← All changes | includes/class-mxchat-word-handler.php +59 -14 2.0.4 → 3.2.2 View file →

		@@ -14,20 +14,37 @@
14	14
15	15	/**
16	16	* Handle Word document upload and processing
17	17	*/
18		-public function mxchat_handle_word_upload() {
	18	+ public function mxchat_handle_word_upload() {
19	19	check_ajax_referer('mxchat_chat_nonce', 'nonce');
20		-
	20	+
21	21	if (!isset($_FILES['word_file']) || !isset($_POST['session_id'])) {
22	22	wp_send_json_error(esc_html__('Missing required parameters.', 'mxchat'));
23	23	return;
24	24	}
25		-
	25	+
	26	+ // SECURITY FIX: Check if Word uploads are enabled in settings
	27	+ $options = get_option('mxchat_options', array());
	28	+ $show_word_button = isset($options['show_word_upload_button']) ? $options['show_word_upload_button'] : 'on';
	29	+
	30	+ if ($show_word_button !== 'on') {
	31	+ wp_send_json_error(esc_html__('Word document uploads are currently disabled.', 'mxchat'));
	32	+ return;
	33	+ }
	34	+
26	35	$file = $_FILES['word_file'];
27	36	$session_id = sanitize_text_field($_POST['session_id']);
28	37	$original_filename = sanitize_text_field($file['name']);
	38	+
	39	+ // Update session owner if it changed (e.g. IP changed due to network switch)
	40	+ $current_user_identifier = MxChat_User::mxchat_get_user_identifier();
	41	+ $session_owner = get_option("mxchat_session_owner_{$session_id}");
29	42
	43	+ if (!$session_owner || $session_owner !== $current_user_identifier) {
	44	+ update_option("mxchat_session_owner_{$session_id}", $current_user_identifier, 'no');
	45	+ }
	46	+
30	47	// Check file type
31	48	$allowed_types = array(
32	49	'docx' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
33	50	);
		@@ -36,23 +53,24 @@
36	53	if (!$file_type['type']) {
37	54	wp_send_json_error(esc_html__('Invalid file type. Only .docx files are allowed.', 'mxchat'));
38	55	return;
39	56	}
40		-
41		- // Generate unique filename
42		- $word_filename = 'mxchat_word_' . $session_id . '_' . time() . '.docx';
	57	+
	58	+ // SECURITY FIX: Generate random filename without exposing session_id
	59	+ $random_string = wp_generate_password(20, false, false); // 20 char alphanumeric string
	60	+ $word_filename = 'mxchat_word_' . $random_string . '_' . time() . '.docx';
43	61	$word_path = $this->temp_dir . '/' . $word_filename;
44		-
	62	+
45	63	if (!move_uploaded_file($file['tmp_name'], $word_path)) {
46	64	wp_send_json_error(esc_html__('Failed to upload file.', 'mxchat'));
47	65	return;
48	66	}
49		-
	67	+
50	68	$this->mxchat_clear_word_transients($session_id);
51		-
	69	+
52	70	// Process the document
53	71	$embeddings = $this->mxchat_process_word_document($word_path);
54		-
	72	+
55	73	if ($embeddings === false || empty($embeddings)) {
56	74	unlink($word_path);
57	75	$error_message = $this->options['word_intent_error_text'] ??
58	76	esc_html__('The uploaded document appears to be empty or contains unsupported content.', 'mxchat');
		@@ -58,18 +76,18 @@
58	76	esc_html__('The uploaded document appears to be empty or contains unsupported content.', 'mxchat');
59	77	wp_send_json_error($error_message);
60	78	return;
61	79	}
62		-
63		- // Store the embeddings and file information
	80	+
	81	+ // Store the mapping between session and the random filename
64	82	set_transient('mxchat_word_url_' . $session_id, $word_path, HOUR_IN_SECONDS);
65	83	set_transient('mxchat_word_filename_' . $session_id, $original_filename, HOUR_IN_SECONDS);
66	84	set_transient('mxchat_word_embeddings_' . $session_id, $embeddings, HOUR_IN_SECONDS);
67	85	set_transient('mxchat_include_word_in_context_' . $session_id, true, HOUR_IN_SECONDS);
68		-
	86	+
69	87	$success_message = $this->options['pdf_intent_success_text'] ??
70	88	__("I've processed the document. What questions do you have about it?", 'mxchat');
71		-
	89	+
72	90	wp_send_json_success([
73	91	'message' => $success_message,
74	92	'filename' => $original_filename
75	93	]);
		@@ -326,7 +344,34 @@
326	344	}
327	345
328	346	return $dotProduct / ($normA * $normB);
329	347	}
	348	+
	349	+ /**
	350	+ * Check the status of a Word document for the current session
	351	+ */
	352	+public function mxchat_check_word_status() {
	353	+ check_ajax_referer('mxchat_chat_nonce', 'nonce');
	354	+
	355	+ if (empty($_POST['session_id'])) {
	356	+ wp_send_json_error(esc_html__('Session ID missing.', 'mxchat'));
	357	+ return;
	358	+ }
	359	+
	360	+ $session_id = sanitize_text_field($_POST['session_id']);
	361	+ $word_path = get_transient('mxchat_word_url_' . $session_id);
	362	+ $filename = get_transient('mxchat_word_filename_' . $session_id);
	363	+
	364	+ if ($word_path && file_exists($word_path) && $filename) {
	365	+ wp_send_json_success([
	366	+ 'has_word' => true,
	367	+ 'filename' => $filename
	368	+ ]);
	369	+ } else {
	370	+ wp_send_json_success([
	371	+ 'has_word' => false
	372	+ ]);
	373	+ }
	374	+}
330	375
331	376
332	377	}