← All changes | includes/admin/tasks/wppm_set_delete_task.php +11 -21 1.0.5 → 6.0.6 View file →

		@@ -3,27 +3,17 @@
3	3	exit; // Exit if accessed directly
4	4	}
5	5
6	6	global $current_user, $wppmfunction ,$wpdb;
7		-$task_id = isset($_POST['task_id']) ? sanitize_text_field($_POST['task_id']) : 0 ;
	7	+if ( check_ajax_referer( 'wppm_set_delete_task', '_ajax_nonce', false ) != 1 ) {
	8	+ wp_send_json_error( 'Unauthorised request!', 401 );
	9	+}
	10	+$task_id = isset($_POST['task_id']) ? intval(sanitize_text_field(wp_unslash($_POST['task_id']))) : 0 ;
8	11
9		-$sql="SELECT attachment_ids FROM {$wpdb->prefix}wppm_task_comment WHERE task_id =".$task_id;
10		-$thread_attachment_ids= $wpdb->get_results( $sql );
11		-/***************************Code for deleting attachment files****************************************************/
12		-foreach ($thread_attachment_ids as $thread_attachment_id){
13		- $attachment_ids_temp=array();
14		- if($thread_attachment_id->attachment_ids){
15		- $attachment_ids_temp= explode(',', $thread_attachment_id->attachment_ids);
16		- }
17		- //$attachment_ids=$attachment_ids_temp;
18		- foreach ($attachment_ids_temp as $attachment_id){
19		- $sql="SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id =".$attachment_id;
20		- $result=$wpdb->get_row($sql);
21		- if(file_exists($result->file_path))
22		- {
23		- unlink($result->file_path);
24		- }
25		- $wpdb->delete($wpdb->prefix.'wppm_attachments', array( 'id' => $attachment_id));
26		- }
	12	+$task_data = $wppmfunction->get_task($task_id);
	13	+$project_data = $wppmfunction->get_project($task_data['project']);
	14	+$wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
	15	+if(!(($current_user->ID && $current_user->has_cap('manage_options')) || ($wppmfunction->has_permission('delete_task',$task_id)) || $wppm_current_user_capability == 'wppm_admin'|| $project_data['created_by']==$current_user->ID )){
	16	+ exit;
27	17	}
28		-$wpdb->delete($wpdb->prefix.'wppm_task',array('id'=>$task_id));
29		-$wpdb->delete($wpdb->prefix.'wppm_task_comment',array('task_id'=>$task_id));
	18	+// Deletes the task's own attachments/checklists/comments, and cascades to any subtasks.
	19	+WPPM_Functions::delete_task_and_children($task_id);