• Resolved openedsauce

    (@openedsauce)


    Description:

    The Load More button on the Post Grid widget returns {"success":false,"data":"Invalid template"} on Linux servers due to two bugs in Ajax_Handler.php:

    Bug 1 — Missing dir segment in template path

    In ajax_load_more(), the file path is built as:

    Template/{name}/{file_name}

    But template_info contains a dir value (lite, pro, or theme) that is never included in the path. It should be:

    Template/{name}/{dir}/{file_name}

    Bug 2 — Case mismatch from sanitize_file_name

    eael_sanitize_template_param() runs sanitize_file_name() on template_info, which lowercases the name value from Post-Grid to post-grid. On Linux, realpath() then fails because the actual folder is named Post-Grid (capital P, capital G). Either the folder should be lowercase, or sanitize_file_name should not be applied to the name key.

    Fix:

    In ajax_load_more(), change the path sprintf from:

    php

    '%s/Template/%s/%s'
    $dir_path, $template_info['name'], $template_info['file_name']

    To:

    php

    '%s/Template/%s/%s/%s'
    $dir_path, $template_info['name'], $template_info['dir'], $template_info['file_name']

    And either rename the Post-Grid folder to post-grid, or exclude the name key from sanitize_file_name in eael_sanitize_template_param().

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support Amit Paul

    (@paulamit)

    Hi @openedsauce,

    Greetings! We’re reviewing your concerns with our team now. We’ll get back to you with the update soon.

    Thank you!

    Thread Starter openedsauce

    (@openedsauce)

    Okay thanks 👍

    Plugin Support Amit Paul

    (@paulamit)

    Hi @openedsauce,

    Thank you again for the detailed investigation and feedback.

    After reviewing this with our developers, we found that Bug 1 is not actually needed in this case. The dir value is only used to determine the base path and is not intended to be a subfolder. The templates are correctly located directly under paths like Template/Post-Grid/default.php, so adding the extra directory level would break the Load More functionality globally.

    Regarding the second point, sanitize_file_name() normally does not convert uppercase letters to lowercase in WordPress core. Because of that, it’s possible that another plugin or custom code on the site is modifying this behavior through a filter.

    We truly appreciate the time and effort you put into sharing these findings with us.

    Best wishes,

Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.