plugin updates

wp/wp-content/plugins/advanced-custom-fields-pro/pro/fields/class-acf-field-gallery.php

@@ -74,32 +74,28 @@ if ( ! class_exists( 'acf_field_gallery' ) ) :
 			);
 		}
 
-
 		/**
-		 * description
+		 * AJAX handler for retrieving and rendering an attachment.
 		 *
-		 * @type    function
-		 * @date    13/12/2013
-		 * @since   5.0.0
+		 * @since 5.0.0
 		 *
-		 * @param   $post_id (int)
-		 * @return  $post_id (int)
+		 * @return void
 		 */
-		function ajax_get_attachment() {
-
-			// Validate requrest.
-			if ( ! acf_verify_ajax() ) {
-				die();
-			}
-
+		public function ajax_get_attachment() {
 			// Get args.
 			$args = acf_request_args(
 				array(
 					'id'        => 0,
 					'field_key' => '',
+					'nonce'     => '',
 				)
 			);
 
+			// Validate request.
+			if ( ! acf_verify_ajax( $args['nonce'], $args['field_key'] ) ) {
+				die();
+			}
+
 			// Cast args.
 			$args['id'] = (int) $args['id'];
 
@@ -119,25 +115,22 @@ if ( ! class_exists( 'acf_field_gallery' ) ) :
 			die;
 		}
 
-
 		/**
-		 * description
+		 * AJAX handler for updating an attachment.
 		 *
-		 * @type    function
-		 * @date    13/12/2013
 		 * @since   5.0.0
 		 *
-		 * @param   $post_id (int)
-		 * @return  $post_id (int)
+		 * @return void
 		 */
-		function ajax_update_attachment() {
+		public function ajax_update_attachment() {
+			$args = acf_request_args(
+				array(
+					'nonce'     => '',
+					'field_key' => '',
+				)
+			);
 
-			if ( ! isset( $_POST['nonce'] ) ) {
-				wp_send_json_error();
-			}
-
-			// validate nonce
-			if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'acf_nonce' ) ) {
+			if ( ! acf_verify_ajax( $args['nonce'], $args['field_key'] ) ) {
 				wp_send_json_error();
 			}
 
@@ -196,21 +189,14 @@ if ( ! class_exists( 'acf_field_gallery' ) ) :
 			wp_send_json_success();
 		}
 
-
 		/**
-		 * description
+		 * AJAX handler for getting the attachment sort order.
 		 *
-		 * @type    function
-		 * @date    13/12/2013
-		 * @since   5.0.0
+		 * @since 5.0.0
 		 *
-		 * @param   $post_id (int)
-		 * @return  $post_id (int)
+		 * @return void
 		 */
-		function ajax_get_sort_order() {
-
-			// vars
-			$r     = array();
+		public function ajax_get_sort_order() {
 			$order = 'DESC';
 			$args  = acf_parse_args(
 				$_POST, // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Verified below.
@@ -222,23 +208,22 @@ if ( ! class_exists( 'acf_field_gallery' ) ) :
 				)
 			);
 
-			// validate
-			if ( ! wp_verify_nonce( $args['nonce'], 'acf_nonce' ) ) {
+			if ( ! acf_verify_ajax( $args['nonce'], $args['field_key'] ) ) {
 				wp_send_json_error();
 			}
 
-			// reverse
-			if ( $args['sort'] == 'reverse' ) {
+			// Reverse order.
+			if ( $args['sort'] === 'reverse' ) {
 				$ids = array_reverse( $args['ids'] );
-
 				wp_send_json_success( $ids );
 			}
 
-			if ( $args['sort'] == 'title' ) {
+			// Ascending order.
+			if ( $args['sort'] === 'title' ) {
 				$order = 'ASC';
 			}
 
-			// find attachments (DISTINCT POSTS)
+			// Find attachments (DISTINCT POSTS).
 			$ids = get_posts(
 				array(
 					'post_type'   => 'attachment',
@@ -251,12 +236,10 @@ if ( ! class_exists( 'acf_field_gallery' ) ) :
 				)
 			);
 
-			// success
 			if ( ! empty( $ids ) ) {
 				wp_send_json_success( $ids );
 			}
 
-			// failure
 			wp_send_json_error();
 		}
 
@@ -403,6 +386,7 @@ if ( ! class_exists( 'acf_field_gallery' ) ) :
 				'data-mime_types'   => $field['mime_types'],
 				'data-insert'       => $field['insert'],
 				'data-columns'      => 4,
+				'data-nonce'        => wp_create_nonce( $field['key'] ),
 			);
 
 			// Set gallery height with deafult of 400px and minimum of 200px.