| @@ -3,13 +3,20 @@ | ||
| 3 | 3 | |
| 4 | 4 | class Wdk_fields extends Winter_MVC_Controller { |
| 5 | 5 | |
| 6 | 6 | public function __construct(){ |
| 7 | + | |
| 8 | + if ( ! current_user_can('administrator') ) { | |
| 9 | + wp_die( esc_html__('You do not have sufficient permissions to access this page.','wpdirectorykit') ); | |
| 10 | + } | |
| 11 | + | |
| 7 | 12 | parent::__construct(); |
| 8 | 13 | } |
| 9 | 14 | |
| 10 | 15 | public function index() |
| 11 | 16 | { |
| 17 | + | |
| 18 | + | |
| 12 | 19 | $this->load->model('field_m'); |
| 13 | 20 | |
| 14 | 21 | $this->data['fields'] = $this->field_m->get(); |
| 15 | 22 | |
| @@ -207,14 +214,14 @@ | ||
| 207 | 214 | foreach( $this->data['fields_tree'] as $key_section => $section) |
| 208 | 215 | { |
| 209 | 216 | if(empty($key_section)) continue; |
| 210 | 217 | |
| 211 | - $values[] = array('order_index' => $order_index, 'idfield' => $key_section); | |
| 218 | + $values[] = array('order_index' => $order_index, 'idfield' => (int) $key_section); | |
| 212 | 219 | $order_index++; |
| 213 | 220 | if(is_array($section)) |
| 214 | 221 | foreach($section as $key_field => $field) |
| 215 | 222 | { |
| 216 | - $values[] = array('order_index' => $order_index, 'idfield' => $key_field); | |
| 223 | + $values[] = array('order_index' => $order_index, 'idfield' => (int) $key_field); | |
| 217 | 224 | $order_index++; |
| 218 | 225 | } |
| 219 | 226 | } |
| 220 | 227 | $this->db->updateBatch( $this->field_m->_table_name, $values, 'idfield'); |
| @@ -255,13 +262,18 @@ | ||
| 255 | 262 | public function ajax_save_order() |
| 256 | 263 | { |
| 257 | 264 | $this->load->model('field_m'); |
| 258 | 265 | |
| 259 | - $data_fields_list = $this->input->post_get('data_fields_list'); | |
| 260 | - | |
| 266 | + $data_fields_list = sanitize_text_field($this->input->post_get('data_fields_list')); | |
| 261 | 267 | |
| 262 | - $splitted = explode(';', $data_fields_list); | |
| 268 | + // Verify the nonce before proceeding | |
| 269 | + $nonce = $this->input->post_get('wdk_fields_nonce'); | |
| 270 | + if (empty($nonce) || !wp_verify_nonce($nonce, 'wdk_fields_save_order')) { | |
| 271 | + wp_send_json_error(array('message' => __('Invalid security token (nonce).', 'wpdirectorykit')), 403); | |
| 272 | + exit(); | |
| 273 | + } | |
| 263 | 274 | |
| 275 | + $splitted = explode(';', preg_replace('/[^0-9;]/', '', $data_fields_list)); | |
| 264 | 276 | $values = array(); |
| 265 | 277 | $order_index = 1; |
| 266 | 278 | |
| 267 | 279 | foreach($splitted as $field_id) |
