supportcandy / includes / rest-api / class-wpsc-rest-attachment.php

class-wpsc-rest-attachment.php in SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.5.3, at includes/rest-api/class-wpsc-rest-attachment.php

322 lines 10.1 KB

Raw Download Zip

1	<?php
2	if ( ! defined( 'ABSPATH' ) ) {
3	exit; // Exit if accessed directly!
4	}
5
6	if ( ! class_exists( 'WPSC_REST_Attachment' ) ) :
7
8	final class WPSC_REST_Attachment {
9
10	/**
11	* Initialize this class
12	*
13	* @return void
14	*/
15	public static function init() {
16
17	add_action( 'init', array( __CLASS__, 'check_download_file' ), 99 );
18	add_action( 'wpsc_rest_register_routes', array( __CLASS__, 'register_routes' ) );
19	}
20
21	/**
22	* Register routes
23	*
24	* @return void
25	*/
26	public static function register_routes() {
27
28	// list statuses.
29	register_rest_route(
30	'supportcandy/v2',
31	'/attachments',
32	array(
33	'methods' => 'POST',
34	'callback' => array( __CLASS__, 'new_attachment' ),
35	'permission_callback' => 'is_user_logged_in',
36	),
37	);
38
39	// list individual status.
40	register_rest_route(
41	'supportcandy/v2',
42	'/attachments/(?P<id>\d+)',
43	array(
44	'methods' => 'GET',
45	'callback' => array( __CLASS__, 'get_individual_attachment' ),
46	'args' => array(
47	'id' => array(
48	'validate_callback' => array( __CLASS__, 'validate_id' ),
49	),
50	),
51	'permission_callback' => 'is_user_logged_in',
52	),
53	);
54	}
55
56	/**
57	* Create new attachment
58	*
59	* @param WP_REST_Request $request - request object.
60	* @return WP_Error\|WP_REST_Response
61	*/
62	public static function new_attachment( $request ) {
63
64	$file_parameters = $request->get_file_params();
65	if ( ! isset( $file_parameters['file'] ) ) {
66	return new WP_Error( 'rest_missing_callback_param', 'Missing parameter(s): file', array( 'status' => 400 ) );
67	}
68
69	$file = $file_parameters['file'];
70	$file_settings = get_option( 'wpsc-gs-file-attachments' );
71
72	$original_name = sanitize_file_name( $file['name'] );
73	$filename = time() . '_' . $original_name;
74	$extension = strtolower( pathinfo( $filename, PATHINFO_EXTENSION ) );
75	$today = new DateTime();
76
77	// Allowed extensions.
78	$allowed_file_extensions = explode( ',', $file_settings['allowed-file-extensions'] );
79	$allowed_file_extensions = array_map( 'trim', $allowed_file_extensions );
80	$allowed_file_extensions = array_map( 'strtolower', $allowed_file_extensions );
81
82	if ( ! in_array( $extension, $allowed_file_extensions, true ) ) {
83	wp_send_json_error( 'File extension not allowed!', 400 );
84	}
85
86	// Allowed file size.
87	$allowed_file_size = intval( $file_settings['attachments-max-filesize'] ) * 1000000;
88	if ( ! isset( $file['size'] ) \|\| $file['size'] > $allowed_file_size ) {
89	wp_send_json_error( 'File size exceeds allowed limit!', 400 );
90	}
91
92	// Ensure wp_handle_upload is available.
93	if ( ! function_exists( 'wp_handle_upload' ) ) {
94	require_once ABSPATH . 'wp-admin/includes/file.php';
95	}
96
97	// Validate MIME using SAME custom mime rules.
98	add_filter( 'upload_mimes', array( 'WPSC_Attachment', 'wpsc_custom_upload_mimes' ) );
99	$wp_filetype = wp_check_filetype_and_ext( $file['tmp_name'], $file['name'] );
100	remove_filter( 'upload_mimes', array( 'WPSC_Attachment', 'wpsc_custom_upload_mimes' ) );
101
102	if ( empty( $wp_filetype['ext'] ) \|\| empty( $wp_filetype['type'] ) ) {
103	wp_send_json_error( 'Invalid file type!', 400 );
104	}
105
106	// Strict extension match check.
107	if ( strtolower( $wp_filetype['ext'] ) !== $extension ) {
108	wp_send_json_error( 'File extension mismatch detected!', 400 );
109	}
110
111	if ( ! in_array( strtolower( $wp_filetype['ext'] ), $allowed_file_extensions, true ) ) {
112	wp_send_json_error( 'File type does not match allowed extension!', 400 );
113	}
114
115	$data = array(
116	'name' => $original_name,
117	'date_created' => $today->format( 'Y-m-d H:i:s' ),
118	);
119
120	// List of safe image extensions.
121	$safe_images = array( 'png', 'jpeg', 'jpg', 'bmp', 'gif', 'webp' );
122
123	if ( in_array( $extension, $safe_images, true ) && ! wp_get_image_mime( $file['tmp_name'] ) ) {
124	wp_send_json_error( 'Invalid image file!', 400 );
125	}
126
127	// PDF validation.
128	if ( 'pdf' === $extension && 'application/pdf' !== $wp_filetype['type'] ) {
129	wp_send_json_error( 'Invalid PDF file!', 400 );
130	}
131
132	if ( in_array( $extension, $safe_images, true ) \|\| 'pdf' === $extension ) {
133	$data['is_image'] = 1;
134	} else {
135	$data['is_image'] = 0;
136	}
137
138	$ext = pathinfo( $filename, PATHINFO_EXTENSION );
139	$file_name = substr( $filename, 0, -( strlen( $ext ) + 1 ) );
140	$filename = $file_name . '.' . strtolower( $ext );
141
142	$filepath_short = '/wpsc/' . $today->format( 'Y' ) . '/' . $today->format( 'm' ) . '/' . $filename;
143	$data['file_path'] = $filepath_short;
144
145	$upload_overrides = array(
146	'test_form' => false,
147	);
148
149	$file['name'] = $filename;
150
151	add_filter( 'upload_dir', array( 'WPSC_Attachment', 'wpsc_upload_dir' ) );
152	add_filter( 'upload_mimes', array( 'WPSC_Attachment', 'wpsc_custom_upload_mimes' ) );
153
154	$uploaded_file = wp_handle_upload( $file, $upload_overrides );
155
156	remove_filter( 'upload_dir', array( 'WPSC_Attachment', 'wpsc_upload_dir' ) );
157	remove_filter( 'upload_mimes', array( 'WPSC_Attachment', 'wpsc_custom_upload_mimes' ) );
158
159	if ( $uploaded_file && empty( $uploaded_file['error'] ) ) {
160
161	// Normalize path for cross-platform compatibility.
162	$normalized_path = wp_normalize_path( $uploaded_file['file'] );
163
164	$pos = strpos( $normalized_path, '/wpsc/' );
165	if ( $pos === false ) {
166	wp_send_json_error( 'Something went wrong!', 500 );
167	}
168
169	$new_path = substr( $normalized_path, $pos );
170
171	if ( $new_path[0] !== '/' ) {
172	$new_path = '/' . $new_path;
173	}
174
175	$data['file_path'] = $new_path;
176
177	$attachment = WPSC_Attachment::insert( $data );
178	if ( ! $attachment->id ) {
179	wp_send_json_error( 'Something went wrong!', 500 );
180	}
181
182	return new WP_REST_Response(
183	array(
184	'id' => intval( $attachment->id ),
185	'name' => $attachment->name,
186	),
187	200
188	);
189	}
190
191	$error_message = isset( $uploaded_file['error'] ) ? $uploaded_file['error'] : 'Something went wrong!';
192	wp_send_json_error( $error_message, 500 );
193	}
194
195	/**
196	* Single attachment
197	*
198	* @param WP_REST_Request $request - request object.
199	* @return WP_Error\|WP_REST_Response
200	*/
201	public static function get_individual_attachment( $request ) {
202
203	$current_user = WPSC_Current_User::$current_user;
204	$attachment = new WPSC_Attachment( $request->get_param( 'id' ) );
205	$url = home_url( '/' ) . '?wpsc_attachment=' . $attachment->id . '&user=' . $current_user->user->ID . '&auth_code=' . $current_user->get_attachment_auth();
206	$data = array(
207	'id' => intval( $attachment->id ),
208	'name' => $attachment->name,
209	'url' => $url,
210	);
211	return new WP_REST_Response( $data, 200 );
212	}
213
214	/**
215	* Validate id
216	*
217	* @param string $param - parameter value.
218	* @param WP_REST_Request $request - request object.
219	* @param string $key - filter key.
220	* @return boolean
221	*/
222	public static function validate_id( $param, $request, $key ) {
223
224	$current_user = WPSC_Current_User::$current_user;
225	$attachment = new WPSC_Attachment( $param );
226	if ( ! $attachment->id \|\| ! $attachment->is_active ) {
227	return new WP_Error( 'invalid_id', 'Invalid attachment id', array( 'status' => 400 ) );
228	}
229
230	switch ( $attachment->source ) {
231
232	case 'cf':
233	if ( in_array( $cf->field, array( 'ticket', 'agentonly' ) ) ) { // ticket field.
234
235	$ticket = new WPSC_Ticket( $attachment->ticket_id );
236	if ( ! $ticket->id ) {
237	return new WP_Error( 'invalid_id', 'Invalid attachment id', array( 'status' => 400 ) );
238	}
239
240	WPSC_Individual_Ticket::$ticket = $ticket;
241	if ( ! (
242	( $current_user->is_agent && WPSC_Individual_Ticket::has_ticket_cap( 'view' ) ) \|\|
243	WPSC_Individual_Ticket::is_customer()
244	) ) {
245	return new WP_Error( 'unauthorized', 'You are not authorized to access this attachment!', array( 'status' => 401 ) );
246	}
247	} else { // customer field.
248
249	$customer = new WPSC_Customer( intval( $attachment->customer_id ) );
250	$ticket_widgets = get_option( 'wpsc-ticket-widget', array() );
251	$raised_by = $ticket_widgets['raised-by'];
252
253	if ( ! (
254	$current_user->customer->id == $customer->id \|\|
255	(
256	$current_user->is_agent &&
257	in_array( $current_user->agent->role, $raised_by['allowed-agent-roles'] )
258	) )
259	) {
260	return new WP_Error( 'unauthorized', 'You are not authorized to access this attachment!', array( 'status' => 401 ) );
261	}
262	}
263	break;
264
265	case 'reply':
266	case 'report':
267	$ticket = new WPSC_Ticket( $attachment->ticket_id );
268	if ( ! $ticket->id ) {
269	return new WP_Error( 'invalid_id', 'Invalid attachment id', array( 'status' => 400 ) );
270	}
271
272	WPSC_Individual_Ticket::$ticket = $ticket;
273	if ( ! (
274	( $current_user->is_agent && WPSC_Individual_Ticket::has_ticket_cap( 'view' ) ) \|\|
275	WPSC_Individual_Ticket::is_customer()
276	) ) {
277	return new WP_Error( 'unauthorized', 'You are not authorized to access this attachment!', array( 'status' => 401 ) );
278	}
279	break;
280
281	case 'note':
282	$ticket = new WPSC_Ticket( $attachment->ticket_id );
283	if ( ! $ticket->id ) {
284	return new WP_Error( 'invalid_id', 'Invalid attachment id', array( 'status' => 400 ) );
285	}
286
287	WPSC_Individual_Ticket::$ticket = $ticket;
288	if ( ! (
289	$current_user->is_agent && WPSC_Individual_Ticket::has_ticket_cap( 'pn' )
290	) ) {
291	return new WP_Error( 'unauthorized', 'You are not authorized to access this attachment!', array( 'status' => 401 ) );
292	}
293	break;
294	}
295
296	return true;
297	}
298
299	/**
300	* Check for rest attachment
301	*
302	* @return void
303	*/
304	public static function check_download_file() {
305
306	// phpcs:disable
307	if ( isset( $_REQUEST['wpsc_attachment'] ) && isset( $_REQUEST['user'] ) && isset( $_REQUEST['auth_code'] ) ) {
308	$user = get_user_by( 'id', intval( $_REQUEST['user'] ) );
309	if ( $user ) {
310	$current_user = WPSC_Current_User::change_current_user( $user->user_email );
311	if ( $_REQUEST['auth_code'] != $current_user->get_attachment_auth() ) {
312	wp_send_json_error( __( 'Unauthorized access!', 'supportcandy' ), 401 );
313	}
314	}
315	}
316	// phpcs:enable
317	}
318	}
319	endif;
320
321	WPSC_REST_Attachment::init();
322