← All changes | includes/class-mxchat-word-handler.php +14 -32 3.2.3 → 2.4.6 View file →

		@@ -14,37 +14,20 @@
14	14
15	15	/**
16	16	* Handle Word document upload and processing
17	17	*/
18		- public function mxchat_handle_word_upload() {
	18	+public function mxchat_handle_word_upload() {
19	19	check_ajax_referer('mxchat_chat_nonce', 'nonce');
20		-
	20	+
21	21	if (!isset($_FILES['word_file']) || !isset($_POST['session_id'])) {
22	22	wp_send_json_error(esc_html__('Missing required parameters.', 'mxchat'));
23	23	return;
24	24	}
25		-
26		- // SECURITY FIX: Check if Word uploads are enabled in settings
27		- $options = get_option('mxchat_options', array());
28		- $show_word_button = isset($options['show_word_upload_button']) ? $options['show_word_upload_button'] : 'on';
29		-
30		- if ($show_word_button !== 'on') {
31		- wp_send_json_error(esc_html__('Word document uploads are currently disabled.', 'mxchat'));
32		- return;
33		- }
34		-
	25	+
35	26	$file = $_FILES['word_file'];
36	27	$session_id = sanitize_text_field($_POST['session_id']);
37	28	$original_filename = sanitize_text_field($file['name']);
38		-
39		- // Update session owner if it changed (e.g. IP changed due to network switch)
40		- $current_user_identifier = MxChat_User::mxchat_get_user_identifier();
41		- $session_owner = get_option("mxchat_session_owner_{$session_id}");
42	29
43		- if (!$session_owner || $session_owner !== $current_user_identifier) {
44		- update_option("mxchat_session_owner_{$session_id}", $current_user_identifier, 'no');
45		- }
46		-
47	30	// Check file type
48	31	$allowed_types = array(
49	32	'docx' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
50	33	);
		@@ -53,24 +36,23 @@
53	36	if (!$file_type['type']) {
54	37	wp_send_json_error(esc_html__('Invalid file type. Only .docx files are allowed.', 'mxchat'));
55	38	return;
56	39	}
57		-
58		- // SECURITY FIX: Generate random filename without exposing session_id
59		- $random_string = wp_generate_password(20, false, false); // 20 char alphanumeric string
60		- $word_filename = 'mxchat_word_' . $random_string . '_' . time() . '.docx';
	40	+
	41	+ // Generate unique filename
	42	+ $word_filename = 'mxchat_word_' . $session_id . '_' . time() . '.docx';
61	43	$word_path = $this->temp_dir . '/' . $word_filename;
62		-
	44	+
63	45	if (!move_uploaded_file($file['tmp_name'], $word_path)) {
64	46	wp_send_json_error(esc_html__('Failed to upload file.', 'mxchat'));
65	47	return;
66	48	}
67		-
	49	+
68	50	$this->mxchat_clear_word_transients($session_id);
69		-
	51	+
70	52	// Process the document
71	53	$embeddings = $this->mxchat_process_word_document($word_path);
72		-
	54	+
73	55	if ($embeddings === false || empty($embeddings)) {
74	56	unlink($word_path);
75	57	$error_message = $this->options['word_intent_error_text'] ??
76	58	esc_html__('The uploaded document appears to be empty or contains unsupported content.', 'mxchat');
		@@ -76,18 +58,18 @@
76	58	esc_html__('The uploaded document appears to be empty or contains unsupported content.', 'mxchat');
77	59	wp_send_json_error($error_message);
78	60	return;
79	61	}
80		-
81		- // Store the mapping between session and the random filename
	62	+
	63	+ // Store the embeddings and file information
82	64	set_transient('mxchat_word_url_' . $session_id, $word_path, HOUR_IN_SECONDS);
83	65	set_transient('mxchat_word_filename_' . $session_id, $original_filename, HOUR_IN_SECONDS);
84	66	set_transient('mxchat_word_embeddings_' . $session_id, $embeddings, HOUR_IN_SECONDS);
85	67	set_transient('mxchat_include_word_in_context_' . $session_id, true, HOUR_IN_SECONDS);
86		-
	68	+
87	69	$success_message = $this->options['pdf_intent_success_text'] ??
88	70	__("I've processed the document. What questions do you have about it?", 'mxchat');
89		-
	71	+
90	72	wp_send_json_success([
91	73	'message' => $success_message,
92	74	'filename' => $original_filename
93	75	]);