| @@ -3,13 +3,20 @@ | ||
| 3 | 3 | |
| 4 | 4 | class Wdk_fields extends Winter_MVC_Controller { |
| 5 | 5 | |
| 6 | 6 | public function __construct(){ |
| 7 | + | |
| 8 | + if ( ! current_user_can('administrator') ) { | |
| 9 | + wp_die( esc_html__('You do not have sufficient permissions to access this page.','wpdirectorykit') ); | |
| 10 | + } | |
| 11 | + | |
| 7 | 12 | parent::__construct(); |
| 8 | 13 | } |
| 9 | 14 | |
| 10 | 15 | public function index() |
| 11 | 16 | { |
| 17 | + | |
| 18 | + | |
| 12 | 19 | $this->load->model('field_m'); |
| 13 | 20 | |
| 14 | 21 | $this->data['fields'] = $this->field_m->get(); |
| 15 | 22 | |
| @@ -25,8 +32,9 @@ | ||
| 25 | 32 | $this->load->model('field_m'); |
| 26 | 33 | $this->load->model('listingfield_m'); |
| 27 | 34 | |
| 28 | 35 | $field_id = (int) $this->input->post_get('id'); |
| 36 | + $this->data['selected_section'] = ''; | |
| 29 | 37 | wdk_access_check('category_m', $field_id); |
| 30 | 38 | $this->data['field_types'] = array( |
| 31 | 39 | 'INPUTBOX' => __('INPUTBOX', 'wpdirectorykit'), |
| 32 | 40 | 'SECTION' => __('SECTION', 'wpdirectorykit'), |
| @@ -36,8 +44,9 @@ | ||
| 36 | 44 | 'DATE' => __('DATE', 'wpdirectorykit'), |
| 37 | 45 | 'DROPDOWN' => __('DROPDOWN', 'wpdirectorykit'), |
| 38 | 46 | 'DROPDOWNMULTIPLE' => __('DROPDOWN MULTIPLE', 'wpdirectorykit'), |
| 39 | 47 | 'CHECKBOX' => __('CHECKBOX', 'wpdirectorykit'), |
| 48 | + 'FILEUPLOAD' => __('FILE UPLOAD', 'wpdirectorykit'), | |
| 40 | 49 | ); |
| 41 | 50 | $this->data['section_list'] = array( |
| 42 | 51 | '' => __('Not Selected', 'wpdirectorykit'), |
| 43 | 52 | ); |
| @@ -159,11 +168,16 @@ | ||
| 159 | 168 | 'rules' => 'is_numerical' |
| 160 | 169 | ), |
| 161 | 170 | array( |
| 162 | 171 | 'field' => 'date_format', |
| 163 | - 'label' => __('Вate Аormat', 'wpdirectorykit'), | |
| 172 | + 'label' => __('Date Format', 'wpdirectorykit'), | |
| 164 | 173 | 'rules' => '' |
| 165 | 174 | ), |
| 175 | + array( | |
| 176 | + 'field' => 'autosuggestion', | |
| 177 | + 'label' => __('Autosuggestion', 'wpdirectorykit'), | |
| 178 | + 'rules' => '' | |
| 179 | + ), | |
| 166 | 180 | ); |
| 167 | 181 | |
| 168 | 182 | if($this->form->run($rules)) |
| 169 | 183 | { |
| @@ -200,14 +214,14 @@ | ||
| 200 | 214 | foreach( $this->data['fields_tree'] as $key_section => $section) |
| 201 | 215 | { |
| 202 | 216 | if(empty($key_section)) continue; |
| 203 | 217 | |
| 204 | - $values[] = array('order_index' => $order_index, 'idfield' => $key_section); | |
| 218 | + $values[] = array('order_index' => $order_index, 'idfield' => (int) $key_section); | |
| 205 | 219 | $order_index++; |
| 206 | 220 | if(is_array($section)) |
| 207 | 221 | foreach($section as $key_field => $field) |
| 208 | 222 | { |
| 209 | - $values[] = array('order_index' => $order_index, 'idfield' => $key_field); | |
| 223 | + $values[] = array('order_index' => $order_index, 'idfield' => (int) $key_field); | |
| 210 | 224 | $order_index++; |
| 211 | 225 | } |
| 212 | 226 | } |
| 213 | 227 | $this->db->updateBatch( $this->field_m->_table_name, $values, 'idfield'); |
| @@ -234,10 +248,14 @@ | ||
| 234 | 248 | } |
| 235 | 249 | } |
| 236 | 250 | } |
| 237 | 251 | |
| 238 | - if(!empty($field_id)) | |
| 252 | + | |
| 253 | + | |
| 254 | + if(!empty($field_id)) { | |
| 239 | 255 | $this->data['db_data'] = $this->field_m->get($field_id, TRUE); |
| 256 | + $this->data['selected_section'] = wmvc_show_data($field_id, $this->data['fields_categories']); | |
| 257 | + } | |
| 240 | 258 | |
| 241 | 259 | $this->load->view('wdk_fields/field_edit', $this->data); |
| 242 | 260 | } |
| 243 | 261 | |
| @@ -244,13 +262,18 @@ | ||
| 244 | 262 | public function ajax_save_order() |
| 245 | 263 | { |
| 246 | 264 | $this->load->model('field_m'); |
| 247 | 265 | |
| 248 | - $data_fields_list = $this->input->post_get('data_fields_list'); | |
| 249 | - | |
| 266 | + $data_fields_list = sanitize_text_field($this->input->post_get('data_fields_list')); | |
| 250 | 267 | |
| 251 | - $splitted = explode(';', $data_fields_list); | |
| 268 | + // Verify the nonce before proceeding | |
| 269 | + $nonce = $this->input->post_get('wdk_fields_nonce'); | |
| 270 | + if (empty($nonce) || !wp_verify_nonce($nonce, 'wdk_fields_save_order')) { | |
| 271 | + wp_send_json_error(array('message' => __('Invalid security token (nonce).', 'wpdirectorykit')), 403); | |
| 272 | + exit(); | |
| 273 | + } | |
| 252 | 274 | |
| 275 | + $splitted = explode(';', preg_replace('/[^0-9;]/', '', $data_fields_list)); | |
| 253 | 276 | $values = array(); |
| 254 | 277 | $order_index = 1; |
| 255 | 278 | |
| 256 | 279 | foreach($splitted as $field_id) |
