supportcandy / includes / rest-api / class-wpsc-rest-attachment.php

class-wpsc-rest-attachment.php in SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.4.1, at includes/rest-api/class-wpsc-rest-attachment.php

258 lines 8.1 KB

Raw Download Zip

1	<?php
2	if ( ! defined( 'ABSPATH' ) ) {
3	exit; // Exit if accessed directly!
4	}
5
6	if ( ! class_exists( 'WPSC_REST_Attachment' ) ) :
7
8	final class WPSC_REST_Attachment {
9
10	/**
11	* Initialize this class
12	*
13	* @return void
14	*/
15	public static function init() {
16
17	add_action( 'init', array( __CLASS__, 'check_download_file' ), 99 );
18	add_action( 'wpsc_rest_register_routes', array( __CLASS__, 'register_routes' ) );
19	}
20
21	/**
22	* Register routes
23	*
24	* @return void
25	*/
26	public static function register_routes() {
27
28	// list statuses.
29	register_rest_route(
30	'supportcandy/v2',
31	'/attachments',
32	array(
33	'methods' => 'POST',
34	'callback' => array( __CLASS__, 'new_attachment' ),
35	'permission_callback' => 'is_user_logged_in',
36	),
37	);
38
39	// list individual status.
40	register_rest_route(
41	'supportcandy/v2',
42	'/attachments/(?P<id>\d+)',
43	array(
44	'methods' => 'GET',
45	'callback' => array( __CLASS__, 'get_individual_attachment' ),
46	'args' => array(
47	'id' => array(
48	'validate_callback' => array( __CLASS__, 'validate_id' ),
49	),
50	),
51	'permission_callback' => 'is_user_logged_in',
52	),
53	);
54	}
55
56	/**
57	* Create new attachment
58	*
59	* @param WP_REST_Request $request - request object.
60	* @return WP_Error\|WP_REST_Response
61	*/
62	public static function new_attachment( $request ) {
63
64	$file_parameters = $request->get_file_params();
65	if ( ! isset( $file_parameters['file'] ) ) {
66	return new WP_Error( 'rest_missing_callback_param', 'Missing parameter(s): file', array( 'status' => 400 ) );
67	}
68
69	$file = $file_parameters['file'];
70	$file_settings = get_option( 'wpsc-gs-file-attachments' );
71	$filename = time() . '_' . sanitize_file_name( $file['name'] );
72	$extension = strtolower( pathinfo( $filename, PATHINFO_EXTENSION ) );
73	$today = new DateTime();
74	$upload_dir = wp_upload_dir();
75
76	// Allowed file extension.
77	$allowed_file_extensions = explode( ',', $file_settings['allowed-file-extensions'] );
78	$allowed_file_extensions = array_map( 'trim', $allowed_file_extensions );
79	$allowed_file_extensions = array_map( 'strtolower', $allowed_file_extensions );
80	if ( ! ( in_array( $extension, $allowed_file_extensions ) ) ) {
81	wp_send_json_error( 'File extension not allowed!', 400 );
82	}
83
84	// Allowed file size.
85	$allowed_file_size = intval( $file_settings['attachments-max-filesize'] ) * 1000000;
86	if ( ! ( isset( $file['size'] ) && $file['size'] <= $allowed_file_size ) ) {
87	wp_send_json_error( 'File size exceeds allowed limit!', 400 );
88	}
89
90	// Init attachment data.
91	$data = array(
92	'name' => sanitize_file_name( $file['name'] ),
93	'date_created' => $today->format( 'Y-m-d H:i:s' ),
94	);
95
96	// Check for image type. Add a ".txt" extension to non-image file to prevent executing uploaded files on server.
97	$img_extensions = array( 'png', 'jpeg', 'jpg', 'bmp', 'pdf', 'gif' );
98	if ( ! in_array( $extension, $img_extensions ) ) {
99	$data['is_image'] = 0;
100	} else {
101	$data['is_image'] = 1;
102	}
103
104	// File path.
105	$file_path = $upload_dir['basedir'] . '/wpsc/' . $today->format( 'Y' ) . '/' . $today->format( 'm' );
106	if ( ! file_exists( $file_path ) ) {
107	mkdir( $file_path, 0755, true );
108	}
109	$file_path .= '/' . $filename;
110
111	$filepath_short = '/wpsc/' . $today->format( 'Y' ) . '/' . $today->format( 'm' ) . '/' . $filename;
112	$data['file_path'] = $filepath_short;
113
114	// Insert record in database.
115	if ( move_uploaded_file( $file['tmp_name'], $file_path ) ) {
116
117	$attachment = WPSC_Attachment::insert( $data );
118	if ( ! $attachment->id ) {
119	wp_send_json_error( 'Something went wrong, attachment record not created!', 500 );
120	}
121	$data = array(
122	'id' => intval( $attachment->id ),
123	'name' => $attachment->name,
124	);
125	return new WP_REST_Response( $data, 200 );
126	}
127
128	wp_send_json_error( 'Something went wrong, file not saved!', 500 );
129	}
130
131	/**
132	* Single attachment
133	*
134	* @param WP_REST_Request $request - request object.
135	* @return WP_Error\|WP_REST_Response
136	*/
137	public static function get_individual_attachment( $request ) {
138
139	$current_user = WPSC_Current_User::$current_user;
140	$attachment = new WPSC_Attachment( $request->get_param( 'id' ) );
141	$url = home_url( '/' ) . '?wpsc_attachment=' . $attachment->id . '&user=' . $current_user->user->ID . '&auth_code=' . $current_user->get_attachment_auth();
142	$data = array(
143	'id' => intval( $attachment->id ),
144	'name' => $attachment->name,
145	'url' => $url,
146	);
147	return new WP_REST_Response( $data, 200 );
148	}
149
150	/**
151	* Validate id
152	*
153	* @param string $param - parameter value.
154	* @param WP_REST_Request $request - request object.
155	* @param string $key - filter key.
156	* @return boolean
157	*/
158	public static function validate_id( $param, $request, $key ) {
159
160	$current_user = WPSC_Current_User::$current_user;
161	$attachment = new WPSC_Attachment( $param );
162	if ( ! $attachment->id \|\| ! $attachment->is_active ) {
163	return new WP_Error( 'invalid_id', 'Invalid attachment id', array( 'status' => 400 ) );
164	}
165
166	switch ( $attachment->source ) {
167
168	case 'cf':
169	if ( in_array( $cf->field, array( 'ticket', 'agentonly' ) ) ) { // ticket field.
170
171	$ticket = new WPSC_Ticket( $attachment->ticket_id );
172	if ( ! $ticket->id ) {
173	return new WP_Error( 'invalid_id', 'Invalid attachment id', array( 'status' => 400 ) );
174	}
175
176	WPSC_Individual_Ticket::$ticket = $ticket;
177	if ( ! (
178	( $current_user->is_agent && WPSC_Individual_Ticket::has_ticket_cap( 'view' ) ) \|\|
179	WPSC_Individual_Ticket::is_customer()
180	) ) {
181	return new WP_Error( 'unauthorized', 'You are not authorized to access this attachment!', array( 'status' => 401 ) );
182	}
183	} else { // customer field.
184
185	$customer = new WPSC_Customer( intval( $attachment->customer_id ) );
186	$ticket_widgets = get_option( 'wpsc-ticket-widget', array() );
187	$raised_by = $ticket_widgets['raised-by'];
188
189	if ( ! (
190	$current_user->customer->id == $customer->id \|\|
191	(
192	$current_user->is_agent &&
193	in_array( $current_user->agent->role, $raised_by['allowed-agent-roles'] )
194	) )
195	) {
196	return new WP_Error( 'unauthorized', 'You are not authorized to access this attachment!', array( 'status' => 401 ) );
197	}
198	}
199	break;
200
201	case 'reply':
202	case 'report':
203	$ticket = new WPSC_Ticket( $attachment->ticket_id );
204	if ( ! $ticket->id ) {
205	return new WP_Error( 'invalid_id', 'Invalid attachment id', array( 'status' => 400 ) );
206	}
207
208	WPSC_Individual_Ticket::$ticket = $ticket;
209	if ( ! (
210	( $current_user->is_agent && WPSC_Individual_Ticket::has_ticket_cap( 'view' ) ) \|\|
211	WPSC_Individual_Ticket::is_customer()
212	) ) {
213	return new WP_Error( 'unauthorized', 'You are not authorized to access this attachment!', array( 'status' => 401 ) );
214	}
215	break;
216
217	case 'note':
218	$ticket = new WPSC_Ticket( $attachment->ticket_id );
219	if ( ! $ticket->id ) {
220	return new WP_Error( 'invalid_id', 'Invalid attachment id', array( 'status' => 400 ) );
221	}
222
223	WPSC_Individual_Ticket::$ticket = $ticket;
224	if ( ! (
225	$current_user->is_agent && WPSC_Individual_Ticket::has_ticket_cap( 'pn' )
226	) ) {
227	return new WP_Error( 'unauthorized', 'You are not authorized to access this attachment!', array( 'status' => 401 ) );
228	}
229	break;
230	}
231
232	return true;
233	}
234
235	/**
236	* Check for rest attachment
237	*
238	* @return void
239	*/
240	public static function check_download_file() {
241
242	// phpcs:disable
243	if ( isset( $_REQUEST['wpsc_attachment'] ) && isset( $_REQUEST['user'] ) && isset( $_REQUEST['auth_code'] ) ) {
244	$user = get_user_by( 'id', intval( $_REQUEST['user'] ) );
245	if ( $user ) {
246	$current_user = WPSC_Current_User::change_current_user( $user->user_email );
247	if ( $_REQUEST['auth_code'] != $current_user->get_attachment_auth() ) {
248	wp_send_json_error( __( 'Unauthorized access!', 'supportcandy' ), 401 );
249	}
250	}
251	}
252	// phpcs:enable
253	}
254	}
255	endif;
256
257	WPSC_REST_Attachment::init();
258