← All changes | includes/admin/tasks/open_task/wppm_thread_attachment_remove.php +46 -47 4.0.9 → 6.0.6 View file →

		@@ -1,48 +1,47 @@
1		-<?php
2		-if ( ! defined( 'ABSPATH' ) ) {
3		- exit; // Exit if accessed directly
4		-}
5		-
6		-global $current_user, $wppmfunction, $wpdb;
7		-if ( check_ajax_referer( 'wppm_remove_thread_attachment', '_ajax_nonce', false ) != 1 ) {
8		- wp_send_json_error( 'Unauthorised request!', 401 );
9		-}
10		-$attachment = isset($_POST['attachment']) ? intval(sanitize_text_field($_POST['attachment'])) : '0' ;
11		-$attachment = esc_sql($attachment);
12		-$comment_id = isset($_POST['comment_id']) ? intval(sanitize_text_field($_POST['comment_id'])) : '0' ;
13		-$task_id = isset($_POST['task_id']) ? intval(sanitize_text_field($_POST['task_id'])) : '0' ;
14		-$comment_id = esc_sql($comment_id);
15		-$task_id = esc_sql($task_id);
16		-$task_comment = $wpdb->get_row( "SELECT * FROM {$wpdb->prefix}wppm_task_comment where id = '$comment_id' AND task_id='$task_id'");
17		-if(!(((!empty($task_comment)) && ($task_comment->created_by == $current_user->ID)) || ($current_user->has_cap('manage_options')) || ($wppmfunction->has_comment_permission('edit_task_comment',$task_id,$comment_id)))){
18		- exit;
19		-}
20		-$sql="SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id = '$attachment'";
21		-$result=$wpdb->get_row($sql);
22		-$sql_query="SELECT file_path FROM {$wpdb->prefix}wppm_attachments WHERE file_path ='".esc_sql($result->file_path)."'";
23		-$attach_result=$wpdb->get_results($sql_query);
24		-$result_count = count($attach_result);
25		-if(file_exists($result->file_path) && $result_count < 2)
26		-{
27		- unlink($result->file_path);
28		-}
29		-$success = $wpdb->delete(
30		- $wpdb->prefix . 'wppm_attachments',
31		- array( 'id' => "$attachment" )
32		-);
33		-if( !$success ) return false;
34		-$task_attachment = $wpdb->get_var("SELECT attachment_ids FROM {$wpdb->prefix}wppm_task_comment WHERE id='$comment_id' ");
35		-$task_attachment = explode(",",$task_attachment);
36		-if(!empty($task_attachment)){
37		- foreach($task_attachment as $key=>$val){
38		- if($val == $attachment){
39		- unset($task_attachment[$key]);
40		- }
41		- }
42		-}
43		-$tattachment = implode(',',$task_attachment);
44		-$values=array(
45		- 'attachment_ids'=>esc_sql($tattachment)
46		-);
47		-$wpdb->update($wpdb->prefix.'wppm_task_comment', $values, array('id'=>"$comment_id"));
	1	+<?php
	2	+if ( ! defined( 'ABSPATH' ) ) {
	3	+ exit; // Exit if accessed directly
	4	+}
	5	+
	6	+global $current_user, $wppmfunction, $wpdb;
	7	+if ( check_ajax_referer( 'wppm_remove_thread_attachment', '_ajax_nonce', false ) != 1 ) {
	8	+ wp_send_json_error( 'Unauthorised request!', 401 );
	9	+}
	10	+$attachment = isset($_POST['attachment']) ? intval(sanitize_text_field(wp_unslash($_POST['attachment']))) : '0' ;
	11	+$attachment = esc_sql($attachment);
	12	+$comment_id = isset($_POST['comment_id']) ? intval(sanitize_text_field(wp_unslash($_POST['comment_id']))) : '0' ;
	13	+$task_id = isset($_POST['task_id']) ? intval(sanitize_text_field(wp_unslash($_POST['task_id']))) : '0' ;
	14	+$task_comment = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE id = %d AND task_id = %d", $comment_id,$task_id));
	15	+if(!(((!empty($task_comment)) && ($task_comment->created_by == $current_user->ID)) || ($current_user->has_cap('manage_options')) || ($wppmfunction->has_comment_permission('edit_task_comment',$task_id,$comment_id)))){
	16	+ exit;
	17	+}
	18	+$attachment = absint( $attachment );
	19	+$result = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id = %d", $attachment ));
	20	+$file_path = isset( $result->file_path ) ? $result->file_path : '';
	21	+$attach_result = $wpdb->get_results( $wpdb->prepare( "SELECT file_path FROM {$wpdb->prefix}wppm_attachments WHERE file_path = %s", $file_path));
	22	+$result_count = count($attach_result);
	23	+if(file_exists($result->file_path) && $result_count < 2)
	24	+{
	25	+ wp_delete_file($result->file_path);
	26	+}
	27	+$success = $wpdb->delete(
	28	+ $wpdb->prefix . 'wppm_attachments',
	29	+ array( 'id' => "$attachment" )
	30	+);
	31	+if( !$success ) return false;
	32	+$comment_id = isset( $comment_id ) ? absint( $comment_id ) : 0;
	33	+$task_attachment = $wpdb->get_var( $wpdb->prepare( "SELECT attachment_ids FROM {$wpdb->prefix}wppm_task_comment WHERE id = %d", $comment_id));
	34	+$task_attachment = explode(",",$task_attachment);
	35	+if(!empty($task_attachment)){
	36	+ foreach($task_attachment as $key=>$val){
	37	+ if($val == $attachment){
	38	+ unset($task_attachment[$key]);
	39	+ }
	40	+ }
	41	+}
	42	+$tattachment = implode(',',$task_attachment);
	43	+$values=array(
	44	+ 'attachment_ids'=>esc_sql($tattachment)
	45	+);
	46	+$wpdb->update($wpdb->prefix.'wppm_task_comment', $values, array('id'=>"$comment_id"));
48	47	$attachment = apply_filters('wppm_after_delete_comment_attachment',$attachment,$comment_id,$task_id);