← All changes | back/Controllers/ZonesController.php +19 -12 10.0.1 → 11.1.0 View file →

		@@ -6,13 +6,13 @@
6	6	use AcyMailing\Classes\ZoneClass;
7	7
8	8	class ZonesController extends AcymController
9	9	{
10		- const ZONE_IMAGE_FOLDER = ACYM_UPLOAD_FOLDER.'zones'.DS;
	10	+ private const ZONE_IMAGE_FOLDER = ACYM_UPLOAD_FOLDER.'zones'.DS;
11	11
12		- public function save()
	12	+ public function save(): void
13	13	{
14		- acym_checkToken();
	14	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
15	15
16	16	$zone = new \stdClass();
17	17	$zone->name = acym_getVar('string', 'name');
18	18	$zone->content = acym_getVar('string', 'content', '', 'default', ACYM_ALLOWRAW);
		@@ -31,15 +31,22 @@
31	31	$zone->id = $zoneClass->save($zone);
32	32
33	33	$dataResponse = ['id' => $zone->id];
34	34
35		- if (!empty($_FILES['image']['name'])) {
36		- $extension = pathinfo($_FILES['image']['name']);
	35	+ $image = acym_getVar('array', 'image', [], 'FILES');
	36	+ if (!empty($image['name'])) {
	37	+ $extension = pathinfo($image['name']);
37	38	$newPath = self::ZONE_IMAGE_FOLDER.$zone->id.'.'.$extension['extension'];
38	39
39		- if (in_array($extension['extension'], acym_getImageFileExtensions()) && acym_uploadFile($_FILES['image']['tmp_name'], ACYM_ROOT.$newPath)) {
	40	+ if (in_array($extension['extension'], acym_getImageFileExtensions(true)) && acym_uploadFile($image['tmp_name'], ACYM_ROOT.$newPath)) {
	41	+ if (strtolower($extension['extension']) === 'svg' && !acym_isSvgFileSafe(ACYM_ROOT.$newPath)) {
	42	+ acym_deleteFile(ACYM_ROOT.$newPath);
	43	+ acym_sendAjaxResponse(acym_translation('ACYM_FAILED_CUSTOM_ZONE_SAVE'), [], false);
	44	+ }
	45	+
40	46	$zone->image = $newPath;
41		- if ($zoneClass->save($zone)) {
	47	+ $savedZoneId = $zoneClass->save($zone);
	48	+ if (!empty($savedZoneId)) {
42	49	$dataResponse['image'] = acym_rootURI().$newPath;
43	50	}
44	51	}
45	52	}
		@@ -46,11 +53,11 @@
46	53
47	54	acym_sendAjaxResponse('', $dataResponse);
48	55	}
49	56
50		- private function getZoneData()
	57	+ private function getZoneData(): array
51	58	{
52		- acym_checkToken();
	59	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
53	60	$zoneId = acym_getVar('int', 'zoneId', 0);
54	61	if (empty($zoneId)) {
55	62	acym_sendAjaxResponse(acym_translation('ACYM_FAILED_CUSTOM_ZONE_FIND'), [], false);
56	63	}
		@@ -67,9 +74,9 @@
67	74	'zone' => $zone,
68	75	];
69	76	}
70	77
71		- public function getForInsertion()
	78	+ public function getForInsertion(): void
72	79	{
73	80	$zoneData = $this->getZoneData();
74	81
75	82	acym_sendAjaxResponse('', ['content' => $zoneData['zone']->content]);
		@@ -74,12 +81,12 @@
74	81
75	82	acym_sendAjaxResponse('', ['content' => $zoneData['zone']->content]);
76	83	}
77	84
78		- public function delete()
	85	+ public function delete(): void
79	86	{
80	87	$zoneData = $this->getZoneData();
81		- $zoneData['zoneClass']->delete($zoneData['zoneId']);
	88	+ $zoneData['zoneClass']->delete([$zoneData['zoneId']]);
82	89
83	90	acym_sendAjaxResponse();
84	91	}
85	92	}