === $wpda_project_mode['allow_insert']) ) { | |
| 547 | + wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) ); | |
| 548 | + } | |
| 544 | 549 | // Prepare row and items for validation |
| 545 | 550 | $this->row = $this->row_data->new_row(); |
| 546 | 551 | $this->prepare_items( true ); |
| 547 | 552 | // Save new record. |
| @@ -567,8 +572,12 @@ | ||
| 567 | 572 | $set_back_form_values = true; |
| 568 | 573 | } |
| 569 | 574 | } |
| 570 | 575 | } else { |
| 576 | + global $wpda_project_mode; | |
| 577 | + if ( 'on' !== WPDA::get_option( WPDA::OPTION_BE_ALLOW_UPDATE ) && (isset( $wpda_project_mode['mode'] ) && 'edit' === $wpda_project_mode['mode']) ) { | |
| 578 | + wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) ); | |
| 579 | + } | |
| 571 | 580 | // Prepare row and items for validation |
| 572 | 581 | $this->row = $this->row_data->get_row( $this->auto_increment_value, $this->wpda_err ); |
| 573 | 582 | $this->prepare_items( true ); |
| 574 | 583 | // Update existing record. |
