weforms / includes / class-ajax-upload.php

class-ajax-upload.php in weForms – Easy Drag & Drop Contact Form Builder For WordPress 1.6.7, at includes/class-ajax-upload.php

212 lines 7.2 KB

Raw Download Zip

1	<?php
2
3	/**
4	* Attachment Uploader class
5	*
6	* @since 1.1.0
7	*/
8	class WeForms_Ajax_Upload {
9
10	public function __construct() {
11
12	// let WPUF handle the upload if installed
13	if ( class_exists( 'WPUF_Upload' ) ) {
14	return;
15	}
16
17	add_action( 'wp_ajax_wpuf_upload_file', [$this, 'upload_file'] );
18	add_action( 'wp_ajax_nopriv_wpuf_upload_file', [$this, 'upload_file'] );
19
20	add_action( 'wp_ajax_wpuf_file_del', [$this, 'delete_file'] );
21	add_action( 'wp_ajax_nopriv_wpuf_file_del', [$this, 'delete_file'] );
22	}
23
24	/**
25	* Validate if it's coming from WordPress with a valid nonce
26	*
27	* @return void
28	*/
29	function validate_nonce() {
30	$nonce = isset( $_GET['nonce'] ) ? sanitize_text_field( wp_unslash( $_GET['nonce'] ) ) : '';
31
32	if ( !wp_verify_nonce( $nonce, 'wpuf-upload-nonce' ) ) {
33	die( 'error' );
34	}
35	}
36
37	/**
38	* Upload a file
39	*
40	* @param bool $image_only
41	*
42	* @return string
43	*/
44	public function upload_file( $image_only = false ) {
45	$this->validate_nonce();
46	$nonce = isset( $_GET['nonce'] ) ? sanitize_text_field( wp_unslash( $_GET['nonce'] ) ) : '';
47
48	if ( ! wp_verify_nonce( $nonce, 'wpuf-upload-nonce' ) ) {
49	die( 'error' );
50	}
51
52	// a valid request will have a form ID
53	$form_id = isset( $_POST['form_id'] ) ? intval( sanitize_text_field( wp_unslash( $_POST['form_id'] ) ) ) : false;
54
55	if ( !$form_id ) {
56	die( 'error' );
57	}
58
59
60	$file = isset( $_FILES['wpuf_file'] ) ? array_map( 'sanitize_text_field', wp_unslash( $_FILES['wpuf_file'] ) ) : [];
61
62	$upload = array(
63	'name' => isset( $file['name'] ) ? $file['name'] : '',
64	'type' => isset( $file['type'] ) ? $file['type'] : '',
65	'tmp_name' => $_FILES['wpuf_file']['tmp_name'],
66	'error' => isset( $file['error'] ) ? $file['error'] : '',
67	'size' => isset( $file['size'] ) ? $file['size'] : '',
68	);
69
70	// $upload = array(
71	// 'name' => isset( $_FILES['wpuf_file']['name'] ) ? sanitize_file_name( wp_unslash( $_FILES['wpuf_file']['name'] ) ) : '',
72	// 'type' => isset( $_FILES['wpuf_file']['type'] ) ? sanitize_mime_type( wp_unslash( $_FILES['wpuf_file']['type'] ) ) : '',
73	// 'tmp_name' => $_FILES['wpuf_file']['tmp_name'],
74	// 'error' => isset( $_FILES['wpuf_file']['error'] ) ? sanitize_text_field( wp_unslash( $_FILES['wpuf_file']['error'] ) ) : '',
75	// 'size' => isset( $_FILES['wpuf_file']['size'] ) ? sanitize_text_field( wp_unslash( $_FILES['wpuf_file']['size'] ) ) : ''
76	// );
77
78	header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) );
79
80	$attach = $this->handle_upload( $upload );
81
82	if ( $attach['success'] ) {
83	$response = [ 'success' => true ];
84	$response['html'] = $this->attach_html( $attach['attach_id'] );
85
86	echo wp_kses( $response['html'], [
87	'li' => [
88	'class' => []
89	],
90	'div' => [
91	'class' => []
92	],
93	'img' => [
94	'src' => [],
95	'alt' => []
96	],
97
98	'input' => [
99	'type' => [],
100	'name' => [],
101	'value' => []
102	],
103	'a' => [
104	'data-attach_id' => [],
105	'href' => [],
106	'class' => []
107	],
108	'span' => [
109	'class' => []
110	]
111	]);
112	} else {
113	echo 'error';
114	}
115
116	exit;
117	}
118
119	/**
120	* Generic function to upload a file
121	*
122	* @param string $field_name file input field name
123	*
124	* @return bool\|int attachment id on success, bool false instead
125	*/
126	public function handle_upload( $upload_data ) {
127	$uploaded_file = wp_handle_upload( $upload_data, ['test_form' => false] );
128
129	// If the wp_handle_upload call returned a local path for the image
130	if ( isset( $uploaded_file['file'] ) ) {
131	$file_loc = $uploaded_file['file'];
132	$file_name = basename( $upload_data['name'] );
133	$file_type = wp_check_filetype( $file_name );
134
135	$attachment = [
136	'post_mime_type' => $file_type['type'],
137	'post_title' => preg_replace( '/\.[^.]+$/', '', basename( $file_name ) ),
138	'post_content' => '',
139	'post_status' => 'inherit',
140	];
141
142	$attach_id = wp_insert_attachment( $attachment, $file_loc );
143	$attach_data = wp_generate_attachment_metadata( $attach_id, $file_loc );
144
145	wp_update_attachment_metadata( $attach_id, $attach_data );
146
147	return ['success' => true, 'attach_id' => $attach_id];
148	}
149
150	return ['success' => false, 'error' => $uploaded_file['error']];
151	}
152
153	/**
154	* Image attachment response
155	*
156	* @param int $attach_id
157	* @param string $type
158	*
159	* @return string
160	*/
161	public static function attach_html( $attach_id, $type = NULL ) {
162	if ( ! $type ) {
163	$type = isset( $_GET['type'] ) ? sanitize_text_field( wp_unslash( $_GET['type'] ) ) : 'image';
164	}
165
166	$attachment = get_post( $attach_id );
167
168	if ( !$attachment ) {
169	return;
170	}
171
172	if ( wp_attachment_is_image( $attach_id ) ) {
173	$image = wp_get_attachment_image_src( $attach_id, 'thumbnail' );
174	$image = $image[0];
175	} else {
176	$image = wp_mime_type_icon( $attach_id );
177	}
178
179	$html = '<li class="ui-state-default wpuf-image-wrap thumbnail">';
180	$html .= sprintf( '<div class="attachment-name"><img src="%s" alt="%s" /></div>', $image, esc_attr( $attachment->post_title ) );
181
182	$html .= sprintf( '<input type="hidden" name="wpuf_files[%s][]" value="%d">', $type, $attach_id );
183	$html .= '<div class="caption">';
184	$html .= sprintf( '<a href="#" class="attachment-delete" data-attach_id="%d"> <img src="%s" /></a>', $attach_id, WEFORMS_ASSET_URI . '/images/del-img.png' );
185	$html .= sprintf( '<span class="wpuf-drag-file"> <img src="%s" /></span>', WEFORMS_ASSET_URI . '/images/move-img.png' );
186	$html .= '</div>';
187	$html .= '</li>';
188
189	return $html;
190	}
191
192	/**
193	* Delete a file
194	*
195	* @return void
196	*/
197	public function delete_file() {
198	check_ajax_referer( 'wpuf_nonce', 'nonce' );
199
200	$attach_id = isset( $_POST['attach_id'] ) ? intval( $_POST['attach_id'] ) : 0;
201	$attachment = get_post( $attach_id );
202
203	//post author or editor role
204	if ( get_current_user_id() == $attachment->post_author \|\| current_user_can( 'delete_private_pages' ) ) {
205	wp_delete_attachment( $attach_id, true );
206	}
207
208	echo 'success';
209	exit;
210	}
211	}
212