audit clean-up

add 'no dates' logic

includes/class-hssm-slides-cpt.php

@@ -109,7 +109,6 @@ class HSSM_Slides_CPT {
             'supports'           => array( 'title', 'editor', 'thumbnail', 'excerpt' ),
             'show_in_rest'       => true,
             'rest_base'          => 'slides',
-            'rest_controller_class' => 'HSSM_REST_Slides_Controller',
         );
         
         register_post_type( self::POST_TYPE, $args );
@@ -927,7 +926,8 @@ class HSSM_Slides_CPT {
      */
     public function ajax_update_slide_order() {
         // Verify nonce and permissions
-        if ( ! wp_verify_nonce( $_POST['nonce'], 'hssm_update_slide_order' ) || ! current_user_can( 'edit_posts' ) ) {
+        $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
+        if ( ! wp_verify_nonce( $nonce, 'hssm_update_slide_order' ) || ! current_user_can( 'edit_posts' ) ) {
             wp_send_json_error( 'Unauthorized' );
         }