← All changes | includes/class-mxchat-word-handler.php +14 -37 3.2.11 → 2.4.6 View file →

		@@ -14,42 +14,20 @@
14	14
15	15	/**
16	16	* Handle Word document upload and processing
17	17	*/
18		- public function mxchat_handle_word_upload() {
19		- // Match the PDF handler's nonce verification: the widget sends the chat-send
20		- // nonce (action 'mxchat_chat_send'), which the old check_ajax_referer('mxchat_chat_nonce')
21		- // rejected with -1. mxchat_verify_chat_send_nonce accepts both chat-send and chat nonces.
22		- if (!isset($_POST['nonce']) || !MxChat_Integrator::mxchat_verify_chat_send_nonce(wp_unslash((string) $_POST['nonce']))) {
23		- wp_send_json_error(array('message' => esc_html__('Invalid nonce.', 'mxchat')), 403);
24		- }
	18	+public function mxchat_handle_word_upload() {
	19	+ check_ajax_referer('mxchat_chat_nonce', 'nonce');
25	20
26	21	if (!isset($_FILES['word_file']) || !isset($_POST['session_id'])) {
27	22	wp_send_json_error(esc_html__('Missing required parameters.', 'mxchat'));
28	23	return;
29	24	}
30		-
31		- // SECURITY FIX: Check if Word uploads are enabled in settings
32		- $options = get_option('mxchat_options', array());
33		- $show_word_button = isset($options['show_word_upload_button']) ? $options['show_word_upload_button'] : 'on';
34		-
35		- if ($show_word_button !== 'on') {
36		- wp_send_json_error(esc_html__('Word document uploads are currently disabled.', 'mxchat'));
37		- return;
38		- }
39		-
	25	+
40	26	$file = $_FILES['word_file'];
41	27	$session_id = sanitize_text_field($_POST['session_id']);
42	28	$original_filename = sanitize_text_field($file['name']);
43		-
44		- // Update session owner if it changed (e.g. IP changed due to network switch)
45		- $current_user_identifier = MxChat_User::mxchat_get_user_identifier();
46		- $session_owner = get_option("mxchat_session_owner_{$session_id}");
47	29
48		- if (!$session_owner || $session_owner !== $current_user_identifier) {
49		- update_option("mxchat_session_owner_{$session_id}", $current_user_identifier, 'no');
50		- }
51		-
52	30	// Check file type
53	31	$allowed_types = array(
54	32	'docx' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
55	33	);
		@@ -58,24 +36,23 @@
58	36	if (!$file_type['type']) {
59	37	wp_send_json_error(esc_html__('Invalid file type. Only .docx files are allowed.', 'mxchat'));
60	38	return;
61	39	}
62		-
63		- // SECURITY FIX: Generate random filename without exposing session_id
64		- $random_string = wp_generate_password(20, false, false); // 20 char alphanumeric string
65		- $word_filename = 'mxchat_word_' . $random_string . '_' . time() . '.docx';
	40	+
	41	+ // Generate unique filename
	42	+ $word_filename = 'mxchat_word_' . $session_id . '_' . time() . '.docx';
66	43	$word_path = $this->temp_dir . '/' . $word_filename;
67		-
	44	+
68	45	if (!move_uploaded_file($file['tmp_name'], $word_path)) {
69	46	wp_send_json_error(esc_html__('Failed to upload file.', 'mxchat'));
70	47	return;
71	48	}
72		-
	49	+
73	50	$this->mxchat_clear_word_transients($session_id);
74		-
	51	+
75	52	// Process the document
76	53	$embeddings = $this->mxchat_process_word_document($word_path);
77		-
	54	+
78	55	if ($embeddings === false || empty($embeddings)) {
79	56	unlink($word_path);
80	57	$error_message = $this->options['word_intent_error_text'] ??
81	58	esc_html__('The uploaded document appears to be empty or contains unsupported content.', 'mxchat');
		@@ -81,18 +58,18 @@
81	58	esc_html__('The uploaded document appears to be empty or contains unsupported content.', 'mxchat');
82	59	wp_send_json_error($error_message);
83	60	return;
84	61	}
85		-
86		- // Store the mapping between session and the random filename
	62	+
	63	+ // Store the embeddings and file information
87	64	set_transient('mxchat_word_url_' . $session_id, $word_path, HOUR_IN_SECONDS);
88	65	set_transient('mxchat_word_filename_' . $session_id, $original_filename, HOUR_IN_SECONDS);
89	66	set_transient('mxchat_word_embeddings_' . $session_id, $embeddings, HOUR_IN_SECONDS);
90	67	set_transient('mxchat_include_word_in_context_' . $session_id, true, HOUR_IN_SECONDS);
91		-
	68	+
92	69	$success_message = $this->options['pdf_intent_success_text'] ??
93	70	__("I've processed the document. What questions do you have about it?", 'mxchat');
94		-
	71	+
95	72	wp_send_json_success([
96	73	'message' => $success_message,
97	74	'filename' => $original_filename
98	75	]);