← All changes | includes/admin/tasks/open_task/wppm_upload_file.php +113 -103 5.0.3 → 6.0.6 View file →

		@@ -1,103 +1,113 @@
1		-<?php
2		-// Exit if accessed directly
3		-if ( ! defined( 'ABSPATH' ) ) exit;
4		-if ( isset($_POST['wppm_upload_proj_attach_file']) && check_ajax_referer( 'wppm_upload_proj_attach_file', 'nonce', false ) != 1 ) {
5		- wp_send_json_error( 'Unauthorised request!', 401 );
6		-}
7		-elseif ( isset($_POST['wppm_upload_file']) && check_ajax_referer( 'wppm_upload_file', 'nonce', false ) != 1 ) {
8		- wp_send_json_error( 'Unauthorised request!', 401 );
9		-}
10		-global $wpdb;
11		-$isError = false;
12		-$errorMessege = '';
13		-$attachment_id = 0;
14		-if(!$_FILES){
15		- $isError=true;
16		-}
17		-$upload_dir = wp_upload_dir();
18		-$now = date("Y-m-d H:i:s");
19		-$time = strtotime($now);
20		-$month = date("m",$time);
21		-$year = date("Y",$time);
22		-$filename = sanitize_file_name($_FILES['file']['name']);
23		-$path = $upload_dir['basedir'] . '/wppm/'.$year.'/'.$month.'/'.$_FILES['file']['name'];
24		-$filetype_extention = wp_check_filetype_and_ext($path,$_FILES['file']['name']);
25		-if( !$isError ){
26		- switch ($filetype_extention['ext']){
27		- case 'exe':
28		- case 'php':
29		- case 'js':
30		- $isError = true;
31		- $errorMessege = __('Error: file format not supported!','taskbuilder');
32		- break;
33		- }
34		- if ( preg_match('/php/i', $filetype_extention['ext']) || preg_match('/phtml/i', $filetype_extention['ext']) ){
35		- $isError=true;
36		- $errorMessege=__('Error: file format not supported!','taskbuilder');
37		- }
38		-}
39		-
40		-if( !$isError && $_FILES['file']['tmp_name']==''){
41		- $isError = true;
42		- $errorMessege = __('Error: file size exceeded allowed limit!','taskbuilder');
43		-}
44		-
45		-if( !$isError ){
46		- if (!file_exists($upload_dir['basedir'] . '/wppm/'.$year)) {
47		- mkdir($upload_dir['basedir'] . '/wppm/'.$year, 0755, true);
48		- }
49		- if (!file_exists($upload_dir['basedir'] . '/wppm/'.$year.'/'.$month)) {
50		- mkdir($upload_dir['basedir'] . '/wppm/'.$year.'/'.$month, 0755, true);
51		- }
52		-
53		- $file_name = sanitize_file_name($_FILES['file']['name']);
54		- if(!empty($file_name)){
55		- $save_file_name = str_replace(' ','_',$file_name);
56		- $save_file_name = str_replace(',','_',$file_name);
57		- $save_file_name = explode('.', $save_file_name);
58		- }else{
59		- $save_file_name ="";
60		- }
61		-
62		- $img_extensions = array('png','jpeg','jpg','bmp','pdf','gif','PNG','JPEG','JPG','BMP','PDF','GIF');
63		- //$extension = $save_file_name[count($save_file_name)-1];
64		- if(!in_array($filetype_extention['ext'], $img_extensions)){
65		- $extension = $filetype_extention['ext'].'.txt';
66		- $is_image = 0;
67		- } else {
68		- $is_image = 1;
69		- }
70		- unset( $save_file_name[count($save_file_name)-1] );
71		- $save_file_name = implode('-', $save_file_name);
72		- $save_file_name = time().'_'.preg_replace('/[^A-Za-z0-9\-]/', '', $save_file_name).'.'.$filetype_extention['ext'];
73		- $save_directory = $upload_dir['basedir'] . '/wppm/'.$year.'/'.$month.'/'.$save_file_name;
74		- move_uploaded_file( $_FILES['file']['tmp_name'], $save_directory );
75		-}
76		-$save_file_name = esc_sql($save_file_name);
77		-$file_name = esc_sql($file_name);
78		-$save_directory = $save_directory;
79		-$is_image = esc_sql($is_image);
80		-$now = esc_sql($now);
81		-$values=array(
82		- 'name'=>$save_file_name,
83		- 'file_name'=> $file_name,
84		- 'file_path'=>$save_directory,
85		- 'is_image'=>$is_image,
86		- 'is_active'=>0,
87		- 'is_uploaded'=>0,
88		- 'date_created'=>$now
89		-);
90		-
91		-$wpdb->insert($wpdb->prefix.'wppm_attachments',$values);
92		-$attachment_id= $wpdb->insert_id;
93		-$errorMessege=__('done','taskbuilder');
94		-
95		-$isError=($isError)?'yes':'no';
96		-
97		-$response = array(
98		- 'error' => $isError,
99		- 'errorMessege' => $errorMessege,
100		- 'id' => $attachment_id
101		-);
102		-
103		-echo json_encode($response);
	1	+<?php
	2	+// Exit if accessed directly
	3	+if ( ! defined( 'ABSPATH' ) ) exit;
	4	+global $wpdb,$wppmfunction,$current_user;
	5	+
	6	+$nonce_valid = check_ajax_referer( 'wppm_upload_proj_attach_file', 'nonce', false ) === 1 || check_ajax_referer( 'wppm_upload_file', 'nonce', false ) === 1;
	7	+if ( ! $nonce_valid ) {
	8	+ wp_send_json_error( 'Unauthorized request!', 403 );
	9	+}
	10	+$has_upload_action = isset($_POST['action']) && ( $_POST['action'] === 'wppm_upload_proj_attach_file' || $_POST['action'] === 'wppm_upload_file');
	11	+
	12	+if ( ! $has_upload_action ) {
	13	+ wp_send_json_error('Unauthorized', 401);
	14	+}
	15	+$isError = false;
	16	+$errorMessege = '';
	17	+$attachment_id = 0;
	18	+if(!$_FILES){
	19	+ $isError=true;
	20	+}
	21	+$upload_dir = wp_upload_dir();
	22	+$now = wp_date("Y-m-d H:i:s");
	23	+$time = strtotime($now);
	24	+$month = wp_date("m",$time);
	25	+$year = wp_date("Y",$time);
	26	+$filename = isset( $_FILES['file']['name'] ) ? sanitize_file_name( $_FILES['file']['name'] ) : '';
	27	+if ( ! $filename ) {
	28	+ wp_send_json_error( esc_html__( 'No file uploaded.', 'taskbuilder' ), 400 );
	29	+}
	30	+$path = $upload_dir['basedir'] . '/wppm/'.$year.'/'.$month.'/'.$filename;
	31	+$filetype_extention = wp_check_filetype_and_ext($path,$filename);
	32	+
	33	+if( !$isError ){
	34	+ if (!file_exists($upload_dir['basedir'] . '/wppm/'.$year)) {
	35	+ mkdir($upload_dir['basedir'] . '/wppm/'.$year, 0755, true);
	36	+ }
	37	+ if (!file_exists($upload_dir['basedir'] . '/wppm/'.$year.'/'.$month)) {
	38	+ mkdir($upload_dir['basedir'] . '/wppm/'.$year.'/'.$month, 0755, true);
	39	+ }
	40	+ switch ($filetype_extention['ext']){
	41	+ case 'exe':
	42	+ case 'php':
	43	+ case 'js':
	44	+ $isError = true;
	45	+ $errorMessege = esc_html__( 'Error: file format not supported!', 'taskbuilder' );
	46	+ break;
	47	+ }
	48	+ if ( preg_match('/php/i', $filetype_extention['ext']) || preg_match('/phtml/i', $filetype_extention['ext']) ){
	49	+ $isError=true;
	50	+ $errorMessege=esc_html__('Error: file format not supported!','taskbuilder');
	51	+ }
	52	+}
	53	+
	54	+if( !$isError && $_FILES['file']['tmp_name']==''){
	55	+ $isError = true;
	56	+ $errorMessege = esc_html__( 'Error: file size exceeded allowed limit!', 'taskbuilder' );
	57	+}
	58	+
	59	+if( !$isError ){
	60	+ $file_name = sanitize_file_name($_FILES['file']['name']);
	61	+ if(!empty($file_name)){
	62	+ $save_file_name = str_replace(' ','_',$file_name);
	63	+ }
	64	+
	65	+ // if (!file_exists($upload_dir['basedir'] . '/wppm/'.$year.'/'.$month)) {
	66	+ // mkdir($upload_dir['basedir'] . '/wppm/'.$year.'/'.$month, 0755, true);
	67	+ // }
	68	+ if(!empty($filename)){
	69	+ $save_file_name = str_replace(' ','_',$filename);
	70	+ $save_file_name = str_replace(',','_',$save_file_name);
	71	+ $save_file_name = explode('.', $save_file_name);
	72	+ }else{
	73	+ $save_file_name ="";
	74	+ }
	75	+
	76	+ $img_extensions = array('png','jpeg','jpg','bmp','pdf','gif','PNG','JPEG','JPG','BMP','PDF','GIF');
	77	+ //$extension = $save_file_name[count($save_file_name)-1];
	78	+ if(!in_array($filetype_extention['ext'], $img_extensions)){
	79	+ $extension = $filetype_extention['ext'].'.txt';
	80	+ $is_image = 0;
	81	+ } else {
	82	+ $is_image = 1;
	83	+ }
	84	+ unset( $save_file_name[count($save_file_name)-1] );
	85	+ $save_file_name = implode('-', $save_file_name);
	86	+ $save_file_name = time().'_'.preg_replace('/[^A-Za-z0-9\-]/', '', $save_file_name).'.'.$filetype_extention['ext'];
	87	+ $save_directory = $upload_dir['basedir'] . '/wppm/'.$year.'/'.$month.'/'.$save_file_name;
	88	+ move_uploaded_file( $_FILES['file']['tmp_name'], $save_directory );
	89	+}
	90	+
	91	+$values=array(
	92	+ 'name'=>$save_file_name,
	93	+ 'file_name'=> $filename,
	94	+ 'file_path'=>$save_directory,
	95	+ 'is_image'=>$is_image,
	96	+ 'is_active'=>0,
	97	+ 'is_uploaded'=>0,
	98	+ 'date_created'=>$now
	99	+);
	100	+
	101	+$wpdb->insert($wpdb->prefix.'wppm_attachments',$values);
	102	+$attachment_id= $wpdb->insert_id;
	103	+$errorMessege=esc_html__('done','taskbuilder');
	104	+
	105	+$isError=($isError)?'yes':'no';
	106	+
	107	+$response = array(
	108	+ 'error' => $isError,
	109	+ 'errorMessege' => $errorMessege,
	110	+ 'id' => $attachment_id
	111	+);
	112	+
	113	+echo wp_json_encode($response);