Edit File by line

<?php if ( ! defined( 'ABSPATH' ) ) exit;

[0] Fix | Delete

[1] Fix | Delete

class NF_AJAX_REST_BatchProcess extends NF_AJAX_REST_Controller

[2] Fix | Delete

{

[3] Fix | Delete

protected $action = 'nf_batch_process';

[4] Fix | Delete

public function __construct()

[5] Fix | Delete

{

[6] Fix | Delete

parent::__construct();

[7] Fix | Delete

}

[8] Fix | Delete

[9] Fix | Delete

/**

[10] Fix | Delete

* POST /forms/<id>/

[11] Fix | Delete

* @param array $request_data [ int $clone_id ]

[12] Fix | Delete

* @return array $data [ int $new_form_id ]

[13] Fix | Delete

[14] Fix | Delete

public function post( $request_data )

[15] Fix | Delete

{

[16] Fix | Delete

$data = array();

[17] Fix | Delete

[18] Fix | Delete

// Does the current user have admin privileges

[19] Fix | Delete

if (!current_user_can(apply_filters('ninja_forms_admin_all_forms_capabilities', 'manage_options'))) {

[20] Fix | Delete

$data['error'] = esc_html__('Request forbidden.', 'ninja-forms');

[21] Fix | Delete

return $data;

[22] Fix | Delete

}

[23] Fix | Delete

[24] Fix | Delete

// If we don't have a nonce...

[25] Fix | Delete

// OR if the nonce is invalid...

[26] Fix | Delete

if ( ! isset( $request_data[ 'security' ] ) || ! wp_verify_nonce( $request_data[ 'security' ], 'ninja_forms_batch_nonce' ) ) {

[27] Fix | Delete

// Kick the request out now.

[28] Fix | Delete

$data[ 'error' ] = esc_html__( 'Request forbidden.', 'ninja-forms' );

[29] Fix | Delete

return $data;

[30] Fix | Delete

}

[31] Fix | Delete

[32] Fix | Delete

// If we have a batch type...

[33] Fix | Delete

if ( isset( $request_data[ 'batch_type' ]) ){

[34] Fix | Delete

$batch_type = $request_data[ 'batch_type' ];

[35] Fix | Delete

$batch_processes = Ninja_Forms()->config( 'BatchProcesses' );

[36] Fix | Delete

[37] Fix | Delete

if ( isset ( $batch_processes[ $batch_type ][ 'class_name' ] ) ) {

[38] Fix | Delete

$batch_class = $batch_processes[ $batch_type ][ 'class_name' ];

[39] Fix | Delete

$batch = new $batch_class( $request_data );

[40] Fix | Delete

} else {

[41] Fix | Delete

$data[ 'error' ] = esc_html__( 'Invalid request.', 'ninja-forms' );

[42] Fix | Delete

}

[43] Fix | Delete

} // Otherwise... (We don't have a batch type.)

[44] Fix | Delete

else {

[45] Fix | Delete

// Kick the request out.

[46] Fix | Delete

$data[ 'error' ] = esc_html__( 'Invalid request.', 'ninja-forms' );

[47] Fix | Delete

}

[48] Fix | Delete

return $data;

[49] Fix | Delete

}

[50] Fix | Delete

[51] Fix | Delete

protected function get_request_data()

[52] Fix | Delete

{

[53] Fix | Delete

$request_data = array();

[54] Fix | Delete

[55] Fix | Delete

if (isset($_REQUEST['batch_type']) && $_REQUEST['batch_type']) {

[56] Fix | Delete

$request_data['batch_type'] = WPN_Helper::sanitize_text_field($_REQUEST['batch_type']);

[57] Fix | Delete

}

[58] Fix | Delete

[59] Fix | Delete

if (isset($_REQUEST['data']) && $_REQUEST['data']) {

[60] Fix | Delete

// @TODO: Find a way to safely sanitize this later.

[61] Fix | Delete

// sanitize_text_field overcorrects, breaking "actual" data.

[62] Fix | Delete

$request_data['data'] = $_REQUEST['data'];

[63] Fix | Delete

}

[64] Fix | Delete

[65] Fix | Delete

if (isset($_REQUEST['security']) && $_REQUEST['security']) {

[66] Fix | Delete

$request_data['security'] = WPN_Helper::sanitize_text_field($_REQUEST['security']);

[67] Fix | Delete

}

[68] Fix | Delete

[69] Fix | Delete

if (isset($_REQUEST['action']) && $_REQUEST['action']) {

[70] Fix | Delete

$request_data['action'] = WPN_Helper::sanitize_text_field($_REQUEST['action']);

[71] Fix | Delete

}

[72] Fix | Delete

[73] Fix | Delete

return $request_data;

[74] Fix | Delete

}

[75] Fix | Delete

}

[76] Fix | Delete

[77] Fix | Delete