plugin updates

wp/wp-content/plugins/advanced-custom-fields-pro/includes/fields/class-acf-field-taxonomy.php

@@ -48,32 +48,35 @@ if ( ! class_exists( 'acf_field_taxonomy' ) ) :
 			add_action( 'acf/save_post', array( $this, 'save_post' ), 15, 1 );
 		}
 
-
 		/**
-		 * description
+		 * Returns AJAX results for the Taxonomy field.
 		 *
-		 * @type    function
-		 * @date    24/10/13
-		 * @since   5.0.0
+		 * @since 5.0.0
 		 *
-		 * @param   $post_id (int)
-		 * @return  $post_id (int)
+		 * @return void
 		 */
-		function ajax_query() {
+		public function ajax_query() {
+			$nonce             = acf_request_arg( 'nonce', '' );
+			$key               = acf_request_arg( 'field_key', '' );
+			$conditional_logic = (bool) acf_request_arg( 'conditional_logic', false );
 
-			// validate
-			if ( ! acf_verify_ajax() ) {
+			if ( $conditional_logic ) {
+				if ( ! acf_current_user_can_admin() ) {
+					die();
+				}
+
+				// Use the standard ACF admin nonce.
+				$nonce = '';
+				$key   = '';
+			}
+
+			if ( ! acf_verify_ajax( $nonce, $key ) ) {
 				die();
 			}
 
-			// get choices
-			$response = $this->get_ajax_query( $_POST );
-
-			// return
-			acf_send_ajax_results( $response );
+			acf_send_ajax_results( $this->get_ajax_query( $_POST ) );
 		}
 
-
 		/**
 		 * This function will return an array of data formatted for use in a select2 AJAX response
 		 *
@@ -455,18 +458,15 @@ if ( ! class_exists( 'acf_field_taxonomy' ) ) :
 			return $value;
 		}
 
-
 		/**
-		 * Create the HTML interface for your field
+		 * Renders the Taxonomy field.
 		 *
-		 * @type    action
-		 * @since   3.6
-		 * @date    23/01/13
+		 * @since 3.6
 		 *
-		 * @param   $field - an array holding all the field's data
+		 * @param array $field The field settings array.
+		 * @return void
 		 */
-		function render_field( $field ) {
-
+		public function render_field( $field ) {
 			// force value to array
 			$field['value'] = acf_get_array( $field['value'] );
 
@@ -477,6 +477,7 @@ if ( ! class_exists( 'acf_field_taxonomy' ) ) :
 				'data-ftype'      => $field['field_type'],
 				'data-taxonomy'   => $field['taxonomy'],
 				'data-allow_null' => $field['allow_null'],
+				'data-nonce'      => wp_create_nonce( $field['key'] ),
 			);
 			// get taxonomy
 			$taxonomy = get_taxonomy( $field['taxonomy'] );
@@ -514,7 +515,6 @@ if ( ! class_exists( 'acf_field_taxonomy' ) ) :
 			<?php
 		}
 
-
 		/**
 		 * Create the HTML interface for your field
 		 *
@@ -750,25 +750,14 @@ if ( ! class_exists( 'acf_field_taxonomy' ) ) :
 
 
 		/**
-		 * ajax_add_term
+		 * AJAX handler for adding Taxonomy field terms.
 		 *
-		 * @since  5.2.3
-		 *
-		 * @type   function
-		 * @date   17/04/2015
+		 * @since 5.2.3
 		 *
 		 * @return void
 		 */
-		function ajax_add_term() {
-
-			// verify nonce
-			if ( ! acf_verify_ajax() ) {
-				die();
-			}
-
-			// vars
-			$args = wp_parse_args(
-				$_POST,
+		public function ajax_add_term() {
+			$args = acf_request_args(
 				array(
 					'nonce'       => '',
 					'field_key'   => '',
@@ -777,6 +766,10 @@ if ( ! class_exists( 'acf_field_taxonomy' ) ) :
 				)
 			);
 
+			if ( ! acf_verify_ajax( $args['nonce'], $args['field_key'] ) ) {
+				die();
+			}
+
 			// load field
 			$field = acf_get_field( $args['field_key'] );
 			if ( ! $field ) {