WordPress.org
Get WordPress

Plugin Directory

Changeset 3235167


Ignore:
Timestamp:
02/05/2025 06:33:48 AM (14 months ago)
Author:
adirectory
Message:

Ajax permission check implemented version 2.3.5

Location:
adirectory
Files:
438 added
3 edited

Legend:

Unmodified
Added
Removed

  • adirectory/trunk/adirectory.php

    r3233466 r3235167  
    77 * Author URI:  http://adirectory.io
    88 * Description: Directory Plugins that help to build Business Directory, Classified listing and WordPress Listing Directory websites.
    9  * Version:     2.3
     9 * Version:     2.3.5
    1010 * Requires at least: 6.0
    1111 * Tested up to: 6.7.1

  • adirectory/trunk/inc/Frontend/Ajax.php

    r3228817 r3235167  
    113113    public function adqs_delete_listing()
    114114    {
    115         if (!check_ajax_referer('__qs_directory_userdash', 'security', 'false')) {
    116             wp_send_json_error(array('messsage' => 'Nonce verification failed'));
     115        if (!check_ajax_referer('__qs_directory_userdash', 'security', false)) {
     116            wp_send_json_error(array('message' => 'Nonce verification failed'));
    117117        }
    118118
    119119        if (!current_user_can('read')) {
    120             wp_send_json_error(array('messsage' => 'Do not have any permisiion'));
     120            wp_send_json_error(array('message' => 'Do not have any permission'));
    121121        }
    122122
    123123        $postid = isset($_POST['listid']) ? absint($_POST['listid']) : 0;
    124124
    125         $delete = wp_delete_post($postid);
     125        if (!$postid) {
     126            wp_send_json_error(array('message' => 'Invalid post ID'));
     127        }
     128
     129        $post = get_post($postid);
     130
     131        if (!$post) {
     132            wp_send_json_error(array('message' => 'Post not found'));
     133        }
     134
     135        if ($post->post_type !== 'adqs_directory') {
     136            wp_send_json_error(array('message' => 'You can only delete listings of type adqs_directory'));
     137        }
     138
     139        if ((int) $post->post_author !== get_current_user_id()) {
     140            wp_send_json_error(array('message' => 'You do not have permission to delete this listing'));
     141        }
     142
     143        $delete = wp_delete_post($postid, true);
    126144
    127145        if ($delete) {
    128             wp_send_json_success();
    129         }
    130 
    131         wp_send_json_error();
     146            wp_send_json_success(array('message' => 'Listing deleted successfully'));
     147        } else {
     148            wp_send_json_error(array('message' => 'Failed to delete listing'));
     149        }
    132150    }
    133151

  • adirectory/trunk/readme.txt

    r3233466 r3235167  
    44Requires at least: 6.0
    55Tested up to: 6.7.1
    6 Stable tag: 2.3
     6Stable tag: 2.3.5
    77Requires PHP: 7.4
    88License: GPLv2 or later
Note: See TracChangeset for help on using the changeset viewer.