Skip to content

Commit 67cb6d7

Browse files
inc2734inc2734
committed
Security fix
1 parent ac32883 commit 67cb6d7

File tree

2 files changed

+166
-109
lines changed

2 files changed

+166
-109
lines changed

‎classes/fields/class.field-related-posts.php‎

Lines changed: 90 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -77,56 +77,70 @@ public function admin_enqueue_scripts() {
7777
*/
7878
public function relational_posts_search() {
7979
check_ajax_referer( SCF_Config::NAME . '-relation-post-types', 'nonce' );
80+
8081
$_posts = array();
8182

8283
$post_types = filter_input( INPUT_POST, 'post_types' );
8384
if ( $post_types ) {
84-
$post_type = explode( ',', $post_types );
85-
$args = array(
86-
'post_type' => $post_type,
87-
'order' => 'ASC',
88-
'orderby' => 'ID',
89-
'posts_per_page' => -1,
90-
'post_status' => 'any',
91-
);
85+
$post_type = explode( ',', $post_types );
86+
$retrievable_post_types = array();
9287

93-
$click_count = filter_input( INPUT_POST, 'click_count' );
94-
if ( $click_count ) {
95-
$posts_per_page = get_option( 'posts_per_page' );
96-
$offset = $click_count * $posts_per_page;
97-
$args = array_merge(
98-
$args,
99-
array(
100-
'offset' => $offset,
101-
'posts_per_page' => $posts_per_page,
102-
)
103-
);
88+
foreach ( $post_type as $_post_type ) {
89+
$post_type_object = get_post_type_object( $_post_type );
90+
91+
if ( current_user_can( $post_type_object->cap->edit_posts ) ) {
92+
$retrievable_post_types[] = $_post_type;
93+
}
10494
}
10595

106-
$s = filter_input( INPUT_POST, 's' );
107-
if ( $s ) {
108-
$args = array_merge(
109-
$args,
110-
array(
111-
's' => $s,
112-
)
96+
if ( $retrievable_post_types ) {
97+
$args = array(
98+
'post_type' => $retrievable_post_types,
99+
'order' => 'ASC',
100+
'orderby' => 'ID',
101+
'posts_per_page' => -1,
102+
'post_status' => 'any',
113103
);
114-
}
115104

116-
$field_name = sanitize_text_field( filter_input( INPUT_POST, 'field_name' ) );
105+
$click_count = filter_input( INPUT_POST, 'click_count' );
106+
if ( $click_count ) {
107+
$posts_per_page = get_option( 'posts_per_page' );
108+
$offset = $click_count * $posts_per_page;
109+
$args = array_merge(
110+
$args,
111+
array(
112+
'offset' => $offset,
113+
'posts_per_page' => $posts_per_page,
114+
)
115+
);
116+
}
117+
118+
$s = filter_input( INPUT_POST, 's' );
119+
if ( $s ) {
120+
$args = array_merge(
121+
$args,
122+
array(
123+
's' => $s,
124+
)
125+
);
126+
}
127+
128+
$field_name = sanitize_text_field( filter_input( INPUT_POST, 'field_name' ) );
117129

118-
/**
119-
* This filter will be always applied when it queries posts in related posts field.
120-
*/
121-
$args = apply_filters( SCF_Config::PREFIX . 'custom_related_posts_args', $args, $field_name, $post_type );
130+
/**
131+
* This filter will be always applied when it queries posts in related posts field.
132+
*/
133+
$args = apply_filters( SCF_Config::PREFIX . 'custom_related_posts_args', $args, $field_name, $post_type );
122134

123-
/**
124-
* This filter will only be applied when getting posts via ajax call, therefore it won't be applied for the first load.
125-
*/
126-
$args = apply_filters( SCF_Config::PREFIX . 'custom_related_posts_args_ajax_call', $args, $field_name, $post_type );
135+
/**
136+
* This filter will only be applied when getting posts via ajax call, therefore it won't be applied for the first load.
137+
*/
138+
$args = apply_filters( SCF_Config::PREFIX . 'custom_related_posts_args_ajax_call', $args, $field_name, $post_type );
127139

128-
$_posts = get_posts( $args );
140+
$_posts = get_posts( $args );
141+
}
129142
}
143+
130144
header( 'Content-Type: application/json; charset=utf-8' );
131145
echo wp_json_encode( $_posts );
132146
die();
@@ -144,33 +158,48 @@ public function get_field( $index, $value ) {
144158
$disabled = $this->get_disable_attribute( $index );
145159
$post_type = $this->get( 'post-type' );
146160
$limit = $this->get( 'limit' );
147-
if ( ! $post_type ) {
148-
$post_type = array( 'post' );
149-
}
150-
if ( ! preg_match( '/^\d+$/', $limit ) ) {
151-
$limit = '';
152-
}
161+
162+
$choices_posts = array();
153163
$posts_per_page = get_option( 'posts_per_page' );
154164

155-
$args = array(
156-
'post_type' => $post_type,
157-
'order' => 'ASC',
158-
'orderby' => 'ID',
159-
'posts_per_page' => $posts_per_page,
160-
'post_status' => 'any',
161-
);
165+
if ( $post_type ) {
166+
$retrievable_post_types = array();
167+
168+
foreach ( $post_type as $_post_type ) {
169+
$post_type_object = get_post_type_object( $_post_type );
162170

163-
/**
164-
* This filter will be always applied when it queries posts in related posts field.
165-
*/
166-
$args = apply_filters( SCF_Config::PREFIX . 'custom_related_posts_args', $args, $name, $post_type );
167-
/**
168-
* This filter will only be applied in the first load, therefore it won't be applied when getting posts via ajax call.
169-
*/
170-
$args = apply_filters( SCF_Config::PREFIX . 'custom_related_posts_args_first_load', $args, $name, $post_type );
171-
172-
// Get posts to show in the first load.
173-
$choices_posts = get_posts( $args );
171+
if ( current_user_can( $post_type_object->cap->edit_posts ) ) {
172+
$retrievable_post_types[] = $_post_type;
173+
}
174+
}
175+
176+
if ( $retrievable_post_types ) {
177+
if ( ! preg_match( '/^\d+$/', $limit ) ) {
178+
$limit = '';
179+
}
180+
181+
$args = array(
182+
'post_type' => $retrievable_post_types,
183+
'order' => 'ASC',
184+
'orderby' => 'ID',
185+
'posts_per_page' => $posts_per_page,
186+
'post_status' => 'any',
187+
);
188+
189+
/**
190+
* This filter will be always applied when it queries posts in related posts field.
191+
*/
192+
$args = apply_filters( SCF_Config::PREFIX . 'custom_related_posts_args', $args, $name, $post_type );
193+
194+
/**
195+
* This filter will only be applied in the first load, therefore it won't be applied when getting posts via ajax call.
196+
*/
197+
$args = apply_filters( SCF_Config::PREFIX . 'custom_related_posts_args_first_load', $args, $name, $post_type );
198+
199+
// Get posts to show in the first load.
200+
$choices_posts = get_posts( $args );
201+
}
202+
}
174203

175204
$choices_li = array();
176205
foreach ( $choices_posts as $_post ) {

‎classes/fields/class.field-related-terms.php‎

Lines changed: 76 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -77,46 +77,59 @@ public function admin_enqueue_scripts() {
7777
*/
7878
public function relational_terms_search() {
7979
check_ajax_referer( SCF_Config::NAME . '-relation-taxonomies', 'nonce' );
80+
8081
$_terms = array();
81-
$args = array();
8282

8383
$taxonomies = filter_input( INPUT_POST, 'taxonomies' );
8484
if ( $taxonomies ) {
85-
$taxonomies = explode( ',', $taxonomies );
86-
$args = array(
87-
'taxonomy' => $taxonomies,
88-
'order' => 'ASC',
89-
'orderby' => 'ID',
90-
'number' => '',
91-
'hide_empty' => false,
92-
'hierarchical' => false,
93-
);
85+
$taxonomies = explode( ',', $taxonomies );
86+
$retrievable_taxonomies = array();
9487

95-
$click_count = filter_input( INPUT_POST, 'click_count' );
96-
if ( $click_count ) {
97-
$number = get_option( 'posts_per_page' );
98-
$offset = $click_count * $number;
99-
$args = array_merge(
100-
$args,
101-
array(
102-
'offset' => $offset,
103-
'number' => $number,
104-
)
105-
);
88+
foreach ( $taxonomies as $_taxonomy ) {
89+
$tax = get_taxonomy( $_taxonomy );
90+
91+
if ( current_user_can( $tax->cap->manage_terms ) ) {
92+
$retrievable_taxonomies[] = $_taxonomy;
93+
}
10694
}
10795

108-
$search = filter_input( INPUT_POST, 'search' );
109-
if ( $search ) {
110-
$args = array_merge(
111-
$args,
112-
array(
113-
'search' => $search,
114-
)
96+
if ( $retrievable_taxonomies ) {
97+
$args = array(
98+
'taxonomy' => $retrievable_taxonomies,
99+
'order' => 'ASC',
100+
'orderby' => 'ID',
101+
'number' => '',
102+
'hide_empty' => false,
103+
'hierarchical' => false,
115104
);
116-
}
117105

118-
$_terms = get_terms( $args );
106+
$click_count = filter_input( INPUT_POST, 'click_count' );
107+
if ( $click_count ) {
108+
$number = get_option( 'posts_per_page' );
109+
$offset = $click_count * $number;
110+
$args = array_merge(
111+
$args,
112+
array(
113+
'offset' => $offset,
114+
'number' => $number,
115+
)
116+
);
117+
}
118+
119+
$search = filter_input( INPUT_POST, 'search' );
120+
if ( $search ) {
121+
$args = array_merge(
122+
$args,
123+
array(
124+
'search' => $search,
125+
)
126+
);
127+
}
128+
129+
$_terms = get_terms( $args );
130+
}
119131
}
132+
120133
header( 'Content-Type: application/json; charset=utf-8' );
121134
echo wp_json_encode( $_terms );
122135
die();
@@ -134,26 +147,41 @@ public function get_field( $index, $value ) {
134147
$disabled = $this->get_disable_attribute( $index );
135148
$taxonomies = $this->get( 'taxonomy' );
136149
$limit = $this->get( 'limit' );
137-
if ( ! $taxonomies ) {
138-
$taxonomies = array( 'category' );
139-
}
140-
if ( ! preg_match( '/^\d+$/', $limit ) ) {
141-
$limit = '';
150+
151+
$choices_terms = array();
152+
$number = get_option( 'posts_per_page' );
153+
154+
if ( $taxonomies ) {
155+
$retrievable_taxonomies = array();
156+
157+
foreach ( $taxonomies as $_taxonomy ) {
158+
$tax = get_taxonomy( $_taxonomy );
159+
160+
if ( current_user_can( $tax->cap->manage_terms ) ) {
161+
$retrievable_taxonomies[] = $_taxonomy;
162+
}
163+
}
164+
165+
if ( $retrievable_taxonomies ) {
166+
if ( ! preg_match( '/^\d+$/', $limit ) ) {
167+
$limit = '';
168+
}
169+
170+
// choicse
171+
$choices_terms = get_terms(
172+
array(
173+
'taxonomy' => $taxonomies,
174+
'order' => 'ASC',
175+
'orderby' => 'ID',
176+
'hide_empty' => false,
177+
'hierarchical' => false,
178+
'number' => $number,
179+
)
180+
);
181+
}
142182
}
143-
$number = get_option( 'posts_per_page' );
144183

145-
// choicse
146-
$choices_terms = get_terms(
147-
array(
148-
'taxonomy' => $taxonomies,
149-
'order' => 'ASC',
150-
'orderby' => 'ID',
151-
'hide_empty' => false,
152-
'hierarchical' => false,
153-
'number' => $number,
154-
)
155-
);
156-
$choices_li = array();
184+
$choices_li = array();
157185
foreach ( $choices_terms as $_term ) {
158186
$term_name = $_term->name;
159187
if ( empty( $term_name ) ) {

0 commit comments

Comments
 (0)