← All changes | back/Controllers/ZonesController.php +11 -5 10.11.1 → 11.1.0 View file →

		@@ -10,9 +10,9 @@
10	10	private const ZONE_IMAGE_FOLDER = ACYM_UPLOAD_FOLDER.'zones'.DS;
11	11
12	12	public function save(): void
13	13	{
14		- acym_checkToken();
	14	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
15	15
16	16	$zone = new \stdClass();
17	17	$zone->name = acym_getVar('string', 'name');
18	18	$zone->content = acym_getVar('string', 'content', '', 'default', ACYM_ALLOWRAW);
		@@ -31,13 +31,19 @@
31	31	$zone->id = $zoneClass->save($zone);
32	32
33	33	$dataResponse = ['id' => $zone->id];
34	34
35		- if (!empty($_FILES['image']['name'])) {
36		- $extension = pathinfo($_FILES['image']['name']);
	35	+ $image = acym_getVar('array', 'image', [], 'FILES');
	36	+ if (!empty($image['name'])) {
	37	+ $extension = pathinfo($image['name']);
37	38	$newPath = self::ZONE_IMAGE_FOLDER.$zone->id.'.'.$extension['extension'];
38	39
39		- if (in_array($extension['extension'], acym_getImageFileExtensions()) && acym_uploadFile($_FILES['image']['tmp_name'], ACYM_ROOT.$newPath)) {
	40	+ if (in_array($extension['extension'], acym_getImageFileExtensions(true)) && acym_uploadFile($image['tmp_name'], ACYM_ROOT.$newPath)) {
	41	+ if (strtolower($extension['extension']) === 'svg' && !acym_isSvgFileSafe(ACYM_ROOT.$newPath)) {
	42	+ acym_deleteFile(ACYM_ROOT.$newPath);
	43	+ acym_sendAjaxResponse(acym_translation('ACYM_FAILED_CUSTOM_ZONE_SAVE'), [], false);
	44	+ }
	45	+
40	46	$zone->image = $newPath;
41	47	$savedZoneId = $zoneClass->save($zone);
42	48	if (!empty($savedZoneId)) {
43	49	$dataResponse['image'] = acym_rootURI().$newPath;
		@@ -49,9 +55,9 @@
49	55	}
50	56
51	57	private function getZoneData(): array
52	58	{
53		- acym_checkToken();
	59	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
54	60	$zoneId = acym_getVar('int', 'zoneId', 0);
55	61	if (empty($zoneId)) {
56	62	acym_sendAjaxResponse(acym_translation('ACYM_FAILED_CUSTOM_ZONE_FIND'), [], false);
57	63	}