| @@ -143,12 +143,8 @@ | ||
| 143 | 143 | $attach_data = wp_generate_attachment_metadata( $attach_id, $file_loc ); |
| 144 | 144 | |
| 145 | 145 | wp_update_attachment_metadata( $attach_id, $attach_data ); |
| 146 | 146 | |
| 147 | - // Store a unique deletion token for security (prevents IDOR attacks) | |
| 148 | - $delete_token = wp_generate_password( 32, false ); | |
| 149 | - update_post_meta( $attach_id, '_wpuf_delete_token', $delete_token ); | |
| 150 | - | |
| 151 | 147 | return ['success' => true, 'attach_id' => $attach_id]; |
| 152 | 148 | } |
| 153 | 149 | |
| 154 | 150 | return ['success' => false, 'error' => $uploaded_file['error']]; |
| @@ -179,22 +175,14 @@ | ||
| 179 | 175 | } else { |
| 180 | 176 | $image = wp_mime_type_icon( $attach_id ); |
| 181 | 177 | } |
| 182 | 178 | |
| 183 | - // Get deletion token for security (prevents IDOR attacks) | |
| 184 | - $delete_token = get_post_meta( $attach_id, '_wpuf_delete_token', true ); | |
| 185 | - // If no token exists (legacy files), generate one now | |
| 186 | - if ( empty( $delete_token ) ) { | |
| 187 | - $delete_token = wp_generate_password( 32, false ); | |
| 188 | - update_post_meta( $attach_id, '_wpuf_delete_token', $delete_token ); | |
| 189 | - } | |
| 190 | - | |
| 191 | 179 | $html = '<li class="ui-state-default wpuf-image-wrap thumbnail">'; |
| 192 | 180 | $html .= sprintf( '<div class="attachment-name"><img src="%s" alt="%s" /></div>', $image, esc_attr( $attachment->post_title ) ); |
| 193 | 181 | |
| 194 | 182 | $html .= sprintf( '<input type="hidden" name="wpuf_files[%s][]" value="%d">', $type, $attach_id ); |
| 195 | 183 | $html .= '<div class="caption">'; |
| 196 | - $html .= sprintf( '<a href="#" class="attachment-delete" data-attach_id="%d" data-delete-token="%s"> <img src="%s" /></a>', $attach_id, esc_attr( $delete_token ), WEFORMS_ASSET_URI . '/images/del-img.png' ); | |
| 184 | + $html .= sprintf( '<a href="#" class="attachment-delete" data-attach_id="%d"> <img src="%s" /></a>', $attach_id, WEFORMS_ASSET_URI . '/images/del-img.png' ); | |
| 197 | 185 | $html .= sprintf( '<span class="wpuf-drag-file"> <img src="%s" /></span>', WEFORMS_ASSET_URI . '/images/move-img.png' ); |
| 198 | 186 | $html .= '</div>'; |
| 199 | 187 | $html .= '</li>'; |
| 200 | 188 | |
| @@ -211,43 +199,13 @@ | ||
| 211 | 199 | |
| 212 | 200 | $attach_id = isset( $_POST['attach_id'] ) ? intval( $_POST['attach_id'] ) : 0; |
| 213 | 201 | $attachment = get_post( $attach_id ); |
| 214 | 202 | |
| 215 | - // Validate attachment exists | |
| 216 | - if ( ! $attachment || 'attachment' !== $attachment->post_type ) { | |
| 217 | - echo 'error'; | |
| 218 | - exit; | |
| 219 | - } | |
| 220 | - | |
| 221 | - $current_user_id = get_current_user_id(); | |
| 222 | - $is_authenticated = $current_user_id > 0; | |
| 223 | - $can_delete = false; | |
| 224 | - | |
| 225 | - if ( $is_authenticated ) { | |
| 226 | - // For authenticated users: must own the file OR have admin/editor capabilities | |
| 227 | - if ( $current_user_id == $attachment->post_author || current_user_can( 'delete_private_pages' ) ) { | |
| 228 | - $can_delete = true; | |
| 229 | - } | |
| 230 | - } else { | |
| 231 | - // For unauthenticated users: must provide the correct deletion token | |
| 232 | - // This prevents IDOR attacks where 0 == 0 would allow deletion of any guest upload | |
| 233 | - $delete_token = isset( $_POST['delete_token'] ) ? sanitize_text_field( wp_unslash( $_POST['delete_token'] ) ) : ''; | |
| 234 | - $stored_token = get_post_meta( $attach_id, '_wpuf_delete_token', true ); | |
| 235 | - | |
| 236 | - // Only allow deletion if token matches AND file was uploaded by guest (post_author == 0) | |
| 237 | - if ( ! empty( $delete_token ) && ! empty( $stored_token ) && | |
| 238 | - hash_equals( $stored_token, $delete_token ) && | |
| 239 | - $attachment->post_author == 0 ) { | |
| 240 | - $can_delete = true; | |
| 241 | - } | |
| 242 | - } | |
| 243 | - | |
| 244 | - if ( $can_delete ) { | |
| 203 | + //post author or editor role | |
| 204 | + if ( get_current_user_id() == $attachment->post_author || current_user_can( 'delete_private_pages' ) ) { | |
| 245 | 205 | wp_delete_attachment( $attach_id, true ); |
| 246 | - echo 'success'; | |
| 247 | - } else { | |
| 248 | - echo 'error'; | |
| 249 | 206 | } |
| 250 | 207 | |
| 208 | + echo 'success'; | |
| 251 | 209 | exit; |
| 252 | 210 | } |
| 253 | 211 | } |
