| @@ -1,253 +1,173 @@ | ||
| 1 | -<?php | |
| 2 | - | |
| 3 | -/** | |
| 4 | - * Attachment Uploader class | |
| 5 | - * | |
| 6 | - * @since 1.1.0 | |
| 7 | - */ | |
| 8 | -class WeForms_Ajax_Upload { | |
| 9 | - | |
| 10 | - public function __construct() { | |
| 11 | - | |
| 12 | - // let WPUF handle the upload if installed | |
| 13 | - if ( class_exists( 'WPUF_Upload' ) ) { | |
| 14 | - return; | |
| 15 | - } | |
| 16 | - | |
| 17 | - add_action( 'wp_ajax_wpuf_upload_file', [$this, 'upload_file'] ); | |
| 18 | - add_action( 'wp_ajax_nopriv_wpuf_upload_file', [$this, 'upload_file'] ); | |
| 19 | - | |
| 20 | - add_action( 'wp_ajax_wpuf_file_del', [$this, 'delete_file'] ); | |
| 21 | - add_action( 'wp_ajax_nopriv_wpuf_file_del', [$this, 'delete_file'] ); | |
| 22 | - } | |
| 23 | - | |
| 24 | - /** | |
| 25 | - * Validate if it's coming from WordPress with a valid nonce | |
| 26 | - * | |
| 27 | - * @return void | |
| 28 | - */ | |
| 29 | - function validate_nonce() { | |
| 30 | - $nonce = isset( $_GET['nonce'] ) ? sanitize_text_field( wp_unslash( $_GET['nonce'] ) ) : ''; | |
| 31 | - | |
| 32 | - if ( !wp_verify_nonce( $nonce, 'wpuf-upload-nonce' ) ) { | |
| 33 | - die( 'error' ); | |
| 34 | - } | |
| 35 | - } | |
| 36 | - | |
| 37 | - /** | |
| 38 | - * Upload a file | |
| 39 | - * | |
| 40 | - * @param bool $image_only | |
| 41 | - * | |
| 42 | - * @return string | |
| 43 | - */ | |
| 44 | - public function upload_file( $image_only = false ) { | |
| 45 | - $this->validate_nonce(); | |
| 46 | - $nonce = isset( $_GET['nonce'] ) ? sanitize_text_field( wp_unslash( $_GET['nonce'] ) ) : ''; | |
| 47 | - | |
| 48 | - if ( ! wp_verify_nonce( $nonce, 'wpuf-upload-nonce' ) ) { | |
| 49 | - die( 'error' ); | |
| 50 | - } | |
| 51 | - | |
| 52 | - // a valid request will have a form ID | |
| 53 | - $form_id = isset( $_POST['form_id'] ) ? intval( sanitize_text_field( wp_unslash( $_POST['form_id'] ) ) ) : false; | |
| 54 | - | |
| 55 | - if ( !$form_id ) { | |
| 56 | - die( 'error' ); | |
| 57 | - } | |
| 58 | - | |
| 59 | - | |
| 60 | - $file = isset( $_FILES['wpuf_file'] ) ? array_map( 'sanitize_text_field', wp_unslash( $_FILES['wpuf_file'] ) ) : []; | |
| 61 | - | |
| 62 | - $upload = array( | |
| 63 | - 'name' => isset( $file['name'] ) ? $file['name'] : '', | |
| 64 | - 'type' => isset( $file['type'] ) ? $file['type'] : '', | |
| 65 | - 'tmp_name' => $_FILES['wpuf_file']['tmp_name'], | |
| 66 | - 'error' => isset( $file['error'] ) ? $file['error'] : '', | |
| 67 | - 'size' => isset( $file['size'] ) ? $file['size'] : '', | |
| 68 | - ); | |
| 69 | - | |
| 70 | - // $upload = array( | |
| 71 | - // 'name' => isset( $_FILES['wpuf_file']['name'] ) ? sanitize_file_name( wp_unslash( $_FILES['wpuf_file']['name'] ) ) : '', | |
| 72 | - // 'type' => isset( $_FILES['wpuf_file']['type'] ) ? sanitize_mime_type( wp_unslash( $_FILES['wpuf_file']['type'] ) ) : '', | |
| 73 | - // 'tmp_name' => $_FILES['wpuf_file']['tmp_name'], | |
| 74 | - // 'error' => isset( $_FILES['wpuf_file']['error'] ) ? sanitize_text_field( wp_unslash( $_FILES['wpuf_file']['error'] ) ) : '', | |
| 75 | - // 'size' => isset( $_FILES['wpuf_file']['size'] ) ? sanitize_text_field( wp_unslash( $_FILES['wpuf_file']['size'] ) ) : '' | |
| 76 | - // ); | |
| 77 | - | |
| 78 | - header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) ); | |
| 79 | - | |
| 80 | - $attach = $this->handle_upload( $upload ); | |
| 81 | - | |
| 82 | - if ( $attach['success'] ) { | |
| 83 | - $response = [ 'success' => true ]; | |
| 84 | - $response['html'] = $this->attach_html( $attach['attach_id'] ); | |
| 85 | - | |
| 86 | - echo wp_kses( $response['html'], [ | |
| 87 | - 'li' => [ | |
| 88 | - 'class' => [] | |
| 89 | - ], | |
| 90 | - 'div' => [ | |
| 91 | - 'class' => [] | |
| 92 | - ], | |
| 93 | - 'img' => [ | |
| 94 | - 'src' => [], | |
| 95 | - 'alt' => [] | |
| 96 | - ], | |
| 97 | - | |
| 98 | - 'input' => [ | |
| 99 | - 'type' => [], | |
| 100 | - 'name' => [], | |
| 101 | - 'value' => [] | |
| 102 | - ], | |
| 103 | - 'a' => [ | |
| 104 | - 'data-attach_id' => [], | |
| 105 | - 'href' => [], | |
| 106 | - 'class' => [] | |
| 107 | - ], | |
| 108 | - 'span' => [ | |
| 109 | - 'class' => [] | |
| 110 | - ] | |
| 111 | - ]); | |
| 112 | - } else { | |
| 113 | - echo 'error'; | |
| 114 | - } | |
| 115 | - | |
| 116 | - exit; | |
| 117 | - } | |
| 118 | - | |
| 119 | - /** | |
| 120 | - * Generic function to upload a file | |
| 121 | - * | |
| 122 | - * @param string $field_name file input field name | |
| 123 | - * | |
| 124 | - * @return bool|int attachment id on success, bool false instead | |
| 125 | - */ | |
| 126 | - public function handle_upload( $upload_data ) { | |
| 127 | - $uploaded_file = wp_handle_upload( $upload_data, ['test_form' => false] ); | |
| 128 | - | |
| 129 | - // If the wp_handle_upload call returned a local path for the image | |
| 130 | - if ( isset( $uploaded_file['file'] ) ) { | |
| 131 | - $file_loc = $uploaded_file['file']; | |
| 132 | - $file_name = basename( $upload_data['name'] ); | |
| 133 | - $file_type = wp_check_filetype( $file_name ); | |
| 134 | - | |
| 135 | - $attachment = [ | |
| 136 | - 'post_mime_type' => $file_type['type'], | |
| 137 | - 'post_title' => preg_replace( '/\.[^.]+$/', '', basename( $file_name ) ), | |
| 138 | - 'post_content' => '', | |
| 139 | - 'post_status' => 'inherit', | |
| 140 | - ]; | |
| 141 | - | |
| 142 | - $attach_id = wp_insert_attachment( $attachment, $file_loc ); | |
| 143 | - $attach_data = wp_generate_attachment_metadata( $attach_id, $file_loc ); | |
| 144 | - | |
| 145 | - wp_update_attachment_metadata( $attach_id, $attach_data ); | |
| 146 | - | |
| 147 | - // Store a unique deletion token for security (prevents IDOR attacks) | |
| 148 | - $delete_token = wp_generate_password( 32, false ); | |
| 149 | - update_post_meta( $attach_id, '_wpuf_delete_token', $delete_token ); | |
| 150 | - | |
| 151 | - return ['success' => true, 'attach_id' => $attach_id]; | |
| 152 | - } | |
| 153 | - | |
| 154 | - return ['success' => false, 'error' => $uploaded_file['error']]; | |
| 155 | - } | |
| 156 | - | |
| 157 | - /** | |
| 158 | - * Image attachment response | |
| 159 | - * | |
| 160 | - * @param int $attach_id | |
| 161 | - * @param string $type | |
| 162 | - * | |
| 163 | - * @return string | |
| 164 | - */ | |
| 165 | - public static function attach_html( $attach_id, $type = NULL ) { | |
| 166 | - if ( ! $type ) { | |
| 167 | - $type = isset( $_GET['type'] ) ? sanitize_text_field( wp_unslash( $_GET['type'] ) ) : 'image'; | |
| 168 | - } | |
| 169 | - | |
| 170 | - $attachment = get_post( $attach_id ); | |
| 171 | - | |
| 172 | - if ( !$attachment ) { | |
| 173 | - return; | |
| 174 | - } | |
| 175 | - | |
| 176 | - if ( wp_attachment_is_image( $attach_id ) ) { | |
| 177 | - $image = wp_get_attachment_image_src( $attach_id, 'thumbnail' ); | |
| 178 | - $image = $image[0]; | |
| 179 | - } else { | |
| 180 | - $image = wp_mime_type_icon( $attach_id ); | |
| 181 | - } | |
| 182 | - | |
| 183 | - // Get deletion token for security (prevents IDOR attacks) | |
| 184 | - $delete_token = get_post_meta( $attach_id, '_wpuf_delete_token', true ); | |
| 185 | - // If no token exists (legacy files), generate one now | |
| 186 | - if ( empty( $delete_token ) ) { | |
| 187 | - $delete_token = wp_generate_password( 32, false ); | |
| 188 | - update_post_meta( $attach_id, '_wpuf_delete_token', $delete_token ); | |
| 189 | - } | |
| 190 | - | |
| 191 | - $html = '<li class="ui-state-default wpuf-image-wrap thumbnail">'; | |
| 192 | - $html .= sprintf( '<div class="attachment-name"><img src="%s" alt="%s" /></div>', $image, esc_attr( $attachment->post_title ) ); | |
| 193 | - | |
| 194 | - $html .= sprintf( '<input type="hidden" name="wpuf_files[%s][]" value="%d">', $type, $attach_id ); | |
| 195 | - $html .= '<div class="caption">'; | |
| 196 | - $html .= sprintf( '<a href="#" class="attachment-delete" data-attach_id="%d" data-delete-token="%s"> <img src="%s" /></a>', $attach_id, esc_attr( $delete_token ), WEFORMS_ASSET_URI . '/images/del-img.png' ); | |
| 197 | - $html .= sprintf( '<span class="wpuf-drag-file"> <img src="%s" /></span>', WEFORMS_ASSET_URI . '/images/move-img.png' ); | |
| 198 | - $html .= '</div>'; | |
| 199 | - $html .= '</li>'; | |
| 200 | - | |
| 201 | - return $html; | |
| 202 | - } | |
| 203 | - | |
| 204 | - /** | |
| 205 | - * Delete a file | |
| 206 | - * | |
| 207 | - * @return void | |
| 208 | - */ | |
| 209 | - public function delete_file() { | |
| 210 | - check_ajax_referer( 'wpuf_nonce', 'nonce' ); | |
| 211 | - | |
| 212 | - $attach_id = isset( $_POST['attach_id'] ) ? intval( $_POST['attach_id'] ) : 0; | |
| 213 | - $attachment = get_post( $attach_id ); | |
| 214 | - | |
| 215 | - // Validate attachment exists | |
| 216 | - if ( ! $attachment || 'attachment' !== $attachment->post_type ) { | |
| 217 | - echo 'error'; | |
| 218 | - exit; | |
| 219 | - } | |
| 220 | - | |
| 221 | - $current_user_id = get_current_user_id(); | |
| 222 | - $is_authenticated = $current_user_id > 0; | |
| 223 | - $can_delete = false; | |
| 224 | - | |
| 225 | - if ( $is_authenticated ) { | |
| 226 | - // For authenticated users: must own the file OR have admin/editor capabilities | |
| 227 | - if ( $current_user_id == $attachment->post_author || current_user_can( 'delete_private_pages' ) ) { | |
| 228 | - $can_delete = true; | |
| 229 | - } | |
| 230 | - } else { | |
| 231 | - // For unauthenticated users: must provide the correct deletion token | |
| 232 | - // This prevents IDOR attacks where 0 == 0 would allow deletion of any guest upload | |
| 233 | - $delete_token = isset( $_POST['delete_token'] ) ? sanitize_text_field( wp_unslash( $_POST['delete_token'] ) ) : ''; | |
| 234 | - $stored_token = get_post_meta( $attach_id, '_wpuf_delete_token', true ); | |
| 235 | - | |
| 236 | - // Only allow deletion if token matches AND file was uploaded by guest (post_author == 0) | |
| 237 | - if ( ! empty( $delete_token ) && ! empty( $stored_token ) && | |
| 238 | - hash_equals( $stored_token, $delete_token ) && | |
| 239 | - $attachment->post_author == 0 ) { | |
| 240 | - $can_delete = true; | |
| 241 | - } | |
| 242 | - } | |
| 243 | - | |
| 244 | - if ( $can_delete ) { | |
| 245 | - wp_delete_attachment( $attach_id, true ); | |
| 246 | - echo 'success'; | |
| 247 | - } else { | |
| 248 | - echo 'error'; | |
| 249 | - } | |
| 250 | - | |
| 251 | - exit; | |
| 252 | - } | |
| 253 | -} | |
| 1 | +<?php | |
| 2 | + | |
| 3 | +/** | |
| 4 | + * Attachment Uploader class | |
| 5 | + * | |
| 6 | + * @since 1.1.0 | |
| 7 | + */ | |
| 8 | +class WeForms_Ajax_Upload { | |
| 9 | + | |
| 10 | + function __construct() { | |
| 11 | + | |
| 12 | + // let WPUF handle the upload if installed | |
| 13 | + if ( class_exists( 'WPUF_Upload' ) ) { | |
| 14 | + return; | |
| 15 | + } | |
| 16 | + | |
| 17 | + add_action( 'wp_ajax_wpuf_upload_file', array($this, 'upload_file') ); | |
| 18 | + add_action( 'wp_ajax_nopriv_wpuf_upload_file', array($this, 'upload_file') ); | |
| 19 | + | |
| 20 | + add_action( 'wp_ajax_wpuf_file_del', array($this, 'delete_file') ); | |
| 21 | + add_action( 'wp_ajax_nopriv_wpuf_file_del', array($this, 'delete_file') ); | |
| 22 | + } | |
| 23 | + | |
| 24 | + /** | |
| 25 | + * Validate if it's coming from WordPress with a valid nonce | |
| 26 | + * | |
| 27 | + * @return void | |
| 28 | + */ | |
| 29 | + function validate_nonce() { | |
| 30 | + $nonce = isset( $_GET['nonce'] ) ? $_GET['nonce'] : ''; | |
| 31 | + | |
| 32 | + if ( ! wp_verify_nonce( $nonce, 'wpuf-upload-nonce' ) ) { | |
| 33 | + die( 'error' ); | |
| 34 | + } | |
| 35 | + } | |
| 36 | + | |
| 37 | + /** | |
| 38 | + * Upload a file | |
| 39 | + * | |
| 40 | + * @param boolean $image_only | |
| 41 | + * | |
| 42 | + * @return string | |
| 43 | + */ | |
| 44 | + function upload_file( $image_only = false ) { | |
| 45 | + $this->validate_nonce(); | |
| 46 | + | |
| 47 | + // a valid request will have a form ID | |
| 48 | + $form_id = isset( $_POST['form_id'] ) ? intval( $_POST['form_id'] ) : false; | |
| 49 | + | |
| 50 | + if ( ! $form_id ) { | |
| 51 | + die( 'error' ); | |
| 52 | + } | |
| 53 | + | |
| 54 | + $upload = array( | |
| 55 | + 'name' => $_FILES['wpuf_file']['name'], | |
| 56 | + 'type' => $_FILES['wpuf_file']['type'], | |
| 57 | + 'tmp_name' => $_FILES['wpuf_file']['tmp_name'], | |
| 58 | + 'error' => $_FILES['wpuf_file']['error'], | |
| 59 | + 'size' => $_FILES['wpuf_file']['size'] | |
| 60 | + ); | |
| 61 | + | |
| 62 | + header('Content-Type: text/html; charset=' . get_option('blog_charset')); | |
| 63 | + | |
| 64 | + $attach = $this->handle_upload( $upload ); | |
| 65 | + | |
| 66 | + if ( $attach['success'] ) { | |
| 67 | + | |
| 68 | + $response = array( 'success' => true ); | |
| 69 | + $response['html'] = $this->attach_html( $attach['attach_id'] ); | |
| 70 | + | |
| 71 | + echo $response['html']; | |
| 72 | + } else { | |
| 73 | + echo 'error'; | |
| 74 | + } | |
| 75 | + | |
| 76 | + exit; | |
| 77 | + } | |
| 78 | + | |
| 79 | + /** | |
| 80 | + * Generic function to upload a file | |
| 81 | + * | |
| 82 | + * @param string $field_name file input field name | |
| 83 | + * | |
| 84 | + * @return bool|int attachment id on success, bool false instead | |
| 85 | + */ | |
| 86 | + function handle_upload( $upload_data ) { | |
| 87 | + | |
| 88 | + $uploaded_file = wp_handle_upload( $upload_data, array('test_form' => false) ); | |
| 89 | + | |
| 90 | + // If the wp_handle_upload call returned a local path for the image | |
| 91 | + if ( isset( $uploaded_file['file'] ) ) { | |
| 92 | + $file_loc = $uploaded_file['file']; | |
| 93 | + $file_name = basename( $upload_data['name'] ); | |
| 94 | + $file_type = wp_check_filetype( $file_name ); | |
| 95 | + | |
| 96 | + $attachment = array( | |
| 97 | + 'post_mime_type' => $file_type['type'], | |
| 98 | + 'post_title' => preg_replace( '/\.[^.]+$/', '', basename( $file_name ) ), | |
| 99 | + 'post_content' => '', | |
| 100 | + 'post_status' => 'inherit' | |
| 101 | + ); | |
| 102 | + | |
| 103 | + $attach_id = wp_insert_attachment( $attachment, $file_loc ); | |
| 104 | + $attach_data = wp_generate_attachment_metadata( $attach_id, $file_loc ); | |
| 105 | + | |
| 106 | + wp_update_attachment_metadata( $attach_id, $attach_data ); | |
| 107 | + | |
| 108 | + return array('success' => true, 'attach_id' => $attach_id); | |
| 109 | + } | |
| 110 | + | |
| 111 | + return array('success' => false, 'error' => $uploaded_file['error']); | |
| 112 | + } | |
| 113 | + | |
| 114 | + /** | |
| 115 | + * Image attachment response | |
| 116 | + * | |
| 117 | + * @param integer $attach_id | |
| 118 | + * @param string $type | |
| 119 | + * | |
| 120 | + * @return string | |
| 121 | + */ | |
| 122 | + public static function attach_html( $attach_id, $type = NULL ) { | |
| 123 | + if ( ! $type ) { | |
| 124 | + $type = isset( $_GET['type'] ) ? $_GET['type'] : 'image'; | |
| 125 | + } | |
| 126 | + | |
| 127 | + $attachment = get_post( $attach_id ); | |
| 128 | + | |
| 129 | + if ( ! $attachment ) { | |
| 130 | + return; | |
| 131 | + } | |
| 132 | + | |
| 133 | + if ( wp_attachment_is_image( $attach_id ) ) { | |
| 134 | + $image = wp_get_attachment_image_src( $attach_id, 'thumbnail' ); | |
| 135 | + $image = $image[0]; | |
| 136 | + } else { | |
| 137 | + $image = wp_mime_type_icon( $attach_id ); | |
| 138 | + } | |
| 139 | + | |
| 140 | + $html = '<li class="ui-state-default wpuf-image-wrap thumbnail">'; | |
| 141 | + $html .= sprintf( '<div class="attachment-name"><img src="%s" alt="%s" /></div>', $image, esc_attr( $attachment->post_title ) ); | |
| 142 | + | |
| 143 | + $html .= sprintf( '<input type="hidden" name="wpuf_files[%s][]" value="%d">', $type, $attach_id ); | |
| 144 | + $html .= '<div class="caption">'; | |
| 145 | + $html .= sprintf( '<a href="#" class="attachment-delete" data-attach_id="%d"> <img src="%s" /></a>', $attach_id, WEFORMS_ASSET_URI . '/images/del-img.png' ); | |
| 146 | + $html .= sprintf( '<span class="wpuf-drag-file"> <img src="%s" /></span>', WEFORMS_ASSET_URI . '/images/move-img.png' ); | |
| 147 | + $html .= '</div>'; | |
| 148 | + $html .= '</li>'; | |
| 149 | + | |
| 150 | + return $html; | |
| 151 | + } | |
| 152 | + | |
| 153 | + /** | |
| 154 | + * Delete a file | |
| 155 | + * | |
| 156 | + * @return void | |
| 157 | + */ | |
| 158 | + function delete_file() { | |
| 159 | + check_ajax_referer( 'wpuf_nonce', 'nonce' ); | |
| 160 | + | |
| 161 | + $attach_id = isset( $_POST['attach_id'] ) ? intval( $_POST['attach_id'] ) : 0; | |
| 162 | + $attachment = get_post( $attach_id ); | |
| 163 | + | |
| 164 | + //post author or editor role | |
| 165 | + if ( get_current_user_id() == $attachment->post_author || current_user_can( 'delete_private_pages' ) ) { | |
| 166 | + wp_delete_attachment( $attach_id, true ); | |
| 167 | + } | |
| 168 | + | |
| 169 | + echo 'success'; | |
| 170 | + exit; | |
| 171 | + } | |
| 172 | + | |
| 173 | +} | |
