| @@ -3,13 +3,20 @@ | ||
| 3 | 3 | |
| 4 | 4 | class Wdk_fields extends Winter_MVC_Controller { |
| 5 | 5 | |
| 6 | 6 | public function __construct(){ |
| 7 | + | |
| 8 | + if ( ! current_user_can('administrator') ) { | |
| 9 | + wp_die( esc_html__('You do not have sufficient permissions to access this page.','wpdirectorykit') ); | |
| 10 | + } | |
| 11 | + | |
| 7 | 12 | parent::__construct(); |
| 8 | 13 | } |
| 9 | 14 | |
| 10 | 15 | public function index() |
| 11 | 16 | { |
| 17 | + | |
| 18 | + | |
| 12 | 19 | $this->load->model('field_m'); |
| 13 | 20 | |
| 14 | 21 | $this->data['fields'] = $this->field_m->get(); |
| 15 | 22 | |
| @@ -25,8 +32,9 @@ | ||
| 25 | 32 | $this->load->model('field_m'); |
| 26 | 33 | $this->load->model('listingfield_m'); |
| 27 | 34 | |
| 28 | 35 | $field_id = (int) $this->input->post_get('id'); |
| 36 | + $this->data['selected_section'] = ''; | |
| 29 | 37 | wdk_access_check('category_m', $field_id); |
| 30 | 38 | $this->data['field_types'] = array( |
| 31 | 39 | 'INPUTBOX' => __('INPUTBOX', 'wpdirectorykit'), |
| 32 | 40 | 'SECTION' => __('SECTION', 'wpdirectorykit'), |
| @@ -36,8 +44,9 @@ | ||
| 36 | 44 | 'DATE' => __('DATE', 'wpdirectorykit'), |
| 37 | 45 | 'DROPDOWN' => __('DROPDOWN', 'wpdirectorykit'), |
| 38 | 46 | 'DROPDOWNMULTIPLE' => __('DROPDOWN MULTIPLE', 'wpdirectorykit'), |
| 39 | 47 | 'CHECKBOX' => __('CHECKBOX', 'wpdirectorykit'), |
| 48 | + 'FILEUPLOAD' => __('FILE UPLOAD', 'wpdirectorykit'), | |
| 40 | 49 | ); |
| 41 | 50 | $this->data['section_list'] = array( |
| 42 | 51 | '' => __('Not Selected', 'wpdirectorykit'), |
| 43 | 52 | ); |
| @@ -133,8 +142,13 @@ | ||
| 133 | 142 | 'label' => __('Values', 'wpdirectorykit'), |
| 134 | 143 | 'rules' => '' |
| 135 | 144 | ), |
| 136 | 145 | array( |
| 146 | + 'field' => 'empty_value', | |
| 147 | + 'label' => __('Empty Value', 'wpdirectorykit'), | |
| 148 | + 'rules' => '' | |
| 149 | + ), | |
| 150 | + array( | |
| 137 | 151 | 'field' => 'icon_id', |
| 138 | 152 | 'label' => __('Parent', 'wpdirectorykit'), |
| 139 | 153 | 'rules' => '' |
| 140 | 154 | ), |
| @@ -152,8 +166,18 @@ | ||
| 152 | 166 | 'field' => 'max_length', |
| 153 | 167 | 'label' => __('Max Length', 'wpdirectorykit'), |
| 154 | 168 | 'rules' => 'is_numerical' |
| 155 | 169 | ), |
| 170 | + array( | |
| 171 | + 'field' => 'date_format', | |
| 172 | + 'label' => __('Date Format', 'wpdirectorykit'), | |
| 173 | + 'rules' => '' | |
| 174 | + ), | |
| 175 | + array( | |
| 176 | + 'field' => 'autosuggestion', | |
| 177 | + 'label' => __('Autosuggestion', 'wpdirectorykit'), | |
| 178 | + 'rules' => '' | |
| 179 | + ), | |
| 156 | 180 | ); |
| 157 | 181 | |
| 158 | 182 | if($this->form->run($rules)) |
| 159 | 183 | { |
| @@ -190,14 +214,14 @@ | ||
| 190 | 214 | foreach( $this->data['fields_tree'] as $key_section => $section) |
| 191 | 215 | { |
| 192 | 216 | if(empty($key_section)) continue; |
| 193 | 217 | |
| 194 | - $values[] = array('order_index' => $order_index, 'idfield' => $key_section); | |
| 218 | + $values[] = array('order_index' => $order_index, 'idfield' => (int) $key_section); | |
| 195 | 219 | $order_index++; |
| 196 | 220 | if(is_array($section)) |
| 197 | 221 | foreach($section as $key_field => $field) |
| 198 | 222 | { |
| 199 | - $values[] = array('order_index' => $order_index, 'idfield' => $key_field); | |
| 223 | + $values[] = array('order_index' => $order_index, 'idfield' => (int) $key_field); | |
| 200 | 224 | $order_index++; |
| 201 | 225 | } |
| 202 | 226 | } |
| 203 | 227 | $this->db->updateBatch( $this->field_m->_table_name, $values, 'idfield'); |
| @@ -224,10 +248,14 @@ | ||
| 224 | 248 | } |
| 225 | 249 | } |
| 226 | 250 | } |
| 227 | 251 | |
| 228 | - if(!empty($field_id)) | |
| 252 | + | |
| 253 | + | |
| 254 | + if(!empty($field_id)) { | |
| 229 | 255 | $this->data['db_data'] = $this->field_m->get($field_id, TRUE); |
| 256 | + $this->data['selected_section'] = wmvc_show_data($field_id, $this->data['fields_categories']); | |
| 257 | + } | |
| 230 | 258 | |
| 231 | 259 | $this->load->view('wdk_fields/field_edit', $this->data); |
| 232 | 260 | } |
| 233 | 261 | |
| @@ -234,13 +262,18 @@ | ||
| 234 | 262 | public function ajax_save_order() |
| 235 | 263 | { |
| 236 | 264 | $this->load->model('field_m'); |
| 237 | 265 | |
| 238 | - $data_fields_list = $this->input->post_get('data_fields_list'); | |
| 239 | - | |
| 266 | + $data_fields_list = sanitize_text_field($this->input->post_get('data_fields_list')); | |
| 240 | 267 | |
| 241 | - $splitted = explode(';', $data_fields_list); | |
| 268 | + // Verify the nonce before proceeding | |
| 269 | + $nonce = $this->input->post_get('wdk_fields_nonce'); | |
| 270 | + if (empty($nonce) || !wp_verify_nonce($nonce, 'wdk_fields_save_order')) { | |
| 271 | + wp_send_json_error(array('message' => __('Invalid security token (nonce).', 'wpdirectorykit')), 403); | |
| 272 | + exit(); | |
| 273 | + } | |
| 242 | 274 | |
| 275 | + $splitted = explode(';', preg_replace('/[^0-9;]/', '', $data_fields_list)); | |
| 243 | 276 | $values = array(); |
| 244 | 277 | $order_index = 1; |
| 245 | 278 | |
| 246 | 279 | foreach($splitted as $field_id) |
