← All changes
|
includes/admin/tasks/open_task/wppm_submit_task_comment.php
+39
-2
5.0.5
→
6.0.6
View file →
| @@ -6,15 +6,51 @@ | ||
| 6 | 6 | if ( check_ajax_referer( 'wppm_submit_task_comment', '_ajax_nonce', false ) != 1 ) { |
| 7 | 7 | wp_send_json_error( 'Unauthorised request!', 401 ); |
| 8 | 8 | } |
| 9 | 9 | $task_id = isset($_POST['task_id']) ? absint(sanitize_text_field(wp_unslash($_POST['task_id']))) : '' ; |
| 10 | +$page_setting = get_option( 'wppm-page-settings' ); | |
| 11 | +$view = $page_setting['task-url-page']; | |
| 10 | 12 | if(!$wppmfunction->has_permission('add_task_comment',$task_id)){ exit; } |
| 13 | +$task_url = '<a class="wppm_link" href="' . $wppmfunction->get_task_url($task_id,$view) . '" target="_blank">' . $wppmfunction->get_task_url($task_id,$view) . '</a>'; | |
| 11 | 14 | $comment = isset( $_POST['comment_body'] ) ? ( wp_unslash( $_POST['comment_body'] ) ) : ''; |
| 12 | -$allowed_tags = array( 'br' => array(), 'abbr' => array('title' => array(),), 'p' => array(), 'strong' => array(), 'a' => array('href' => array(), 'title' => array(), 'rel'=> array(), 'target'=> array()),'em' =>array(),'span' =>array(), 'blockquote'=>array('cite' => array(),),'div' => array('class' => array(),'title' => array(),'style' => array(),),'ul'=>array(),'li'=>array(),'ol'=>array(),'img' => array( 'alt'=> array(),'class' => array(),'height' => array(),'src'=> array(),'width'=> array(),)); | |
| 13 | -$comment_body = !empty($comment) ? wp_kses($comment,$allowed_tags) : ''; | |
| 15 | +$allowed_tags = array( 'br' => array(), 'abbr' => array('title' => array(),), 'p' => array(), 'strong' => array(), 'a' => array('href' => array(), 'title' => array(), 'rel'=> array(), 'target'=> array()),'em' =>array(),'span' =>array('class' => array(),'data-user-id' => array(),'data-username' => array(),'contenteditable' => array()), 'blockquote'=>array('cite' => array(),),'div' => array('class' => array(),'title' => array(),'style' => array(),),'ul'=>array(),'li'=>array(),'ol'=>array(),'img' => array( 'alt'=> array(),'class' => array(),'height' => array(),'src'=> array(),'width'=> array(),)); | |
| 16 | +$comment_body = !empty($comment) ? wp_kses_post($comment) : ''; | |
| 14 | 17 | $attachments = !empty($_POST['wppm_comment_attachment']) ? $wppmfunction->sanitize_array($_POST['wppm_comment_attachment']) : []; |
| 15 | 18 | $attachment_ids = implode(",",$attachments); |
| 16 | 19 | if($comment_body=="" && $attachment_ids=="") exit; |
| 20 | +$mentions = $wppmfunction->wppm_extract_mentions($comment_body); | |
| 21 | +// Remove mention list div completely | |
| 22 | +$comment_body = preg_replace('/<div id="wppm_mention_list".*?<\/div>/is', '', $comment_body); | |
| 23 | + | |
| 24 | +// Allow only safe HTML | |
| 25 | +$comment_body = wp_kses_post($comment_body); | |
| 26 | +$user_ids = $mentions; // Since we are now extracting user IDs directly, we can use them as is | |
| 27 | +$user_ids = array_unique($user_ids); | |
| 28 | +foreach ($user_ids as $uid => $user) { | |
| 29 | + $uid = is_object($user) ? $user->ID : (int) $user; | |
| 30 | + // Skip self notification | |
| 31 | + if ($uid == $current_user->ID) { | |
| 32 | + continue; | |
| 33 | + } | |
| 34 | + $task_url = esc_url($wppmfunction->get_task_url($task_id, $view)); | |
| 35 | + $message = sprintf( | |
| 36 | + '%s <a class="wppm_link" href="%s" target="_blank">%s</a>', | |
| 37 | + esc_html__("You were mentioned in a comment.", "taskbuilder"), | |
| 38 | + $task_url, | |
| 39 | + esc_html__("View Task", "taskbuilder") | |
| 40 | + ); | |
| 41 | + $wppmfunction->wppm_insert_notification( | |
| 42 | + $uid, | |
| 43 | + $message, | |
| 44 | + $task_url, | |
| 45 | + '0', | |
| 46 | + 'mention_task_comment' | |
| 47 | + ); | |
| 48 | + $userdata = get_userdata($uid); | |
| 49 | + if ($userdata) { | |
| 50 | + $email_addresses[] = $userdata->user_email; | |
| 51 | + } | |
| 52 | +} | |
| 17 | 53 | $vals = array('is_active' => 1); |
| 18 | 54 | foreach($attachments as $attach){ |
| 19 | 55 | $wpdb->update($wpdb->prefix.'wppm_attachments', $vals, array('id'=>$attach)); |
| 20 | 56 | } |
| @@ -26,7 +62,8 @@ | ||
| 26 | 62 | 'created_by'=>$current_user->ID |
| 27 | 63 | ); |
| 28 | 64 | $args = apply_filters( 'wppm_submit_comment_args', $args ); |
| 29 | 65 | $comment_id = $wppmfunction->wppm_submit_task_comment($args); |
| 66 | +$wppmfunction->wppm_send_mention_email($email_addresses, $comment_body, $task_id); | |
| 30 | 67 | $task_log_values = array('task_id'=>esc_sql($task_id),'comment_id'=>esc_sql($comment_id),'comment_type'=>'comment'); |
| 31 | 68 | $wpdb->insert($wpdb->prefix . 'wppm_task_comment_meta',$task_log_values); |
| 32 | 69 | do_action('wppm_after_submit_task_comment', $task_id,$comment_id); |