← All changes | back/Controllers/ZonesController.php +14 -7 10.2.2 → 11.1.0 View file →

		@@ -10,9 +10,9 @@
10	10	private const ZONE_IMAGE_FOLDER = ACYM_UPLOAD_FOLDER.'zones'.DS;
11	11
12	12	public function save(): void
13	13	{
14		- acym_checkToken();
	14	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
15	15
16	16	$zone = new \stdClass();
17	17	$zone->name = acym_getVar('string', 'name');
18	18	$zone->content = acym_getVar('string', 'content', '', 'default', ACYM_ALLOWRAW);
		@@ -31,15 +31,22 @@
31	31	$zone->id = $zoneClass->save($zone);
32	32
33	33	$dataResponse = ['id' => $zone->id];
34	34
35		- if (!empty($_FILES['image']['name'])) {
36		- $extension = pathinfo($_FILES['image']['name']);
	35	+ $image = acym_getVar('array', 'image', [], 'FILES');
	36	+ if (!empty($image['name'])) {
	37	+ $extension = pathinfo($image['name']);
37	38	$newPath = self::ZONE_IMAGE_FOLDER.$zone->id.'.'.$extension['extension'];
38	39
39		- if (in_array($extension['extension'], acym_getImageFileExtensions()) && acym_uploadFile($_FILES['image']['tmp_name'], ACYM_ROOT.$newPath)) {
	40	+ if (in_array($extension['extension'], acym_getImageFileExtensions(true)) && acym_uploadFile($image['tmp_name'], ACYM_ROOT.$newPath)) {
	41	+ if (strtolower($extension['extension']) === 'svg' && !acym_isSvgFileSafe(ACYM_ROOT.$newPath)) {
	42	+ acym_deleteFile(ACYM_ROOT.$newPath);
	43	+ acym_sendAjaxResponse(acym_translation('ACYM_FAILED_CUSTOM_ZONE_SAVE'), [], false);
	44	+ }
	45	+
40	46	$zone->image = $newPath;
41		- if ($zoneClass->save($zone)) {
	47	+ $savedZoneId = $zoneClass->save($zone);
	48	+ if (!empty($savedZoneId)) {
42	49	$dataResponse['image'] = acym_rootURI().$newPath;
43	50	}
44	51	}
45	52	}
		@@ -48,9 +55,9 @@
48	55	}
49	56
50	57	private function getZoneData(): array
51	58	{
52		- acym_checkToken();
	59	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
53	60	$zoneId = acym_getVar('int', 'zoneId', 0);
54	61	if (empty($zoneId)) {
55	62	acym_sendAjaxResponse(acym_translation('ACYM_FAILED_CUSTOM_ZONE_FIND'), [], false);
56	63	}
		@@ -77,9 +84,9 @@
77	84
78	85	public function delete(): void
79	86	{
80	87	$zoneData = $this->getZoneData();
81		- $zoneData['zoneClass']->delete($zoneData['zoneId']);
	88	+ $zoneData['zoneClass']->delete([$zoneData['zoneId']]);
82	89
83	90	acym_sendAjaxResponse();
84	91	}
85	92	}