stack_admn/Hi-School-Slide-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add nonces for security

Browse Source 
dry up redundencies
This commit is contained in:
Stack Administrator the 3rd
2026-02-09 21:30:13 -08:00
parent 40099aa68a
commit 999c2cc866
5 changed files with 43 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
assets/js/dashboard.js
+1
View File
@@ -474,6 +474,7 @@
$form.addClass('hssm-loading');
formData.append('nonce', hssmDashboard.nonce);
$.ajax({
url: hssmDashboard.ajaxurl,
type: 'POST',
hi-school-slide-manager.php
-44
View File
@@ -36,50 +36,6 @@ define( 'HSSM_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );
require_once HSSM_PLUGIN_DIR . 'includes/class-hssm-autoloader.php';
require_once HSSM_PLUGIN_DIR . 'includes/class-hssm-main.php';
/**
* Plugin activation hook
*
* @since 1.0.0
*/
function hssm_activate() {
// Create custom capability
$admin_role = get_role( 'administrator' );
if ( $admin_role ) {
$admin_role->add_cap( 'hssm_manage_slides' );
}
// Also add to editor role
$editor_role = get_role( 'editor' );
if ( $editor_role ) {
$editor_role->add_cap( 'hssm_manage_slides' );
}
// Flush rewrite rules to ensure our CPT permalinks work
flush_rewrite_rules();
}
register_activation_hook( __FILE__, 'hssm_activate' );
/**
* Plugin deactivation hook
*
* @since 1.0.0
*/
function hssm_deactivate() {
// Remove custom capability
$admin_role = get_role( 'administrator' );
if ( $admin_role ) {
$admin_role->remove_cap( 'hssm_manage_slides' );
}
$editor_role = get_role( 'editor' );
if ( $editor_role ) {
$editor_role->remove_cap( 'hssm_manage_slides' );
}
// Flush rewrite rules
flush_rewrite_rules();
}
register_deactivation_hook( __FILE__, 'hssm_deactivate' );
/**
* Initialize the Hi-School Slide Manager plugin
includes/class-hssm-frontend.php
+23 -5
View File
@@ -44,7 +44,7 @@ class HSSM_Frontend {
// AJAX handlers
add_action( 'wp_ajax_hssm_save_slide', array( $this, 'ajax_save_slide' ) );
add_action( 'wp_ajax_hssm_upload_image', array( $this, 'ajax_upload_image' ) ); // Added missing upload handler
add_action( 'wp_ajax_hssm_upload_image', array( $this, 'ajax_upload_image' ) );
add_action( 'wp_ajax_hssm_get_slides', array( $this, 'ajax_get_slides' ) );
add_action( 'wp_ajax_hssm_delete_slide', array( $this, 'ajax_delete_slide' ) );
add_action( 'wp_ajax_hssm_update_slide', array( $this, 'ajax_update_slide' ) );
@@ -53,15 +53,12 @@ class HSSM_Frontend {
add_action( 'wp_ajax_hssm_duplicate_slide', array( $this, 'ajax_duplicate_slide' ) );
add_action( 'wp_ajax_hssm_toggle_slide_status', array( $this, 'ajax_toggle_slide_status' ) );
add_action( 'wp_ajax_hssm_approve_slide', array( $this, 'ajax_approve_slide' ) );
add_action( 'wp_ajax_hssm_preview_slides', array( $this, 'ajax_preview_slides' ) ); // Added missing preview handler
add_action( 'wp_ajax_hssm_preview_slides', array( $this, 'ajax_preview_slides' ) );
// Notification Settings AJAX
add_action( 'wp_ajax_hssm_get_notification_settings', array( $this, 'ajax_get_notification_settings' ) );
add_action( 'wp_ajax_hssm_save_notification_settings', array( $this, 'ajax_save_notification_settings' ) );
// Add nopriv versions (this shouldn't be needed but let's test)
add_action( 'wp_ajax_nopriv_hssm_get_slides', array( $this, 'ajax_get_slides' ) );
// Test handler to verify AJAX is working
add_action( 'wp_ajax_hssm_test', array( $this, 'ajax_test' ) );
add_action( 'wp_ajax_nopriv_hssm_test', array( $this, 'ajax_test' ) );
@@ -681,6 +678,15 @@ class HSSM_Frontend {
* @since 1.0.0
*/
public function ajax_get_slides() {
if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'hssm_dashboard_nonce' ) ) {
wp_send_json_error( array( 'message' => 'Nonce verification failed' ) );
return;
}
if ( ! current_user_can( 'edit_posts' ) ) {
wp_send_json_error( array( 'message' => 'You do not have permission to view slides.' ) );
return;
}
// Get pagination parameters
$page = isset( $_POST['page'] ) ? intval( $_POST['page'] ) : 1;
$per_page = isset( $_POST['per_page'] ) ? intval( $_POST['per_page'] ) : 25;
@@ -849,6 +855,10 @@ class HSSM_Frontend {
* @since 1.0.0
*/
public function ajax_approve_slide() {
if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'hssm_dashboard_nonce' ) ) {
wp_send_json_error( array( 'message' => 'Nonce verification failed' ) );
return;
}
error_log( 'Approve slide AJAX called' );
if ( empty( $_POST['slide_id'] ) ) {
@@ -924,6 +934,10 @@ class HSSM_Frontend {
* @since 1.0.0
*/
public function ajax_delete_slide() {
if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'hssm_dashboard_nonce' ) ) {
wp_send_json_error( array( 'message' => 'Nonce verification failed' ) );
return;
}
if ( empty( $_POST['slide_id'] ) ) {
wp_send_json_error( array( 'message' => 'Slide ID is required' ) );
}
@@ -956,6 +970,10 @@ class HSSM_Frontend {
* @since 1.0.0
*/
public function ajax_update_slide() {
if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'hssm_dashboard_nonce' ) ) {
wp_send_json_error( array( 'message' => 'Nonce verification failed' ) );
return;
}
if ( empty( $_POST['slide_id'] ) ) {
wp_send_json_error( array( 'message' => 'Slide ID is required' ) );
}
includes/class-hssm-main.php
+18 -2
View File
@@ -175,8 +175,6 @@ class HSSM_Main {
// AJAX hooks for authenticated users
// Note: Main AJAX handlers are in HSSM_Frontend class
add_action( 'wp_ajax_hssm_upload_image', array( $this, 'ajax_upload_image' ) );
add_action( 'wp_ajax_hssm_preview_slides', array( $this, 'ajax_preview_slides' ) );
add_action( 'wp_ajax_hssm_send_preview_email', array( $this, 'ajax_send_preview_email' ) );
// Cron hooks for scheduled slides
@@ -352,6 +350,15 @@ class HSSM_Main {
* @since 1.0.0
*/
public static function activate() {
// Create custom capability
$roles = [ 'administrator', 'editor' ];
foreach ( $roles as $role_name ) {
$role = get_role( $role_name );
if ( $role ) {
$role->add_cap( 'hssm_manage_slides' );
}
}
// Set up cron jobs
self::setup_cron_jobs();
@@ -371,6 +378,15 @@ class HSSM_Main {
* @since 1.0.0
*/
public static function deactivate() {
// Remove custom capability
$roles = [ 'administrator', 'editor' ];
foreach ( $roles as $role_name ) {
$role = get_role( $role_name );
if ( $role ) {
$role->remove_cap( 'hssm_manage_slides' );
}
}
// Clear cron jobs
wp_clear_scheduled_hook( 'hssm_check_scheduled_slides' );
includes/class-hssm-slides-cpt.php
+1 -1
View File
@@ -928,7 +928,7 @@ class HSSM_Slides_CPT {
public function ajax_update_slide_order() {
// Verify nonce and permissions
if ( ! wp_verify_nonce( $_POST['nonce'], 'hssm_update_slide_order' ) || ! current_user_can( 'edit_posts' ) ) {
wp_die( 'Unauthorized' );
wp_send_json_error( 'Unauthorized' );
}
if ( isset( $_POST['slide_ids'] ) && is_array( $_POST['slide_ids'] ) ) {