| @@ -666,30 +666,10 @@ | ||
| 666 | 666 | //pree($ret); |
| 667 | 667 | |
| 668 | 668 | return $ret; |
| 669 | 669 | } |
| 670 | - function wpdocs_create_folder_post( $post_parent, $post_title = "New Folder" ) { | |
| 671 | - | |
| 672 | - if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) { | |
| 673 | - return 0; | |
| 674 | - } | |
| 675 | 670 | |
| 676 | - $post_parent = absint( $post_parent ); | |
| 677 | - $post_title = sanitize_text_field( $post_title ); | |
| 678 | - | |
| 679 | - $my_post = array( | |
| 680 | - 'post_title' => $post_title, | |
| 681 | - 'post_content' => '', | |
| 682 | - 'post_status' => 'hidden', | |
| 683 | - 'post_author' => get_current_user_id(), | |
| 684 | - 'post_type' => 'wpdocs_folder', | |
| 685 | - 'post_parent' => ( ( $post_parent > 0 && wpdocs_folder_exists( $post_parent ) ) ? $post_parent : 0 ), | |
| 686 | - 'post_category' => array(), | |
| 687 | - ); | |
| 688 | - | |
| 689 | - return wp_insert_post( $my_post ); | |
| 690 | - } | |
| 691 | - /*function wpdocs_create_folder_post($post_parent, $post_title = "New Folder") | |
| 671 | + function wpdocs_create_folder_post($post_parent, $post_title = "New Folder") | |
| 692 | 672 | { |
| 693 | 673 | |
| 694 | 674 | $my_post = array( |
| 695 | 675 | 'post_title' => $post_title, |
| @@ -703,9 +683,9 @@ | ||
| 703 | 683 | |
| 704 | 684 | $dir_id = wp_insert_post($my_post); |
| 705 | 685 | |
| 706 | 686 | return $dir_id; |
| 707 | - }*/ | |
| 687 | + } | |
| 708 | 688 | |
| 709 | 689 | add_action('wp_ajax_wpdocs_create_folder', 'wpdocs_create_folder'); |
| 710 | 690 | |
| 711 | 691 | function wpdocs_create_folder() |
| @@ -841,68 +821,11 @@ | ||
| 841 | 821 | |
| 842 | 822 | } |
| 843 | 823 | } |
| 844 | 824 | |
| 845 | - /** | |
| 846 | - * Centralize the "can this user edit this folder?" decision. | |
| 847 | - * Admins always pass; otherwise require the folder to be owned by the user. | |
| 848 | - */ | |
| 849 | - function wpdocs_user_can_edit_folder( $dir_id ) { | |
| 850 | - if ( current_user_can( 'manage_options' ) ) { | |
| 851 | - return true; | |
| 852 | - } | |
| 853 | - | |
| 854 | - $dir = get_post( $dir_id ); | |
| 855 | - if ( ! $dir || 'wpdocs_folder' !== $dir->post_type ) { // adjust CPT slug | |
| 856 | - return false; | |
| 857 | - } | |
| 858 | - | |
| 859 | - return (int) $dir->post_author === get_current_user_id(); | |
| 860 | - } | |
| 861 | - | |
| 862 | 825 | add_action('wp_ajax_wpdocs_add_files', 'wpdocs_add_files'); |
| 863 | 826 | |
| 864 | - function wpdocs_add_files() { | |
| 865 | - | |
| 866 | - // 1) Capability FIRST — before nonce, before anything. | |
| 867 | - if ( ! is_user_logged_in() || ! current_user_can( 'upload_files' ) ) { | |
| 868 | - wp_send_json_error( array( 'message' => __( 'Insufficient permissions.', 'wp-docs' ) ), 403 ); | |
| 869 | - } | |
| 870 | - | |
| 871 | - // 2) Nonce check. | |
| 872 | - if ( empty( $_POST['nonce'] ) | |
| 873 | - || ! wp_verify_nonce( | |
| 874 | - sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), | |
| 875 | - 'wpdocs_update_options_nonce' | |
| 876 | - ) | |
| 877 | - ) { | |
| 878 | - wp_send_json_error( array( 'message' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 879 | - } | |
| 880 | - | |
| 881 | - // 3) Input validation. | |
| 882 | - $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0; | |
| 883 | - if ( ! $dir_id ) { | |
| 884 | - wp_send_json_error( array( 'message' => __( 'Invalid folder.', 'wp-docs' ) ), 400 ); | |
| 885 | - } | |
| 886 | - | |
| 887 | - // 4) Per-folder ownership / capability gate. | |
| 888 | - if ( ! wpdocs_user_can_edit_folder( $dir_id ) ) { | |
| 889 | - wp_send_json_error( array( 'message' => __( 'You cannot modify this folder.', 'wp-docs' ) ), 403 ); | |
| 890 | - } | |
| 891 | - | |
| 892 | - $files = isset( $_POST['files'] ) ? sanitize_wpdocs_data( $_POST['files'] ) : array(); | |
| 893 | - $files = is_array( $files ) ? $files : array( $files ); | |
| 894 | - $files = array_filter( array_map( 'absint', $files ) ); | |
| 895 | - | |
| 896 | - wpdocs_update_files_meta( $dir_id, $files ); | |
| 897 | - | |
| 898 | - $ret = ! empty( $files ) ? wpdocs_list_added_items( $dir_id ) : ''; | |
| 899 | - | |
| 900 | - echo $ret; | |
| 901 | - exit; | |
| 902 | - } | |
| 903 | - | |
| 904 | - /*function wpdocs_add_files_old(){ | |
| 827 | + function wpdocs_add_files(){ | |
| 905 | 828 | |
| 906 | 829 | $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce'])); |
| 907 | 830 | |
| 908 | 831 | if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) ) |
| @@ -928,9 +851,9 @@ | ||
| 928 | 851 | } |
| 929 | 852 | |
| 930 | 853 | echo $ret; |
| 931 | 854 | exit; |
| 932 | - }*/ | |
| 855 | + } | |
| 933 | 856 | function wpdocs_list_added_items($dir) |
| 934 | 857 | { |
| 935 | 858 | |
| 936 | 859 | global $wpdocs_options, $icon_sub_path, $wpdocs_url; |
| @@ -2195,53 +2118,8 @@ | ||
| 2195 | 2118 | add_action('wp_ajax_wpdocs_update_folder', 'wpdocs_update_folder'); |
| 2196 | 2119 | |
| 2197 | 2120 | function wpdocs_update_folder() { |
| 2198 | 2121 | |
| 2199 | - if ( ! current_user_can( 'manage_options' ) ) { | |
| 2200 | - wp_send_json_error( array( 'msg' => __( 'Unauthorized access.', 'wp-docs' ) ), 403 ); | |
| 2201 | - } | |
| 2202 | - | |
| 2203 | - if ( | |
| 2204 | - empty( $_POST['nonce'] ) || | |
| 2205 | - ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) | |
| 2206 | - ) { | |
| 2207 | - wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 2208 | - } | |
| 2209 | - | |
| 2210 | - $dir_id = absint( $_POST['dir_id'] ?? 0 ); | |
| 2211 | - $resource_id = base64_decode( sanitize_text_field( $_POST['resource_id'] ?? '' ) ); | |
| 2212 | - $new_name = sanitize_text_field( $_POST['new_name'] ?? '' ); | |
| 2213 | - | |
| 2214 | - if ( ! $dir_id || $resource_id != $dir_id || ! wpdocs_folder_exists( $dir_id ) ) { | |
| 2215 | - wp_send_json_error( array( 'msg' => __( 'Invalid folder ID or resource mismatch.', 'wp-docs' ) ), 400 ); | |
| 2216 | - } | |
| 2217 | - | |
| 2218 | - global $wpdb, $wpdocs_post_types, $wpdocs_post_status; | |
| 2219 | - | |
| 2220 | - $updated = $wpdb->query( | |
| 2221 | - $wpdb->prepare( | |
| 2222 | - "UPDATE $wpdb->posts | |
| 2223 | - SET post_title = %s | |
| 2224 | - WHERE ID = %d | |
| 2225 | - AND post_type IN ('" . implode( "','", array_map( 'esc_sql', $wpdocs_post_types ) ) . "') | |
| 2226 | - AND post_status = %s", | |
| 2227 | - htmlspecialchars_decode( $new_name ), | |
| 2228 | - $dir_id, | |
| 2229 | - $wpdocs_post_status | |
| 2230 | - ) | |
| 2231 | - ); | |
| 2232 | - | |
| 2233 | - wp_send_json_success( | |
| 2234 | - array( | |
| 2235 | - 'msg' => $updated | |
| 2236 | - ? __( 'Successfully updated.', 'wp-docs' ) | |
| 2237 | - : __( 'No changes were made. Input seems the same as before.', 'wp-docs' ), | |
| 2238 | - ) | |
| 2239 | - ); | |
| 2240 | - } | |
| 2241 | - | |
| 2242 | - /*function wpdocs_update_folder() { | |
| 2243 | - | |
| 2244 | 2122 | |
| 2245 | 2123 | if ( ! current_user_can('edit_posts') ) { |
| 2246 | 2124 | wp_send_json_error(['msg' => __('Unauthorized access.', 'wp-docs')]); |
| 2247 | 2125 | } |
| @@ -2287,35 +2165,14 @@ | ||
| 2287 | 2165 | $ret['msg'] = __('Invalid folder ID or resource mismatch.', 'wp-docs'); |
| 2288 | 2166 | } |
| 2289 | 2167 | |
| 2290 | 2168 | wp_send_json_success($ret); |
| 2291 | - }*/ | |
| 2169 | + } | |
| 2292 | 2170 | |
| 2293 | 2171 | |
| 2294 | 2172 | add_action('wp_ajax_wpdocs_delete_folder', 'wpdocs_delete_folder'); |
| 2295 | 2173 | |
| 2296 | - function wpdocs_delete_folder() { | |
| 2297 | - | |
| 2298 | - if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) { | |
| 2299 | - wp_send_json_error( array( 'msg' => __( 'Unauthorized user', 'wp-docs' ) ), 403 ); | |
| 2300 | - } | |
| 2301 | - | |
| 2302 | - if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) { | |
| 2303 | - wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 2304 | - } | |
| 2305 | - | |
| 2306 | - $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0; | |
| 2307 | - $resource_id = base64_decode( sanitize_wpdocs_data( $_POST['resource_id'] ?? '' ) ); | |
| 2308 | - | |
| 2309 | - if ( ! $dir_id || $dir_id != $resource_id || ! wpdocs_folder_exists( $dir_id ) ) { | |
| 2310 | - wp_send_json_error( array( 'msg' => __( 'Invalid folder.', 'wp-docs' ) ), 400 ); | |
| 2311 | - } | |
| 2312 | - | |
| 2313 | - wpdocs_recursive_delete_folder( $dir_id ); | |
| 2314 | - | |
| 2315 | - wp_send_json_success(); | |
| 2316 | - } | |
| 2317 | - /*function wpdocs_delete_folder() | |
| 2174 | + function wpdocs_delete_folder() | |
| 2318 | 2175 | { |
| 2319 | 2176 | |
| 2320 | 2177 | if ( ! current_user_can( 'manage_options' ) ) { |
| 2321 | 2178 | wp_send_json_error( __( 'Unauthorized user', 'wp-docs' ) ); |
| @@ -2334,9 +2191,9 @@ | ||
| 2334 | 2191 | wpdocs_recursive_delete_folder($dir_id); |
| 2335 | 2192 | } |
| 2336 | 2193 | |
| 2337 | 2194 | exit; |
| 2338 | - } */ | |
| 2195 | + } | |
| 2339 | 2196 | |
| 2340 | 2197 | |
| 2341 | 2198 | |
| 2342 | 2199 | add_action('wp_ajax_wpdocs_delete_files', 'wpdocs_delete_files'); |
| @@ -2416,59 +2273,11 @@ | ||
| 2416 | 2273 | return update_post_meta($dir_id, 'wpdocs_items', $wpdocs_items); |
| 2417 | 2274 | } |
| 2418 | 2275 | } |
| 2419 | 2276 | } |
| 2277 | + | |
| 2278 | + | |
| 2420 | 2279 | |
| 2421 | - function wpdocs_delete_files() { | |
| 2422 | - if ( ! is_user_logged_in() || ! current_user_can( 'delete_posts' ) ) { | |
| 2423 | - wp_send_json_error( array( 'message' => __( 'Insufficient permissions.', 'wp-docs' ) ), 403 ); | |
| 2424 | - } | |
| 2425 | - | |
| 2426 | - if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) { | |
| 2427 | - wp_send_json_error( array( 'message' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 2428 | - } | |
| 2429 | - | |
| 2430 | - $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0; | |
| 2431 | - $files = isset( $_POST['files'] ) ? (array) $_POST['files'] : array(); | |
| 2432 | - $files = array_values( array_unique( array_filter( array_map( 'absint', $files ) ) ) ); | |
| 2433 | - | |
| 2434 | - if ( ! $dir_id || ! wpdocs_folder_exists( $dir_id ) || empty( $files ) ) { | |
| 2435 | - wp_send_json_error( array( 'message' => __( 'Invalid request.', 'wp-docs' ) ), 400 ); | |
| 2436 | - } | |
| 2437 | - | |
| 2438 | - $is_admin = current_user_can( 'manage_options' ); | |
| 2439 | - $is_owner = wpdocs_user_can_edit_folder( $dir_id ); | |
| 2440 | - | |
| 2441 | - if ( ! $is_admin && ! $is_owner ) { | |
| 2442 | - wp_send_json_error( array( 'message' => __( 'You cannot delete files from this folder.', 'wp-docs' ) ), 403 ); | |
| 2443 | - } | |
| 2444 | - | |
| 2445 | - $allowed = array(); | |
| 2446 | - foreach ( $files as $file_id ) { | |
| 2447 | - $attachment = get_post( $file_id ); | |
| 2448 | - if ( ! $attachment || 'attachment' !== $attachment->post_type ) { | |
| 2449 | - continue; | |
| 2450 | - } | |
| 2451 | - if ( $is_admin || current_user_can( 'edit_post', $file_id ) ) { | |
| 2452 | - $allowed[] = $file_id; | |
| 2453 | - } | |
| 2454 | - } | |
| 2455 | - | |
| 2456 | - if ( empty( $allowed ) ) { | |
| 2457 | - wp_send_json_error( array( 'message' => __( 'None of the specified files can be deleted by you.', 'wp-docs' ) ), 403 ); | |
| 2458 | - } | |
| 2459 | - | |
| 2460 | - wpdocs_del_items_by_user( $dir_id, $allowed, get_current_user_id() ); | |
| 2461 | - | |
| 2462 | - $wpdocs_items = wpdocs_added_items( $dir_id ); | |
| 2463 | - $wpdocs_items = array_values( array_unique( array_diff( (array) $wpdocs_items, $allowed ) ) ); | |
| 2464 | - | |
| 2465 | - update_post_meta( $dir_id, 'wpdocs_items', $wpdocs_items ); | |
| 2466 | - | |
| 2467 | - wp_send_json_success( array( 'dir_id' => $dir_id, 'files' => $allowed ) ); | |
| 2468 | - } | |
| 2469 | - | |
| 2470 | - /* | |
| 2471 | 2280 | function wpdocs_delete_files() |
| 2472 | 2281 | { |
| 2473 | 2282 | |
| 2474 | 2283 | $dir_id = sanitize_wpdocs_data($_POST['dir_id']); |
| @@ -2492,9 +2301,9 @@ | ||
| 2492 | 2301 | } |
| 2493 | 2302 | |
| 2494 | 2303 | |
| 2495 | 2304 | exit; |
| 2496 | - } */ | |
| 2305 | + } | |
| 2497 | 2306 | |
| 2498 | 2307 | function wpd_admin_footer(){ |
| 2499 | 2308 | |
| 2500 | 2309 | ?> |
| @@ -2790,46 +2599,11 @@ | ||
| 2790 | 2599 | } |
| 2791 | 2600 | } |
| 2792 | 2601 | |
| 2793 | 2602 | add_action('wp_ajax_wpdocs_update_view', 'wpdocs_update_view'); |
| 2794 | - | |
| 2795 | - | |
| 2796 | - if ( ! function_exists( 'wpdocs_update_view' ) ) { | |
| 2797 | - function wpdocs_update_view() { | |
| 2798 | - | |
| 2799 | - if ( ! is_user_logged_in() || ! current_user_can( 'read' ) ) { | |
| 2800 | - wp_send_json_error( array( 'msg' => __( 'Unauthorized access.', 'wp-docs' ) ), 403 ); | |
| 2801 | - } | |
| 2802 | - | |
| 2803 | - if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) { | |
| 2804 | - wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 2805 | - } | |
| 2806 | - | |
| 2807 | - $uid = get_current_user_id(); | |
| 2808 | - $key = 'wpdocs_view_rl_' . $uid; | |
| 2809 | - $hits = (int) get_transient( $key ); | |
| 2810 | - | |
| 2811 | - if ( $hits >= 60 ) { | |
| 2812 | - wp_send_json_error( array( 'msg' => __( 'Too many requests.', 'wp-docs' ) ), 429 ); | |
| 2813 | - } | |
| 2814 | - set_transient( $key, $hits + 1, MINUTE_IN_SECONDS ); | |
| 2815 | - | |
| 2816 | - if ( isset( $_POST['update_view'] ) ) { | |
| 2817 | - | |
| 2818 | - $wpdocs_view = get_option( 'wpdocs_view', array() ); | |
| 2819 | - $wpdocs_view = is_array( $wpdocs_view ) ? $wpdocs_view : array(); | |
| 2820 | - | |
| 2821 | - $parent_dir = sanitize_wpdocs_data( $_POST['parent_dir'] ?? '' ); | |
| 2822 | - $view_val = sanitize_wpdocs_data( $_POST['update_view'] ); | |
| 2823 | - | |
| 2824 | - $wpdocs_view[ $parent_dir ] = $view_val; | |
| 2825 | - update_option( 'wpdocs_view', $wpdocs_view ); | |
| 2826 | - } | |
| 2827 | - | |
| 2828 | - wp_send_json_success(); | |
| 2829 | - } | |
| 2830 | - } | |
| 2831 | - /*if(!function_exists('wpdocs_update_view')){ | |
| 2603 | + add_action('wp_ajax_nopriv_wpdocs_update_view', 'wpdocs_update_view'); | |
| 2604 | + | |
| 2605 | + if(!function_exists('wpdocs_update_view')){ | |
| 2832 | 2606 | function wpdocs_update_view(){ |
| 2833 | 2607 | |
| 2834 | 2608 | $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce'])); |
| 2835 | 2609 | |
| @@ -2847,9 +2621,9 @@ | ||
| 2847 | 2621 | |
| 2848 | 2622 | } |
| 2849 | 2623 | exit; |
| 2850 | 2624 | } |
| 2851 | - }*/ | |
| 2625 | + } | |
| 2852 | 2626 | function wpdocs_init_session() { |
| 2853 | 2627 | if(!session_id()) { |
| 2854 | 2628 | session_start(); |
| 2855 | 2629 | } |
