← All changes | includes/extensions/Image_Optimizer/Image_Optimizer_Ajax.php +94 -1 51.1.79 → 51.1.83 View file →

		@@ -114,8 +114,12 @@
114	114	if (!$attachment_id || !wp_attachment_is_image($attachment_id)) {
115	115	wp_send_json_error(['message' => 'Invalid attachment'], 400);
116	116	}
117	117
	118	+ if (!$this->require_attachment_edit($attachment_id)) {
	119	+ return;
	120	+ }
	121	+
118	122	$optimizer = Image_Optimizer::instance();
119	123	$html = $optimizer->get_attachment_optimizer_card_html($attachment_id);
120	124
121	125	wp_send_json_success([
		@@ -141,8 +145,50 @@
141	145	return true;
142	146	}
143	147
144	148	/**
	149	+ * Whether the current user may change this attachment.
	150	+ */
	151	+ private function user_can_edit_attachment(int $attachment_id): bool
	152	+ {
	153	+ return $attachment_id > 0
	154	+ && get_post_type($attachment_id) === 'attachment'
	155	+ && current_user_can('edit_post', $attachment_id);
	156	+ }
	157	+
	158	+ /**
	159	+ * Reject the request unless the user can edit this attachment.
	160	+ */
	161	+ private function require_attachment_edit(int $attachment_id): bool
	162	+ {
	163	+ if (!$this->user_can_edit_attachment($attachment_id)) {
	164	+ wp_send_json_error(['message' => __('Permission denied.', 'king-addons')]);
	165	+ return false;
	166	+ }
	167	+
	168	+ return true;
	169	+ }
	170	+
	171	+ /**
	172	+ * Drop attachment IDs the current user cannot edit.
	173	+ *
	174	+ * @param array<int|string> $ids
	175	+ * @return array<int>
	176	+ */
	177	+ private function filter_editable_attachment_ids(array $ids): array
	178	+ {
	179	+ $out = [];
	180	+ foreach ($ids as $id) {
	181	+ $id = absint($id);
	182	+ if ($id && $this->user_can_edit_attachment($id)) {
	183	+ $out[] = $id;
	184	+ }
	185	+ }
	186	+
	187	+ return array_values(array_unique($out));
	188	+ }
	189	+
	190	+ /**
145	191	* Get image data for optimization.
146	192	*/
147	193	public function get_image_data(): void
148	194	{
		@@ -157,8 +203,12 @@
157	203	wp_send_json_error(['message' => __('Invalid attachment ID.', 'king-addons')]);
158	204	return;
159	205	}
160	206
	207	+ if (!$this->require_attachment_edit($attachment_id)) {
	208	+ return;
	209	+ }
	210	+
161	211	$file = get_attached_file($attachment_id);
162	212	if (!$file || !file_exists($file)) {
163	213	wp_send_json_error(['message' => __('File not found.', 'king-addons')]);
164	214	return;
		@@ -232,8 +282,12 @@
232	282	wp_send_json_error(['message' => __('Invalid attachment ID.', 'king-addons')]);
233	283	return;
234	284	}
235	285
	286	+ if (!$this->require_attachment_edit($attachment_id)) {
	287	+ return;
	288	+ }
	289	+
236	290	if (empty($image_data)) {
237	291	wp_send_json_error(['message' => __('No image data provided.', 'king-addons')]);
238	292	return;
239	293	}
		@@ -399,8 +453,12 @@
399	453	wp_send_json_error(['message' => __('Invalid attachment ID.', 'king-addons')]);
400	454	return;
401	455	}
402	456
	457	+ if (!$this->require_attachment_edit($attachment_id)) {
	458	+ return;
	459	+ }
	460	+
403	461	$meta = Image_Optimizer_DB::get_optimization_meta($attachment_id) ?: [];
404	462	$meta['status'] = 'skipped';
405	463	$meta['skipped_reason'] = $reason ?: 'skipped';
406	464	$meta['skipped_at'] = current_time('mysql');
		@@ -432,8 +490,12 @@
432	490	wp_send_json_error(['message' => __('Invalid attachment ID.', 'king-addons')]);
433	491	return;
434	492	}
435	493
	494	+ if (!$this->require_attachment_edit($attachment_id)) {
	495	+ return;
	496	+ }
	497	+
436	498	$meta = Image_Optimizer_DB::get_optimization_meta($attachment_id) ?: [];
437	499	$meta['status'] = 'failed';
438	500	$meta['failed_reason'] = $reason ?: 'failed';
439	501	$meta['failed_at'] = current_time('mysql');
		@@ -472,8 +534,9 @@
472	534	)
473	535	);
474	536
475	537	$ids = array_values(array_unique(array_map('absint', $ids)));
	538	+ $ids = $this->filter_editable_attachment_ids($ids);
476	539
477	540	wp_send_json_success([
478	541	'ids' => $ids,
479	542	'total' => count($ids),
		@@ -510,8 +573,13 @@
510	573	$skipped++;
511	574	continue;
512	575	}
513	576
	577	+ if (!$this->user_can_edit_attachment($attachment_id)) {
	578	+ $skipped++;
	579	+ continue;
	580	+ }
	581	+
514	582	$meta = Image_Optimizer_DB::get_optimization_meta($attachment_id);
515	583	if (empty($meta) || ($meta['status'] ?? '') !== 'optimized') {
516	584	$skipped++;
517	585	continue;
		@@ -553,8 +621,12 @@
553	621	wp_send_json_error(['message' => __('Invalid attachment ID.', 'king-addons')]);
554	622	return;
555	623	}
556	624
	625	+ if (!$this->require_attachment_edit($attachment_id)) {
	626	+ return;
	627	+ }
	628	+
557	629	$meta = Image_Optimizer_DB::get_optimization_meta($attachment_id);
558	630
559	631	if (empty($meta) || $meta['status'] !== 'optimized') {
560	632	wp_send_json_error(['message' => __('Image not optimized yet.', 'king-addons')]);
		@@ -585,8 +657,12 @@
585	657	wp_send_json_error(['message' => __('Invalid attachment ID.', 'king-addons')]);
586	658	return;
587	659	}
588	660
	661	+ if (!$this->require_attachment_edit($attachment_id)) {
	662	+ return;
	663	+ }
	664	+
589	665	$updated = Image_Optimizer_DB::revert_to_original_urls($attachment_id);
590	666
591	667	wp_send_json_success([
592	668	'attachment_id' => $attachment_id,
		@@ -621,8 +697,12 @@
621	697	'orderby' => 'date',
622	698	'order' => 'DESC',
623	699	];
624	700
	701	+ if (!current_user_can('edit_others_posts')) {
	702	+ $args['author'] = get_current_user_id();
	703	+ }
	704	+
625	705	// Format filter
626	706	if (!empty($format_filter)) {
627	707	$mime_types = [];
628	708	foreach ($format_filter as $fmt) {
		@@ -668,8 +748,11 @@
668	748	$query = new \WP_Query($args);
669	749	$images = [];
670	750
671	751	foreach ($query->posts as $post) {
	752	+ if (!$this->user_can_edit_attachment((int) $post->ID)) {
	753	+ continue;
	754	+ }
672	755	$file = get_attached_file($post->ID);
673	756	$metadata = wp_get_attachment_metadata($post->ID);
674	757	$opt_meta = Image_Optimizer_DB::get_optimization_meta($post->ID);
675	758
		@@ -804,8 +887,12 @@
804	887	wp_send_json_error(['message' => __('Invalid attachment ID.', 'king-addons')]);
805	888	return;
806	889	}
807	890
	891	+ if (!$this->require_attachment_edit($attachment_id)) {
	892	+ return;
	893	+ }
	894	+
808	895	// First revert URLs
809	896	Image_Optimizer_DB::revert_to_original_urls($attachment_id);
810	897
811	898	// Get meta and delete optimized files
		@@ -916,10 +1003,12 @@
916	1003	'_king_img_optimized'
917	1004	)
918	1005	);
919	1006
	1007	+ $ids = $this->filter_editable_attachment_ids(array_map('absint', $ids));
	1008	+
920	1009	wp_send_json_success([
921		- 'ids' => array_map('absint', $ids),
	1010	+ 'ids' => $ids,
922	1011	'total' => count($ids),
923	1012	]);
924	1013	}
925	1014
		@@ -935,8 +1024,12 @@
935	1024	$attachment_id = absint($_POST['attachment_id'] ?? 0);
936	1025
937	1026	if (!$attachment_id) {
938	1027	wp_send_json_error(['message' => __('Invalid attachment ID.', 'king-addons')]);
	1028	+ return;
	1029	+ }
	1030	+
	1031	+ if (!$this->require_attachment_edit($attachment_id)) {
939	1032	return;
940	1033	}
941	1034
942	1035	// Revert URLs in database