1 files changed, 45 insertions, 12 deletions

diff --git a/src/class-draggable-post-order.php b/src/class-draggable-post-order.php
index ae9b501..a976816 100644
--- a/src/class-draggable-post-order.php
+++ b/src/class-draggable-post-order.php
@@ -15,10 +15,31 @@ namespace Draggable_Post_Order;
 class Draggable_Post_Order {
 
 	/**
+	 * The meta key.
+	 *
+	 * @var string
+	 */
+	public static string $meta_key = 'draggable-post-order';
+
+	/**
+	 * The post type feature.
+	 *
+	 * @var string
+	 */
+	public static string $post_type_feature = 'draggable-post-order';
+
+	/**
+	 * The nonce name.
+	 *
+	 * @var string
+	 */
+	public static string $nonce = 'draggable-post-order';
+
+	/**
 	 * Initialize.
 	 */
 	public static function init() {
-		$post_types = get_post_types_by_support( 'draggable-post-order' );
+		$post_types = get_post_types_by_support( self::$post_type_feature );
 
 		// if there are no post types to order => return.
 		if ( empty( $post_types ) ) {
@@ -40,6 +61,9 @@ class Draggable_Post_Order {
 
 		// sort posts by post order.
 		add_action( 'pre_get_posts', [ self::class, 'order_posts' ] );
+
+		// sort for adjacent posts.
+		Adjacent_Post_Order::init();
 	}
 
 	/**
@@ -52,7 +76,7 @@ class Draggable_Post_Order {
 	public static function supports( $post_type = null ) {
 		$post_type ??= get_current_screen()->post_type ?? '';
 
-		return post_type_supports( $post_type, 'draggable-post-order' );
+		return post_type_supports( $post_type, self::$post_type_feature );
 	}
 
 	/**
@@ -64,19 +88,19 @@ class Draggable_Post_Order {
 	public static function save_post( $post_id, $post ) {
 		if (
 			( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) ||
-			! check_admin_referer( 'metaBoxDraggablePostOrder', 'metaBoxDraggablePostOrder' ) ||
+			! check_admin_referer( self::$nonce, self::$nonce ) ||
 			( ! isset( $_POST['post_ID'] ) || intval( $_POST['post_ID'] ) !== intval( $post_id ) ) ||
-			! isset( $_POST['draggable-post-order'] )
+			! isset( $_POST[ self::$meta_key ] )
 		) {
 			return;
 		}
 
-		$post_order = sanitize_text_field( wp_unslash( $_POST['draggable-post-order'] ) );
+		$post_order = sanitize_text_field( wp_unslash( $_POST[ self::$meta_key ] ) );
 		if ( empty( $post_order ) ) {
 			$post_order = wp_count_posts( $post->post_type )->publish;
 		}
 
-		update_post_meta( $post_id, 'draggable-post-order', $post_order );
+		update_post_meta( $post_id, self::$meta_key, $post_order );
 	}
 
 	/**
@@ -96,8 +120,8 @@ class Draggable_Post_Order {
 	 * @param \WP_Post $post The post object.
 	 */
 	public static function add_meta_box( $post ) {
-		wp_nonce_field( 'metaBoxDraggablePostOrder', 'metaBoxDraggablePostOrder' );
-		?><input type="number" name="draggable-post-order" value="<?php echo get_post_meta( $post->ID, 'draggable-post-order', true ); ?>">
+		wp_nonce_field( self::$nonce, self::$nonce );
+		?><input type="number" name="<?php echo esc_html( self::$meta_key ); ?>" value="<?php echo esc_html( get_post_meta( $post->ID, self::$meta_key, true ) ); ?>">
 		<?php
 	}
 
@@ -105,17 +129,19 @@ class Draggable_Post_Order {
 	 * Callback for "wp_ajax" action.
 	 */
 	public static function update_post_order() {
-		if ( ! isset( $_POST['page'] ) || ! isset( $_POST['perPage'] ) || ! isset( $_POST['postOrder'] ) ) {
+		if ( ! check_ajax_referer( self::$nonce, 'nonce' ) ||
+			! isset( $_POST['page'] ) || ! isset( $_POST['perPage'] ) || ! isset( $_POST['postOrder'] ) ) {
 			return;
 		}
 
 		$page     = intval( $_POST['page'] );
 		$per_page = intval( $_POST['perPage'] );
+        //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
 		parse_str( $_POST['postOrder'], $post_order );
 
 		foreach ( $post_order['post'] as $order => $post_id ) {
 			$order = intval( $order ) + 1;
-			update_post_meta( $post_id, 'draggable-post-order', ( ( $page - 1 ) * $per_page ) + $order );
+			update_post_meta( $post_id, self::$meta_key, ( ( $page - 1 ) * $per_page ) + $order );
 		}
 	}
 
@@ -132,6 +158,13 @@ class Draggable_Post_Order {
 		$dependencies[] = 'jquery-ui-sortable';
 		wp_enqueue_script( 'draggable-post-order', draggable_post_order_assets_url( 'index.js' ), $dependencies, $version, true );
 		wp_enqueue_style( 'draggable-post-order', draggable_post_order_assets_url( 'index.css' ), [], $version );
+		wp_localize_script(
+			'draggable-post-order',
+			'draggablePostOrder',
+			[
+				'nonce' => wp_create_nonce( self::$nonce ),
+			]
+		);
 	}
 
 	/**
@@ -150,12 +183,12 @@ class Draggable_Post_Order {
 			$meta_sub_query = [
 				'relation'                           => 'OR',
 				'draggable-post-order-clause'        => [
-					'key'  => 'draggable-post-order',
+					'key'  => self::$meta_key,
 					'type' => 'NUMERIC',
 				],
 				// get all posts without the meta as well.
 				'draggable-post-order-exists-clause' => [
-					'key'     => 'draggable-post-order',
+					'key'     => self::$meta_key,
 					'compare' => 'NOT EXISTS',
 				],
 			];