← All changes | includes/class-mxchat-word-handler.php +25 -70 3.2.6 → 1.5.7 View file →

		@@ -16,35 +16,18 @@
16	16	* Handle Word document upload and processing
17	17	*/
18	18	public function mxchat_handle_word_upload() {
19	19	check_ajax_referer('mxchat_chat_nonce', 'nonce');
20		-
	20	+
21	21	if (!isset($_FILES['word_file']) || !isset($_POST['session_id'])) {
22		- wp_send_json_error(esc_html__('Missing required parameters.', 'mxchat'));
	22	+ wp_send_json_error('Missing required parameters.');
23	23	return;
24	24	}
25		-
26		- // SECURITY FIX: Check if Word uploads are enabled in settings
27		- $options = get_option('mxchat_options', array());
28		- $show_word_button = isset($options['show_word_upload_button']) ? $options['show_word_upload_button'] : 'on';
29		-
30		- if ($show_word_button !== 'on') {
31		- wp_send_json_error(esc_html__('Word document uploads are currently disabled.', 'mxchat'));
32		- return;
33		- }
34		-
	25	+
35	26	$file = $_FILES['word_file'];
36	27	$session_id = sanitize_text_field($_POST['session_id']);
37	28	$original_filename = sanitize_text_field($file['name']);
38		-
39		- // Update session owner if it changed (e.g. IP changed due to network switch)
40		- $current_user_identifier = MxChat_User::mxchat_get_user_identifier();
41		- $session_owner = get_option("mxchat_session_owner_{$session_id}");
42	29
43		- if (!$session_owner || $session_owner !== $current_user_identifier) {
44		- update_option("mxchat_session_owner_{$session_id}", $current_user_identifier, 'no');
45		- }
46		-
47	30	// Check file type
48	31	$allowed_types = array(
49	32	'docx' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
50	33	);
		@@ -50,44 +33,43 @@
50	33	);
51	34	$file_type = wp_check_filetype($file['name'], $allowed_types);
52	35
53	36	if (!$file_type['type']) {
54		- wp_send_json_error(esc_html__('Invalid file type. Only .docx files are allowed.', 'mxchat'));
	37	+ wp_send_json_error('Invalid file type. Only .docx files are allowed.');
55	38	return;
56	39	}
57		-
58		- // SECURITY FIX: Generate random filename without exposing session_id
59		- $random_string = wp_generate_password(20, false, false); // 20 char alphanumeric string
60		- $word_filename = 'mxchat_word_' . $random_string . '_' . time() . '.docx';
	40	+
	41	+ // Generate unique filename
	42	+ $word_filename = 'mxchat_word_' . $session_id . '_' . time() . '.docx';
61	43	$word_path = $this->temp_dir . '/' . $word_filename;
62		-
	44	+
63	45	if (!move_uploaded_file($file['tmp_name'], $word_path)) {
64		- wp_send_json_error(esc_html__('Failed to upload file.', 'mxchat'));
	46	+ wp_send_json_error('Failed to upload file.');
65	47	return;
66	48	}
67		-
	49	+
68	50	$this->mxchat_clear_word_transients($session_id);
69		-
	51	+
70	52	// Process the document
71	53	$embeddings = $this->mxchat_process_word_document($word_path);
72		-
	54	+
73	55	if ($embeddings === false || empty($embeddings)) {
74	56	unlink($word_path);
75	57	$error_message = $this->options['word_intent_error_text'] ??
76		- esc_html__('The uploaded document appears to be empty or contains unsupported content.', 'mxchat');
	58	+ 'The uploaded document appears to be empty or contains unsupported content.';
77	59	wp_send_json_error($error_message);
78	60	return;
79	61	}
80		-
81		- // Store the mapping between session and the random filename
	62	+
	63	+ // Store the embeddings and file information
82	64	set_transient('mxchat_word_url_' . $session_id, $word_path, HOUR_IN_SECONDS);
83	65	set_transient('mxchat_word_filename_' . $session_id, $original_filename, HOUR_IN_SECONDS);
84	66	set_transient('mxchat_word_embeddings_' . $session_id, $embeddings, HOUR_IN_SECONDS);
85	67	set_transient('mxchat_include_word_in_context_' . $session_id, true, HOUR_IN_SECONDS);
86		-
	68	+
87	69	$success_message = $this->options['pdf_intent_success_text'] ??
88		- __("I've processed the document. What questions do you have about it?", 'mxchat');
89		-
	70	+ "I've processed the document. What questions do you have about it?";
	71	+
90	72	wp_send_json_success([
91	73	'message' => $success_message,
92	74	'filename' => $original_filename
93	75	]);
		@@ -121,9 +103,9 @@
121	103	$paragraphs = explode("\n\n", $text);
122	104	$estimated_pages = ceil(count($paragraphs) / 3); // Assume ~3 paragraphs per page
123	105
124	106	if ($estimated_pages > $max_pages) {
125		- return esc_html__('too_many_pages', 'mxchat');
	107	+ return 'too_many_pages';
126	108	}
127	109
128	110	// Split into chunks and continue processing...
129	111	$chunks = $this->mxchat_split_word_into_chunks($text, 1000);
		@@ -134,9 +116,9 @@
134	116	continue;
135	117	}
136	118
137	119	$embedding = $this->mxchat_generate_embedding_word(
138		- esc_html__('Chunk ', 'mxchat') . ($chunk_number + 1) . ': ' . $chunk,
	120	+ "Chunk " . ($chunk_number + 1) . ": " . $chunk,
139	121	$this->options['api_key']
140	122	);
141	123
142	124	if ($embedding) {
		@@ -203,13 +185,13 @@
203	185
204	186	/**
205	187	* Remove Word document and clean up transients
206	188	*/
207		-public function mxchat_handle_word_remove() {
	189	+ public function mxchat_handle_word_remove() {
208	190	check_ajax_referer('mxchat_chat_nonce', 'nonce');
209	191
210	192	if (empty($_POST['session_id'])) {
211		- wp_send_json_error(esc_html__('Session ID missing.', 'mxchat'));
	193	+ wp_send_json_error('Session ID missing.');
212	194	return;
213	195	}
214	196
215	197	$session_id = sanitize_text_field($_POST['session_id']);
		@@ -221,9 +203,9 @@
221	203
222	204	$this->mxchat_clear_word_transients($session_id);
223	205
224	206	wp_send_json_success([
225		- 'message' => esc_html__('Document removed successfully.', 'mxchat')
	207	+ 'message' => 'Document removed successfully.'
226	208	]);
227	209	}
228	210
229	211	/**
		@@ -267,9 +249,9 @@
267	249
268	250	/**
269	251	* Handle Word document discussion similar to PDF discussion
270	252	*/
271		-public function mxchat_handle_word_discussion($message, $user_id, $session_id) {
	253	+ public function mxchat_handle_word_discussion($message, $user_id, $session_id) {
272	254	// Get stored embeddings for the session
273	255	$embeddings = get_transient('mxchat_word_embeddings_' . $session_id);
274	256	$word_path = get_transient('mxchat_word_url_' . $session_id);
275	257
		@@ -274,9 +256,9 @@
274	256	$word_path = get_transient('mxchat_word_url_' . $session_id);
275	257
276	258	if (!$embeddings || !$word_path) {
277	259	$trigger_text = $this->options['word_intent_trigger_text'] ??
278		- __("Please upload a Word document (.docx) that you'd like to discuss.", 'mxchat');
	260	+ "Please upload a Word document (.docx) that you'd like to discuss.";
279	261	set_transient('mxchat_waiting_for_word_' . $session_id, true, HOUR_IN_SECONDS);
280	262	$this->fallbackResponse['text'] = $trigger_text;
281	263	return;
282	264	}
		@@ -344,34 +326,7 @@
344	326	}
345	327
346	328	return $dotProduct / ($normA * $normB);
347	329	}
348		-
349		- /**
350		- * Check the status of a Word document for the current session
351		- */
352		-public function mxchat_check_word_status() {
353		- check_ajax_referer('mxchat_chat_nonce', 'nonce');
354		-
355		- if (empty($_POST['session_id'])) {
356		- wp_send_json_error(esc_html__('Session ID missing.', 'mxchat'));
357		- return;
358		- }
359		-
360		- $session_id = sanitize_text_field($_POST['session_id']);
361		- $word_path = get_transient('mxchat_word_url_' . $session_id);
362		- $filename = get_transient('mxchat_word_filename_' . $session_id);
363		-
364		- if ($word_path && file_exists($word_path) && $filename) {
365		- wp_send_json_success([
366		- 'has_word' => true,
367		- 'filename' => $filename
368		- ]);
369		- } else {
370		- wp_send_json_success([
371		- 'has_word' => false
372		- ]);
373		- }
374		-}
375	330
376	331
377	332	}