← All changes | includes/admin/tasks/open_task/wppm_submit_task_comment.php +69 -32 4.0.9 → 6.0.6 View file →

		@@ -1,32 +1,69 @@
1		-<?php
2		-if ( ! defined( 'ABSPATH' ) ) {
3		- exit; // Exit if accessed directly
4		-}
5		-global $wpdb,$wppmfunction,$current_user;
6		-if ( check_ajax_referer( 'wppm_submit_task_comment', '_ajax_nonce', false ) != 1 ) {
7		- wp_send_json_error( 'Unauthorised request!', 401 );
8		-}
9		-$task_id = isset($_POST['task_id']) ? intval(sanitize_text_field($_POST['task_id'])) : '' ;
10		-$comment = isset($_POST['comment_body']) ? ($_POST['comment_body']) : '' ;
11		-$allowed_tags = array( 'br' => array(), 'abbr' => array('title' => array(),), 'p' => array(), 'strong' => array(), 'a' => array('href' => array(), 'title' => array(), 'rel'=> array(), 'target'=> array()),'em' =>array(),'span' =>array(), 'blockquote'=>array('cite' => array(),),'div' => array('class' => array(),'title' => array(),'style' => array(),),'ul'=>array(),'li'=>array(),'ol'=>array(),'img' => array( 'alt'=> array(),'class' => array(),'height' => array(),'src'=> array(),'width'=> array(),));
12		-$comment_body = wp_kses(htmlspecialchars_decode($comment, ENT_QUOTES),$allowed_tags);
13		-$attachments = !empty($_POST['wppm_comment_attachment']) ? $wppmfunction->sanitize_array($_POST['wppm_comment_attachment']) : [];
14		-$attachment_ids = implode(",",$attachments);
15		-if($comment_body=="" && $attachment_ids=="") exit;
16		-$vals = array('is_active' => 1);
17		-foreach($attachments as $attach){
18		- $wpdb->update($wpdb->prefix.'wppm_attachments', $vals, array('id'=>$attach));
19		-}
20		-$args=array(
21		- 'task_id'=> $task_id,
22		- 'body'=>$comment_body,
23		- 'attachment_ids'=>$attachment_ids,
24		- 'create_time'=>date("Y-m-d h:i:sa"),
25		- 'created_by'=>$current_user->ID
26		-);
27		-$args = apply_filters( 'wppm_submit_comment_args', $args );
28		-$comment_id = $wppmfunction->wppm_submit_task_comment($args);
29		-$task_log_values = array('task_id'=>esc_sql($task_id),'comment_id'=>esc_sql($comment_id),'comment_type'=>'comment');
30		-$wpdb->insert($wpdb->prefix . 'wppm_task_comment_meta',$task_log_values);
31		-do_action('wppm_after_submit_task_comment', $task_id,$comment_id);
32		-
	1	+<?php
	2	+if ( ! defined( 'ABSPATH' ) ) {
	3	+ exit; // Exit if accessed directly
	4	+}
	5	+global $wpdb,$wppmfunction,$current_user;
	6	+if ( check_ajax_referer( 'wppm_submit_task_comment', '_ajax_nonce', false ) != 1 ) {
	7	+ wp_send_json_error( 'Unauthorised request!', 401 );
	8	+}
	9	+$task_id = isset($_POST['task_id']) ? absint(sanitize_text_field(wp_unslash($_POST['task_id']))) : '' ;
	10	+$page_setting = get_option( 'wppm-page-settings' );
	11	+$view = $page_setting['task-url-page'];
	12	+if(!$wppmfunction->has_permission('add_task_comment',$task_id)){ exit; }
	13	+$task_url = '<a class="wppm_link" href="' . $wppmfunction->get_task_url($task_id,$view) . '" target="_blank">' . $wppmfunction->get_task_url($task_id,$view) . '</a>';
	14	+$comment = isset( $_POST['comment_body'] ) ? ( wp_unslash( $_POST['comment_body'] ) ) : '';
	15	+$allowed_tags = array( 'br' => array(), 'abbr' => array('title' => array(),), 'p' => array(), 'strong' => array(), 'a' => array('href' => array(), 'title' => array(), 'rel'=> array(), 'target'=> array()),'em' =>array(),'span' =>array('class' => array(),'data-user-id' => array(),'data-username' => array(),'contenteditable' => array()), 'blockquote'=>array('cite' => array(),),'div' => array('class' => array(),'title' => array(),'style' => array(),),'ul'=>array(),'li'=>array(),'ol'=>array(),'img' => array( 'alt'=> array(),'class' => array(),'height' => array(),'src'=> array(),'width'=> array(),));
	16	+$comment_body = !empty($comment) ? wp_kses_post($comment) : '';
	17	+$attachments = !empty($_POST['wppm_comment_attachment']) ? $wppmfunction->sanitize_array($_POST['wppm_comment_attachment']) : [];
	18	+$attachment_ids = implode(",",$attachments);
	19	+if($comment_body=="" && $attachment_ids=="") exit;
	20	+$mentions = $wppmfunction->wppm_extract_mentions($comment_body);
	21	+// Remove mention list div completely
	22	+$comment_body = preg_replace('/<div id="wppm_mention_list".*?<\/div>/is', '', $comment_body);
	23	+
	24	+// Allow only safe HTML
	25	+$comment_body = wp_kses_post($comment_body);
	26	+$user_ids = $mentions; // Since we are now extracting user IDs directly, we can use them as is
	27	+$user_ids = array_unique($user_ids);
	28	+foreach ($user_ids as $uid => $user) {
	29	+ $uid = is_object($user) ? $user->ID : (int) $user;
	30	+ // Skip self notification
	31	+ if ($uid == $current_user->ID) {
	32	+ continue;
	33	+ }
	34	+ $task_url = esc_url($wppmfunction->get_task_url($task_id, $view));
	35	+ $message = sprintf(
	36	+ '%s <a class="wppm_link" href="%s" target="_blank">%s</a>',
	37	+ esc_html__("You were mentioned in a comment.", "taskbuilder"),
	38	+ $task_url,
	39	+ esc_html__("View Task", "taskbuilder")
	40	+ );
	41	+ $wppmfunction->wppm_insert_notification(
	42	+ $uid,
	43	+ $message,
	44	+ $task_url,
	45	+ '0',
	46	+ 'mention_task_comment'
	47	+ );
	48	+ $userdata = get_userdata($uid);
	49	+ if ($userdata) {
	50	+ $email_addresses[] = $userdata->user_email;
	51	+ }
	52	+}
	53	+$vals = array('is_active' => 1);
	54	+foreach($attachments as $attach){
	55	+ $wpdb->update($wpdb->prefix.'wppm_attachments', $vals, array('id'=>$attach));
	56	+}
	57	+$args=array(
	58	+ 'task_id'=> $task_id,
	59	+ 'body'=>$comment_body,
	60	+ 'attachment_ids'=>$attachment_ids,
	61	+ 'create_time'=>wp_date("Y-m-d h:i:sa"),
	62	+ 'created_by'=>$current_user->ID
	63	+);
	64	+$args = apply_filters( 'wppm_submit_comment_args', $args );
	65	+$comment_id = $wppmfunction->wppm_submit_task_comment($args);
	66	+$wppmfunction->wppm_send_mention_email($email_addresses, $comment_body, $task_id);
	67	+$task_log_values = array('task_id'=>esc_sql($task_id),'comment_id'=>esc_sql($comment_id),'comment_type'=>'comment');
	68	+$wpdb->insert($wpdb->prefix . 'wppm_task_comment_meta',$task_log_values);
	69	+do_action('wppm_after_submit_task_comment', $task_id,$comment_id);