← All changes | application/controllers/Wdk_fields.php +90 -9 1.1.0 → 1.5.9 View file →

		@@ -3,13 +3,20 @@
3	3
4	4	class Wdk_fields extends Winter_MVC_Controller {
5	5
6	6	public function __construct(){
	7	+
	8	+ if ( ! current_user_can('administrator') ) {
	9	+ wp_die( esc_html__('You do not have sufficient permissions to access this page.','wpdirectorykit') );
	10	+ }
	11	+
7	12	parent::__construct();
8	13	}
9	14
10	15	public function index()
11	16	{
	17	+
	18	+
12	19	$this->load->model('field_m');
13	20
14	21	$this->data['fields'] = $this->field_m->get();
15	22
		@@ -20,12 +27,14 @@
20	27	}
21	28
22	29	public function field_edit()
23	30	{
	31	+
24	32	$this->load->model('field_m');
25	33	$this->load->model('listingfield_m');
26	34
27	35	$field_id = (int) $this->input->post_get('id');
	36	+ $this->data['selected_section'] = '';
28	37	wdk_access_check('category_m', $field_id);
29	38	$this->data['field_types'] = array(
30	39	'INPUTBOX' => __('INPUTBOX', 'wpdirectorykit'),
31	40	'SECTION' => __('SECTION', 'wpdirectorykit'),
		@@ -33,9 +42,11 @@
33	42	'TEXTAREA_WYSIWYG' => __('TEXTAREA WYSIWYG', 'wpdirectorykit'),
34	43	'NUMBER' => __('NUMBER', 'wpdirectorykit'),
35	44	'DATE' => __('DATE', 'wpdirectorykit'),
36	45	'DROPDOWN' => __('DROPDOWN', 'wpdirectorykit'),
	46	+ 'DROPDOWNMULTIPLE' => __('DROPDOWN MULTIPLE', 'wpdirectorykit'),
37	47	'CHECKBOX' => __('CHECKBOX', 'wpdirectorykit'),
	48	+ 'FILEUPLOAD' => __('FILE UPLOAD', 'wpdirectorykit'),
38	49	);
39	50	$this->data['section_list'] = array(
40	51	'' => __('Not Selected', 'wpdirectorykit'),
41	52	);
		@@ -63,8 +74,14 @@
63	74	$this->data['db_data'] = NULL;
64	75
65	76	$this->data['form'] = &$this->form;
66	77
	78	+ /* default data */
	79	+ if(empty($field_id) && empty($_POST)) {
	80	+ $this->data['db_data']['is_visible_frontend'] = 1;
	81	+ $this->data['db_data']['is_visible_dashboard'] = 1;
	82	+ }
	83	+
67	84	$rules = array(
68	85	array(
69	86	'field' => 'field_type',
70	87	'label' => __('Field Type', 'wpdirectorykit'),
		@@ -80,8 +97,13 @@
80	97	'label' => __('Hint', 'wpdirectorykit'),
81	98	'rules' => ''
82	99	),
83	100	array(
	101	+ 'field' => 'placeholder',
	102	+ 'label' => __('Placeholder', 'wpdirectorykit'),
	103	+ 'rules' => ''
	104	+ ),
	105	+ array(
84	106	'field' => 'columns_number',
85	107	'label' => __('Columns number/Width', 'wpdirectorykit'),
86	108	'rules' => ''
87	109	),
		@@ -120,24 +142,57 @@
120	142	'label' => __('Values', 'wpdirectorykit'),
121	143	'rules' => ''
122	144	),
123	145	array(
	146	+ 'field' => 'empty_value',
	147	+ 'label' => __('Empty Value', 'wpdirectorykit'),
	148	+ 'rules' => ''
	149	+ ),
	150	+ array(
124	151	'field' => 'icon_id',
125	152	'label' => __('Parent', 'wpdirectorykit'),
126	153	'rules' => ''
127	154	),
	155	+ array(
	156	+ 'field' => 'validation',
	157	+ 'label' => __('Validation', 'wpdirectorykit'),
	158	+ 'rules' => ''
	159	+ ),
	160	+ array(
	161	+ 'field' => 'min_length',
	162	+ 'label' => __('Min Length', 'wpdirectorykit'),
	163	+ 'rules' => 'is_numerical'
	164	+ ),
	165	+ array(
	166	+ 'field' => 'max_length',
	167	+ 'label' => __('Max Length', 'wpdirectorykit'),
	168	+ 'rules' => 'is_numerical'
	169	+ ),
	170	+ array(
	171	+ 'field' => 'date_format',
	172	+ 'label' => __('Date Format', 'wpdirectorykit'),
	173	+ 'rules' => ''
	174	+ ),
	175	+ array(
	176	+ 'field' => 'autosuggestion',
	177	+ 'label' => __('Autosuggestion', 'wpdirectorykit'),
	178	+ 'rules' => ''
	179	+ ),
128	180	);
129		-
	181	+
130	182	if($this->form->run($rules))
131	183	{
	184	+ // Check _wpnonce
	185	+ check_admin_referer( 'wdk-fields-edit_'.$field_id, '_wpnonce' );
	186	+
132	187	// Save procedure for basic data
133	188
134		- $data = $this->field_m->prepare_data($this->input->post(), $rules);
	189	+ $data = $this->field_m->prepare_data(wdk_get_post(), $rules);
135	190
136	191
137	192	$insert_id = $this->field_m->insert($data, $field_id);
138	193
139		- // check if column exists, add if nto exists
	194	+ // check if column exists, add if not exists
140	195
141	196	if(!empty($insert_id))
142	197	$this->listingfield_m->create_table_column($data, $insert_id);
143	198
		@@ -157,18 +212,21 @@
157	212	$values = array();
158	213	$order_index = 1;
159	214	foreach( $this->data['fields_tree'] as $key_section => $section)
160	215	{
161		- $values[] = array('order_index' => $order_index, 'idfield' => $key_section);
	216	+ if(empty($key_section)) continue;
	217	+
	218	+ $values[] = array('order_index' => $order_index, 'idfield' => (int) $key_section);
162	219	$order_index++;
163	220	if(is_array($section))
164	221	foreach($section as $key_field => $field)
165	222	{
166		- $values[] = array('order_index' => $order_index, 'idfield' => $key_field);
	223	+ $values[] = array('order_index' => $order_index, 'idfield' => (int) $key_field);
167	224	$order_index++;
168	225	}
169	226	}
170	227	$this->db->updateBatch( $this->field_m->_table_name, $values, 'idfield');
	228	+
171	229	}
172	230
173	231
174	232	// redirect
		@@ -176,13 +234,28 @@
176	234	if(!empty($insert_id) && empty($field_id))
177	235	{
178	236	wp_redirect(admin_url("admin.php?page=wdk_fields&function=field_edit&id=$insert_id&is_updated=true"));
179	237	exit;
	238	+ } else {
	239	+ $fields_list = $this->field_m->get();
	240	+ $this->data['fields_categories'] = array();
	241	+ $section = '';
	242	+ foreach ($fields_list as $key => $field) {
	243	+ if($field->field_type == "SECTION") {
	244	+ $section = $field->idfield;
	245	+ } else {
	246	+ $this->data['fields_categories'][$field->idfield] = $section;
	247	+ }
	248	+ }
180	249	}
181	250	}
182	251
183		- if(!empty($field_id))
	252	+
	253	+
	254	+ if(!empty($field_id)) {
184	255	$this->data['db_data'] = $this->field_m->get($field_id, TRUE);
	256	+ $this->data['selected_section'] = wmvc_show_data($field_id, $this->data['fields_categories']);
	257	+ }
185	258
186	259	$this->load->view('wdk_fields/field_edit', $this->data);
187	260	}
188	261
		@@ -189,13 +262,18 @@
189	262	public function ajax_save_order()
190	263	{
191	264	$this->load->model('field_m');
192	265
193		- $data_fields_list = $this->input->post_get('data_fields_list');
194		-
	266	+ $data_fields_list = sanitize_text_field($this->input->post_get('data_fields_list'));
195	267
196		- $splitted = explode(';', $data_fields_list);
	268	+ // Verify the nonce before proceeding
	269	+ $nonce = $this->input->post_get('wdk_fields_nonce');
	270	+ if (empty($nonce) || !wp_verify_nonce($nonce, 'wdk_fields_save_order')) {
	271	+ wp_send_json_error(array('message' => __('Invalid security token (nonce).', 'wpdirectorykit')), 403);
	272	+ exit();
	273	+ }
197	274
	275	+ $splitted = explode(';', preg_replace('/[^0-9;]/', '', $data_fields_list));
198	276	$values = array();
199	277	$order_index = 1;
200	278
201	279	foreach($splitted as $field_id)
		@@ -214,8 +292,11 @@
214	292
215	293	public function delete()
216	294	{
217	295	$field_id = (int) $this->input->post_get('id');
	296	+ wdk_access_check('field_m', $field_id);
	297	+ // Check _wpnonce
	298	+ check_admin_referer( 'wdk-fields-delete_'.$field_id, '_wpnonce' );
218	299
219	300	$this->load->model('field_m');
220	301
221	302	$this->field_m->delete($field_id);