← All changes | includes/admin/tasks/open_task/wppm_upload_file.php +113 -92 1.0.5 → 6.0.6 View file →

		@@ -1,92 +1,113 @@
1		-<?php
2		-// Exit if accessed directly
3		-if ( ! defined( 'ABSPATH' ) ) exit;
4		-
5		-global $wpdb;
6		-$isError = false;
7		-$errorMessege = '';
8		-$attachment_id = 0;
9		-if(!$_FILES){
10		- $isError=true;
11		-}
12		-$filename = sanitize_file_name($_FILES['file']['name']);
13		-$tempExtension = explode('.',$filename);
14		-$extension = strtolower($tempExtension[count($tempExtension)-1]);
15		-
16		-if( !$isError ){
17		- switch ($extension){
18		- case 'exe':
19		- case 'php':
20		- case 'js':
21		- $isError = true;
22		- $errorMessege = __('Error: file format not supported!','taskbuilder');
23		- break;
24		- }
25		- if ( preg_match('/php/i', $extension) || preg_match('/phtml/i', $extension) ){
26		- $isError=true;
27		- $errorMessege=__('Error: file format not supported!','taskbuilder');
28		- }
29		-}
30		-
31		-if( !$isError && $_FILES['file']['tmp_name']==''){
32		- $isError = true;
33		- $errorMessege = __('Error: file size exceeded allowed limit!','taskbuilder');
34		-}
35		-
36		-if( !$isError ){
37		- $now = date("Y-m-d H:i:s");
38		- $time = strtotime($now);
39		- $month = date("m",$time);
40		- $year = date("Y",$time);
41		-
42		- $upload_dir = wp_upload_dir();
43		- if (!file_exists($upload_dir['basedir'] . '/wppm/'.$year)) {
44		- mkdir($upload_dir['basedir'] . '/wppm/'.$year, 0755, true);
45		- }
46		- if (!file_exists($upload_dir['basedir'] . '/wppm/'.$year.'/'.$month)) {
47		- mkdir($upload_dir['basedir'] . '/wppm/'.$year.'/'.$month, 0755, true);
48		- }
49		-
50		- $file_name = sanitize_file_name($_FILES['file']['name']);
51		- $save_file_name = str_replace(' ','_',$file_name);
52		- $save_file_name = str_replace(',','_',$file_name);
53		- $save_file_name = explode('.', $save_file_name);
54		-
55		- $img_extensions = array('png','jpeg','svg','SVG','jpg','bmp','pdf','gif','PNG','JPEG','JPG','BMP','PDF','GIF');
56		- $extension = $save_file_name[count($save_file_name)-1];
57		- if(!in_array($extension, $img_extensions)){
58		- $extension = $extension.'.txt';
59		- $is_image = 0;
60		- } else {
61		- $is_image = 1;
62		- }
63		- unset( $save_file_name[count($save_file_name)-1] );
64		- $save_file_name = implode('-', $save_file_name);
65		- $save_file_name = time().'_'.preg_replace('/[^A-Za-z0-9\-]/', '', $save_file_name).'.'.$extension;
66		- $save_directory = $upload_dir['basedir'] . '/wppm/'.$year.'/'.$month.'/'.$save_file_name;
67		- move_uploaded_file( $_FILES['file']['tmp_name'], $save_directory );
68		-}
69		-
70		-$values=array(
71		- 'name'=>$save_file_name,
72		- 'file_name'=> $file_name,
73		- 'file_path'=>$save_directory,
74		- 'is_image'=>$is_image,
75		- 'is_active'=>0,
76		- 'is_uploaded'=>0,
77		- 'date_created'=>$now
78		-);
79		-
80		-$wpdb->insert($wpdb->prefix.'wppm_attachments',$values);
81		-$attachment_id= $wpdb->insert_id;
82		-$errorMessege=__('done','taskbuilder');
83		-
84		-$isError=($isError)?'yes':'no';
85		-
86		-$response = array(
87		- 'error' => $isError,
88		- 'errorMessege' => $errorMessege,
89		- 'id' => $attachment_id
90		-);
91		-
92		-echo json_encode($response);
	1	+<?php
	2	+// Exit if accessed directly
	3	+if ( ! defined( 'ABSPATH' ) ) exit;
	4	+global $wpdb,$wppmfunction,$current_user;
	5	+
	6	+$nonce_valid = check_ajax_referer( 'wppm_upload_proj_attach_file', 'nonce', false ) === 1 || check_ajax_referer( 'wppm_upload_file', 'nonce', false ) === 1;
	7	+if ( ! $nonce_valid ) {
	8	+ wp_send_json_error( 'Unauthorized request!', 403 );
	9	+}
	10	+$has_upload_action = isset($_POST['action']) && ( $_POST['action'] === 'wppm_upload_proj_attach_file' || $_POST['action'] === 'wppm_upload_file');
	11	+
	12	+if ( ! $has_upload_action ) {
	13	+ wp_send_json_error('Unauthorized', 401);
	14	+}
	15	+$isError = false;
	16	+$errorMessege = '';
	17	+$attachment_id = 0;
	18	+if(!$_FILES){
	19	+ $isError=true;
	20	+}
	21	+$upload_dir = wp_upload_dir();
	22	+$now = wp_date("Y-m-d H:i:s");
	23	+$time = strtotime($now);
	24	+$month = wp_date("m",$time);
	25	+$year = wp_date("Y",$time);
	26	+$filename = isset( $_FILES['file']['name'] ) ? sanitize_file_name( $_FILES['file']['name'] ) : '';
	27	+if ( ! $filename ) {
	28	+ wp_send_json_error( esc_html__( 'No file uploaded.', 'taskbuilder' ), 400 );
	29	+}
	30	+$path = $upload_dir['basedir'] . '/wppm/'.$year.'/'.$month.'/'.$filename;
	31	+$filetype_extention = wp_check_filetype_and_ext($path,$filename);
	32	+
	33	+if( !$isError ){
	34	+ if (!file_exists($upload_dir['basedir'] . '/wppm/'.$year)) {
	35	+ mkdir($upload_dir['basedir'] . '/wppm/'.$year, 0755, true);
	36	+ }
	37	+ if (!file_exists($upload_dir['basedir'] . '/wppm/'.$year.'/'.$month)) {
	38	+ mkdir($upload_dir['basedir'] . '/wppm/'.$year.'/'.$month, 0755, true);
	39	+ }
	40	+ switch ($filetype_extention['ext']){
	41	+ case 'exe':
	42	+ case 'php':
	43	+ case 'js':
	44	+ $isError = true;
	45	+ $errorMessege = esc_html__( 'Error: file format not supported!', 'taskbuilder' );
	46	+ break;
	47	+ }
	48	+ if ( preg_match('/php/i', $filetype_extention['ext']) || preg_match('/phtml/i', $filetype_extention['ext']) ){
	49	+ $isError=true;
	50	+ $errorMessege=esc_html__('Error: file format not supported!','taskbuilder');
	51	+ }
	52	+}
	53	+
	54	+if( !$isError && $_FILES['file']['tmp_name']==''){
	55	+ $isError = true;
	56	+ $errorMessege = esc_html__( 'Error: file size exceeded allowed limit!', 'taskbuilder' );
	57	+}
	58	+
	59	+if( !$isError ){
	60	+ $file_name = sanitize_file_name($_FILES['file']['name']);
	61	+ if(!empty($file_name)){
	62	+ $save_file_name = str_replace(' ','_',$file_name);
	63	+ }
	64	+
	65	+ // if (!file_exists($upload_dir['basedir'] . '/wppm/'.$year.'/'.$month)) {
	66	+ // mkdir($upload_dir['basedir'] . '/wppm/'.$year.'/'.$month, 0755, true);
	67	+ // }
	68	+ if(!empty($filename)){
	69	+ $save_file_name = str_replace(' ','_',$filename);
	70	+ $save_file_name = str_replace(',','_',$save_file_name);
	71	+ $save_file_name = explode('.', $save_file_name);
	72	+ }else{
	73	+ $save_file_name ="";
	74	+ }
	75	+
	76	+ $img_extensions = array('png','jpeg','jpg','bmp','pdf','gif','PNG','JPEG','JPG','BMP','PDF','GIF');
	77	+ //$extension = $save_file_name[count($save_file_name)-1];
	78	+ if(!in_array($filetype_extention['ext'], $img_extensions)){
	79	+ $extension = $filetype_extention['ext'].'.txt';
	80	+ $is_image = 0;
	81	+ } else {
	82	+ $is_image = 1;
	83	+ }
	84	+ unset( $save_file_name[count($save_file_name)-1] );
	85	+ $save_file_name = implode('-', $save_file_name);
	86	+ $save_file_name = time().'_'.preg_replace('/[^A-Za-z0-9\-]/', '', $save_file_name).'.'.$filetype_extention['ext'];
	87	+ $save_directory = $upload_dir['basedir'] . '/wppm/'.$year.'/'.$month.'/'.$save_file_name;
	88	+ move_uploaded_file( $_FILES['file']['tmp_name'], $save_directory );
	89	+}
	90	+
	91	+$values=array(
	92	+ 'name'=>$save_file_name,
	93	+ 'file_name'=> $filename,
	94	+ 'file_path'=>$save_directory,
	95	+ 'is_image'=>$is_image,
	96	+ 'is_active'=>0,
	97	+ 'is_uploaded'=>0,
	98	+ 'date_created'=>$now
	99	+);
	100	+
	101	+$wpdb->insert($wpdb->prefix.'wppm_attachments',$values);
	102	+$attachment_id= $wpdb->insert_id;
	103	+$errorMessege=esc_html__('done','taskbuilder');
	104	+
	105	+$isError=($isError)?'yes':'no';
	106	+
	107	+$response = array(
	108	+ 'error' => $isError,
	109	+ 'errorMessege' => $errorMessege,
	110	+ 'id' => $attachment_id
	111	+);
	112	+
	113	+echo wp_json_encode($response);