PluginProbe
WP Docs / 2.3.4
WP Docs v2.3.4
2.3.4 2.3.3 2.3.2 trunk 2.2.0 2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 2.2.6 2.2.7 2.2.8 2.2.9 2.3.0 2.3.1
← All changes | inc/functions.php +828 -320 2.2.0 → 2.3.4 View file →
@@ -1,12 +1,23 @@
1 1 <?php
2 -
2 + if(!function_exists('wpdocs_secure_url')){
3 + function wpdocs_secure_url($file_id=''){
4 +
5 + $ret = add_query_arg(
6 + array(
7 + 'wpdocs_dl' => $file_id,
8 + 'wpdocs_nonce' => wp_create_nonce('wpdocs_dl_'.$file_id),
9 + ),
10 + home_url('/')
11 + );
12 + return $ret;
13 + }
14 + }
3 15 if(!function_exists('wp_docs_get_memphis_dir_option_id')){
4 16 function wp_docs_get_option_id($option_name){
5 17 global $wpdb;
6 18 $option_name = esc_sql( $option_name );
7 - $query = $wpdb->prepare("SELECT option_id FROM %s WHERE option_name = '%s'",
8 - $wpdb->options,
19 + $query = $wpdb->prepare("SELECT option_id FROM $wpdb->options WHERE option_name = %s",
9 20 $option_name
10 21 );
11 22 return $wpdb->get_var($query);
12 23 }
@@ -45,8 +56,10 @@
45 56 function wpdocs_admin_enqueue_script()
46 57 {
47 58 if (isset($_GET['page']) && $_GET['page'] == 'wpdocs') {
48 59
60 + //pree(get_option('mdocs-list'));exit;
61 +
49 62 global $wpdocs_pro, $wpdocs_options;
50 63
51 64 wp_enqueue_script('wpdocs_boostrap', plugin_dir_url(dirname(__FILE__)) . 'js/bootstrap.min.js', array('jquery'));
52 65 wp_enqueue_style('wpdocs-boostrap', plugins_url('css/bootstrap.min.css', dirname(__FILE__)));
@@ -66,8 +79,9 @@
66 79 wp_enqueue_style('wpdocs-common', plugins_url('css/common-styles.css', dirname(__FILE__)), array(), date('Ymdhi'));
67 80 wp_enqueue_style('wpdocs-admin', plugins_url('css/admin-styles.css', dirname(__FILE__)), array(), date('Ymdhi'));
68 81
69 82 wp_enqueue_script('wpdocs_admin_scripts', plugin_dir_url(dirname(__FILE__)) . 'js/admin-scripts.js', array('jquery', 'jquery-ui-dialog'), time());
83 + wp_enqueue_script('wpdocs_verify_scripts', plugin_dir_url(dirname(__FILE__)) . 'js/verify-scripts.js', array('jquery', 'jquery-ui-dialog'), time());
70 84
71 85 if($wpdocs_pro){
72 86 wp_enqueue_script('wpdocs_pro_scripts', plugin_dir_url(dirname(__FILE__)) . 'pro/wp-docs-admin.js?t='.time(), array('jquery'));
73 87 }
@@ -84,8 +98,9 @@
84 98 'wpdocs_admin_scripts',
85 99 'wpdocs_ajax_object',
86 100 array(
87 101 'ajax_url' => admin_url('admin-ajax.php'),
102 + 'nonce' => wp_create_nonce('wpdocs_update_options_nonce'),
88 103 'url' => admin_url('options-general.php?page=wpdocs'),
89 104 'wpdocs_pro' => $wpdocs_pro,
90 105 'wpdocs_delete_msg' => __('Do you want to delete this directory and data as well?', 'wp-docs'),
91 106 'wpdocs_delete_shortcut_msg' => __('Do you want to delete this shortcut?', 'wp-docs'),
@@ -101,16 +116,64 @@
101 116 'undo_import_confirm' => __('Do you want to rollback the import?', 'wp-docs'),
102 117 'select_role_str' => __('Select roles to allow upload', 'wp-docs'),
103 118 'rename_confirm' => __('Do you want to rename this directory?', 'wp-docs'),
104 119 'reset_confirm' => __('Do you want to reset all settings and clear directories?', 'wp-docs'),
105 - 'nonce' => wp_create_nonce('wpdocs_update_options_nonce'),
120 +
106 121 'empty_settings' => empty($wpdocs_options),
107 122 'wc_os_pg' => (isset($_GET['pg'])?esc_attr($_GET['pg']):'0'),
108 123 'wc_os_tab' => (isset($_GET['t'])?esc_attr($_GET['t']):'0'),
109 - 'all_dirs' => $dir_id_to_titles
124 + 'all_dirs' => $dir_id_to_titles,
125 + 'rename_confirm' => __('Please enter new folder name:', 'wp-docs'),
110 126
111 127 )
112 128 );
129 +
130 + wp_localize_script(
131 + 'wpdocs_verify_scripts',
132 + 'wpdocs_vars',
133 + array(
134 + 'ajax_url' => admin_url('admin-ajax.php'),
135 + 'url' => admin_url('options-general.php?page=wpdocs'),
136 + 'nonce' => wp_create_nonce('wpdocs_verify_nonce'),
137 + 'preparing_queue' => __('Preparing verification queue...', 'wp-docs'),
138 + 'unable_to_start' => __('Unable to start verification.', 'wp-docs'),
139 + 'ajax_error' => __('AJAX error.', 'wp-docs'),
140 + 'verification_failed' => __('Verification failed.', 'wp-docs'),
141 + 'verification_completed' => __('Verification completed.', 'wp-docs'),
142 + 'verification_interrupted' => __('Verification interrupted.', 'wp-docs'),
143 + 'checking_folder' => __('Checking Folder:', 'wp-docs'),
144 + 'checking_file' => __('Checking File:', 'wp-docs'),
145 + 'unknown_file' => __('Unknown File', 'wp-docs'),
146 + 'items_processed' => __('items processed', 'wp-docs'),
147 + 'total_folders' => __('Total Folders', 'wp-docs'),
148 + 'verified_folders' => __('Verified Folders', 'wp-docs'),
149 + 'missing_folders' => __('Missing Folders', 'wp-docs'),
150 + 'total_files' => __('Total Files', 'wp-docs'),
151 + 'verified_files' => __('Verified Files', 'wp-docs'),
152 + 'missing_files' => __('Missing Files', 'wp-docs'),
153 + 'missing_folder' => __('MISSING FOLDER', 'wp-docs'),
154 + 'missing_file' => __('MISSING FILE', 'wp-docs'),
155 + 'no_items_display' => __('No items to display.', 'wp-docs'),
156 + 'import_in_progress' => __('Import is already in progress. Please wait.', 'wp-docs'),
157 + 'import_missing_confirm' => __('This will import only missing folders and files. Do you want to continue?', 'wp-docs'),
158 + 'initializing' => __('Initializing...', 'wp-docs'),
159 + 'preparing_import_queue' => __('Preparing import queue...', 'wp-docs'),
160 + 'unable_to_start_import' => __('Unable to start import.', 'wp-docs'),
161 + 'import_failed' => __('Import failed.', 'wp-docs'),
162 + 'import_completed' => __('Import completed!', 'wp-docs'),
163 + 'refreshing_results' => __('Refreshing verification results...', 'wp-docs'),
164 + 'import_interrupted' => __('Import interrupted. Please try again.', 'wp-docs'),
165 + 'creating_folder' => __('Creating Folder:', 'wp-docs'),
166 + 'importing_file' => __('Importing File:', 'wp-docs'),
167 + 'path' => __('Path:', 'wp-docs'),
168 + 'target' => __('Target:', 'wp-docs'),
169 + 'folders_imported' => __('Folders imported:', 'wp-docs'),
170 + 'files_imported' => __('Files imported:', 'wp-docs'),
171 + 'failed' => __('Failed:', 'wp-docs'),
172 + 'please_wait' => __('Please wait...', 'wp-docs'),
173 + 'import_missing_items' => __('Import Missing Items Only', 'wp-docs'),
174 + )
175 + );
113 176 }
114 177 }
115 178
116 179 add_filter( 'ajax_query_attachments_args', 'wpdocs_filter_media');
@@ -420,8 +483,10 @@
420 483 $dir_id = (!$dir_id && array_key_exists('dir', $_GET)?sanitize_wpdocs_data($_GET['dir']):0);
421 484
422 485 $params_array = array(
423 486 'dir_id' => $dir_id,
487 +
488 + 'nonce' => wp_create_nonce('wpdocs_update_options_nonce'),
424 489 'parent_dir' => get_permalink($post->ID).'/?dir=',
425 490 'wpdocs_pro' => $wpdocs_pro,
426 491 'details_view_sorting' => $details_view_sorting,
427 492 'ajax_based_deep_search' => $ajax_based_deep_search,
@@ -437,9 +502,8 @@
437 502 'block_ui' => __('Please wait...', 'wp-docs'),
438 503 'is_ajax' => $is_ajax,
439 504 'is_ajax_url' => $is_ajax_url,
440 505 'del_from_front' => array_key_exists('del_from_front', $wpdocs_options),
441 - 'nonce' => wp_create_nonce('wpdocs_update_options_nonce'),
442 506 'restriction_load' => isset($_GET['wpdocs_restriction']),
443 507 'restriction_id' => isset($_GET['wpdocs_restriction']) ? $_GET['wpdocs_restriction'] : '',
444 508 'restriction_container' => isset($_GET['wpdocs_container']) ? $_GET['wpdocs_container'] : '',
445 509 'current_user_id' => get_current_user_id(),
@@ -504,13 +568,10 @@
504 568 unset($post_types['shortcut']);
505 569 }
506 570
507 571
508 - $query_str = $wpdb->prepare("SELECT ID, post_title, post_type, post_content, post_parent, guid FROM %s WHERE post_status='%s' AND post_type IN ('%s') AND post_parent IN ('%s') ORDER BY $orderby $order",
509 - $wpdb->posts,
510 - $wpdocs_post_status,
511 - implode("','", $post_types),
512 - implode(',', $ids)
572 + $query_str = $wpdb->prepare('SELECT ID, post_title, post_type, post_content, post_parent, guid FROM '.$wpdb->posts.' WHERE post_status=%s AND post_type IN ("'.implode('","', $post_types).'") AND post_parent IN ("'.implode(',', $ids).'") ORDER BY '. $orderby.' '.$order,
573 + $wpdocs_post_status
513 574 );
514 575
515 576 //pree($query_str);
516 577
@@ -605,10 +666,30 @@
605 666 //pree($ret);
606 667
607 668 return $ret;
608 669 }
670 + function wpdocs_create_folder_post( $post_parent, $post_title = "New Folder" ) {
671 +
672 + if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
673 + return 0;
674 + }
609 675
610 - function wpdocs_create_folder_post($post_parent, $post_title = "New Folder")
676 + $post_parent = absint( $post_parent );
677 + $post_title = sanitize_text_field( $post_title );
678 +
679 + $my_post = array(
680 + 'post_title' => $post_title,
681 + 'post_content' => '',
682 + 'post_status' => 'hidden',
683 + 'post_author' => get_current_user_id(),
684 + 'post_type' => 'wpdocs_folder',
685 + 'post_parent' => ( ( $post_parent > 0 && wpdocs_folder_exists( $post_parent ) ) ? $post_parent : 0 ),
686 + 'post_category' => array(),
687 + );
688 +
689 + return wp_insert_post( $my_post );
690 + }
691 + /*function wpdocs_create_folder_post($post_parent, $post_title = "New Folder")
611 692 {
612 693
613 694 $my_post = array(
614 695 'post_title' => $post_title,
@@ -622,17 +703,22 @@
622 703
623 704 $dir_id = wp_insert_post($my_post);
624 705
625 706 return $dir_id;
626 - }
707 + }*/
627 708
628 709 add_action('wp_ajax_wpdocs_create_folder', 'wpdocs_create_folder');
629 710
630 711 function wpdocs_create_folder()
631 712 {
713 + if ( ! current_user_can( 'manage_options' ) ) {
714 + wp_send_json_error( __("Unauthorized user", 'wp-docs') );
715 + wp_die();
716 + }
717 +
632 718 $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce']));
633 719
634 - if ( ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
720 + if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
635 721 die (__("Sorry, your nonce did not verify.", 'wp-docs'));
636 722
637 723 $post_parent = sanitize_wpdocs_data($_POST['parent_dir']);
638 724
@@ -643,9 +729,29 @@
643 729 $list = array('id'=>$list_obj->ID, 'content'=>$list_obj->post_content, 'title'=>$list_obj->post_title, 'type'=>$list_obj->post_type, 'guid'=>$list_obj->guid);
644 730
645 731 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
646 732
647 - echo '<li class="ab-dir ab-new" data-id="'.$dir_id.'" data-resource='.base64_encode($dir_id).'" data-linked="'.$list['content'].'" data-guid="'.($is_shortcut?$list['guid']:'').'"><a class="folder fa fa-folder"></a><a class="dtitle" title="'.__('Click here to rename', 'wp-docs').'">'.__('New Folder', 'wp-docs').'</a><span class="wpd_action_span"><a class="wpd-edit" title="'.__('Click here to edit', 'wp-docs').'"></a><span class="wpd_action_span_inner"><a class="wpd-copy" title="'.__('Click here to copy', 'wp-docs').'"></a><a class="wpd-move" title="'.__('Click here to move', 'wp-docs').'"></a></span><a class="wpd-trash" title="'.__('Click here to delete', 'wp-docs').'"></a></span></li>';
733 + echo '<li class="ab-dir ab-new"
734 + data-id="' . esc_attr($dir_id) . '"
735 + data-resource="' . esc_attr(base64_encode($dir_id)) . '"
736 + data-linked="' . esc_attr($list['content']) . '"
737 + data-guid="' . ($is_shortcut ? esc_attr($list['guid']) : '') . '">
738 +
739 + <a class="folder fa fa-folder"></a>
740 +
741 + <a class="dtitle" title="' . esc_attr(__('Click here to rename', 'wp-docs')) . '">
742 + ' . esc_html__('New Folder', 'wp-docs') . '
743 + </a>
744 +
745 + <span class="wpd_action_span">
746 + <a class="wpd-edit" title="' . esc_attr(__('Click here to edit', 'wp-docs')) . '"></a>
747 + <span class="wpd_action_span_inner">
748 + <a class="wpd-copy" title="' . esc_attr(__('Click here to copy', 'wp-docs')) . '"></a>
749 + <a class="wpd-move" title="' . esc_attr(__('Click here to move', 'wp-docs')) . '"></a>
750 + </span>
751 + <a class="wpd-trash" title="' . esc_attr(__('Click here to delete', 'wp-docs')) . '"></a>
752 + </span>
753 + </li>';
648 754
649 755 exit;
650 756 }
651 757
@@ -722,29 +828,85 @@
722 828 }
723 829
724 830
725 831
832 + return array(
833 + 'file_id' => $item,
834 + 'file_url' => esc_url($file_url),
835 + 'ext' => esc_attr($ext),
836 + 'filename' => esc_attr($filename),
837 + 'title' => esc_html($filename),
838 + 'icon_url' => esc_url($icon_url)
839 + );
726 840
727 - return array(
728 841
729 - 'file_url' => $file_url,
730 - 'ext' => $ext,
731 - 'filename' => $filename,
732 - 'title' => $filename,
733 - 'icon_url' => $icon_url
734 - );
842 + }
843 + }
735 844
845 + /**
846 + * Centralize the "can this user edit this folder?" decision.
847 + * Admins always pass; otherwise require the folder to be owned by the user.
848 + */
849 + function wpdocs_user_can_edit_folder( $dir_id ) {
850 + if ( current_user_can( 'manage_options' ) ) {
851 + return true;
852 + }
736 853
854 + $dir = get_post( $dir_id );
855 + if ( ! $dir || 'wpdocs_folder' !== $dir->post_type ) { // adjust CPT slug
856 + return false;
737 857 }
858 +
859 + return (int) $dir->post_author === get_current_user_id();
738 860 }
739 861
740 862 add_action('wp_ajax_wpdocs_add_files', 'wpdocs_add_files');
741 863
742 - function wpdocs_add_files(){
864 + function wpdocs_add_files() {
865 +
866 + // 1) Capability FIRST — before nonce, before anything.
867 + if ( ! is_user_logged_in() || ! current_user_can( 'upload_files' ) ) {
868 + wp_send_json_error( array( 'message' => __( 'Insufficient permissions.', 'wp-docs' ) ), 403 );
869 + }
870 +
871 + // 2) Nonce check.
872 + if ( empty( $_POST['nonce'] )
873 + || ! wp_verify_nonce(
874 + sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ),
875 + 'wpdocs_update_options_nonce'
876 + )
877 + ) {
878 + wp_send_json_error( array( 'message' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 );
879 + }
880 +
881 + // 3) Input validation.
882 + $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0;
883 + if ( ! $dir_id ) {
884 + wp_send_json_error( array( 'message' => __( 'Invalid folder.', 'wp-docs' ) ), 400 );
885 + }
886 +
887 + // 4) Per-folder ownership / capability gate.
888 + if ( ! wpdocs_user_can_edit_folder( $dir_id ) ) {
889 + wp_send_json_error( array( 'message' => __( 'You cannot modify this folder.', 'wp-docs' ) ), 403 );
890 + }
891 +
892 + $files = isset( $_POST['files'] ) ? sanitize_wpdocs_data( $_POST['files'] ) : array();
893 + $files = is_array( $files ) ? $files : array( $files );
894 + $files = array_filter( array_map( 'absint', $files ) );
895 +
896 + wpdocs_update_files_meta( $dir_id, $files );
897 +
898 + $ret = ! empty( $files ) ? wpdocs_list_added_items( $dir_id ) : '';
899 +
900 + echo $ret;
901 + exit;
902 + }
903 +
904 + /*function wpdocs_add_files_old(){
743 905
744 906 $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce']));
745 907
746 - if ( ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
908 + if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
747 909 die (__("Sorry, your nonce did not verify.", 'wp-docs'));
748 910
749 911
750 912 $dir_id = sanitize_wpdocs_data($_POST['dir_id']);
@@ -766,13 +928,13 @@
766 928 }
767 929
768 930 echo $ret;
769 931 exit;
770 - }
932 + }*/
771 933 function wpdocs_list_added_items($dir)
772 934 {
773 935
774 - global $wpdocs_options;
936 + global $wpdocs_options, $icon_sub_path, $wpdocs_url;
775 937
776 938 $wp_get_upload_dir = wp_get_upload_dir();
777 939 $wp_uploads_path = $wp_get_upload_dir['basedir'];
778 940 $wp_uploads_url = $wp_get_upload_dir['baseurl'];
@@ -791,12 +953,12 @@
791 953
792 954 $item_data = wpd_get_item_type_icon_url($item);
793 955 extract($item_data);
794 956
795 - //pree($item_data);
957 + //pree($item_data);exit;
796 958 //pree($wp_uploads_path);exit;
797 959
798 - $icon_str = '<img src="'.$icon_url.'" style="">';
960 + $icon_str = '<img src="' . esc_url($icon_url) . '" style="" alt="' . esc_attr($title) . '">';
799 961
800 962 switch ($ext) {
801 963 case 'png':
802 964 case 'jpg':
@@ -821,18 +983,30 @@
821 983
822 984 $file_url_thumb = str_replace('.pdf', '.png', strtolower($item_data['file_url']));
823 985 $file_url_thumb_path = str_replace($wp_uploads_url, $wp_uploads_path, $file_url_thumb);
824 986
825 - if(!file_exists($file_url_thumb_path)){
987 + if(!file_exists($file_url_thumb_path) && class_exists('imagick')){
826 988
827 - $im = new imagick($item_data['file_url']);
828 - $im->setIteratorIndex(0);
829 - $im->setImageFormat('png');
830 - $im->writeImage($file_url_thumb_path);
989 + try {
990 + $im = new imagick($item_data['file_url']);
991 + $im->setIteratorIndex(0);
992 + $im->setImageFormat('png');
993 + $im->writeImage($file_url_thumb_path);
994 + } catch (ImagickException $e) {
995 +
996 + if(defined('WP_DEBUG') && WP_DEBUG && defined('WP_DEBUG_LOG') && WP_DEBUG_LOG){
997 + error_log("Imagick error: " . $e->getMessage());
998 + error_log('file_url: '.$item_data['file_url']);
999 + error_log('file_url_thumb_path: '.$file_url_thumb_path);
1000 + }
1001 +
1002 + $file_url_thumb = $wpdocs_url.$icon_sub_path.$ext.'.png';
1003 + }
831 1004
1005 +
832 1006 }
833 1007
834 - $icon_str = '<img src="'.$file_url_thumb.'" style="">';
1008 + $icon_str = '<img src="' . esc_url( $file_url_thumb ) . '" style="" alt="' . esc_attr( $title ) . '">';
835 1009
836 1010 }
837 1011
838 1012 }
@@ -843,21 +1017,24 @@
843 1017 //$class .= 'fa-file';
844 1018 break;
845 1019 }
846 1020 $class = '';
847 - $files_list[$title] = '<li data-id="' . $item . '" data-dir="'.$dir. '" title="'.esc_attr($filename).'">
848 - <a href="' . $file_url . '" target="_blank" class="file ' . $class . '"> '.$icon_str.' </a>
849 - <a class="ftitle" title="' . $title . '">' . $title . '</a>
850 - <span class="wpd_action_span">
851 - <a href="upload.php?item='.$item.'" target="_blank" class="wpd-edit" title="'.__('Click here to edit', 'wp-docs').'"></a>
852 - <span class="wpd_action_span_inner">
853 - <a class="wpd-copy" title="'.__('Click here to copy', 'wp-docs').'"></a>
854 - <a class="wpd-move" title="'.__('Click here to move', 'wp-docs').'"></a>
855 - </span>
856 -
857 - <a href="upload.php?search='.esc_attr($filename).'" target="_blank" class="wpd-trash" title="'.__('Click here to delete', 'wp-docs').'"></a>
858 - </span>
859 - </li>';
1021 +
1022 +
1023 + $secured_file_url = wpdocs_secure_url($file_id);
1024 +
1025 + $files_list[ $title ] = '<li data-id="' . esc_attr( $item ) . '" data-dir="' . esc_attr( $dir ) . '" title="' . esc_attr( $filename ) . '">
1026 + <a href="' . esc_url( $secured_file_url ) . '" target="_blank" class="file ' . esc_attr( $class ) . '"> ' . $icon_str . ' </a>
1027 + <a class="ftitle" title="' . esc_attr( $title ) . '">' . esc_html( $title ) . '</a>
1028 + <span class="wpd_action_span">
1029 + <a href="' . esc_url( 'upload.php?item=' . $item ) . '" target="_blank" class="wpd-edit" title="' . esc_attr__( 'Click here to edit', 'wp-docs' ) . '"></a>
1030 + <span class="wpd_action_span_inner">
1031 + <a class="wpd-copy" title="' . esc_attr__( 'Click here to copy', 'wp-docs' ) . '"></a>
1032 + <a class="wpd-move" title="' . esc_attr__( 'Click here to move', 'wp-docs' ) . '"></a>
1033 + </span>
1034 + <a href="' . esc_url( 'upload.php?search=' . rawurlencode( $filename ) ) . '" target="_blank" class="wpd-trash" title="' . esc_attr__( 'Click here to delete', 'wp-docs' ) . '"></a>
1035 + </span>
1036 +</li>';
860 1037 }
861 1038 }
862 1039
863 1040 ksort($files_list);
@@ -915,13 +1092,9 @@
915 1092 {
916 1093
917 1094 if (
918 1095 !empty($_POST) && !wp_doing_ajax() &&
919 - (
920 - ! isset( $_POST['wpdocs_front_list_nonce'] )
921 -
922 - ||
923 -
1096 + (
924 1097 (isset( $_POST['wpdocs_front_list_nonce'] ) && ! wp_verify_nonce( sanitize_wpdocs_data(wp_unslash($_POST['wpdocs_front_list_nonce_field'])), 'wpdocs_front_list_nonce' ) )
925 1098 )
926 1099 ) {
927 1100
@@ -936,9 +1109,9 @@
936 1109
937 1110
938 1111 //pree($atts);
939 1112 ob_start();
940 - global $wpdocs_url, $wpdocs_options, $wpdocs_pro, $wpdocs_post_types, $pdf_thumb_selected;
1113 + global $wpdocs_url, $wpdocs_options, $wpdocs_pro, $wpdocs_post_types, $pdf_thumb_selected, $icon_sub_path;
941 1114
942 1115 $pdf_thumb_selected = (array_key_exists('pdf_thumb', $wpdocs_options)?$wpdocs_options['pdf_thumb']:'default');
943 1116
944 1117 $wpdocs_view = get_option('wpdocs_view', array());
@@ -1130,12 +1303,19 @@
1130 1303
1131 1304 ?>
1132 1305
1133 1306
1134 - <div class="container-fluid wpdoc_container" data-dir_restrictions = "<?php echo wpdocs_get_dir_restrictions($dir, 'base64'); ?>" data-del_from_front="<?php echo $is_del_from_front; ?>" data-dir="<?php echo $dir; ?>" data-home="<?php echo $home_id; ?>">
1135 - <?php wp_nonce_field( 'wpdocs_front_list_nonce', 'wpdocs_front_list_nonce_field' ); ?>
1136 - <input type="hidden" class="wpd_home_id" value="<?php echo esc_html($home_id); ?>" />
1137 - <input type="hidden" class="wpd_del_file_id" value="" />
1307 +<div class="container-fluid wpdoc_container"
1308 + data-dir_restrictions="<?php echo esc_attr( wpdocs_get_dir_restrictions( $dir, 'base64' ) ); ?>"
1309 + data-del_from_front="<?php echo esc_attr( $is_del_from_front ); ?>"
1310 + data-dir="<?php echo esc_attr( $dir ); ?>"
1311 + data-home="<?php echo esc_attr( $home_id ); ?>">
1312 +
1313 + <?php wp_nonce_field( 'wpdocs_front_list_nonce', 'wpdocs_front_list_nonce_field' ); ?>
1314 +
1315 + <input type="hidden" class="wpd_home_id" value="<?php echo esc_attr( $home_id ); ?>" />
1316 + <input type="hidden" class="wpd_del_file_id" value="" />
1317 +
1138 1318 <?php
1139 1319
1140 1320 $wpdocs_view = array_key_exists($home_id, $wpdocs_view) ? $wpdocs_view[$home_id] : trim($default_view);
1141 1321
@@ -1147,9 +1327,13 @@
1147 1327 <ol class="breadcrumb bg-light" style="border-bottom:1px solid #dee2e6;border-radius: 0; min-height: 40px;">
1148 1328
1149 1329 <?php if (!empty($breadcrumb_array)) { ?>
1150 1330
1151 - <li class="breadcrumb-item bread_home_url"><a class="wpd_bread_item" href="<?php echo $get_permalink ?>" data-id="0"><?php _e('Home', 'wp-docs'); ?></a></li>
1331 + <li class="breadcrumb-item bread_home_url">
1332 + <a class="wpd_bread_item" href="<?php echo esc_url($get_permalink); ?>" data-id="0">
1333 + <?php echo esc_html__('Home', 'wp-docs'); ?>
1334 + </a>
1335 +</li>
1152 1336 <?php
1153 1337
1154 1338 foreach (array_reverse($breadcrumb_array) as $bread_key => $bread_value) {
1155 1339 $active = '';
@@ -1155,9 +1339,9 @@
1155 1339 $active = '';
1156 1340 $page = '';
1157 1341 $permalink = stripos($get_permalink, '?');
1158 1342 $permalink_c = ($permalink!='' && is_numeric($permalink) && $permalink>=0);
1159 - $link = '<a class="wpd_bread_item" href="' . $get_permalink . ($permalink_c?'&':'?').'dir=' . $bread_value . '" data-id="'.$bread_value.'" >' . get_the_title($bread_value) . '</a>';
1343 + $link = '<a class="wpd_bread_item" href="' . esc_url($get_permalink . ($permalink_c ? '&' : '?') . 'dir=' . $bread_value) . '" data-id="' . esc_attr($bread_value) . '">' . (get_the_title($bread_value)) . '</a>';
1160 1344 if ($bread_value == 0) {
1161 1345 continue;
1162 1346 }
1163 1347 if ($bread_value == $dir) {
@@ -1167,9 +1351,11 @@
1167 1351 }
1168 1352
1169 1353
1170 1354 ?>
1171 - <li class="breadcrumb-item <?php echo $active ?>" aria-current="<?php echo $page; ?>"><?php echo $link; ?></li>
1355 + <li class="breadcrumb-item <?php echo esc_attr($active); ?>" aria-current="<?php echo esc_attr($page); ?>">
1356 + <?php echo wp_kses_post($link); ?>
1357 +</li>
1172 1358
1173 1359 <?php } ?>
1174 1360 <?php
1175 1361 }
@@ -1178,16 +1364,21 @@
1178 1364
1179 1365 </ol>
1180 1366
1181 1367 <?php if($is_del_from_front):?>
1368 +<i style="opacity: 0.5;"
1369 + class="fa fa-trash fa-1x position-absolute wp_docs_del_file <?php echo esc_attr(is_user_logged_in() ? 'logged_in' : 'logged_out'); ?>"
1370 + title="<?php echo esc_attr__('Click here to delete selected files', 'wp-docs'); ?>">
1371 +</i>
1182 1372
1183 - <i style="opacity: 0.5;" class="fa fa-trash fa-1x position-absolute wp_docs_del_file <?php echo (is_user_logged_in()?'logged_in':'logged_out'); ?>" title="<?php _e('Click here to delete selected files', 'wp-docs'); ?>"></i>
1184 -
1185 1373 <?php endif; ?>
1186 1374
1187 1375 <?php if($wpdocs_pro && $dir != 0 && wpdocs_can_current_user_upload_file($dir) && $is_file):?>
1188 1376
1189 - <i class="fa fa-upload fa-1x wpdocs-front-add-media position-absolute" id="wpdocs_front_file_add_<?php echo $dir; ?>" title="<?php _e('Click here to add files', 'wp-docs'); ?>"></i>
1377 +<i class="fa fa-upload fa-1x wpdocs-front-add-media position-absolute"
1378 + id="wpdocs_front_file_add_<?php echo esc_attr( $dir ); ?>"
1379 + title="<?php echo esc_attr__( 'Click here to add files', 'wp-docs' ); ?>">
1380 +</i>
1190 1381
1191 1382 <?php endif; ?>
1192 1383 </nav>
1193 1384 <?php
@@ -1220,10 +1411,9 @@
1220 1411 pree($posts_array);
1221 1412 */
1222 1413 ?>
1223 1414
1224 - <?php echo $warning_msg?'<div class="card-body">'.$warning_msg.'</div>':''; ?>
1225 -
1415 + <?php echo $warning_msg ? '<div class="card-body">' . wp_kses_post( $warning_msg ) . '</div>' : ''; ?>
1226 1416 <?php if($is_searchbox || $ajax_based_deep_search): ?>
1227 1417 <div class="wpdocs-searchbox">
1228 1418 <input type="text" placeholder="<?php echo ($ajax_based_deep_search?__('Type here to search...', 'wp-docs'):__('Type here to filter...', 'wp-docs')); ?>" />
1229 1419 </div>
@@ -1245,14 +1435,22 @@
1245 1435 //$wpdocs_child_files_list = wpdocs_added_items($list['id']);
1246 1436 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
1247 1437 ?>
1248 1438
1249 - <div class="col-4 col-md-3 file_wrapper is_dir" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['link']:''; ?>">
1250 - <figure class="figure file_view p-0">
1251 - <span class="fa fa-folder text-warning" style="<?php echo $customize_icon_size; ?>"></span>
1252 - <figcaption class="figure-caption text-center" style="<?php echo $customize_font_size; ?>"><?php echo $list['title']; ?></figcaption>
1253 - </figure>
1254 - </div>
1439 +<div class="col-4 col-md-3 file_wrapper is_dir" style="cursor: pointer;"
1440 + data-id="<?php echo esc_attr($list['id']); ?>"
1441 + data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>"
1442 + data-linked="<?php echo esc_attr($list['content']); ?>"
1443 + data-guid="<?php echo esc_attr($is_shortcut ? $list['link'] : ''); ?>">
1444 +
1445 + <figure class="figure file_view p-0">
1446 + <span class="fa fa-folder text-warning" style="<?php echo esc_attr($customize_icon_size); ?>"></span>
1447 + <figcaption class="figure-caption text-center" style="<?php echo esc_attr($customize_font_size); ?>">
1448 + <?php echo esc_html($list['title']); ?>
1449 + </figcaption>
1450 + </figure>
1451 +
1452 +</div>
1255 1453 <?php
1256 1454 }
1257 1455 } else {
1258 1456 $no_dir_found = true;
@@ -1269,14 +1467,23 @@
1269 1467 $list = array('id'=>$list_obj->ID, 'content'=>$list_obj->post_content, 'title'=>$list_obj->post_title, 'type'=>$list_obj->post_type, 'guid'=>$list_obj->guid);
1270 1468 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
1271 1469
1272 1470 ?>
1273 - <div class="col-4 col-md-3 file_wrapper is_dir is_deep" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['guid']:''; ?>">
1274 - <figure class="figure file_view p-0">
1275 - <span class="fa fa-folder text-warning" style="<?php echo $customize_icon_size; ?>"></span>
1276 - <figcaption class="figure-caption text-center" style="<?php echo $customize_font_size; ?>"><?php echo $list['title']; ?></figcaption>
1277 - </figure>
1278 - </div>
1471 +<div class="col-4 col-md-3 file_wrapper is_dir is_deep" style="cursor: pointer;"
1472 + data-id="<?php echo esc_attr($list['id']); ?>"
1473 + data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>"
1474 + data-linked="<?php echo esc_attr($list['content']); ?>"
1475 + data-guid="<?php echo esc_attr($is_shortcut ? $list['guid'] : ''); ?>">
1476 +
1477 + <figure class="figure file_view p-0">
1478 + <span class="fa fa-folder text-warning" style="<?php echo esc_attr($customize_icon_size); ?>"></span>
1479 +
1480 + <figcaption class="figure-caption text-center" style="<?php echo esc_attr($customize_font_size); ?>">
1481 + <?php echo esc_html($list['title']); ?>
1482 + </figcaption>
1483 + </figure>
1484 +
1485 +</div>
1279 1486 <?php
1280 1487 }
1281 1488 }
1282 1489 }
@@ -1319,17 +1526,30 @@
1319 1526
1320 1527 $file_url_thumb = str_replace('.pdf', '.png', strtolower($file_data['file_url']));
1321 1528 $file_url_thumb_path = str_replace($wp_uploads_url, $wp_uploads_path, $file_url_thumb);
1322 1529
1323 - if(!file_exists($file_url_thumb_path)){
1324 -
1325 - $im = new imagick($file_data['file_url']);
1326 - $im->setIteratorIndex(0);
1327 - $im->setImageFormat('png');
1328 - $im->writeImage($file_url_thumb_path);
1530 + if(!file_exists($file_url_thumb_path) && class_exists('imagick')){
1531 +
1532 + try {
1533 + $im = new imagick($item_data['file_url']);
1534 + $im->setIteratorIndex(0);
1535 + $im->setImageFormat('png');
1536 + $im->writeImage($file_url_thumb_path);
1537 + } catch (ImagickException $e) {
1538 +
1539 + if(defined('WP_DEBUG') && WP_DEBUG && defined('WP_DEBUG_LOG') && WP_DEBUG_LOG){
1540 + error_log("Imagick error: " . $e->getMessage());
1541 + error_log('file_url: '.$item_data['file_url']);
1542 + error_log('file_url_thumb_path: '.$file_url_thumb_path);
1543 + }
1544 +
1545 + $file_url_thumb = $wpdocs_url.$icon_sub_path.$ext.'.png';
1546 + }
1329 1547
1548 +
1330 1549 }
1331 1550
1551 +
1332 1552 $icon_url = $file_url_thumb;
1333 1553
1334 1554 }
1335 1555
@@ -1340,21 +1560,23 @@
1340 1560 default:
1341 1561 //$class .= 'fa-file';
1342 1562 break;
1343 1563 }
1564 +
1565 + $secured_file_url = wpdocs_secure_url($file_id);
1344 1566
1345 1567 $file_list_row = '
1346 -
1347 -
1348 - <div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_shallow" style="cursor: pointer;" data-id="'.$file.'">
1349 - <figure class="figure file_view p-1">
1350 - <a href="'.$file_url.'" target="_blank" class="file" ><img class="my-3" src="'.$icon_url.'" /></a>
1351 - <figcaption class="figure-caption text-center">'.$title.'</figcaption>
1352 - </figure>
1353 - </div>
1354 -
1355 -
1356 - ';
1568 +
1569 +<div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_shallow" style="cursor: pointer;" data-id="'.esc_attr($file).'">
1570 + <figure class="figure file_view p-1">
1571 + <a href="'.esc_url($secured_file_url).'" target="_blank" class="file">
1572 + <img class="my-3" src="'.esc_url($icon_url).'" />
1573 + </a>
1574 + <figcaption class="figure-caption text-center">'.esc_html($title).'</figcaption>
1575 + </figure>
1576 +</div>
1577 +
1578 +';
1357 1579 $list = wpdocs_list_population($list, $file_data, $file_list_row, $default_orderby);
1358 1580
1359 1581 }
1360 1582
@@ -1425,21 +1647,23 @@
1425 1647 default:
1426 1648 //$class .= 'fa-file';
1427 1649 break;
1428 1650 }
1651 +
1652 + $secured_file_url = wpdocs_secure_url($file_id);
1429 1653
1430 1654 $file_list_row = '
1431 -
1432 -
1433 - <div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_deep" style="cursor: pointer;" data-id="'.$file.'">
1434 - <figure class="figure file_view p-1">
1435 - <a href="'.$file_url.'" target="_blank" class="file" ><img class="my-3" src="'.$icon_url.'" /></a>
1436 - <figcaption class="figure-caption text-center">'.$title.'</figcaption>
1437 - </figure>
1438 - </div>
1439 -
1440 -
1441 - ';
1655 +
1656 +<div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_deep" style="cursor: pointer;" data-id="'.esc_attr($file).'">
1657 + <figure class="figure file_view p-1">
1658 + <a href="'.esc_url($secured_file_url).'" target="_blank" class="file">
1659 + <img class="my-3" src="'.esc_url($icon_url).'" />
1660 + </a>
1661 + <figcaption class="figure-caption text-center">'.esc_html($title).'</figcaption>
1662 + </figure>
1663 +</div>
1664 +
1665 +';
1442 1666 $list = wpdocs_list_population($list, $file_data, $file_list_row, $default_orderby);
1443 1667
1444 1668 }
1445 1669
@@ -1474,12 +1698,16 @@
1474 1698 foreach ($wpdocs_list as $list) {
1475 1699 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
1476 1700 ?>
1477 1701
1478 - <div class="col-12 file_wrapper is_dir" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['link']:''; ?>">
1702 +<div class="col-12 file_wrapper is_dir" style="cursor: pointer;"
1703 + data-id="<?php echo esc_attr($list['id']); ?>"
1704 + data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>"
1705 + data-linked="<?php echo esc_attr($list['content']); ?>"
1706 + data-guid="<?php echo esc_attr($is_shortcut ? $list['link'] : ''); ?>">
1479 1707 <figure class="figure file_view p-2">
1480 1708 <span class="fa fa-folder text-warning" style="font-size:25px"></span>
1481 - <small class="text-center"><?php echo $list['title']; ?></small>
1709 + <small class="text-center"><?php echo esc_html($list['title']); ?></small>
1482 1710 </figure>
1483 1711 </div>
1484 1712 <?php
1485 1713 }
@@ -1496,12 +1724,16 @@
1496 1724 $list = array('id'=>$list_obj->ID, 'content'=>$list_obj->post_content, 'title'=>$list_obj->post_title, 'type'=>$list_obj->post_type, 'guid'=>$list_obj->guid);
1497 1725 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
1498 1726
1499 1727 ?>
1500 - <div class="col-12 file_wrapper is_dir is_deep" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['guid']:''; ?>">
1728 + <div class="col-12 file_wrapper is_dir is_deep" style="cursor: pointer;"
1729 + data-id="<?php echo esc_attr($list['id']); ?>"
1730 + data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>"
1731 + data-linked="<?php echo esc_attr($list['content']); ?>"
1732 + data-guid="<?php echo esc_attr($is_shortcut ? $list['guid'] : ''); ?>">
1501 1733 <figure class="figure file_view p-2">
1502 1734 <span class="fa fa-folder text-warning" style="font-size:25px"></span>
1503 - <small class="text-center"><?php echo $list['title']; ?></small>
1735 + <small class="text-center"><?php echo esc_html($list['title']); ?></small>
1504 1736 </figure>
1505 1737 </div>
1506 1738 <?php
1507 1739 }
@@ -1517,13 +1749,15 @@
1517 1749 extract($file_data);
1518 1750
1519 1751
1520 1752 if(trim($file_url)){
1753 +
1754 + $secured_file_url = wpdocs_secure_url($file_id);
1521 1755
1522 1756 $file_list_row = '
1523 1757 <div title="'.esc_attr($filename).'" class="col-12 file_wrapper is_file" style="cursor: pointer;" data-id="'.$file.'">
1524 1758 <figure class="figure file_view p-3">
1525 - <a href="'.$file_url.'" target="_blank" class="file" ><img class="mb-2" src="'.$icon_url.'" style="width: 25px; height: 25px"></a>
1759 + <a href="'.$secured_file_url.'" target="_blank" class="file" ><img class="mb-2" src="'.$icon_url.'" style="width: 25px; height: 25px"></a>
1526 1760 <small class="text-center">'.$title.'</small>
1527 1761 </figure>
1528 1762 </div>';
1529 1763
@@ -1597,14 +1831,27 @@
1597 1831 <div class="table-responsive" style="zoom:70%">
1598 1832 <table class="table">
1599 1833 <thead class="thead">
1600 1834 <tr>
1601 - <th><?php _e('Name', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th>
1602 - <?php if($details_date_created): ?> <th><?php _e('Created Date', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th><?php endif; ?>
1603 - <?php if($details_date): ?> <th><?php _e('Modified Date', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th><?php endif; ?>
1604 - <?php if($details_type): ?> <th><?php _e('Type', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th><?php endif; ?>
1605 - <?php if($details_size): ?> <th><?php _e('Size', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th><?php endif; ?>
1606 - </tr>
1835 + <th><?php esc_html_e('Name', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th>
1836 +
1837 +<?php if ( $details_date_created ) : ?>
1838 + <th><?php esc_html_e('Created Date', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th>
1839 +<?php endif; ?>
1840 +
1841 +<?php if ( $details_date ) : ?>
1842 + <th><?php esc_html_e('Modified Date', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th>
1843 +<?php endif; ?>
1844 +
1845 +<?php if ( $details_type ) : ?>
1846 + <th><?php esc_html_e('Type', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th>
1847 +<?php endif; ?>
1848 +
1849 +<?php if ( $details_size ) : ?>
1850 + <th><?php esc_html_e('Size', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th>
1851 +<?php endif; ?>
1852 +
1853 +</tr>
1607 1854 </thead>
1608 1855 <?php
1609 1856 $no_dir_found = false;
1610 1857 $no_file_found = false;
@@ -1611,13 +1858,13 @@
1611 1858 if (!empty($wpdocs_list)) {
1612 1859 foreach ($wpdocs_list as $list) {
1613 1860 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
1614 1861 ?>
1615 - <tr title="<?php echo $list['id']; ?>" class="file_wrapper file_view is_dir" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['link']:''; ?>">
1862 + <tr title="<?php echo esc_attr($list['id']); ?>" class="file_wrapper file_view is_dir" style="cursor: pointer;" data-id="<?php echo esc_attr($list['id']); ?>" data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>" data-linked="<?php echo esc_attr($list['content']); ?>" data-guid="<?php echo $is_shortcut?esc_url($list['link']):''; ?>">
1616 1863 <td>
1617 1864 <figure class="figure ">
1618 1865 <span class="fa fa-folder text-warning" style="font-size:25px"></span>
1619 - <small class="text-center mb-1"><?php echo $list['title']; ?></small>
1866 + <small class="text-center mb-1"><?php echo esc_html($list['title']); ?></small>
1620 1867 </figure>
1621 1868 </td>
1622 1869
1623 1870 <?php if($details_date_created): ?> <td data-time="<?php get_post_time('U', false, $list['id']) ?>"><small><?php echo get_the_date(get_option( 'date_format' ), $list['id']) . ' ' . get_the_time(get_option( 'time_format' ), $list['id']) ?></small></td><?php endif; ?>
@@ -1655,13 +1902,13 @@
1655 1902 $list = array('id'=>$list_obj->ID, 'content'=>$list_obj->post_content, 'title'=>$list_obj->post_title, 'type'=>$list_obj->post_type, 'guid'=>$list_obj->guid);
1656 1903 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
1657 1904
1658 1905 ?>
1659 - <tr title="<?php echo $list['id']; ?>" class="file_wrapper file_view is_dir is_deep" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['guid']:''; ?>">
1906 + <tr title="<?php echo esc_attr($list['id']); ?>" class="file_wrapper file_view is_dir is_deep" style="cursor: pointer;" data-id="<?php echo esc_attr($list['id']); ?>" data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>" data-linked="<?php echo esc_attr($list['content']); ?>" data-guid="<?php echo $is_shortcut?esc_attr($list['guid']):''; ?>">
1660 1907 <td>
1661 1908 <figure class="figure ">
1662 1909 <span class="fa fa-folder text-warning" style="font-size:25px"></span>
1663 - <small class="text-center mb-1"><?php echo $list['title']; ?></small>
1910 + <small class="text-center mb-1"><?php echo esc_html($list['title']); ?></small>
1664 1911 </figure>
1665 1912 </td>
1666 1913
1667 1914 <?php if($details_date_created): ?> <td data-time="<?php get_post_time('U', false, $list['id']) ?>"><small><?php echo get_the_date(get_option( 'date_format' ), $list['id']) . ' ' . get_the_time(get_option( 'time_format' ), $list['id']) ?></small></td><?php endif; ?>
@@ -1701,11 +1948,11 @@
1701 1948 extract($file_data);
1702 1949 //pree($ts);
1703 1950
1704 1951 if(trim($icon_url)){
1705 -
1952 + $secured_file_url = wpdocs_secure_url($file_id);
1706 1953 $files_list_row = '
1707 - <tr title="'.esc_attr($filename).'" data-url="'.$file_url.'" class="file_view file_link is_file" style="cursor: pointer;" data-id="'.$file.'">
1954 + <tr title="'.esc_attr($filename).'" data-url="'.$secured_file_url.'" class="file_view file_link is_file" style="cursor: pointer;" data-id="'.$file.'">
1708 1955
1709 1956 <td>
1710 1957
1711 1958 <figure class="figure file_view">
@@ -1758,11 +2005,13 @@
1758 2005 extract($file_data);
1759 2006 //pree($ts);
1760 2007
1761 2008 if(trim($icon_url)){
2009 +
2010 + $secured_file_url = wpdocs_secure_url($file_id);
1762 2011
1763 2012 $files_list_row = '
1764 - <tr title="'.esc_attr($filename).'" data-url="'.$file_url.'" class="file_view file_link is_file is_deep" style="cursor: pointer;" data-id="'.$file.'">
2013 + <tr title="'.esc_attr($filename).'" data-url="'.$secured_file_url.'" class="file_view file_link is_file is_deep" style="cursor: pointer;" data-id="'.$file.'">
1765 2014
1766 2015 <td>
1767 2016
1768 2017 <figure class="figure file_view">
@@ -1828,9 +2077,9 @@
1828 2077 </div>
1829 2078 <?php if($is_bootstrap): ?>
1830 2079 <div class="wpdocs_loader wpd_modal d-none">
1831 2080 <div class="modal_content">
1832 - <img src="<?php echo $wpdocs_url.'img/loader.gif' ?>" width="50px" height="50px">
2081 + <img src="<?php echo esc_url($wpdocs_url.'img/loader.gif'); ?>" width="50px" height="50px">
1833 2082 </div>
1834 2083 </div>
1835 2084 <?php endif; ?>
1836 2085
@@ -1943,61 +2192,140 @@
1943 2192
1944 2193
1945 2194
1946 2195 add_action('wp_ajax_wpdocs_update_folder', 'wpdocs_update_folder');
1947 - function wpdocs_update_folder()
1948 - {
2196 +
2197 + function wpdocs_update_folder() {
2198 +
2199 + if ( ! current_user_can( 'manage_options' ) ) {
2200 + wp_send_json_error( array( 'msg' => __( 'Unauthorized access.', 'wp-docs' ) ), 403 );
2201 + }
2202 +
2203 + if (
2204 + empty( $_POST['nonce'] ) ||
2205 + ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' )
2206 + ) {
2207 + wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 );
2208 + }
2209 +
2210 + $dir_id = absint( $_POST['dir_id'] ?? 0 );
2211 + $resource_id = base64_decode( sanitize_text_field( $_POST['resource_id'] ?? '' ) );
2212 + $new_name = sanitize_text_field( $_POST['new_name'] ?? '' );
2213 +
2214 + if ( ! $dir_id || $resource_id != $dir_id || ! wpdocs_folder_exists( $dir_id ) ) {
2215 + wp_send_json_error( array( 'msg' => __( 'Invalid folder ID or resource mismatch.', 'wp-docs' ) ), 400 );
2216 + }
2217 +
2218 + global $wpdb, $wpdocs_post_types, $wpdocs_post_status;
2219 +
2220 + $updated = $wpdb->query(
2221 + $wpdb->prepare(
2222 + "UPDATE $wpdb->posts
2223 + SET post_title = %s
2224 + WHERE ID = %d
2225 + AND post_type IN ('" . implode( "','", array_map( 'esc_sql', $wpdocs_post_types ) ) . "')
2226 + AND post_status = %s",
2227 + htmlspecialchars_decode( $new_name ),
2228 + $dir_id,
2229 + $wpdocs_post_status
2230 + )
2231 + );
2232 +
2233 + wp_send_json_success(
2234 + array(
2235 + 'msg' => $updated
2236 + ? __( 'Successfully updated.', 'wp-docs' )
2237 + : __( 'No changes were made. Input seems the same as before.', 'wp-docs' ),
2238 + )
2239 + );
2240 + }
1949 2241
1950 - $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce']));
2242 + /*function wpdocs_update_folder() {
2243 +
1951 2244
1952 - if ( ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
1953 - die (__("Sorry, your nonce did not verify.", 'wp-docs'));
1954 -
1955 - $dir_id = sanitize_wpdocs_data($_POST['dir_id']);
1956 - $dir_id_compare = base64_decode(sanitize_wpdocs_data($_POST['resource_id']));
1957 - //pree($dir_id_compare.'=='.$dir_id.' - '.wpdocs_folder_exists($dir_id));exit;
2245 + if ( ! current_user_can('edit_posts') ) {
2246 + wp_send_json_error(['msg' => __('Unauthorized access.', 'wp-docs')]);
2247 + }
2248 +
2249 +
2250 + if (
2251 + empty($_POST['nonce']) ||
2252 + ! wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'wpdocs_update_options_nonce')
2253 + ) {
2254 + wp_send_json_error(['msg' => __('Sorry, your nonce did not verify.', 'wp-docs')]);
2255 + }
2256 +
1958 2257
1959 - $ret = array('msg'=>'');
1960 -
1961 - if ($dir_id>0 && $dir_id_compare==$dir_id && wpdocs_folder_exists($dir_id)) {
1962 -
2258 + $dir_id = absint($_POST['dir_id'] ?? 0);
2259 + $resource_id = base64_decode(sanitize_text_field($_POST['resource_id'] ?? ''));
2260 + $new_name = sanitize_text_field($_POST['new_name'] ?? '');
2261 +
2262 + $ret = ['msg' => ''];
2263 +
2264 + if ( $dir_id > 0 && $resource_id == $dir_id && wpdocs_folder_exists($dir_id) ) {
2265 +
1963 2266 global $wpdb, $wpdocs_post_types, $wpdocs_post_status;
1964 -
1965 - $my_post = array(
1966 - 'post_title' => htmlspecialchars_decode(sanitize_wpdocs_data($_POST['new_name'])),
1967 - 'ID' => $dir_id,
2267 +
2268 + $updated = $wpdb->query(
2269 + $wpdb->prepare(
2270 + "UPDATE $wpdb->posts
2271 + SET post_title = %s
2272 + WHERE ID = %d
2273 + AND post_type IN ('" . implode("','", array_map('esc_sql', $wpdocs_post_types)) . "')
2274 + AND post_status = %s",
2275 + htmlspecialchars_decode($new_name),
2276 + $dir_id,
2277 + $wpdocs_post_status
2278 + )
1968 2279 );
1969 - //pree($my_post);exit;
1970 - //wp_update_post($my_post);
1971 - $rename_query = $wpdb->prepare("UPDATE %s SET post_title='%s' WHERE ID='%d' AND post_type IN ('%s') AND post_status='%s'",
1972 - $wpdb->posts,
1973 - $my_post['post_title'],
1974 - $dir_id,
1975 - implode("','", $wpdocs_post_types),
1976 - $wpdocs_post_status
1977 - );
1978 - //pree($rename_query);exit;
1979 - $updated = $wpdb->query($rename_query);
1980 -
1981 -
1982 - if($updated){
1983 - $ret['msg'] = __("Successfully updated.", 'wp-docs');
1984 - }else{
1985 - $ret['msg'] = __("No changes are made, input seems the same as before.", 'wp-docs');
2280 +
2281 + if ( $updated ) {
2282 + $ret['msg'] = __('Successfully updated.', 'wp-docs');
2283 + } else {
2284 + $ret['msg'] = __('No changes were made. Input seems the same as before.', 'wp-docs');
1986 2285 }
2286 + } else {
2287 + $ret['msg'] = __('Invalid folder ID or resource mismatch.', 'wp-docs');
1987 2288 }
2289 +
2290 + wp_send_json_success($ret);
2291 + }*/
1988 2292
1989 - echo wp_json_encode($ret);
1990 - exit;
1991 - }
1992 2293
1993 2294 add_action('wp_ajax_wpdocs_delete_folder', 'wpdocs_delete_folder');
1994 2295
1995 - function wpdocs_delete_folder()
2296 + function wpdocs_delete_folder() {
2297 +
2298 + if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
2299 + wp_send_json_error( array( 'msg' => __( 'Unauthorized user', 'wp-docs' ) ), 403 );
2300 + }
2301 +
2302 + if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) {
2303 + wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 );
2304 + }
2305 +
2306 + $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0;
2307 + $resource_id = base64_decode( sanitize_wpdocs_data( $_POST['resource_id'] ?? '' ) );
2308 +
2309 + if ( ! $dir_id || $dir_id != $resource_id || ! wpdocs_folder_exists( $dir_id ) ) {
2310 + wp_send_json_error( array( 'msg' => __( 'Invalid folder.', 'wp-docs' ) ), 400 );
2311 + }
2312 +
2313 + wpdocs_recursive_delete_folder( $dir_id );
2314 +
2315 + wp_send_json_success();
2316 + }
2317 + /*function wpdocs_delete_folder()
1996 2318 {
2319 +
2320 + if ( ! current_user_can( 'manage_options' ) ) {
2321 + wp_send_json_error( __( 'Unauthorized user', 'wp-docs' ) );
2322 + wp_die();
2323 + }
2324 +
1997 2325 $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce']));
1998 2326
1999 - if ( ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
2327 + if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
2000 2328 die (__("Sorry, your nonce did not verify.", 'wp-docs'));
2001 2329
2002 2330 $dir_id = sanitize_wpdocs_data($_POST['dir_id']);
2003 2331 $resource_id = base64_decode(sanitize_wpdocs_data($_POST['resource_id']));
@@ -2006,9 +2334,9 @@
2006 2334 wpdocs_recursive_delete_folder($dir_id);
2007 2335 }
2008 2336
2009 2337 exit;
2010 - }
2338 + } */
2011 2339
2012 2340
2013 2341
2014 2342 add_action('wp_ajax_wpdocs_delete_files', 'wpdocs_delete_files');
@@ -2088,11 +2416,59 @@
2088 2416 return update_post_meta($dir_id, 'wpdocs_items', $wpdocs_items);
2089 2417 }
2090 2418 }
2091 2419 }
2420 +
2421 + function wpdocs_delete_files() {
2422 + if ( ! is_user_logged_in() || ! current_user_can( 'delete_posts' ) ) {
2423 + wp_send_json_error( array( 'message' => __( 'Insufficient permissions.', 'wp-docs' ) ), 403 );
2424 + }
2425 +
2426 + if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) {
2427 + wp_send_json_error( array( 'message' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 );
2428 + }
2429 +
2430 + $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0;
2431 + $files = isset( $_POST['files'] ) ? (array) $_POST['files'] : array();
2432 + $files = array_values( array_unique( array_filter( array_map( 'absint', $files ) ) ) );
2433 +
2434 + if ( ! $dir_id || ! wpdocs_folder_exists( $dir_id ) || empty( $files ) ) {
2435 + wp_send_json_error( array( 'message' => __( 'Invalid request.', 'wp-docs' ) ), 400 );
2436 + }
2437 +
2438 + $is_admin = current_user_can( 'manage_options' );
2439 + $is_owner = wpdocs_user_can_edit_folder( $dir_id );
2440 +
2441 + if ( ! $is_admin && ! $is_owner ) {
2442 + wp_send_json_error( array( 'message' => __( 'You cannot delete files from this folder.', 'wp-docs' ) ), 403 );
2443 + }
2444 +
2445 + $allowed = array();
2446 + foreach ( $files as $file_id ) {
2447 + $attachment = get_post( $file_id );
2448 + if ( ! $attachment || 'attachment' !== $attachment->post_type ) {
2449 + continue;
2450 + }
2451 + if ( $is_admin || current_user_can( 'edit_post', $file_id ) ) {
2452 + $allowed[] = $file_id;
2453 + }
2454 + }
2455 +
2456 + if ( empty( $allowed ) ) {
2457 + wp_send_json_error( array( 'message' => __( 'None of the specified files can be deleted by you.', 'wp-docs' ) ), 403 );
2458 + }
2459 +
2460 + wpdocs_del_items_by_user( $dir_id, $allowed, get_current_user_id() );
2461 +
2462 + $wpdocs_items = wpdocs_added_items( $dir_id );
2463 + $wpdocs_items = array_values( array_unique( array_diff( (array) $wpdocs_items, $allowed ) ) );
2464 +
2465 + update_post_meta( $dir_id, 'wpdocs_items', $wpdocs_items );
2466 +
2467 + wp_send_json_success( array( 'dir_id' => $dir_id, 'files' => $allowed ) );
2468 + }
2092 2469
2093 -
2094 -
2470 + /*
2095 2471 function wpdocs_delete_files()
2096 2472 {
2097 2473
2098 2474 $dir_id = sanitize_wpdocs_data($_POST['dir_id']);
@@ -2116,9 +2492,9 @@
2116 2492 }
2117 2493
2118 2494
2119 2495 exit;
2120 - }
2496 + } */
2121 2497
2122 2498 function wpd_admin_footer(){
2123 2499
2124 2500 ?>
@@ -2134,152 +2510,157 @@
2134 2510 add_action('wp_ajax_wpdocs_update_option', 'wpdocs_update_option');
2135 2511
2136 2512 if(!function_exists('wpdocs_update_option')){
2137 2513 function wpdocs_update_option(){
2514 +
2515 + if ( ! current_user_can('manage_options') ) {
2516 + wp_send_json_error('Insufficient permissions.');
2517 + }
2138 2518
2519 + if (
2520 + ! isset($_POST['wpdocs_update_option_nonce']) ||
2521 + ! wp_verify_nonce($_POST['wpdocs_update_option_nonce'], 'wpdocs_update_options_nonce')
2522 + ) {
2523 + wp_send_json_error('Invalid nonce '.$_POST['wpdocs_update_option_nonce']);
2524 + } else {
2525 + //wp_send_json_success('Nonce valid!');
2526 + }
2139 2527
2528 + $return = array(
2140 2529
2141 - if(isset($_POST['wpdocs_update_option_nonce'])){
2530 + 'option_update' => false,
2531 + 'dir_move' => false,
2532 + );
2142 2533
2143 - $nonce = sanitize_wpdocs_data(wp_unslash($_POST['wpdocs_update_option_nonce']));
2534 +
2144 2535
2145 - $return = array(
2536 + if(isset($_POST['wpdocs_options'])){
2146 2537
2147 - 'option_update' => false,
2148 - 'dir_move' => false,
2149 - );
2538 + $wpdocs_options = isset($_POST['wpdocs_options']) ? sanitize_wpdocs_data($_POST['wpdocs_options']) : array();
2150 2539
2151 - if ( ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
2152 - die (__("Sorry, your nonce did not verify.", 'wp-docs'));
2540 + $wpdocs_dir_id = isset($_POST['wpdocs_dir_id']) ? sanitize_wpdocs_data($_POST['wpdocs_dir_id']) : 0;
2153 2541
2154 - if(isset($_POST['wpdocs_options'])){
2155 2542
2156 - $wpdocs_options = isset($_POST['wpdocs_options']) ? sanitize_wpdocs_data($_POST['wpdocs_options']) : array();
2543 + $sanitized_option = sanitize_wpdocs_data($wpdocs_options);
2544 + $sanitized_option['allowed_role'] = $sanitized_option['allowed_role'] !== 'empty' ? $sanitized_option['allowed_role'] : array();
2157 2545
2158 - $wpdocs_dir_id = isset($_POST['wpdocs_dir_id']) ? sanitize_wpdocs_data($_POST['wpdocs_dir_id']) : 0;
2159 2546
2547 + if($wpdocs_dir_id == 0){
2160 2548
2161 - $sanitized_option = sanitize_wpdocs_data($wpdocs_options);
2162 - $sanitized_option['allowed_role'] = $sanitized_option['allowed_role'] !== 'empty' ? $sanitized_option['allowed_role'] : array();
2549 + $update = update_option('wpdocs_options', $sanitized_option);
2163 2550
2551 + }else{
2164 2552
2165 - if($wpdocs_dir_id == 0){
2553 + $update = update_post_meta($wpdocs_dir_id, '_wpdocs_dir_options', $sanitized_option);
2554 + $child_dir_list = wpdoc_get_dir_children($wpdocs_dir_id);
2555 + if(!empty($child_dir_list)){
2556 + foreach ($child_dir_list as $child_dir) {
2166 2557
2167 - $update = update_option('wpdocs_options', $sanitized_option);
2558 + $update = update_post_meta($child_dir, '_wpdocs_dir_options', $sanitized_option);
2168 2559
2169 - }else{
2170 -
2171 - $update = update_post_meta($wpdocs_dir_id, '_wpdocs_dir_options', $sanitized_option);
2172 - $child_dir_list = wpdoc_get_dir_children($wpdocs_dir_id);
2173 - if(!empty($child_dir_list)){
2174 - foreach ($child_dir_list as $child_dir) {
2175 -
2176 - $update = update_post_meta($child_dir, '_wpdocs_dir_options', $sanitized_option);
2177 -
2178 - # code...
2179 - }
2560 + # code...
2180 2561 }
2562 + }
2181 2563
2182 -
2564 +
2183 2565
2184 - }
2185 - }
2566 + }
2567 + }
2186 2568
2187 2569
2188 2570
2189 - if(isset($_POST['wpdocs_move_selected_dir'])){
2571 + if(isset($_POST['wpdocs_move_selected_dir'])){
2190 2572
2191 - $wpdocs_move_selected_dir = sanitize_wpdocs_data($_POST['wpdocs_move_selected_dir']);
2192 - $action_type = $wpdocs_move_selected_dir['action_type'];
2193 -
2573 + $wpdocs_move_selected_dir = sanitize_wpdocs_data($_POST['wpdocs_move_selected_dir']);
2574 + $action_type = $wpdocs_move_selected_dir['action_type'];
2575 +
2194 2576
2195 - $is_file = array_key_exists('is_file', $wpdocs_move_selected_dir) ? $wpdocs_move_selected_dir['is_file']: false;
2196 - $is_file = $is_file == 'false' ? false: true;
2577 + $is_file = array_key_exists('is_file', $wpdocs_move_selected_dir) ? $wpdocs_move_selected_dir['is_file']: false;
2578 + $is_file = $is_file == 'false' ? false: true;
2197 2579
2198 2580
2199 - if(!$is_file && array_key_exists('dir_selected', $wpdocs_move_selected_dir) &&
2200 - array_key_exists('dir_id', $wpdocs_move_selected_dir)){
2581 + if(!$is_file && array_key_exists('dir_selected', $wpdocs_move_selected_dir) &&
2582 + array_key_exists('dir_id', $wpdocs_move_selected_dir)){
2583 +
2584 + switch($action_type){
2585 + default:
2586 + case 'move':
2587 +
2588 +
2589 + $update = wp_update_post(
2590 + array(
2591 + 'ID' => $wpdocs_move_selected_dir['dir_selected'],
2592 + 'post_parent' => $wpdocs_move_selected_dir['dir_id']
2593 + )
2594 + );
2201 2595
2202 - switch($action_type){
2203 - default:
2204 - case 'move':
2596 + if($update == $wpdocs_move_selected_dir['dir_selected']){
2597 + $return['dir_move'] = true;
2598 + }
2205 2599
2206 -
2207 - $update = wp_update_post(
2208 - array(
2209 - 'ID' => $wpdocs_move_selected_dir['dir_selected'],
2210 - 'post_parent' => $wpdocs_move_selected_dir['dir_id']
2211 - )
2212 - );
2600 + break;
2601 +
2602 + case 'copy':
2603 + $existing_dir = get_post($wpdocs_move_selected_dir['dir_selected']);
2604 + $existing_dir = (is_object($existing_dir)?(array)$existing_dir:array());
2605 + if(!empty($existing_dir) && array_key_exists('ID', $existing_dir) && function_exists('wpdocs_recursive_copy_folder')){
2213 2606
2214 - if($update == $wpdocs_move_selected_dir['dir_selected']){
2215 - $return['dir_move'] = true;
2216 - }
2607 + wpdocs_recursive_copy_folder($wpdocs_move_selected_dir['dir_id'], $existing_dir);
2217 2608
2218 - break;
2609 + $return['dir_move'] = true;
2610 +
2611 + }
2219 2612
2220 - case 'copy':
2221 - $existing_dir = get_post($wpdocs_move_selected_dir['dir_selected']);
2222 - $existing_dir = (is_object($existing_dir)?(array)$existing_dir:array());
2223 - if(!empty($existing_dir) && array_key_exists('ID', $existing_dir) && function_exists('wpdocs_recursive_copy_folder')){
2224 -
2225 - wpdocs_recursive_copy_folder($wpdocs_move_selected_dir['dir_id'], $existing_dir);
2226 -
2227 - $return['dir_move'] = true;
2228 -
2229 - }
2230 -
2231 -
2232 - break;
2233 - }
2234 -
2235 -
2236 -
2237 - }
2238 - //exit;
2613 +
2614 + break;
2615 + }
2616 +
2617 +
2618 +
2619 + }
2620 + //exit;
2239 2621
2240 - if($is_file){
2622 + if($is_file){
2241 2623
2242 - $file_id = $wpdocs_move_selected_dir['files'];
2243 -
2244 - $current_dir = $wpdocs_move_selected_dir['file_dir'];
2624 + $file_id = $wpdocs_move_selected_dir['files'];
2625 +
2626 + $current_dir = $wpdocs_move_selected_dir['file_dir'];
2627 +
2628 + $new_dir = $wpdocs_move_selected_dir['dir_id'];
2629 +
2630 + $files = wpdocs_added_items($current_dir);
2631 +
2632 + $file_id = is_array($file_id) ? $file_id : array($file_id);
2633 + $files = array_diff($files, $file_id);
2634 +
2635 +
2636 + switch($action_type){
2637 + default:
2638 + case 'move':
2639 +
2640 + update_post_meta($current_dir, 'wpdocs_items', $files);
2641 +
2642 + break;
2245 2643
2246 - $new_dir = $wpdocs_move_selected_dir['dir_id'];
2247 -
2248 - $files = wpdocs_added_items($current_dir);
2249 -
2250 - $file_id = is_array($file_id) ? $file_id : array($file_id);
2251 - $files = array_diff($files, $file_id);
2252 -
2253 -
2254 - switch($action_type){
2255 - default:
2256 - case 'move':
2257 -
2258 - update_post_meta($current_dir, 'wpdocs_items', $files);
2259 -
2260 - break;
2644 + case 'copy':
2261 2645
2262 - case 'copy':
2263 -
2264 - break;
2265 -
2266 - }
2646 + break;
2647 +
2648 + }
2267 2649
2268 - $update = wpdocs_update_files_meta($new_dir, $file_id);
2269 -
2270 - if($update === true){
2271 - $return['dir_move'] = true;
2272 - }
2650 + $update = wpdocs_update_files_meta($new_dir, $file_id);
2651 +
2652 + if($update === true){
2653 + $return['dir_move'] = true;
2654 + }
2273 2655
2274 - }
2275 - }
2656 + }
2657 + }
2276 2658
2277 - echo wp_json_encode($return);
2659 + echo wp_json_encode($return);
2278 2660
2279 - }
2280 2661
2281 - wp_die();
2662 + wp_die();
2282 2663
2283 2664 }
2284 2665 }
2285 2666
@@ -2336,9 +2717,9 @@
2336 2717
2337 2718 if(!array_key_exists('id', $wp_dir)) continue;
2338 2719 $wpdocs_list_child = wpdocs_list($wp_dir['id']);
2339 2720
2340 - $option .= '<option value="'.$wp_dir['id'].'" data-parent="'.$dir.'">'.str_repeat(str_replace(' ', '&nbsp;', $str), $level).$wp_dir['title'].'</option>';
2721 + $option .= '<option value="'.esc_attr($wp_dir['id']).'" data-parent="'.esc_attr($dir).'">'.str_repeat(str_replace(' ', '&nbsp;', $str), $level).esc_html($wp_dir['title']).'</option>';
2341 2722
2342 2723
2343 2724 if(!empty($wpdocs_list_child)){
2344 2725
@@ -2372,9 +2753,9 @@
2372 2753
2373 2754 <nav aria-label="breadcrumb" class="wpdocs-nav">
2374 2755 <ol class="breadcrumb bg-light" style="border-bottom:1px solid #dee2e6;border-radius: 0;">
2375 2756
2376 - <li class="breadcrumb-item bread_home_url"><a class="wpd_bread_item" href="<?php echo $get_permalink ?>" data-id="0"><?php _e('Home', 'wp-docs'); ?></a></li>
2757 + <li class="breadcrumb-item bread_home_url"><a class="wpd_bread_item" href="<?php echo esc_url($get_permalink); ?>" data-id="0"><?php _e('Home', 'wp-docs'); ?></a></li>
2377 2758 <?php
2378 2759
2379 2760 foreach (array_reverse($breadcrumb_array) as $bread_key => $bread_value) {
2380 2761 $active = '';
@@ -2391,9 +2772,9 @@
2391 2772 }
2392 2773
2393 2774
2394 2775 ?>
2395 - <li class="breadcrumb-item <?php echo $active ?>" aria-current="<?php echo $page; ?>"><?php echo $link ?></li>
2776 + <li class="breadcrumb-item <?php echo esc_attr($active); ?>" aria-current="<?php echo esc_attr($page); ?>"><?php echo ($link); ?></li>
2396 2777
2397 2778 <?php
2398 2779 }
2399 2780
@@ -2409,16 +2790,51 @@
2409 2790 }
2410 2791 }
2411 2792
2412 2793 add_action('wp_ajax_wpdocs_update_view', 'wpdocs_update_view');
2413 - add_action('wp_ajax_nopriv_wpdocs_update_view', 'wpdocs_update_view');
2414 -
2415 - if(!function_exists('wpdocs_update_view')){
2794 +
2795 +
2796 + if ( ! function_exists( 'wpdocs_update_view' ) ) {
2797 + function wpdocs_update_view() {
2798 +
2799 + if ( ! is_user_logged_in() || ! current_user_can( 'read' ) ) {
2800 + wp_send_json_error( array( 'msg' => __( 'Unauthorized access.', 'wp-docs' ) ), 403 );
2801 + }
2802 +
2803 + if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) {
2804 + wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 );
2805 + }
2806 +
2807 + $uid = get_current_user_id();
2808 + $key = 'wpdocs_view_rl_' . $uid;
2809 + $hits = (int) get_transient( $key );
2810 +
2811 + if ( $hits >= 60 ) {
2812 + wp_send_json_error( array( 'msg' => __( 'Too many requests.', 'wp-docs' ) ), 429 );
2813 + }
2814 + set_transient( $key, $hits + 1, MINUTE_IN_SECONDS );
2815 +
2816 + if ( isset( $_POST['update_view'] ) ) {
2817 +
2818 + $wpdocs_view = get_option( 'wpdocs_view', array() );
2819 + $wpdocs_view = is_array( $wpdocs_view ) ? $wpdocs_view : array();
2820 +
2821 + $parent_dir = sanitize_wpdocs_data( $_POST['parent_dir'] ?? '' );
2822 + $view_val = sanitize_wpdocs_data( $_POST['update_view'] );
2823 +
2824 + $wpdocs_view[ $parent_dir ] = $view_val;
2825 + update_option( 'wpdocs_view', $wpdocs_view );
2826 + }
2827 +
2828 + wp_send_json_success();
2829 + }
2830 + }
2831 + /*if(!function_exists('wpdocs_update_view')){
2416 2832 function wpdocs_update_view(){
2417 2833
2418 2834 $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce']));
2419 2835
2420 - if ( ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
2836 + if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
2421 2837 die (__("Sorry, your nonce did not verify.", 'wp-docs'));
2422 2838
2423 2839 if(isset($_POST['update_view'])){
2424 2840
@@ -2431,9 +2847,9 @@
2431 2847
2432 2848 }
2433 2849 exit;
2434 2850 }
2435 - }
2851 + }*/
2436 2852 function wpdocs_init_session() {
2437 2853 if(!session_id()) {
2438 2854 session_start();
2439 2855 }
@@ -2629,13 +3045,91 @@
2629 3045 return $ret;
2630 3046
2631 3047 }
2632 3048 }
3049 + if(!function_exists('wpdocs_file_download')){
3050 + function wpdocs_file_download(){
3051 +
3052 + if(empty($_GET['wpdocs_dl'])){
3053 + return;
3054 + }
3055 +
3056 + $file_id = absint(
3057 + wp_unslash($_GET['wpdocs_dl'])
3058 + );
3059 +
3060 + if(!$file_id){
3061 + status_header(404);
3062 + exit;
3063 + }
3064 +
3065 + $nonce = isset($_GET['wpdocs_nonce'])
3066 + ? sanitize_text_field(
3067 + wp_unslash($_GET['wpdocs_nonce'])
3068 + )
3069 + : '';
3070 +
3071 + if(
3072 + !wp_verify_nonce(
3073 + $nonce,
3074 + 'wpdocs_dl_' . $file_id
3075 + )
3076 + ){
3077 + status_header(403);
3078 + exit;
3079 + }
3080 +
3081 + // Adjust this according to where you store the file
3082 + $file = get_attached_file($file_id);
3083 +
3084 + if(
3085 + !$file ||
3086 + !file_exists($file)
3087 + ){
3088 + status_header(404);
3089 + exit;
3090 + }
3091 +
3092 + $uploads = wp_get_upload_dir();
3093 + $base_real = realpath($uploads['basedir']);
3094 + $file_real = realpath($file);
3095 +
3096 + if(
3097 + !$base_real ||
3098 + !$file_real ||
3099 + strpos(
3100 + $file_real,
3101 + $base_real . DIRECTORY_SEPARATOR
3102 + ) !== 0
3103 + ){
3104 + status_header(403);
3105 + exit;
3106 + }
3107 +
3108 + $mime = wp_check_filetype($file_real);
3109 + $mime = !empty($mime['type'])
3110 + ? $mime['type']
3111 + : 'application/octet-stream';
3112 +
3113 + header('Content-Type: ' . $mime);
3114 + header('Content-Length: ' . filesize($file_real));
3115 + header(
3116 + 'Content-Disposition: inline; filename="' .
3117 + basename($file_real) .
3118 + '"'
3119 + );
3120 +
3121 + readfile($file_real);
3122 + exit;
3123 + }
3124 + }
2633 3125
2634 3126 add_action('init', 'wpdocs_dir_actions');
2635 3127 if(!function_exists('wpdocs_dir_actions')){
2636 3128 function wpdocs_dir_actions(){
2637 3129
3130 + wpdocs_file_download();
3131 +
2638 3132 if(is_admin() && get_option('wpdocs_memphis_uninstall')){
2639 3133 if(wp_docs_memphis_folder_preserve('mdocs_2', 'mdocs')){
2640 3134 update_option('wpdocs_memphis_uninstall', false);
2641 3135 }
@@ -2716,9 +3210,9 @@
2716 3210
2717 3211 if(isset($_GET['clear'])){
2718 3212 global $wpdocs_url, $wpdb, $wpdocs_post_types;
2719 3213 update_option('wpdocs_options', array());
2720 - $wpdb->query($wpdb->prepare("DELETE FROM %s WHERE post_type IN ('%s')", $wpdb->posts, implode("','", $wpdocs_post_types)));
3214 + $wpdb->query($wpdb->prepare("DELETE FROM $wpdb->posts WHERE post_type IN ('".implode("','", $wpdocs_post_types)."')"));
2721 3215 wp_redirect(admin_url('options-general.php?page=wpdocs'));exit;
2722 3216 }
2723 3217
2724 3218
@@ -2842,30 +3336,34 @@
2842 3336 $result_array = array(
2843 3337 'status' => false,
2844 3338 );
2845 3339
2846 - if (!isset($_POST['wp_docs_nonce']) || !wp_verify_nonce( sanitize_wpdocs_data(wp_unslash($_POST['wp_docs_nonce'])), 'wpdocs_update_options_nonce' ) ){
3340 + if(!empty($_POST) && isset($_POST['wp_docs_nonce'])){
2847 3341
2848 - wp_die(__("Sorry, your nonce did not verify.", 'wp-docs'));
2849 -
2850 - }else{
2851 -
2852 - $dir_progress = wp_docs_import_memphis_directories();
2853 - $file_progress = wp_docs_memphis_import_files();
2854 -
2855 - $result_array['status'] = ($dir_progress || $file_progress);
2856 -
2857 - if($result_array['status']){
2858 - wp_docs_whiteflag_memphis_htaccess();
2859 - }
2860 -
2861 - if(!$dir_progress && !$file_progress){
3342 + if (!wp_verify_nonce( sanitize_wpdocs_data(wp_unslash($_POST['wp_docs_nonce'])), 'wpdocs_update_options_nonce' ) ){
2862 3343
2863 - $result_array['remarks'] = __('No directories and files found.', 'wp-docs');
3344 + wp_die(__("Sorry, your nonce did not verify.", 'wp-docs'));
3345 +
3346 + }else{
3347 +
3348 + $dir_progress = wp_docs_import_memphis_directories();
3349 + $file_progress = wp_docs_memphis_import_files();
3350 +
3351 + $result_array['status'] = ($dir_progress || $file_progress);
3352 +
3353 + if($result_array['status']){
3354 + wp_docs_whiteflag_memphis_htaccess();
3355 + }
3356 +
3357 + if(!$dir_progress && !$file_progress){
3358 +
3359 + $result_array['remarks'] = __('No directories and files found.', 'wp-docs');
3360 + }
3361 +
2864 3362 }
2865 3363
2866 3364 }
2867 -
3365 +
2868 3366 wp_send_json($result_array);
2869 3367 }
2870 3368 }
2871 3369
@@ -2877,16 +3375,20 @@
2877 3375 $result_array = array(
2878 3376 'status' => false,
2879 3377 );
2880 3378
2881 - if (!isset($_POST['wp_docs_nonce']) || !wp_verify_nonce( sanitize_wpdocs_data(wp_unslash($_POST['wp_docs_nonce'])), 'wpdocs_update_options_nonce' ) ){
3379 + if(!empty($_POST) && isset($_POST['wp_docs_nonce'])){
2882 3380
2883 - wp_die(__("Sorry, your nonce did not verify.", 'wp-docs'));
2884 -
2885 - }else{
2886 -
2887 - wp_docs_rollback_memphis_import();
2888 - $result_array['status'] = true;
3381 + if (!wp_verify_nonce( sanitize_wpdocs_data(wp_unslash($_POST['wp_docs_nonce'])), 'wpdocs_update_options_nonce' ) ){
3382 +
3383 + wp_die(__("Sorry, your nonce did not verify.", 'wp-docs'));
3384 +
3385 + }else{
3386 +
3387 + wp_docs_rollback_memphis_import();
3388 + $result_array['status'] = true;
3389 + }
3390 +
2889 3391 }
2890 3392
2891 3393 wp_send_json($result_array);
2892 3394 }
@@ -2896,9 +3398,9 @@
2896 3398 function wp_docs_get_memphis_name(){
2897 3399 global $wpdb;
2898 3400 $name = esc_sql('Memphis Documents');
2899 3401
2900 - $query = $wpdb->prepare("SELECT max(ID) FROM %s WHERE post_title LIKE '%%s%'", $wpdb->posts, $name);
3402 + $query = $wpdb->prepare("SELECT max(ID) FROM $wpdb->posts WHERE post_title LIKE '%$name%'");
2901 3403
2902 3404 $result = $wpdb->get_var($query);
2903 3405 if($result){
2904 3406
@@ -2929,9 +3431,9 @@
2929 3431 $name = esc_sql('Memphis Documents');
2930 3432
2931 3433 $dir_id = 0;
2932 3434
2933 - $query = $wpdb->prepare("SELECT max(ID) FROM %s WHERE post_title LIKE '%%s%'", $wpdb->posts, $name);
3435 + $query = $wpdb->prepare("SELECT max(ID) FROM $wpdb->posts WHERE post_title LIKE '%$name%'");
2934 3436
2935 3437 $result = $wpdb->get_var($query);
2936 3438 if($result){
2937 3439 $dir_id = $result;
@@ -3078,31 +3580,34 @@
3078 3580
3079 3581 }
3080 3582 }
3081 3583
3584 +
3082 3585 if(!function_exists('wp_docs_relocate_memphis_meta')){
3083 3586 function wp_docs_relocate_memphis_meta($dir_id){
3084 3587 global $wpdocs_imported_files, $wpdocs_imported_folder;
3588 +
3589 + // Ensure arrays are initialized properly before using them
3590 + $wpdocs_imported_files = (is_array($wpdocs_imported_files) ? $wpdocs_imported_files : array());
3591 + $wpdocs_imported_folder = (is_array($wpdocs_imported_folder) ? $wpdocs_imported_folder : array());
3592 +
3085 3593 $wpdocs_items = get_post_meta($dir_id, 'wpdocs_items', true);
3086 3594 $wpdocs_items = (is_array($wpdocs_items) ? $wpdocs_items : array());
3087 3595 $dir_slug = get_post_meta($dir_id, '_wpdocs_memphis_slug', true);
3088 -
3089 - $wpdocs_imported_files = (is_array($wpdocs_imported_files)?$wpdocs_imported_files:array());
3090 -
3596 +
3091 3597 if(!empty($wpdocs_items)){
3092 -
3093 3598 $wpdocs_imported_files = array_diff($wpdocs_imported_files, $wpdocs_items);
3094 3599 }
3095 -
3600 +
3096 3601 if($dir_slug){
3097 3602 $wpdocs_imported_folder = array_diff($wpdocs_imported_folder, array($dir_slug));
3098 3603 }
3099 -
3604 +
3100 3605 update_option('wpdocs_imported_folder', $wpdocs_imported_folder);
3101 3606 update_option('wpdocs_imported_files', $wpdocs_imported_files);
3607 + }
3608 + }
3102 3609
3103 - };
3104 - }
3105 3610
3106 3611 if(!function_exists('wp_docs_memphis_import_files')){
3107 3612 function wp_docs_memphis_import_files(){
3108 3613 global $memphis_folders_id, $memphis_files_array, $wpdocs_imported_files, $wpdocs_memphis_list, $wpdocs_post_types;
@@ -3138,8 +3643,10 @@
3138 3643
3139 3644 if(!empty($dir_list)){
3140 3645 foreach($dir_list as $dir_id){
3141 3646 update_post_meta($attachment_id, '_wpdocs_memphis_media_file', true);
3647 + update_post_meta($attachment_id, '_wpdocs_memphis_file_id', $file_data['id']);
3648 +
3142 3649 $wpdocs_imported_files[] = $attachment_id;
3143 3650 wpdocs_update_files_meta($dir_id, $files);
3144 3651 }
3145 3652 unset($memphis_files_array[$file_index]);
@@ -3320,15 +3827,15 @@
3320 3827 $default_ext = '';
3321 3828
3322 3829 $breadcrumb = get_the_title($dir);
3323 3830 ?>
3324 - <small class="alert alert-success d-block"><i class="fas fa-chevron-right"></i> <?php echo $breadcrumb; ?></small>
3831 + <small class="alert alert-success d-block"><i class="fas fa-chevron-right"></i> <?php echo esc_html($breadcrumb); ?></small>
3325 3832 <?php
3326 3833
3327 3834 }
3328 3835 ?>
3329 3836 <label for="wpdocs_options_file">
3330 - <input <?php checked($is_file); ?> type="checkbox" class="<?php echo $dir_option_class; ?>" name="wpdocs_options[file_upload]" value="file_upload" id="wpdocs_options_file" />
3837 + <input <?php checked($is_file); ?> type="checkbox" class="<?php echo esc_attr($dir_option_class); ?>" name="wpdocs_options[file_upload]" value="file_upload" id="wpdocs_options_file" />
3331 3838 <?php echo __('File Upload Front-end', 'wp-docs'); ?> <small><?php echo $wpdocs_pro?__('(Optional)', 'wp-docs'):__('(Premium)', 'wp-docs'); ?></small> <i title="<?php echo __('This icon will appear on front-end for users', 'wp-docs'); ?>" class="fa fa-upload" style="color:#ffc107"></i>
3332 3839 <a href="https://www.youtube.com/embed/flFmqpJCwYk" target="_blank"><?php echo __('Video Tutorial', 'wp-docs'); ?></a>
3333 3840 </label>
3334 3841
@@ -3336,9 +3843,9 @@
3336 3843
3337 3844 <ul class="ml-4 <?php echo $is_file ? '' : 'd-none'?>">
3338 3845 <li>
3339 3846 <label for="wpdocs_options_current_user_files">
3340 - <input class="<?php echo $dir_option_class; ?>" <?php checked($is_file && $is_current_user_files); ?> type="checkbox" name="wpdocs_options[current_user_files]" value="current_user_files" id="wpdocs_options_current_user_files" />
3847 + <input class="<?php echo esc_attr($dir_option_class); ?>" <?php checked($is_file && $is_current_user_files); ?> type="checkbox" name="wpdocs_options[current_user_files]" value="current_user_files" id="wpdocs_options_current_user_files" />
3341 3848 <?php echo __('Do not make files public uploaded by users', 'wp-docs'); ?> <small><?php echo $wpdocs_pro?__('(Optional)', 'wp-docs'):__('(Premium)', 'wp-docs'); ?></small>
3342 3849 </label>
3343 3850 </li>
3344 3851
@@ -3343,9 +3850,9 @@
3343 3850 </li>
3344 3851
3345 3852 <li>
3346 3853 <label for="wpdocs_options_del_from_front">
3347 - <input class="<?php echo $dir_option_class; ?>" <?php checked($is_file && $is_del_from_front); ?> type="checkbox" name="wpdocs_options[del_from_front]" value="del_from_front" id="wpdocs_options_del_from_front" />
3854 + <input class="<?php echo esc_attr($dir_option_class); ?>" <?php checked($is_file && $is_del_from_front); ?> type="checkbox" name="wpdocs_options[del_from_front]" value="del_from_front" id="wpdocs_options_del_from_front" />
3348 3855 <?php echo __('User can delete the files from front-end?', 'wp-docs'); ?> <small><?php echo $wpdocs_pro?__('(Optional)', 'wp-docs'):__('(Premium)', 'wp-docs'); ?></small> <i class="fas fa-trash-alt" style="color:#ffc107"></i>
3349 3856 </label>
3350 3857 </li>
3351 3858
@@ -3355,9 +3862,9 @@
3355 3862 </label>
3356 3863
3357 3864
3358 3865
3359 - <select class="wpdocs_options_allowed_role <?php echo $dir_option_class; ?>" name="wpdocs_options[allowed_role]" data-name="allowed_role" id="wpdocs_options_allowed_role" multiple placeholder="<?php echo __('Select roles to allow upload', 'wp-docs'); ?>">
3866 + <select class="wpdocs_options_allowed_role <?php echo esc_attr($dir_option_class); ?>" name="wpdocs_options[allowed_role]" data-name="allowed_role" id="wpdocs_options_allowed_role" multiple placeholder="<?php echo __('Select roles to allow upload', 'wp-docs'); ?>">
3360 3867
3361 3868 <?php echo wpdocs_get_user_roles_options($allowed_role) ?>
3362 3869
3363 3870 </select>
@@ -3368,9 +3875,9 @@
3368 3875 <li>
3369 3876 <label for="wpdocs_options_allowed_ext">
3370 3877 <?php echo __('Allowed File Types', 'wp-docs'); ?> <?php echo ($wpdocs_pro?'':'<small>'.__('(Premium)', 'wp-docs').'</small> '); ?> <i class="fas fa-photo-video" style="color:#ffc107"></i>
3371 3878 </label>
3372 - <input type="text" class="form-control <?php echo $dir_option_class; ?>" name="wpdocs_options[allowed_ext]" data-name="allowed_ext" value="<?php echo $allowed_ext; ?>" id="wpdocs_options_allowed_ext" title="<?php _e('Leave blank if you want to allow all type of files', 'wp-docs'); ?>" placeholder="<?php echo $default_ext; ?>" />
3879 + <input type="text" class="form-control <?php echo esc_attr($dir_option_class); ?>" name="wpdocs_options[allowed_ext]" data-name="allowed_ext" value="<?php echo esc_attr($allowed_ext); ?>" id="wpdocs_options_allowed_ext" title="<?php _e('Leave blank if you want to allow all type of files', 'wp-docs'); ?>" placeholder="<?php echo esc_attr($default_ext); ?>" />
3373 3880
3374 3881 </li>
3375 3882
3376 3883 </ul>
@@ -3535,4 +4042,5 @@
3535 4042 function wpdoc_humanize($str){
3536 4043 return ucwords(str_replace(array('-', '_'), ' ', $str));
3537 4044 }
3538 4045 }
4046 + include_once('functions-verify.php');