--- a/advanced-ads/advanced-ads.php
+++ b/advanced-ads/advanced-ads.php
@@ -10,7 +10,7 @@
*
* @wordpress-plugin
* Plugin Name: Advanced Ads
- * Version: 2.0.14
+ * Version: 2.0.15
* Description: Manage and optimize your ads in WordPress
* Plugin URI: https://wpadvancedads.com
* Author: Advanced Ads
@@ -37,7 +37,7 @@
}
define( 'ADVADS_FILE', __FILE__ );
-define( 'ADVADS_VERSION', '2.0.14' );
+define( 'ADVADS_VERSION', '2.0.15' );
// Load the autoloader.
require_once __DIR__ . '/includes/class-autoloader.php';
--- a/advanced-ads/includes/admin/class-ajax.php
+++ b/advanced-ads/includes/admin/class-ajax.php
@@ -954,6 +954,17 @@
* @return void
*/
public function placement_update_item(): void {
+ check_ajax_referer( 'advanced-ads-admin-ajax-nonce', 'nonce' );
+
+ if ( ! Conditional::user_can( 'advanced_ads_manage_placements' ) ) {
+ wp_send_json_error(
+ [
+ 'message' => __( 'Not Authorized', 'advanced-ads' ),
+ ],
+ 403
+ );
+ }
+
$placement = wp_advads_get_placement( Params::post( 'placement_id', false, FILTER_VALIDATE_INT ) );
$new_item = sanitize_text_field( Params::post( 'item_id' ) );
$new_item_type = 0 === strpos( $new_item, 'ad' ) ? 'ad_' : 'group_';
--- a/advanced-ads/includes/admin/class-groups-list-table.php
+++ b/advanced-ads/includes/admin/class-groups-list-table.php
@@ -164,34 +164,17 @@
];
}
- /**
- * Display rows or placeholder
- *
- * @return void
- */
- public function display_rows_or_placeholder(): void {
- if ( empty( $this->items ) || ! is_array( $this->items ) ) {
- echo '<tr class="no-items"><td class="colspanchange" colspan="' . $this->get_column_count() . '">'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
- $this->no_items();
- echo '</td></tr>';
- return;
- }
-
- foreach ( $this->items as $term ) {
- $group = wp_advads_get_group( $term->term_id );
- $this->single_row( $group );
- }
- }
/**
* Render single row.
*
- * @param Group $group Term object.
- * @param int $level Depth level.
+ * @param WP_Term|object $term Term object.
+ * @param int $level Depth level.
*
* @return void
*/
- public function single_row( $group, $level = 0 ): void {
+ public function single_row( $term, $level = 0 ): void {
+ $group = wp_advads_get_group( $term->term_id );
$this->type_error = '';
// Set the group to behave as default, if the original type is not available.
@@ -295,9 +278,9 @@
return '';
}
- $actions = [];
+ $actions = [];
+
if ( ! $this->type_error && current_user_can( $tax->cap->edit_terms ) ) {
- // edit group link.
$actions['edit'] = '<a href="#modal-group-edit-' . $group->get_id() . '"
class="edits">' . esc_html__( 'Edit', 'advanced-ads' ) . '</a>';
@@ -310,14 +293,22 @@
$actions['usage'] = '<a href="#modal-group-usage-' . $group->get_id() . '" class="edits">' . esc_html__( 'Show Usage', 'advanced-ads' ) . '</a>';
if ( current_user_can( $tax->cap->delete_terms ) ) {
- $args = [
- 'action' => 'group',
- 'action2' => 'delete',
- 'group_id' => $group->get_id(),
- 'page' => 'advanced-ads-groups',
- ];
- $delete_link = add_query_arg( $args, admin_url( 'admin.php' ) );
- $actions['delete'] = "<a class='delete-tag' href='" . wp_nonce_url( $delete_link, 'delete-tag_' . $group->get_id() ) . "'>" . __( 'Delete', 'advanced-ads' ) . '</a>';
+ $actions['delete'] = sprintf(
+ '<a class="delete-tag" href="%s">%s</a>',
+ wp_nonce_url(
+ add_query_arg(
+ [
+ 'action' => 'group',
+ 'action2' => 'delete',
+ 'group_id' => $group->get_id(),
+ 'page' => 'advanced-ads-groups',
+ ],
+ admin_url( 'admin.php' )
+ ),
+ 'delete-tag_' . $group->get_id()
+ ),
+ esc_html__( 'Delete', 'advanced-ads' )
+ );
}
$actions = apply_filters( Constants::TAXONOMY_GROUP . '_row_actions', $actions, $group );
--- a/advanced-ads/includes/ads/class-ad-repository.php
+++ b/advanced-ads/includes/ads/class-ad-repository.php
@@ -395,6 +395,7 @@
break;
case 'display_conditions':
case 'visitor_conditions':
+ case 'visitors':
$value = WordPress::sanitize_conditions( $value );
if (
'editpost' === Params::post( 'originalaction' ) &&
--- a/advanced-ads/includes/class-entities.php
+++ b/advanced-ads/includes/class-entities.php
@@ -203,7 +203,7 @@
$args = [
'public' => false,
- 'hierarchical' => false,
+ 'hierarchical' => true,
'labels' => $labels,
'show_ui' => true,
'show_in_nav_menus' => false,
--- a/advanced-ads/includes/class-shortcodes.php
+++ b/advanced-ads/includes/class-shortcodes.php
@@ -177,5 +177,8 @@
foreach ( $atts as $key => $value ) {
$entity->set_prop_temp( $key, $value );
}
+
+ // WP Security: disable PHP for shortcode renders. prevents unauthorized PHP execution.
+ $entity->set_prop_temp( 'allow_php', false );
}
}
--- a/advanced-ads/includes/utilities/class-wordpress.php
+++ b/advanced-ads/includes/utilities/class-wordpress.php
@@ -267,6 +267,20 @@
if ( isset( $condition['type'] ) && 'paginated_post' === $condition['type'] ) {
continue;
}
+
+ // VC - IP address trim each line and drop empties.
+ if (
+ isset( $condition['type'], $condition['value'] )
+ && 'ip_address' === $condition['type']
+ && is_string( $condition['value'] )
+ ) {
+ $condition['value'] = implode(
+ "n",
+ array_filter( array_map( 'trim', preg_split( '/r?n/', $condition['value'] ) ) )
+ );
+ $conditions[ $index ] = $condition;
+ }
+
if ( empty( $condition['value'] ) ) {
unset( $conditions[ $index ] );
}
--- a/advanced-ads/packages/advanced-ads/framework/src/class-updates.php
+++ b/advanced-ads/packages/advanced-ads/framework/src/class-updates.php
@@ -145,6 +145,6 @@
$version = $this->get_version();
}
- update_option( $this->get_option_name(), $this->get_version() );
+ update_option( $this->get_option_name(), $version );
}
}
--- a/advanced-ads/packages/composer/installed.php
+++ b/advanced-ads/packages/composer/installed.php
@@ -22,7 +22,7 @@
'advanced-ads/framework' => array(
'pretty_version' => 'dev-main',
'version' => 'dev-main',
- 'reference' => 'bafe2c32b1530cfb18d8b738adb9524f8406b9aa',
+ 'reference' => 'c6c2bfaab794daa34ddd218016328e09f8531f6e',
'type' => 'wordpress-plugin',
'install_path' => __DIR__ . '/../advanced-ads/framework',
'aliases' => array(
