Skip to content

Commit 691ca60

Browse files
hunkhunk
committed
in import post type change wp_verify_nonce for check_admin_referer
1 parent 8a821f9 commit 691ca60

File tree

2 files changed

+67
-68
lines changed

2 files changed

+67
-68
lines changed

‎admin/mf_custom_fields.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,10 @@ function fields_list() {
9696
print ' ';
9797

9898
print '<span style="font-size:small">';
99-
printf('<a href="admin.php?page=mf_dispatcher&noheader=true&mf_section=mf_posttype&mf_action=export_post_type&post_type=%s ">%s</a>',$post_type->name,__('Export',$mf_domain) );
99+
100+
$link = sprintf("admin.php?page=mf_dispatcher&noheader=true&mf_section=mf_posttype&mf_action=export_post_type&post_type=%s",$post_type->name);
101+
$link = wp_nonce_url($link,"export_post_type");
102+
printf('<a href="%s">%s</a>',$link,__('Export',$mf_domain) );
100103
print '</span>';
101104

102105
if(in_array($post_type->name,$mf_pt_register)):

‎admin/mf_posttype.php‎

Lines changed: 63 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ public function fields_form() {
2929
if( $_GET['mf_action'] == 'edit_post_type' ) {
3030
$type_readonly = TRUE;
3131
}
32-
32+
3333
$data = array(
3434
'suggest_labels' => array(
3535
'id' => 'suggest-labels',
@@ -382,7 +382,7 @@ public function edit_post_type() {
382382
}else{
383383

384384
$data = $this->fields_form();
385-
385+
386386
$post_type_support = array();
387387
if( isset($post_type['support']) ){
388388
foreach($post_type['support'] as $k => $v){
@@ -415,7 +415,7 @@ public function edit_post_type() {
415415
function form_post_type($data){
416416

417417
global $mf_domain;
418-
418+
419419
$supports = array(
420420
'title','editor','author',
421421
'thumbnail','excerpt','trackbacks',
@@ -571,7 +571,7 @@ public function set_categories(){
571571
if(!$post_type){
572572
echo "<h3>is necessary that the post type is created</h3>";
573573
}else{
574-
574+
575575
$all_taxonomies = get_object_taxonomies($post_type,'object');
576576
$is_type_categorie = array();
577577
foreach($all_taxonomies as $cat){
@@ -581,16 +581,16 @@ public function set_categories(){
581581
}
582582
// pr($is_type_categorie);
583583
$customCategoryIds = array();
584-
584+
585585
$post_type_key = sprintf('_cat_%s',$post_type);
586586
$sql ="SELECT meta_value FROM ".$wpdb->postmeta." WHERE meta_key='".$post_type_key."' ";
587587
$check = $wpdb->get_row($sql);
588-
588+
589589
if ($check) {
590590
$cata = $check->meta_value;
591591
$customCategoryIds = maybe_unserialize($cata);
592592
}
593-
593+
594594
echo '<input type="hidden" id="post_type_name" value="'.$post_type.'"> ';
595595
echo '<div id="default-cats">';
596596
echo '<div id="resp" style="color: #39A944; display:none;">changes have been saved successfully</div>';
@@ -607,40 +607,40 @@ public function set_categories(){
607607
$this->PrintNestedCats( $termsOfCategory, 0, 0, $customCategoryIds );
608608
echo "</div>";
609609
}
610-
611-
610+
611+
612612
echo '<p class="submit">';
613-
613+
614614
echo '<input type="submit" class="button button-primary" name="submit" id="send_set_categories" value="Save categories">';
615615
echo '</p>';
616-
616+
617617
echo '</div>';
618-
618+
619619
}
620-
621-
620+
621+
622622

623623
}
624-
625-
624+
625+
626626
private function PrintNestedCats( $cats, $parent = 0, $depth = 0, $customCategoryIds ) {
627-
foreach ($cats as $cat) :
627+
foreach ($cats as $cat) :
628628
if( $cat->parent == $parent ) {
629629
$checked = "";
630-
630+
631631
if (@in_array($cat->taxonomy . "-" .$cat->term_id, $customCategoryIds))
632632
{
633633
$checked = "checked=\"checked\"";
634634
}
635635
echo str_repeat('&nbsp;', $depth * 4);
636636
?> <input type="checkbox" name="custom-write-panel-categories[]" class="dos" value="<?php echo $cat->taxonomy . "-" .$cat->term_id?>" <?php echo $checked?> /> <?php echo $cat->name ?> <br/>
637-
<?php
637+
<?php
638638
$this->PrintNestedCats( $cats, $cat->term_id, $depth+1, $customCategoryIds );
639639
}
640640
endforeach;
641641
}
642-
643-
642+
643+
644644
/**
645645
* Save a Post Type
646646
*/
@@ -678,7 +678,7 @@ public function update_rewrite() {
678678
$this->mf_redirect(null,null,array('message' => 'success'));
679679
die;
680680
}
681-
681+
682682

683683
/**
684684
* Add a news Capabilities for Administrator
@@ -702,8 +702,8 @@ public function _add_cap($name){
702702
$role->add_cap($cap);
703703
}
704704
}
705-
706-
}
705+
706+
}
707707

708708
/**
709709
* get a specific post type using the post_type_id or the post_type_name
@@ -713,7 +713,7 @@ public function _add_cap($name){
713713
*/
714714
public function get_post_type($post_type){
715715
global $wpdb;
716-
716+
717717
$query = $wpdb->prepare( "SELECT * FROM ".MF_TABLE_POSTTYPES." WHERE type = %s", array( $post_type ) );
718718

719719
$post_type = $wpdb->get_row( $query, ARRAY_A );
@@ -742,27 +742,27 @@ public function delete_post_type(){
742742

743743
$sql = $wpdb->prepare( "DELETE FROM ".MF_TABLE_POSTTYPES." WHERE type = '%s'",$post_type );
744744
$wpdb->query($sql);
745-
745+
746746
//delete all groups of post_type
747747
$sql_fields = $wpdb->prepare( "DELETE FROM ".MF_TABLE_CUSTOM_GROUPS." WHERE post_type = '%s'",$post_type );
748748
$wpdb->query($sql_fields);
749-
749+
750750
//delete field of post_type
751751
$sql_fields = $wpdb->prepare( "DELETE FROM ".MF_TABLE_CUSTOM_FIELDS." WHERE post_type = '%s'",$post_type );
752752
$wpdb->query($sql_fields);
753-
753+
754754
$this->mf_redirect(null,null,array('message' => 'success'));
755755
}
756756
}
757757
}
758-
758+
759759
static public function check_post_type($post_type,$id = NULL){
760760
global $wpdb;
761-
761+
762762
$query = sprintf("SELECT COUNT(*) FROM %s WHERE type = '%s'",MF_TABLE_POSTTYPES,$post_type);
763763
if($id)
764764
$query = sprintf("%s AND id != %s",$query,$id);
765-
765+
766766
$check = $wpdb->get_var($query);
767767

768768
if( in_array($post_type,array('post','page') ) )
@@ -772,14 +772,16 @@ static public function check_post_type($post_type,$id = NULL){
772772
}
773773

774774
public function export_post_type(){
775+
check_admin_referer('export_post_type');
776+
775777
global $mf_pt_register;
776778

777779
if(!isset($_GET['post_type']) ){
778780
$this->mf_flash( 'Oops! something was wrong, you will be redirected a safe place in a few seconds' );
779781
}
780782

781783
//post_type_exists
782-
784+
783785
$post_type = $_GET['post_type'];
784786
$data = array(
785787
'name' => $post_type,
@@ -788,7 +790,7 @@ public function export_post_type(){
788790
'taxonomy' => array()
789791
);
790792

791-
793+
792794

793795
if( in_array($post_type,$mf_pt_register) ){
794796
$p = $this->get_post_type($post_type);
@@ -856,17 +858,17 @@ public function export_post_type(){
856858
if( !in_array($tax,array('nav_menu','post_format')) ){
857859
$p['taxonomy'][$tax] = 1;
858860
}
859-
}
861+
}
860862
}
861-
862-
863+
864+
863865
if( isset($p['taxonomy']) ){
864866
foreach($p['taxonomy'] as $tax_name => $t){
865867
if($custom_taxonomy = $this->get_custom_taxonomy_by_type($tax_name)){
866868
unset($p['taxonomy'][$tax_name]);
867869
$data['taxonomy'][] = $custom_taxonomy;
868870
}
869-
871+
870872
}
871873
}
872874

@@ -877,10 +879,10 @@ public function export_post_type(){
877879
$groups[$group_id]['fields'] = $fields;
878880
}
879881
$data['groups'] = $groups;
880-
882+
881883
//post type
882884
$data['post_type'] = $p;
883-
885+
884886
header('Content-type: binary');
885887
header('Content-Disposition: attachment; filename="'.$post_type.'.pnl"');
886888
print serialize($data);
@@ -896,13 +898,13 @@ public function import_form_post_type(){
896898
<h2><?php _e('Import a Post Type', $mf_domain);?></h2>
897899

898900
<form id="import_post_type" method="post" action="admin.php?page=mf_dispatcher&init=true&mf_section=mf_posttype&mf_action=upload_import_post_type" enctype="multipart/form-data">
899-
<?php wp_nonce_field('nonce_upload_file_import','checking'); ?>
901+
<?php wp_nonce_field('nonce_upload_file_import'); ?>
900902
<div class="alignleft fixed" style="width: 40%;" id="mf_add_custom_group">
901903
<div class="form-field mf_form">
902-
<label for="import-file" ><?php _e('File'); ?>:</label>
903-
<input type="file" id="import-file" name="file" >
904-
<p><?php _e('File with information about post type',$mf_domain);?></p>
905-
<div class="clear"></div>
904+
<label for="import-file" ><?php _e('File'); ?>:</label>
905+
<input type="file" id="import-file" name="file" >
906+
<p><?php _e('File with information about post type',$mf_domain);?></p>
907+
<div class="clear"></div>
906908
</div>
907909
<div class="form-field mf_form ">
908910
<label for="import_overwrite"><?php _e('Overwrite',$mf_domain); ?></label>
@@ -911,35 +913,31 @@ public function import_form_post_type(){
911913
<div class="clear"></div>
912914
<p><?php _e('Overwrite existing post type?',$mf_domain); ?> </p>
913915
</div>
914-
915-
<p class="submit">
916-
<a style="color:black" href="admin.php?page=mf_dispatcher" class="button"><?php _e('Cancel',$mf_domain); ?></a>
917-
<input type="submit" class="button button-primary" name="submit" id="submit" value="<?php _e('Import',$mf_domain); ?>">
918-
</p>
919-
</div>
920-
<div class="widefat mf_form_right stuffbox metabox-holder">
921-
<h3><?php _e('Import a Post Type',$mf_domain); ?></h3>
922-
<div class="inside">
923-
<div id="options_field" class="group_side">
924-
<p><?php _e('This functionality allows us to import all the information of a post type',$mf_domain); ?></p>
925-
<p><?php _e('Also they are imported the groups, custom fields and custom taxonomies that contains the post type',$mf_domain); ?></p>
926-
<p><?php _e('For defualt to create a new post type, if it exists a post type with the same name was added with a prefix to be able to differentiate it, if the option overwrite is checked the system overwrite the information of post type and It will add the custom groups and custom fields to the already existing ones, If some custom group or custom field already this registered It will be overwrite',$mf_domain); ?></p>
927-
<p><img src="<?php echo MF_URL; ?>images/admin/import.jpg"/></p>
916+
917+
<p class="submit">
918+
<a style="color:black" href="admin.php?page=mf_dispatcher" class="button"><?php _e('Cancel',$mf_domain); ?></a>
919+
<input type="submit" class="button button-primary" name="submit" id="submit" value="<?php _e('Import',$mf_domain); ?>">
920+
</p>
921+
</div>
922+
<div class="widefat mf_form_right stuffbox metabox-holder">
923+
<h3><?php _e('Import a Post Type',$mf_domain); ?></h3>
924+
<div class="inside">
925+
<div id="options_field" class="group_side">
926+
<p><?php _e('This functionality allows us to import all the information of a post type',$mf_domain); ?></p>
927+
<p><?php _e('Also they are imported the groups, custom fields and custom taxonomies that contains the post type',$mf_domain); ?></p>
928+
<p><?php _e('For defualt to create a new post type, if it exists a post type with the same name was added with a prefix to be able to differentiate it, if the option overwrite is checked the system overwrite the information of post type and It will add the custom groups and custom fields to the already existing ones, If some custom group or custom field already this registered It will be overwrite',$mf_domain); ?></p>
929+
<p><img src="<?php echo MF_URL; ?>images/admin/import.jpg"/></p>
930+
</div>
928931
</div>
929932
</div>
930-
</div>
933+
</form>
931934
</div>
932-
</form>
933935
<?php
934936
}
935937

936938
public function upload_import_post_type(){
937939
global $mf_domain;
938-
939-
if ( empty($_POST) || !wp_verify_nonce($_POST['checking'],'nonce_upload_file_import') ){
940-
print 'Sorry, your nonce did not verify.';
941-
exit;
942-
}
940+
check_admin_referer('nonce_upload_file_import');
943941

944942
if ($_FILES['file']['error'] == UPLOAD_ERR_OK){
945943
$file_path = $_FILES['file']['tmp_name'];
@@ -951,9 +949,7 @@ public function upload_import_post_type(){
951949
//mensaje de error
952950
die(__('Error uploading file!', $mf_domain));
953951
}
954-
955952
die;
956-
957953
}
958954

959955
}

0 commit comments

Comments
 (0)