stack_admn/Hi-School-Slide-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add nonces for security

Browse Source 
dry up redundencies
This commit is contained in:
Stack Administrator the 3rd
2026-02-09 21:30:13 -08:00
parent 40099aa68a
commit 999c2cc866
5 changed files with 43 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/class-hssm-frontend.php
+23 -5
View File
@@ -44,7 +44,7 @@ class HSSM_Frontend {
// AJAX handlers
add_action( 'wp_ajax_hssm_save_slide', array( $this, 'ajax_save_slide' ) );
add_action( 'wp_ajax_hssm_upload_image', array( $this, 'ajax_upload_image' ) ); // Added missing upload handler
add_action( 'wp_ajax_hssm_upload_image', array( $this, 'ajax_upload_image' ) );
add_action( 'wp_ajax_hssm_get_slides', array( $this, 'ajax_get_slides' ) );
add_action( 'wp_ajax_hssm_delete_slide', array( $this, 'ajax_delete_slide' ) );
add_action( 'wp_ajax_hssm_update_slide', array( $this, 'ajax_update_slide' ) );
@@ -53,15 +53,12 @@ class HSSM_Frontend {
add_action( 'wp_ajax_hssm_duplicate_slide', array( $this, 'ajax_duplicate_slide' ) );
add_action( 'wp_ajax_hssm_toggle_slide_status', array( $this, 'ajax_toggle_slide_status' ) );
add_action( 'wp_ajax_hssm_approve_slide', array( $this, 'ajax_approve_slide' ) );
add_action( 'wp_ajax_hssm_preview_slides', array( $this, 'ajax_preview_slides' ) ); // Added missing preview handler
add_action( 'wp_ajax_hssm_preview_slides', array( $this, 'ajax_preview_slides' ) );
// Notification Settings AJAX
add_action( 'wp_ajax_hssm_get_notification_settings', array( $this, 'ajax_get_notification_settings' ) );
add_action( 'wp_ajax_hssm_save_notification_settings', array( $this, 'ajax_save_notification_settings' ) );
// Add nopriv versions (this shouldn't be needed but let's test)
add_action( 'wp_ajax_nopriv_hssm_get_slides', array( $this, 'ajax_get_slides' ) );
// Test handler to verify AJAX is working
add_action( 'wp_ajax_hssm_test', array( $this, 'ajax_test' ) );
add_action( 'wp_ajax_nopriv_hssm_test', array( $this, 'ajax_test' ) );
@@ -681,6 +678,15 @@ class HSSM_Frontend {
* @since 1.0.0
*/
public function ajax_get_slides() {
if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'hssm_dashboard_nonce' ) ) {
wp_send_json_error( array( 'message' => 'Nonce verification failed' ) );
return;
}
if ( ! current_user_can( 'edit_posts' ) ) {
wp_send_json_error( array( 'message' => 'You do not have permission to view slides.' ) );
return;
}
// Get pagination parameters
$page = isset( $_POST['page'] ) ? intval( $_POST['page'] ) : 1;
$per_page = isset( $_POST['per_page'] ) ? intval( $_POST['per_page'] ) : 25;
@@ -849,6 +855,10 @@ class HSSM_Frontend {
* @since 1.0.0
*/
public function ajax_approve_slide() {
if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'hssm_dashboard_nonce' ) ) {
wp_send_json_error( array( 'message' => 'Nonce verification failed' ) );
return;
}
error_log( 'Approve slide AJAX called' );
if ( empty( $_POST['slide_id'] ) ) {
@@ -924,6 +934,10 @@ class HSSM_Frontend {
* @since 1.0.0
*/
public function ajax_delete_slide() {
if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'hssm_dashboard_nonce' ) ) {
wp_send_json_error( array( 'message' => 'Nonce verification failed' ) );
return;
}
if ( empty( $_POST['slide_id'] ) ) {
wp_send_json_error( array( 'message' => 'Slide ID is required' ) );
}
@@ -956,6 +970,10 @@ class HSSM_Frontend {
* @since 1.0.0
*/
public function ajax_update_slide() {
if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'hssm_dashboard_nonce' ) ) {
wp_send_json_error( array( 'message' => 'Nonce verification failed' ) );
return;
}
if ( empty( $_POST['slide_id'] ) ) {
wp_send_json_error( array( 'message' => 'Slide ID is required' ) );
}