PluginProbe
WP Docs / 2.3.4
WP Docs v2.3.4
2.3.4 2.3.3 2.3.2 trunk 2.2.0 2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 2.2.6 2.2.7 2.2.8 2.2.9 2.3.0 2.3.1
← All changes | inc/functions.php +818 -304 2.2.3 → 2.3.4 View file →
@@ -1,6 +1,18 @@
1 1 <?php
2 -
2 + if(!function_exists('wpdocs_secure_url')){
3 + function wpdocs_secure_url($file_id=''){
4 +
5 + $ret = add_query_arg(
6 + array(
7 + 'wpdocs_dl' => $file_id,
8 + 'wpdocs_nonce' => wp_create_nonce('wpdocs_dl_'.$file_id),
9 + ),
10 + home_url('/')
11 + );
12 + return $ret;
13 + }
14 + }
3 15 if(!function_exists('wp_docs_get_memphis_dir_option_id')){
4 16 function wp_docs_get_option_id($option_name){
5 17 global $wpdb;
6 18 $option_name = esc_sql( $option_name );
@@ -44,8 +56,10 @@
44 56 function wpdocs_admin_enqueue_script()
45 57 {
46 58 if (isset($_GET['page']) && $_GET['page'] == 'wpdocs') {
47 59
60 + //pree(get_option('mdocs-list'));exit;
61 +
48 62 global $wpdocs_pro, $wpdocs_options;
49 63
50 64 wp_enqueue_script('wpdocs_boostrap', plugin_dir_url(dirname(__FILE__)) . 'js/bootstrap.min.js', array('jquery'));
51 65 wp_enqueue_style('wpdocs-boostrap', plugins_url('css/bootstrap.min.css', dirname(__FILE__)));
@@ -65,8 +79,9 @@
65 79 wp_enqueue_style('wpdocs-common', plugins_url('css/common-styles.css', dirname(__FILE__)), array(), date('Ymdhi'));
66 80 wp_enqueue_style('wpdocs-admin', plugins_url('css/admin-styles.css', dirname(__FILE__)), array(), date('Ymdhi'));
67 81
68 82 wp_enqueue_script('wpdocs_admin_scripts', plugin_dir_url(dirname(__FILE__)) . 'js/admin-scripts.js', array('jquery', 'jquery-ui-dialog'), time());
83 + wp_enqueue_script('wpdocs_verify_scripts', plugin_dir_url(dirname(__FILE__)) . 'js/verify-scripts.js', array('jquery', 'jquery-ui-dialog'), time());
69 84
70 85 if($wpdocs_pro){
71 86 wp_enqueue_script('wpdocs_pro_scripts', plugin_dir_url(dirname(__FILE__)) . 'pro/wp-docs-admin.js?t='.time(), array('jquery'));
72 87 }
@@ -83,8 +98,9 @@
83 98 'wpdocs_admin_scripts',
84 99 'wpdocs_ajax_object',
85 100 array(
86 101 'ajax_url' => admin_url('admin-ajax.php'),
102 + 'nonce' => wp_create_nonce('wpdocs_update_options_nonce'),
87 103 'url' => admin_url('options-general.php?page=wpdocs'),
88 104 'wpdocs_pro' => $wpdocs_pro,
89 105 'wpdocs_delete_msg' => __('Do you want to delete this directory and data as well?', 'wp-docs'),
90 106 'wpdocs_delete_shortcut_msg' => __('Do you want to delete this shortcut?', 'wp-docs'),
@@ -100,16 +116,64 @@
100 116 'undo_import_confirm' => __('Do you want to rollback the import?', 'wp-docs'),
101 117 'select_role_str' => __('Select roles to allow upload', 'wp-docs'),
102 118 'rename_confirm' => __('Do you want to rename this directory?', 'wp-docs'),
103 119 'reset_confirm' => __('Do you want to reset all settings and clear directories?', 'wp-docs'),
104 - 'nonce' => wp_create_nonce('wpdocs_update_options_nonce'),
120 +
105 121 'empty_settings' => empty($wpdocs_options),
106 122 'wc_os_pg' => (isset($_GET['pg'])?esc_attr($_GET['pg']):'0'),
107 123 'wc_os_tab' => (isset($_GET['t'])?esc_attr($_GET['t']):'0'),
108 - 'all_dirs' => $dir_id_to_titles
124 + 'all_dirs' => $dir_id_to_titles,
125 + 'rename_confirm' => __('Please enter new folder name:', 'wp-docs'),
109 126
110 127 )
111 128 );
129 +
130 + wp_localize_script(
131 + 'wpdocs_verify_scripts',
132 + 'wpdocs_vars',
133 + array(
134 + 'ajax_url' => admin_url('admin-ajax.php'),
135 + 'url' => admin_url('options-general.php?page=wpdocs'),
136 + 'nonce' => wp_create_nonce('wpdocs_verify_nonce'),
137 + 'preparing_queue' => __('Preparing verification queue...', 'wp-docs'),
138 + 'unable_to_start' => __('Unable to start verification.', 'wp-docs'),
139 + 'ajax_error' => __('AJAX error.', 'wp-docs'),
140 + 'verification_failed' => __('Verification failed.', 'wp-docs'),
141 + 'verification_completed' => __('Verification completed.', 'wp-docs'),
142 + 'verification_interrupted' => __('Verification interrupted.', 'wp-docs'),
143 + 'checking_folder' => __('Checking Folder:', 'wp-docs'),
144 + 'checking_file' => __('Checking File:', 'wp-docs'),
145 + 'unknown_file' => __('Unknown File', 'wp-docs'),
146 + 'items_processed' => __('items processed', 'wp-docs'),
147 + 'total_folders' => __('Total Folders', 'wp-docs'),
148 + 'verified_folders' => __('Verified Folders', 'wp-docs'),
149 + 'missing_folders' => __('Missing Folders', 'wp-docs'),
150 + 'total_files' => __('Total Files', 'wp-docs'),
151 + 'verified_files' => __('Verified Files', 'wp-docs'),
152 + 'missing_files' => __('Missing Files', 'wp-docs'),
153 + 'missing_folder' => __('MISSING FOLDER', 'wp-docs'),
154 + 'missing_file' => __('MISSING FILE', 'wp-docs'),
155 + 'no_items_display' => __('No items to display.', 'wp-docs'),
156 + 'import_in_progress' => __('Import is already in progress. Please wait.', 'wp-docs'),
157 + 'import_missing_confirm' => __('This will import only missing folders and files. Do you want to continue?', 'wp-docs'),
158 + 'initializing' => __('Initializing...', 'wp-docs'),
159 + 'preparing_import_queue' => __('Preparing import queue...', 'wp-docs'),
160 + 'unable_to_start_import' => __('Unable to start import.', 'wp-docs'),
161 + 'import_failed' => __('Import failed.', 'wp-docs'),
162 + 'import_completed' => __('Import completed!', 'wp-docs'),
163 + 'refreshing_results' => __('Refreshing verification results...', 'wp-docs'),
164 + 'import_interrupted' => __('Import interrupted. Please try again.', 'wp-docs'),
165 + 'creating_folder' => __('Creating Folder:', 'wp-docs'),
166 + 'importing_file' => __('Importing File:', 'wp-docs'),
167 + 'path' => __('Path:', 'wp-docs'),
168 + 'target' => __('Target:', 'wp-docs'),
169 + 'folders_imported' => __('Folders imported:', 'wp-docs'),
170 + 'files_imported' => __('Files imported:', 'wp-docs'),
171 + 'failed' => __('Failed:', 'wp-docs'),
172 + 'please_wait' => __('Please wait...', 'wp-docs'),
173 + 'import_missing_items' => __('Import Missing Items Only', 'wp-docs'),
174 + )
175 + );
112 176 }
113 177 }
114 178
115 179 add_filter( 'ajax_query_attachments_args', 'wpdocs_filter_media');
@@ -419,8 +483,10 @@
419 483 $dir_id = (!$dir_id && array_key_exists('dir', $_GET)?sanitize_wpdocs_data($_GET['dir']):0);
420 484
421 485 $params_array = array(
422 486 'dir_id' => $dir_id,
487 +
488 + 'nonce' => wp_create_nonce('wpdocs_update_options_nonce'),
423 489 'parent_dir' => get_permalink($post->ID).'/?dir=',
424 490 'wpdocs_pro' => $wpdocs_pro,
425 491 'details_view_sorting' => $details_view_sorting,
426 492 'ajax_based_deep_search' => $ajax_based_deep_search,
@@ -436,9 +502,8 @@
436 502 'block_ui' => __('Please wait...', 'wp-docs'),
437 503 'is_ajax' => $is_ajax,
438 504 'is_ajax_url' => $is_ajax_url,
439 505 'del_from_front' => array_key_exists('del_from_front', $wpdocs_options),
440 - 'nonce' => wp_create_nonce('wpdocs_update_options_nonce'),
441 506 'restriction_load' => isset($_GET['wpdocs_restriction']),
442 507 'restriction_id' => isset($_GET['wpdocs_restriction']) ? $_GET['wpdocs_restriction'] : '',
443 508 'restriction_container' => isset($_GET['wpdocs_container']) ? $_GET['wpdocs_container'] : '',
444 509 'current_user_id' => get_current_user_id(),
@@ -601,10 +666,30 @@
601 666 //pree($ret);
602 667
603 668 return $ret;
604 669 }
670 + function wpdocs_create_folder_post( $post_parent, $post_title = "New Folder" ) {
671 +
672 + if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
673 + return 0;
674 + }
605 675
606 - function wpdocs_create_folder_post($post_parent, $post_title = "New Folder")
676 + $post_parent = absint( $post_parent );
677 + $post_title = sanitize_text_field( $post_title );
678 +
679 + $my_post = array(
680 + 'post_title' => $post_title,
681 + 'post_content' => '',
682 + 'post_status' => 'hidden',
683 + 'post_author' => get_current_user_id(),
684 + 'post_type' => 'wpdocs_folder',
685 + 'post_parent' => ( ( $post_parent > 0 && wpdocs_folder_exists( $post_parent ) ) ? $post_parent : 0 ),
686 + 'post_category' => array(),
687 + );
688 +
689 + return wp_insert_post( $my_post );
690 + }
691 + /*function wpdocs_create_folder_post($post_parent, $post_title = "New Folder")
607 692 {
608 693
609 694 $my_post = array(
610 695 'post_title' => $post_title,
@@ -618,14 +703,19 @@
618 703
619 704 $dir_id = wp_insert_post($my_post);
620 705
621 706 return $dir_id;
622 - }
707 + }*/
623 708
624 709 add_action('wp_ajax_wpdocs_create_folder', 'wpdocs_create_folder');
625 710
626 711 function wpdocs_create_folder()
627 712 {
713 + if ( ! current_user_can( 'manage_options' ) ) {
714 + wp_send_json_error( __("Unauthorized user", 'wp-docs') );
715 + wp_die();
716 + }
717 +
628 718 $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce']));
629 719
630 720 if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
631 721 die (__("Sorry, your nonce did not verify.", 'wp-docs'));
@@ -639,9 +729,29 @@
639 729 $list = array('id'=>$list_obj->ID, 'content'=>$list_obj->post_content, 'title'=>$list_obj->post_title, 'type'=>$list_obj->post_type, 'guid'=>$list_obj->guid);
640 730
641 731 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
642 732
643 - echo '<li class="ab-dir ab-new" data-id="'.$dir_id.'" data-resource='.base64_encode($dir_id).'" data-linked="'.$list['content'].'" data-guid="'.($is_shortcut?$list['guid']:'').'"><a class="folder fa fa-folder"></a><a class="dtitle" title="'.__('Click here to rename', 'wp-docs').'">'.__('New Folder', 'wp-docs').'</a><span class="wpd_action_span"><a class="wpd-edit" title="'.__('Click here to edit', 'wp-docs').'"></a><span class="wpd_action_span_inner"><a class="wpd-copy" title="'.__('Click here to copy', 'wp-docs').'"></a><a class="wpd-move" title="'.__('Click here to move', 'wp-docs').'"></a></span><a class="wpd-trash" title="'.__('Click here to delete', 'wp-docs').'"></a></span></li>';
733 + echo '<li class="ab-dir ab-new"
734 + data-id="' . esc_attr($dir_id) . '"
735 + data-resource="' . esc_attr(base64_encode($dir_id)) . '"
736 + data-linked="' . esc_attr($list['content']) . '"
737 + data-guid="' . ($is_shortcut ? esc_attr($list['guid']) : '') . '">
738 +
739 + <a class="folder fa fa-folder"></a>
740 +
741 + <a class="dtitle" title="' . esc_attr(__('Click here to rename', 'wp-docs')) . '">
742 + ' . esc_html__('New Folder', 'wp-docs') . '
743 + </a>
744 +
745 + <span class="wpd_action_span">
746 + <a class="wpd-edit" title="' . esc_attr(__('Click here to edit', 'wp-docs')) . '"></a>
747 + <span class="wpd_action_span_inner">
748 + <a class="wpd-copy" title="' . esc_attr(__('Click here to copy', 'wp-docs')) . '"></a>
749 + <a class="wpd-move" title="' . esc_attr(__('Click here to move', 'wp-docs')) . '"></a>
750 + </span>
751 + <a class="wpd-trash" title="' . esc_attr(__('Click here to delete', 'wp-docs')) . '"></a>
752 + </span>
753 + </li>';
644 754
645 755 exit;
646 756 }
647 757
@@ -718,25 +828,81 @@
718 828 }
719 829
720 830
721 831
832 + return array(
833 + 'file_id' => $item,
834 + 'file_url' => esc_url($file_url),
835 + 'ext' => esc_attr($ext),
836 + 'filename' => esc_attr($filename),
837 + 'title' => esc_html($filename),
838 + 'icon_url' => esc_url($icon_url)
839 + );
722 840
723 - return array(
724 841
725 - 'file_url' => $file_url,
726 - 'ext' => $ext,
727 - 'filename' => $filename,
728 - 'title' => $filename,
729 - 'icon_url' => $icon_url
730 - );
842 + }
843 + }
731 844
845 + /**
846 + * Centralize the "can this user edit this folder?" decision.
847 + * Admins always pass; otherwise require the folder to be owned by the user.
848 + */
849 + function wpdocs_user_can_edit_folder( $dir_id ) {
850 + if ( current_user_can( 'manage_options' ) ) {
851 + return true;
852 + }
732 853
854 + $dir = get_post( $dir_id );
855 + if ( ! $dir || 'wpdocs_folder' !== $dir->post_type ) { // adjust CPT slug
856 + return false;
733 857 }
858 +
859 + return (int) $dir->post_author === get_current_user_id();
734 860 }
735 861
736 862 add_action('wp_ajax_wpdocs_add_files', 'wpdocs_add_files');
737 863
738 - function wpdocs_add_files(){
864 + function wpdocs_add_files() {
865 +
866 + // 1) Capability FIRST — before nonce, before anything.
867 + if ( ! is_user_logged_in() || ! current_user_can( 'upload_files' ) ) {
868 + wp_send_json_error( array( 'message' => __( 'Insufficient permissions.', 'wp-docs' ) ), 403 );
869 + }
870 +
871 + // 2) Nonce check.
872 + if ( empty( $_POST['nonce'] )
873 + || ! wp_verify_nonce(
874 + sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ),
875 + 'wpdocs_update_options_nonce'
876 + )
877 + ) {
878 + wp_send_json_error( array( 'message' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 );
879 + }
880 +
881 + // 3) Input validation.
882 + $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0;
883 + if ( ! $dir_id ) {
884 + wp_send_json_error( array( 'message' => __( 'Invalid folder.', 'wp-docs' ) ), 400 );
885 + }
886 +
887 + // 4) Per-folder ownership / capability gate.
888 + if ( ! wpdocs_user_can_edit_folder( $dir_id ) ) {
889 + wp_send_json_error( array( 'message' => __( 'You cannot modify this folder.', 'wp-docs' ) ), 403 );
890 + }
891 +
892 + $files = isset( $_POST['files'] ) ? sanitize_wpdocs_data( $_POST['files'] ) : array();
893 + $files = is_array( $files ) ? $files : array( $files );
894 + $files = array_filter( array_map( 'absint', $files ) );
895 +
896 + wpdocs_update_files_meta( $dir_id, $files );
897 +
898 + $ret = ! empty( $files ) ? wpdocs_list_added_items( $dir_id ) : '';
899 +
900 + echo $ret;
901 + exit;
902 + }
903 +
904 + /*function wpdocs_add_files_old(){
739 905
740 906 $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce']));
741 907
742 908 if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
@@ -762,13 +928,13 @@
762 928 }
763 929
764 930 echo $ret;
765 931 exit;
766 - }
932 + }*/
767 933 function wpdocs_list_added_items($dir)
768 934 {
769 935
770 - global $wpdocs_options;
936 + global $wpdocs_options, $icon_sub_path, $wpdocs_url;
771 937
772 938 $wp_get_upload_dir = wp_get_upload_dir();
773 939 $wp_uploads_path = $wp_get_upload_dir['basedir'];
774 940 $wp_uploads_url = $wp_get_upload_dir['baseurl'];
@@ -787,12 +953,12 @@
787 953
788 954 $item_data = wpd_get_item_type_icon_url($item);
789 955 extract($item_data);
790 956
791 - //pree($item_data);
957 + //pree($item_data);exit;
792 958 //pree($wp_uploads_path);exit;
793 959
794 - $icon_str = '<img src="'.$icon_url.'" style="">';
960 + $icon_str = '<img src="' . esc_url($icon_url) . '" style="" alt="' . esc_attr($title) . '">';
795 961
796 962 switch ($ext) {
797 963 case 'png':
798 964 case 'jpg':
@@ -817,18 +983,30 @@
817 983
818 984 $file_url_thumb = str_replace('.pdf', '.png', strtolower($item_data['file_url']));
819 985 $file_url_thumb_path = str_replace($wp_uploads_url, $wp_uploads_path, $file_url_thumb);
820 986
821 - if(!file_exists($file_url_thumb_path)){
987 + if(!file_exists($file_url_thumb_path) && class_exists('imagick')){
822 988
823 - $im = new imagick($item_data['file_url']);
824 - $im->setIteratorIndex(0);
825 - $im->setImageFormat('png');
826 - $im->writeImage($file_url_thumb_path);
989 + try {
990 + $im = new imagick($item_data['file_url']);
991 + $im->setIteratorIndex(0);
992 + $im->setImageFormat('png');
993 + $im->writeImage($file_url_thumb_path);
994 + } catch (ImagickException $e) {
995 +
996 + if(defined('WP_DEBUG') && WP_DEBUG && defined('WP_DEBUG_LOG') && WP_DEBUG_LOG){
997 + error_log("Imagick error: " . $e->getMessage());
998 + error_log('file_url: '.$item_data['file_url']);
999 + error_log('file_url_thumb_path: '.$file_url_thumb_path);
1000 + }
1001 +
1002 + $file_url_thumb = $wpdocs_url.$icon_sub_path.$ext.'.png';
1003 + }
827 1004
1005 +
828 1006 }
829 1007
830 - $icon_str = '<img src="'.$file_url_thumb.'" style="">';
1008 + $icon_str = '<img src="' . esc_url( $file_url_thumb ) . '" style="" alt="' . esc_attr( $title ) . '">';
831 1009
832 1010 }
833 1011
834 1012 }
@@ -839,21 +1017,24 @@
839 1017 //$class .= 'fa-file';
840 1018 break;
841 1019 }
842 1020 $class = '';
843 - $files_list[$title] = '<li data-id="' . $item . '" data-dir="'.$dir. '" title="'.esc_attr($filename).'">
844 - <a href="' . $file_url . '" target="_blank" class="file ' . $class . '"> '.$icon_str.' </a>
845 - <a class="ftitle" title="' . $title . '">' . $title . '</a>
846 - <span class="wpd_action_span">
847 - <a href="upload.php?item='.$item.'" target="_blank" class="wpd-edit" title="'.__('Click here to edit', 'wp-docs').'"></a>
848 - <span class="wpd_action_span_inner">
849 - <a class="wpd-copy" title="'.__('Click here to copy', 'wp-docs').'"></a>
850 - <a class="wpd-move" title="'.__('Click here to move', 'wp-docs').'"></a>
851 - </span>
852 -
853 - <a href="upload.php?search='.esc_attr($filename).'" target="_blank" class="wpd-trash" title="'.__('Click here to delete', 'wp-docs').'"></a>
854 - </span>
855 - </li>';
1021 +
1022 +
1023 + $secured_file_url = wpdocs_secure_url($file_id);
1024 +
1025 + $files_list[ $title ] = '<li data-id="' . esc_attr( $item ) . '" data-dir="' . esc_attr( $dir ) . '" title="' . esc_attr( $filename ) . '">
1026 + <a href="' . esc_url( $secured_file_url ) . '" target="_blank" class="file ' . esc_attr( $class ) . '"> ' . $icon_str . ' </a>
1027 + <a class="ftitle" title="' . esc_attr( $title ) . '">' . esc_html( $title ) . '</a>
1028 + <span class="wpd_action_span">
1029 + <a href="' . esc_url( 'upload.php?item=' . $item ) . '" target="_blank" class="wpd-edit" title="' . esc_attr__( 'Click here to edit', 'wp-docs' ) . '"></a>
1030 + <span class="wpd_action_span_inner">
1031 + <a class="wpd-copy" title="' . esc_attr__( 'Click here to copy', 'wp-docs' ) . '"></a>
1032 + <a class="wpd-move" title="' . esc_attr__( 'Click here to move', 'wp-docs' ) . '"></a>
1033 + </span>
1034 + <a href="' . esc_url( 'upload.php?search=' . rawurlencode( $filename ) ) . '" target="_blank" class="wpd-trash" title="' . esc_attr__( 'Click here to delete', 'wp-docs' ) . '"></a>
1035 + </span>
1036 +</li>';
856 1037 }
857 1038 }
858 1039
859 1040 ksort($files_list);
@@ -911,13 +1092,9 @@
911 1092 {
912 1093
913 1094 if (
914 1095 !empty($_POST) && !wp_doing_ajax() &&
915 - (
916 - ! isset( $_POST['wpdocs_front_list_nonce'] )
917 -
918 - ||
919 -
1096 + (
920 1097 (isset( $_POST['wpdocs_front_list_nonce'] ) && ! wp_verify_nonce( sanitize_wpdocs_data(wp_unslash($_POST['wpdocs_front_list_nonce_field'])), 'wpdocs_front_list_nonce' ) )
921 1098 )
922 1099 ) {
923 1100
@@ -932,9 +1109,9 @@
932 1109
933 1110
934 1111 //pree($atts);
935 1112 ob_start();
936 - global $wpdocs_url, $wpdocs_options, $wpdocs_pro, $wpdocs_post_types, $pdf_thumb_selected;
1113 + global $wpdocs_url, $wpdocs_options, $wpdocs_pro, $wpdocs_post_types, $pdf_thumb_selected, $icon_sub_path;
937 1114
938 1115 $pdf_thumb_selected = (array_key_exists('pdf_thumb', $wpdocs_options)?$wpdocs_options['pdf_thumb']:'default');
939 1116
940 1117 $wpdocs_view = get_option('wpdocs_view', array());
@@ -1126,12 +1303,19 @@
1126 1303
1127 1304 ?>
1128 1305
1129 1306
1130 - <div class="container-fluid wpdoc_container" data-dir_restrictions = "<?php echo wpdocs_get_dir_restrictions($dir, 'base64'); ?>" data-del_from_front="<?php echo $is_del_from_front; ?>" data-dir="<?php echo $dir; ?>" data-home="<?php echo $home_id; ?>">
1131 - <?php wp_nonce_field( 'wpdocs_front_list_nonce', 'wpdocs_front_list_nonce_field' ); ?>
1132 - <input type="hidden" class="wpd_home_id" value="<?php echo esc_html($home_id); ?>" />
1133 - <input type="hidden" class="wpd_del_file_id" value="" />
1307 +<div class="container-fluid wpdoc_container"
1308 + data-dir_restrictions="<?php echo esc_attr( wpdocs_get_dir_restrictions( $dir, 'base64' ) ); ?>"
1309 + data-del_from_front="<?php echo esc_attr( $is_del_from_front ); ?>"
1310 + data-dir="<?php echo esc_attr( $dir ); ?>"
1311 + data-home="<?php echo esc_attr( $home_id ); ?>">
1312 +
1313 + <?php wp_nonce_field( 'wpdocs_front_list_nonce', 'wpdocs_front_list_nonce_field' ); ?>
1314 +
1315 + <input type="hidden" class="wpd_home_id" value="<?php echo esc_attr( $home_id ); ?>" />
1316 + <input type="hidden" class="wpd_del_file_id" value="" />
1317 +
1134 1318 <?php
1135 1319
1136 1320 $wpdocs_view = array_key_exists($home_id, $wpdocs_view) ? $wpdocs_view[$home_id] : trim($default_view);
1137 1321
@@ -1143,9 +1327,13 @@
1143 1327 <ol class="breadcrumb bg-light" style="border-bottom:1px solid #dee2e6;border-radius: 0; min-height: 40px;">
1144 1328
1145 1329 <?php if (!empty($breadcrumb_array)) { ?>
1146 1330
1147 - <li class="breadcrumb-item bread_home_url"><a class="wpd_bread_item" href="<?php echo $get_permalink ?>" data-id="0"><?php _e('Home', 'wp-docs'); ?></a></li>
1331 + <li class="breadcrumb-item bread_home_url">
1332 + <a class="wpd_bread_item" href="<?php echo esc_url($get_permalink); ?>" data-id="0">
1333 + <?php echo esc_html__('Home', 'wp-docs'); ?>
1334 + </a>
1335 +</li>
1148 1336 <?php
1149 1337
1150 1338 foreach (array_reverse($breadcrumb_array) as $bread_key => $bread_value) {
1151 1339 $active = '';
@@ -1151,9 +1339,9 @@
1151 1339 $active = '';
1152 1340 $page = '';
1153 1341 $permalink = stripos($get_permalink, '?');
1154 1342 $permalink_c = ($permalink!='' && is_numeric($permalink) && $permalink>=0);
1155 - $link = '<a class="wpd_bread_item" href="' . $get_permalink . ($permalink_c?'&':'?').'dir=' . $bread_value . '" data-id="'.$bread_value.'" >' . get_the_title($bread_value) . '</a>';
1343 + $link = '<a class="wpd_bread_item" href="' . esc_url($get_permalink . ($permalink_c ? '&' : '?') . 'dir=' . $bread_value) . '" data-id="' . esc_attr($bread_value) . '">' . (get_the_title($bread_value)) . '</a>';
1156 1344 if ($bread_value == 0) {
1157 1345 continue;
1158 1346 }
1159 1347 if ($bread_value == $dir) {
@@ -1163,9 +1351,11 @@
1163 1351 }
1164 1352
1165 1353
1166 1354 ?>
1167 - <li class="breadcrumb-item <?php echo $active ?>" aria-current="<?php echo $page; ?>"><?php echo $link; ?></li>
1355 + <li class="breadcrumb-item <?php echo esc_attr($active); ?>" aria-current="<?php echo esc_attr($page); ?>">
1356 + <?php echo wp_kses_post($link); ?>
1357 +</li>
1168 1358
1169 1359 <?php } ?>
1170 1360 <?php
1171 1361 }
@@ -1174,16 +1364,21 @@
1174 1364
1175 1365 </ol>
1176 1366
1177 1367 <?php if($is_del_from_front):?>
1368 +<i style="opacity: 0.5;"
1369 + class="fa fa-trash fa-1x position-absolute wp_docs_del_file <?php echo esc_attr(is_user_logged_in() ? 'logged_in' : 'logged_out'); ?>"
1370 + title="<?php echo esc_attr__('Click here to delete selected files', 'wp-docs'); ?>">
1371 +</i>
1178 1372
1179 - <i style="opacity: 0.5;" class="fa fa-trash fa-1x position-absolute wp_docs_del_file <?php echo (is_user_logged_in()?'logged_in':'logged_out'); ?>" title="<?php _e('Click here to delete selected files', 'wp-docs'); ?>"></i>
1180 -
1181 1373 <?php endif; ?>
1182 1374
1183 1375 <?php if($wpdocs_pro && $dir != 0 && wpdocs_can_current_user_upload_file($dir) && $is_file):?>
1184 1376
1185 - <i class="fa fa-upload fa-1x wpdocs-front-add-media position-absolute" id="wpdocs_front_file_add_<?php echo $dir; ?>" title="<?php _e('Click here to add files', 'wp-docs'); ?>"></i>
1377 +<i class="fa fa-upload fa-1x wpdocs-front-add-media position-absolute"
1378 + id="wpdocs_front_file_add_<?php echo esc_attr( $dir ); ?>"
1379 + title="<?php echo esc_attr__( 'Click here to add files', 'wp-docs' ); ?>">
1380 +</i>
1186 1381
1187 1382 <?php endif; ?>
1188 1383 </nav>
1189 1384 <?php
@@ -1216,10 +1411,9 @@
1216 1411 pree($posts_array);
1217 1412 */
1218 1413 ?>
1219 1414
1220 - <?php echo $warning_msg?'<div class="card-body">'.$warning_msg.'</div>':''; ?>
1221 -
1415 + <?php echo $warning_msg ? '<div class="card-body">' . wp_kses_post( $warning_msg ) . '</div>' : ''; ?>
1222 1416 <?php if($is_searchbox || $ajax_based_deep_search): ?>
1223 1417 <div class="wpdocs-searchbox">
1224 1418 <input type="text" placeholder="<?php echo ($ajax_based_deep_search?__('Type here to search...', 'wp-docs'):__('Type here to filter...', 'wp-docs')); ?>" />
1225 1419 </div>
@@ -1241,14 +1435,22 @@
1241 1435 //$wpdocs_child_files_list = wpdocs_added_items($list['id']);
1242 1436 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
1243 1437 ?>
1244 1438
1245 - <div class="col-4 col-md-3 file_wrapper is_dir" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['link']:''; ?>">
1246 - <figure class="figure file_view p-0">
1247 - <span class="fa fa-folder text-warning" style="<?php echo $customize_icon_size; ?>"></span>
1248 - <figcaption class="figure-caption text-center" style="<?php echo $customize_font_size; ?>"><?php echo $list['title']; ?></figcaption>
1249 - </figure>
1250 - </div>
1439 +<div class="col-4 col-md-3 file_wrapper is_dir" style="cursor: pointer;"
1440 + data-id="<?php echo esc_attr($list['id']); ?>"
1441 + data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>"
1442 + data-linked="<?php echo esc_attr($list['content']); ?>"
1443 + data-guid="<?php echo esc_attr($is_shortcut ? $list['link'] : ''); ?>">
1444 +
1445 + <figure class="figure file_view p-0">
1446 + <span class="fa fa-folder text-warning" style="<?php echo esc_attr($customize_icon_size); ?>"></span>
1447 + <figcaption class="figure-caption text-center" style="<?php echo esc_attr($customize_font_size); ?>">
1448 + <?php echo esc_html($list['title']); ?>
1449 + </figcaption>
1450 + </figure>
1451 +
1452 +</div>
1251 1453 <?php
1252 1454 }
1253 1455 } else {
1254 1456 $no_dir_found = true;
@@ -1265,14 +1467,23 @@
1265 1467 $list = array('id'=>$list_obj->ID, 'content'=>$list_obj->post_content, 'title'=>$list_obj->post_title, 'type'=>$list_obj->post_type, 'guid'=>$list_obj->guid);
1266 1468 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
1267 1469
1268 1470 ?>
1269 - <div class="col-4 col-md-3 file_wrapper is_dir is_deep" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['guid']:''; ?>">
1270 - <figure class="figure file_view p-0">
1271 - <span class="fa fa-folder text-warning" style="<?php echo $customize_icon_size; ?>"></span>
1272 - <figcaption class="figure-caption text-center" style="<?php echo $customize_font_size; ?>"><?php echo $list['title']; ?></figcaption>
1273 - </figure>
1274 - </div>
1471 +<div class="col-4 col-md-3 file_wrapper is_dir is_deep" style="cursor: pointer;"
1472 + data-id="<?php echo esc_attr($list['id']); ?>"
1473 + data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>"
1474 + data-linked="<?php echo esc_attr($list['content']); ?>"
1475 + data-guid="<?php echo esc_attr($is_shortcut ? $list['guid'] : ''); ?>">
1476 +
1477 + <figure class="figure file_view p-0">
1478 + <span class="fa fa-folder text-warning" style="<?php echo esc_attr($customize_icon_size); ?>"></span>
1479 +
1480 + <figcaption class="figure-caption text-center" style="<?php echo esc_attr($customize_font_size); ?>">
1481 + <?php echo esc_html($list['title']); ?>
1482 + </figcaption>
1483 + </figure>
1484 +
1485 +</div>
1275 1486 <?php
1276 1487 }
1277 1488 }
1278 1489 }
@@ -1315,17 +1526,30 @@
1315 1526
1316 1527 $file_url_thumb = str_replace('.pdf', '.png', strtolower($file_data['file_url']));
1317 1528 $file_url_thumb_path = str_replace($wp_uploads_url, $wp_uploads_path, $file_url_thumb);
1318 1529
1319 - if(!file_exists($file_url_thumb_path)){
1320 -
1321 - $im = new imagick($file_data['file_url']);
1322 - $im->setIteratorIndex(0);
1323 - $im->setImageFormat('png');
1324 - $im->writeImage($file_url_thumb_path);
1530 + if(!file_exists($file_url_thumb_path) && class_exists('imagick')){
1531 +
1532 + try {
1533 + $im = new imagick($item_data['file_url']);
1534 + $im->setIteratorIndex(0);
1535 + $im->setImageFormat('png');
1536 + $im->writeImage($file_url_thumb_path);
1537 + } catch (ImagickException $e) {
1538 +
1539 + if(defined('WP_DEBUG') && WP_DEBUG && defined('WP_DEBUG_LOG') && WP_DEBUG_LOG){
1540 + error_log("Imagick error: " . $e->getMessage());
1541 + error_log('file_url: '.$item_data['file_url']);
1542 + error_log('file_url_thumb_path: '.$file_url_thumb_path);
1543 + }
1544 +
1545 + $file_url_thumb = $wpdocs_url.$icon_sub_path.$ext.'.png';
1546 + }
1325 1547
1548 +
1326 1549 }
1327 1550
1551 +
1328 1552 $icon_url = $file_url_thumb;
1329 1553
1330 1554 }
1331 1555
@@ -1336,21 +1560,23 @@
1336 1560 default:
1337 1561 //$class .= 'fa-file';
1338 1562 break;
1339 1563 }
1564 +
1565 + $secured_file_url = wpdocs_secure_url($file_id);
1340 1566
1341 1567 $file_list_row = '
1342 -
1343 -
1344 - <div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_shallow" style="cursor: pointer;" data-id="'.$file.'">
1345 - <figure class="figure file_view p-1">
1346 - <a href="'.$file_url.'" target="_blank" class="file" ><img class="my-3" src="'.$icon_url.'" /></a>
1347 - <figcaption class="figure-caption text-center">'.$title.'</figcaption>
1348 - </figure>
1349 - </div>
1350 -
1351 -
1352 - ';
1568 +
1569 +<div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_shallow" style="cursor: pointer;" data-id="'.esc_attr($file).'">
1570 + <figure class="figure file_view p-1">
1571 + <a href="'.esc_url($secured_file_url).'" target="_blank" class="file">
1572 + <img class="my-3" src="'.esc_url($icon_url).'" />
1573 + </a>
1574 + <figcaption class="figure-caption text-center">'.esc_html($title).'</figcaption>
1575 + </figure>
1576 +</div>
1577 +
1578 +';
1353 1579 $list = wpdocs_list_population($list, $file_data, $file_list_row, $default_orderby);
1354 1580
1355 1581 }
1356 1582
@@ -1421,21 +1647,23 @@
1421 1647 default:
1422 1648 //$class .= 'fa-file';
1423 1649 break;
1424 1650 }
1651 +
1652 + $secured_file_url = wpdocs_secure_url($file_id);
1425 1653
1426 1654 $file_list_row = '
1427 -
1428 -
1429 - <div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_deep" style="cursor: pointer;" data-id="'.$file.'">
1430 - <figure class="figure file_view p-1">
1431 - <a href="'.$file_url.'" target="_blank" class="file" ><img class="my-3" src="'.$icon_url.'" /></a>
1432 - <figcaption class="figure-caption text-center">'.$title.'</figcaption>
1433 - </figure>
1434 - </div>
1435 -
1436 -
1437 - ';
1655 +
1656 +<div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_deep" style="cursor: pointer;" data-id="'.esc_attr($file).'">
1657 + <figure class="figure file_view p-1">
1658 + <a href="'.esc_url($secured_file_url).'" target="_blank" class="file">
1659 + <img class="my-3" src="'.esc_url($icon_url).'" />
1660 + </a>
1661 + <figcaption class="figure-caption text-center">'.esc_html($title).'</figcaption>
1662 + </figure>
1663 +</div>
1664 +
1665 +';
1438 1666 $list = wpdocs_list_population($list, $file_data, $file_list_row, $default_orderby);
1439 1667
1440 1668 }
1441 1669
@@ -1470,12 +1698,16 @@
1470 1698 foreach ($wpdocs_list as $list) {
1471 1699 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
1472 1700 ?>
1473 1701
1474 - <div class="col-12 file_wrapper is_dir" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['link']:''; ?>">
1702 +<div class="col-12 file_wrapper is_dir" style="cursor: pointer;"
1703 + data-id="<?php echo esc_attr($list['id']); ?>"
1704 + data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>"
1705 + data-linked="<?php echo esc_attr($list['content']); ?>"
1706 + data-guid="<?php echo esc_attr($is_shortcut ? $list['link'] : ''); ?>">
1475 1707 <figure class="figure file_view p-2">
1476 1708 <span class="fa fa-folder text-warning" style="font-size:25px"></span>
1477 - <small class="text-center"><?php echo $list['title']; ?></small>
1709 + <small class="text-center"><?php echo esc_html($list['title']); ?></small>
1478 1710 </figure>
1479 1711 </div>
1480 1712 <?php
1481 1713 }
@@ -1492,12 +1724,16 @@
1492 1724 $list = array('id'=>$list_obj->ID, 'content'=>$list_obj->post_content, 'title'=>$list_obj->post_title, 'type'=>$list_obj->post_type, 'guid'=>$list_obj->guid);
1493 1725 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
1494 1726
1495 1727 ?>
1496 - <div class="col-12 file_wrapper is_dir is_deep" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['guid']:''; ?>">
1728 + <div class="col-12 file_wrapper is_dir is_deep" style="cursor: pointer;"
1729 + data-id="<?php echo esc_attr($list['id']); ?>"
1730 + data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>"
1731 + data-linked="<?php echo esc_attr($list['content']); ?>"
1732 + data-guid="<?php echo esc_attr($is_shortcut ? $list['guid'] : ''); ?>">
1497 1733 <figure class="figure file_view p-2">
1498 1734 <span class="fa fa-folder text-warning" style="font-size:25px"></span>
1499 - <small class="text-center"><?php echo $list['title']; ?></small>
1735 + <small class="text-center"><?php echo esc_html($list['title']); ?></small>
1500 1736 </figure>
1501 1737 </div>
1502 1738 <?php
1503 1739 }
@@ -1513,13 +1749,15 @@
1513 1749 extract($file_data);
1514 1750
1515 1751
1516 1752 if(trim($file_url)){
1753 +
1754 + $secured_file_url = wpdocs_secure_url($file_id);
1517 1755
1518 1756 $file_list_row = '
1519 1757 <div title="'.esc_attr($filename).'" class="col-12 file_wrapper is_file" style="cursor: pointer;" data-id="'.$file.'">
1520 1758 <figure class="figure file_view p-3">
1521 - <a href="'.$file_url.'" target="_blank" class="file" ><img class="mb-2" src="'.$icon_url.'" style="width: 25px; height: 25px"></a>
1759 + <a href="'.$secured_file_url.'" target="_blank" class="file" ><img class="mb-2" src="'.$icon_url.'" style="width: 25px; height: 25px"></a>
1522 1760 <small class="text-center">'.$title.'</small>
1523 1761 </figure>
1524 1762 </div>';
1525 1763
@@ -1593,14 +1831,27 @@
1593 1831 <div class="table-responsive" style="zoom:70%">
1594 1832 <table class="table">
1595 1833 <thead class="thead">
1596 1834 <tr>
1597 - <th><?php _e('Name', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th>
1598 - <?php if($details_date_created): ?> <th><?php _e('Created Date', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th><?php endif; ?>
1599 - <?php if($details_date): ?> <th><?php _e('Modified Date', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th><?php endif; ?>
1600 - <?php if($details_type): ?> <th><?php _e('Type', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th><?php endif; ?>
1601 - <?php if($details_size): ?> <th><?php _e('Size', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th><?php endif; ?>
1602 - </tr>
1835 + <th><?php esc_html_e('Name', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th>
1836 +
1837 +<?php if ( $details_date_created ) : ?>
1838 + <th><?php esc_html_e('Created Date', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th>
1839 +<?php endif; ?>
1840 +
1841 +<?php if ( $details_date ) : ?>
1842 + <th><?php esc_html_e('Modified Date', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th>
1843 +<?php endif; ?>
1844 +
1845 +<?php if ( $details_type ) : ?>
1846 + <th><?php esc_html_e('Type', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th>
1847 +<?php endif; ?>
1848 +
1849 +<?php if ( $details_size ) : ?>
1850 + <th><?php esc_html_e('Size', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th>
1851 +<?php endif; ?>
1852 +
1853 +</tr>
1603 1854 </thead>
1604 1855 <?php
1605 1856 $no_dir_found = false;
1606 1857 $no_file_found = false;
@@ -1607,13 +1858,13 @@
1607 1858 if (!empty($wpdocs_list)) {
1608 1859 foreach ($wpdocs_list as $list) {
1609 1860 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
1610 1861 ?>
1611 - <tr title="<?php echo $list['id']; ?>" class="file_wrapper file_view is_dir" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['link']:''; ?>">
1862 + <tr title="<?php echo esc_attr($list['id']); ?>" class="file_wrapper file_view is_dir" style="cursor: pointer;" data-id="<?php echo esc_attr($list['id']); ?>" data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>" data-linked="<?php echo esc_attr($list['content']); ?>" data-guid="<?php echo $is_shortcut?esc_url($list['link']):''; ?>">
1612 1863 <td>
1613 1864 <figure class="figure ">
1614 1865 <span class="fa fa-folder text-warning" style="font-size:25px"></span>
1615 - <small class="text-center mb-1"><?php echo $list['title']; ?></small>
1866 + <small class="text-center mb-1"><?php echo esc_html($list['title']); ?></small>
1616 1867 </figure>
1617 1868 </td>
1618 1869
1619 1870 <?php if($details_date_created): ?> <td data-time="<?php get_post_time('U', false, $list['id']) ?>"><small><?php echo get_the_date(get_option( 'date_format' ), $list['id']) . ' ' . get_the_time(get_option( 'time_format' ), $list['id']) ?></small></td><?php endif; ?>
@@ -1651,13 +1902,13 @@
1651 1902 $list = array('id'=>$list_obj->ID, 'content'=>$list_obj->post_content, 'title'=>$list_obj->post_title, 'type'=>$list_obj->post_type, 'guid'=>$list_obj->guid);
1652 1903 $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']);
1653 1904
1654 1905 ?>
1655 - <tr title="<?php echo $list['id']; ?>" class="file_wrapper file_view is_dir is_deep" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['guid']:''; ?>">
1906 + <tr title="<?php echo esc_attr($list['id']); ?>" class="file_wrapper file_view is_dir is_deep" style="cursor: pointer;" data-id="<?php echo esc_attr($list['id']); ?>" data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>" data-linked="<?php echo esc_attr($list['content']); ?>" data-guid="<?php echo $is_shortcut?esc_attr($list['guid']):''; ?>">
1656 1907 <td>
1657 1908 <figure class="figure ">
1658 1909 <span class="fa fa-folder text-warning" style="font-size:25px"></span>
1659 - <small class="text-center mb-1"><?php echo $list['title']; ?></small>
1910 + <small class="text-center mb-1"><?php echo esc_html($list['title']); ?></small>
1660 1911 </figure>
1661 1912 </td>
1662 1913
1663 1914 <?php if($details_date_created): ?> <td data-time="<?php get_post_time('U', false, $list['id']) ?>"><small><?php echo get_the_date(get_option( 'date_format' ), $list['id']) . ' ' . get_the_time(get_option( 'time_format' ), $list['id']) ?></small></td><?php endif; ?>
@@ -1697,11 +1948,11 @@
1697 1948 extract($file_data);
1698 1949 //pree($ts);
1699 1950
1700 1951 if(trim($icon_url)){
1701 -
1952 + $secured_file_url = wpdocs_secure_url($file_id);
1702 1953 $files_list_row = '
1703 - <tr title="'.esc_attr($filename).'" data-url="'.$file_url.'" class="file_view file_link is_file" style="cursor: pointer;" data-id="'.$file.'">
1954 + <tr title="'.esc_attr($filename).'" data-url="'.$secured_file_url.'" class="file_view file_link is_file" style="cursor: pointer;" data-id="'.$file.'">
1704 1955
1705 1956 <td>
1706 1957
1707 1958 <figure class="figure file_view">
@@ -1754,11 +2005,13 @@
1754 2005 extract($file_data);
1755 2006 //pree($ts);
1756 2007
1757 2008 if(trim($icon_url)){
2009 +
2010 + $secured_file_url = wpdocs_secure_url($file_id);
1758 2011
1759 2012 $files_list_row = '
1760 - <tr title="'.esc_attr($filename).'" data-url="'.$file_url.'" class="file_view file_link is_file is_deep" style="cursor: pointer;" data-id="'.$file.'">
2013 + <tr title="'.esc_attr($filename).'" data-url="'.$secured_file_url.'" class="file_view file_link is_file is_deep" style="cursor: pointer;" data-id="'.$file.'">
1761 2014
1762 2015 <td>
1763 2016
1764 2017 <figure class="figure file_view">
@@ -1824,9 +2077,9 @@
1824 2077 </div>
1825 2078 <?php if($is_bootstrap): ?>
1826 2079 <div class="wpdocs_loader wpd_modal d-none">
1827 2080 <div class="modal_content">
1828 - <img src="<?php echo $wpdocs_url.'img/loader.gif' ?>" width="50px" height="50px">
2081 + <img src="<?php echo esc_url($wpdocs_url.'img/loader.gif'); ?>" width="50px" height="50px">
1829 2082 </div>
1830 2083 </div>
1831 2084 <?php endif; ?>
1832 2085
@@ -1939,56 +2192,137 @@
1939 2192
1940 2193
1941 2194
1942 2195 add_action('wp_ajax_wpdocs_update_folder', 'wpdocs_update_folder');
1943 - function wpdocs_update_folder()
1944 - {
2196 +
2197 + function wpdocs_update_folder() {
2198 +
2199 + if ( ! current_user_can( 'manage_options' ) ) {
2200 + wp_send_json_error( array( 'msg' => __( 'Unauthorized access.', 'wp-docs' ) ), 403 );
2201 + }
2202 +
2203 + if (
2204 + empty( $_POST['nonce'] ) ||
2205 + ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' )
2206 + ) {
2207 + wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 );
2208 + }
2209 +
2210 + $dir_id = absint( $_POST['dir_id'] ?? 0 );
2211 + $resource_id = base64_decode( sanitize_text_field( $_POST['resource_id'] ?? '' ) );
2212 + $new_name = sanitize_text_field( $_POST['new_name'] ?? '' );
2213 +
2214 + if ( ! $dir_id || $resource_id != $dir_id || ! wpdocs_folder_exists( $dir_id ) ) {
2215 + wp_send_json_error( array( 'msg' => __( 'Invalid folder ID or resource mismatch.', 'wp-docs' ) ), 400 );
2216 + }
2217 +
2218 + global $wpdb, $wpdocs_post_types, $wpdocs_post_status;
2219 +
2220 + $updated = $wpdb->query(
2221 + $wpdb->prepare(
2222 + "UPDATE $wpdb->posts
2223 + SET post_title = %s
2224 + WHERE ID = %d
2225 + AND post_type IN ('" . implode( "','", array_map( 'esc_sql', $wpdocs_post_types ) ) . "')
2226 + AND post_status = %s",
2227 + htmlspecialchars_decode( $new_name ),
2228 + $dir_id,
2229 + $wpdocs_post_status
2230 + )
2231 + );
2232 +
2233 + wp_send_json_success(
2234 + array(
2235 + 'msg' => $updated
2236 + ? __( 'Successfully updated.', 'wp-docs' )
2237 + : __( 'No changes were made. Input seems the same as before.', 'wp-docs' ),
2238 + )
2239 + );
2240 + }
1945 2241
1946 - $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce']));
2242 + /*function wpdocs_update_folder() {
2243 +
1947 2244
1948 - if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
1949 - die (__("Sorry, your nonce did not verify.", 'wp-docs'));
1950 -
1951 - $dir_id = sanitize_wpdocs_data($_POST['dir_id']);
1952 - $dir_id_compare = base64_decode(sanitize_wpdocs_data($_POST['resource_id']));
1953 - //pree($dir_id_compare.'=='.$dir_id.' - '.wpdocs_folder_exists($dir_id));exit;
2245 + if ( ! current_user_can('edit_posts') ) {
2246 + wp_send_json_error(['msg' => __('Unauthorized access.', 'wp-docs')]);
2247 + }
2248 +
2249 +
2250 + if (
2251 + empty($_POST['nonce']) ||
2252 + ! wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'wpdocs_update_options_nonce')
2253 + ) {
2254 + wp_send_json_error(['msg' => __('Sorry, your nonce did not verify.', 'wp-docs')]);
2255 + }
2256 +
1954 2257
1955 - $ret = array('msg'=>'');
1956 -
1957 - if ($dir_id>0 && $dir_id_compare==$dir_id && wpdocs_folder_exists($dir_id)) {
1958 -
2258 + $dir_id = absint($_POST['dir_id'] ?? 0);
2259 + $resource_id = base64_decode(sanitize_text_field($_POST['resource_id'] ?? ''));
2260 + $new_name = sanitize_text_field($_POST['new_name'] ?? '');
2261 +
2262 + $ret = ['msg' => ''];
2263 +
2264 + if ( $dir_id > 0 && $resource_id == $dir_id && wpdocs_folder_exists($dir_id) ) {
2265 +
1959 2266 global $wpdb, $wpdocs_post_types, $wpdocs_post_status;
1960 -
1961 - $my_post = array(
1962 - 'post_title' => htmlspecialchars_decode(sanitize_wpdocs_data($_POST['new_name'])),
1963 - 'ID' => $dir_id,
2267 +
2268 + $updated = $wpdb->query(
2269 + $wpdb->prepare(
2270 + "UPDATE $wpdb->posts
2271 + SET post_title = %s
2272 + WHERE ID = %d
2273 + AND post_type IN ('" . implode("','", array_map('esc_sql', $wpdocs_post_types)) . "')
2274 + AND post_status = %s",
2275 + htmlspecialchars_decode($new_name),
2276 + $dir_id,
2277 + $wpdocs_post_status
2278 + )
1964 2279 );
1965 - //pree($my_post);exit;
1966 - //wp_update_post($my_post);
1967 - $rename_query = $wpdb->prepare("UPDATE $wpdb->posts SET post_title=%s WHERE ID=%d AND post_type IN ('".implode("','", $wpdocs_post_types)."') AND post_status=%s",
1968 - $my_post['post_title'],
1969 - $dir_id,
1970 - $wpdocs_post_status
1971 - );
1972 - //pree($rename_query);exit;
1973 - $updated = $wpdb->query($rename_query);
1974 -
1975 -
1976 - if($updated){
1977 - $ret['msg'] = __("Successfully updated.", 'wp-docs');
1978 - }else{
1979 - $ret['msg'] = __("No changes are made, input seems the same as before.", 'wp-docs');
2280 +
2281 + if ( $updated ) {
2282 + $ret['msg'] = __('Successfully updated.', 'wp-docs');
2283 + } else {
2284 + $ret['msg'] = __('No changes were made. Input seems the same as before.', 'wp-docs');
1980 2285 }
2286 + } else {
2287 + $ret['msg'] = __('Invalid folder ID or resource mismatch.', 'wp-docs');
1981 2288 }
2289 +
2290 + wp_send_json_success($ret);
2291 + }*/
1982 2292
1983 - echo wp_json_encode($ret);
1984 - exit;
1985 - }
1986 2293
1987 2294 add_action('wp_ajax_wpdocs_delete_folder', 'wpdocs_delete_folder');
1988 2295
1989 - function wpdocs_delete_folder()
2296 + function wpdocs_delete_folder() {
2297 +
2298 + if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
2299 + wp_send_json_error( array( 'msg' => __( 'Unauthorized user', 'wp-docs' ) ), 403 );
2300 + }
2301 +
2302 + if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) {
2303 + wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 );
2304 + }
2305 +
2306 + $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0;
2307 + $resource_id = base64_decode( sanitize_wpdocs_data( $_POST['resource_id'] ?? '' ) );
2308 +
2309 + if ( ! $dir_id || $dir_id != $resource_id || ! wpdocs_folder_exists( $dir_id ) ) {
2310 + wp_send_json_error( array( 'msg' => __( 'Invalid folder.', 'wp-docs' ) ), 400 );
2311 + }
2312 +
2313 + wpdocs_recursive_delete_folder( $dir_id );
2314 +
2315 + wp_send_json_success();
2316 + }
2317 + /*function wpdocs_delete_folder()
1990 2318 {
2319 +
2320 + if ( ! current_user_can( 'manage_options' ) ) {
2321 + wp_send_json_error( __( 'Unauthorized user', 'wp-docs' ) );
2322 + wp_die();
2323 + }
2324 +
1991 2325 $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce']));
1992 2326
1993 2327 if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
1994 2328 die (__("Sorry, your nonce did not verify.", 'wp-docs'));
@@ -2000,9 +2334,9 @@
2000 2334 wpdocs_recursive_delete_folder($dir_id);
2001 2335 }
2002 2336
2003 2337 exit;
2004 - }
2338 + } */
2005 2339
2006 2340
2007 2341
2008 2342 add_action('wp_ajax_wpdocs_delete_files', 'wpdocs_delete_files');
@@ -2082,11 +2416,59 @@
2082 2416 return update_post_meta($dir_id, 'wpdocs_items', $wpdocs_items);
2083 2417 }
2084 2418 }
2085 2419 }
2420 +
2421 + function wpdocs_delete_files() {
2422 + if ( ! is_user_logged_in() || ! current_user_can( 'delete_posts' ) ) {
2423 + wp_send_json_error( array( 'message' => __( 'Insufficient permissions.', 'wp-docs' ) ), 403 );
2424 + }
2425 +
2426 + if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) {
2427 + wp_send_json_error( array( 'message' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 );
2428 + }
2429 +
2430 + $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0;
2431 + $files = isset( $_POST['files'] ) ? (array) $_POST['files'] : array();
2432 + $files = array_values( array_unique( array_filter( array_map( 'absint', $files ) ) ) );
2433 +
2434 + if ( ! $dir_id || ! wpdocs_folder_exists( $dir_id ) || empty( $files ) ) {
2435 + wp_send_json_error( array( 'message' => __( 'Invalid request.', 'wp-docs' ) ), 400 );
2436 + }
2437 +
2438 + $is_admin = current_user_can( 'manage_options' );
2439 + $is_owner = wpdocs_user_can_edit_folder( $dir_id );
2440 +
2441 + if ( ! $is_admin && ! $is_owner ) {
2442 + wp_send_json_error( array( 'message' => __( 'You cannot delete files from this folder.', 'wp-docs' ) ), 403 );
2443 + }
2444 +
2445 + $allowed = array();
2446 + foreach ( $files as $file_id ) {
2447 + $attachment = get_post( $file_id );
2448 + if ( ! $attachment || 'attachment' !== $attachment->post_type ) {
2449 + continue;
2450 + }
2451 + if ( $is_admin || current_user_can( 'edit_post', $file_id ) ) {
2452 + $allowed[] = $file_id;
2453 + }
2454 + }
2455 +
2456 + if ( empty( $allowed ) ) {
2457 + wp_send_json_error( array( 'message' => __( 'None of the specified files can be deleted by you.', 'wp-docs' ) ), 403 );
2458 + }
2459 +
2460 + wpdocs_del_items_by_user( $dir_id, $allowed, get_current_user_id() );
2461 +
2462 + $wpdocs_items = wpdocs_added_items( $dir_id );
2463 + $wpdocs_items = array_values( array_unique( array_diff( (array) $wpdocs_items, $allowed ) ) );
2464 +
2465 + update_post_meta( $dir_id, 'wpdocs_items', $wpdocs_items );
2466 +
2467 + wp_send_json_success( array( 'dir_id' => $dir_id, 'files' => $allowed ) );
2468 + }
2086 2469
2087 -
2088 -
2470 + /*
2089 2471 function wpdocs_delete_files()
2090 2472 {
2091 2473
2092 2474 $dir_id = sanitize_wpdocs_data($_POST['dir_id']);
@@ -2110,9 +2492,9 @@
2110 2492 }
2111 2493
2112 2494
2113 2495 exit;
2114 - }
2496 + } */
2115 2497
2116 2498 function wpd_admin_footer(){
2117 2499
2118 2500 ?>
@@ -2128,152 +2510,157 @@
2128 2510 add_action('wp_ajax_wpdocs_update_option', 'wpdocs_update_option');
2129 2511
2130 2512 if(!function_exists('wpdocs_update_option')){
2131 2513 function wpdocs_update_option(){
2514 +
2515 + if ( ! current_user_can('manage_options') ) {
2516 + wp_send_json_error('Insufficient permissions.');
2517 + }
2132 2518
2519 + if (
2520 + ! isset($_POST['wpdocs_update_option_nonce']) ||
2521 + ! wp_verify_nonce($_POST['wpdocs_update_option_nonce'], 'wpdocs_update_options_nonce')
2522 + ) {
2523 + wp_send_json_error('Invalid nonce '.$_POST['wpdocs_update_option_nonce']);
2524 + } else {
2525 + //wp_send_json_success('Nonce valid!');
2526 + }
2133 2527
2528 + $return = array(
2134 2529
2135 - if(isset($_POST['wpdocs_update_option_nonce'])){
2530 + 'option_update' => false,
2531 + 'dir_move' => false,
2532 + );
2136 2533
2137 - $nonce = sanitize_wpdocs_data(wp_unslash($_POST['wpdocs_update_option_nonce']));
2534 +
2138 2535
2139 - $return = array(
2536 + if(isset($_POST['wpdocs_options'])){
2140 2537
2141 - 'option_update' => false,
2142 - 'dir_move' => false,
2143 - );
2538 + $wpdocs_options = isset($_POST['wpdocs_options']) ? sanitize_wpdocs_data($_POST['wpdocs_options']) : array();
2144 2539
2145 - if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) )
2146 - die (__("Sorry, your nonce did not verify.", 'wp-docs'));
2540 + $wpdocs_dir_id = isset($_POST['wpdocs_dir_id']) ? sanitize_wpdocs_data($_POST['wpdocs_dir_id']) : 0;
2147 2541
2148 - if(isset($_POST['wpdocs_options'])){
2149 2542
2150 - $wpdocs_options = isset($_POST['wpdocs_options']) ? sanitize_wpdocs_data($_POST['wpdocs_options']) : array();
2543 + $sanitized_option = sanitize_wpdocs_data($wpdocs_options);
2544 + $sanitized_option['allowed_role'] = $sanitized_option['allowed_role'] !== 'empty' ? $sanitized_option['allowed_role'] : array();
2151 2545
2152 - $wpdocs_dir_id = isset($_POST['wpdocs_dir_id']) ? sanitize_wpdocs_data($_POST['wpdocs_dir_id']) : 0;
2153 2546
2547 + if($wpdocs_dir_id == 0){
2154 2548
2155 - $sanitized_option = sanitize_wpdocs_data($wpdocs_options);
2156 - $sanitized_option['allowed_role'] = $sanitized_option['allowed_role'] !== 'empty' ? $sanitized_option['allowed_role'] : array();
2549 + $update = update_option('wpdocs_options', $sanitized_option);
2157 2550
2551 + }else{
2158 2552
2159 - if($wpdocs_dir_id == 0){
2553 + $update = update_post_meta($wpdocs_dir_id, '_wpdocs_dir_options', $sanitized_option);
2554 + $child_dir_list = wpdoc_get_dir_children($wpdocs_dir_id);
2555 + if(!empty($child_dir_list)){
2556 + foreach ($child_dir_list as $child_dir) {
2160 2557
2161 - $update = update_option('wpdocs_options', $sanitized_option);
2558 + $update = update_post_meta($child_dir, '_wpdocs_dir_options', $sanitized_option);
2162 2559
2163 - }else{
2164 -
2165 - $update = update_post_meta($wpdocs_dir_id, '_wpdocs_dir_options', $sanitized_option);
2166 - $child_dir_list = wpdoc_get_dir_children($wpdocs_dir_id);
2167 - if(!empty($child_dir_list)){
2168 - foreach ($child_dir_list as $child_dir) {
2169 -
2170 - $update = update_post_meta($child_dir, '_wpdocs_dir_options', $sanitized_option);
2171 -
2172 - # code...
2173 - }
2560 + # code...
2174 2561 }
2562 + }
2175 2563
2176 -
2564 +
2177 2565
2178 - }
2179 - }
2566 + }
2567 + }
2180 2568
2181 2569
2182 2570
2183 - if(isset($_POST['wpdocs_move_selected_dir'])){
2571 + if(isset($_POST['wpdocs_move_selected_dir'])){
2184 2572
2185 - $wpdocs_move_selected_dir = sanitize_wpdocs_data($_POST['wpdocs_move_selected_dir']);
2186 - $action_type = $wpdocs_move_selected_dir['action_type'];
2187 -
2573 + $wpdocs_move_selected_dir = sanitize_wpdocs_data($_POST['wpdocs_move_selected_dir']);
2574 + $action_type = $wpdocs_move_selected_dir['action_type'];
2575 +
2188 2576
2189 - $is_file = array_key_exists('is_file', $wpdocs_move_selected_dir) ? $wpdocs_move_selected_dir['is_file']: false;
2190 - $is_file = $is_file == 'false' ? false: true;
2577 + $is_file = array_key_exists('is_file', $wpdocs_move_selected_dir) ? $wpdocs_move_selected_dir['is_file']: false;
2578 + $is_file = $is_file == 'false' ? false: true;
2191 2579
2192 2580
2193 - if(!$is_file && array_key_exists('dir_selected', $wpdocs_move_selected_dir) &&
2194 - array_key_exists('dir_id', $wpdocs_move_selected_dir)){
2581 + if(!$is_file && array_key_exists('dir_selected', $wpdocs_move_selected_dir) &&
2582 + array_key_exists('dir_id', $wpdocs_move_selected_dir)){
2583 +
2584 + switch($action_type){
2585 + default:
2586 + case 'move':
2587 +
2588 +
2589 + $update = wp_update_post(
2590 + array(
2591 + 'ID' => $wpdocs_move_selected_dir['dir_selected'],
2592 + 'post_parent' => $wpdocs_move_selected_dir['dir_id']
2593 + )
2594 + );
2195 2595
2196 - switch($action_type){
2197 - default:
2198 - case 'move':
2596 + if($update == $wpdocs_move_selected_dir['dir_selected']){
2597 + $return['dir_move'] = true;
2598 + }
2199 2599
2200 -
2201 - $update = wp_update_post(
2202 - array(
2203 - 'ID' => $wpdocs_move_selected_dir['dir_selected'],
2204 - 'post_parent' => $wpdocs_move_selected_dir['dir_id']
2205 - )
2206 - );
2600 + break;
2601 +
2602 + case 'copy':
2603 + $existing_dir = get_post($wpdocs_move_selected_dir['dir_selected']);
2604 + $existing_dir = (is_object($existing_dir)?(array)$existing_dir:array());
2605 + if(!empty($existing_dir) && array_key_exists('ID', $existing_dir) && function_exists('wpdocs_recursive_copy_folder')){
2207 2606
2208 - if($update == $wpdocs_move_selected_dir['dir_selected']){
2209 - $return['dir_move'] = true;
2210 - }
2607 + wpdocs_recursive_copy_folder($wpdocs_move_selected_dir['dir_id'], $existing_dir);
2211 2608
2212 - break;
2609 + $return['dir_move'] = true;
2610 +
2611 + }
2213 2612
2214 - case 'copy':
2215 - $existing_dir = get_post($wpdocs_move_selected_dir['dir_selected']);
2216 - $existing_dir = (is_object($existing_dir)?(array)$existing_dir:array());
2217 - if(!empty($existing_dir) && array_key_exists('ID', $existing_dir) && function_exists('wpdocs_recursive_copy_folder')){
2218 -
2219 - wpdocs_recursive_copy_folder($wpdocs_move_selected_dir['dir_id'], $existing_dir);
2220 -
2221 - $return['dir_move'] = true;
2222 -
2223 - }
2224 -
2225 -
2226 - break;
2227 - }
2228 -
2229 -
2230 -
2231 - }
2232 - //exit;
2613 +
2614 + break;
2615 + }
2616 +
2617 +
2618 +
2619 + }
2620 + //exit;
2233 2621
2234 - if($is_file){
2622 + if($is_file){
2235 2623
2236 - $file_id = $wpdocs_move_selected_dir['files'];
2237 -
2238 - $current_dir = $wpdocs_move_selected_dir['file_dir'];
2624 + $file_id = $wpdocs_move_selected_dir['files'];
2625 +
2626 + $current_dir = $wpdocs_move_selected_dir['file_dir'];
2627 +
2628 + $new_dir = $wpdocs_move_selected_dir['dir_id'];
2629 +
2630 + $files = wpdocs_added_items($current_dir);
2631 +
2632 + $file_id = is_array($file_id) ? $file_id : array($file_id);
2633 + $files = array_diff($files, $file_id);
2634 +
2635 +
2636 + switch($action_type){
2637 + default:
2638 + case 'move':
2639 +
2640 + update_post_meta($current_dir, 'wpdocs_items', $files);
2641 +
2642 + break;
2239 2643
2240 - $new_dir = $wpdocs_move_selected_dir['dir_id'];
2241 -
2242 - $files = wpdocs_added_items($current_dir);
2243 -
2244 - $file_id = is_array($file_id) ? $file_id : array($file_id);
2245 - $files = array_diff($files, $file_id);
2246 -
2247 -
2248 - switch($action_type){
2249 - default:
2250 - case 'move':
2251 -
2252 - update_post_meta($current_dir, 'wpdocs_items', $files);
2253 -
2254 - break;
2644 + case 'copy':
2255 2645
2256 - case 'copy':
2257 -
2258 - break;
2259 -
2260 - }
2646 + break;
2647 +
2648 + }
2261 2649
2262 - $update = wpdocs_update_files_meta($new_dir, $file_id);
2263 -
2264 - if($update === true){
2265 - $return['dir_move'] = true;
2266 - }
2650 + $update = wpdocs_update_files_meta($new_dir, $file_id);
2651 +
2652 + if($update === true){
2653 + $return['dir_move'] = true;
2654 + }
2267 2655
2268 - }
2269 - }
2656 + }
2657 + }
2270 2658
2271 - echo wp_json_encode($return);
2659 + echo wp_json_encode($return);
2272 2660
2273 - }
2274 2661
2275 - wp_die();
2662 + wp_die();
2276 2663
2277 2664 }
2278 2665 }
2279 2666
@@ -2330,9 +2717,9 @@
2330 2717
2331 2718 if(!array_key_exists('id', $wp_dir)) continue;
2332 2719 $wpdocs_list_child = wpdocs_list($wp_dir['id']);
2333 2720
2334 - $option .= '<option value="'.$wp_dir['id'].'" data-parent="'.$dir.'">'.str_repeat(str_replace(' ', '&nbsp;', $str), $level).$wp_dir['title'].'</option>';
2721 + $option .= '<option value="'.esc_attr($wp_dir['id']).'" data-parent="'.esc_attr($dir).'">'.str_repeat(str_replace(' ', '&nbsp;', $str), $level).esc_html($wp_dir['title']).'</option>';
2335 2722
2336 2723
2337 2724 if(!empty($wpdocs_list_child)){
2338 2725
@@ -2366,9 +2753,9 @@
2366 2753
2367 2754 <nav aria-label="breadcrumb" class="wpdocs-nav">
2368 2755 <ol class="breadcrumb bg-light" style="border-bottom:1px solid #dee2e6;border-radius: 0;">
2369 2756
2370 - <li class="breadcrumb-item bread_home_url"><a class="wpd_bread_item" href="<?php echo $get_permalink ?>" data-id="0"><?php _e('Home', 'wp-docs'); ?></a></li>
2757 + <li class="breadcrumb-item bread_home_url"><a class="wpd_bread_item" href="<?php echo esc_url($get_permalink); ?>" data-id="0"><?php _e('Home', 'wp-docs'); ?></a></li>
2371 2758 <?php
2372 2759
2373 2760 foreach (array_reverse($breadcrumb_array) as $bread_key => $bread_value) {
2374 2761 $active = '';
@@ -2385,9 +2772,9 @@
2385 2772 }
2386 2773
2387 2774
2388 2775 ?>
2389 - <li class="breadcrumb-item <?php echo $active ?>" aria-current="<?php echo $page; ?>"><?php echo $link ?></li>
2776 + <li class="breadcrumb-item <?php echo esc_attr($active); ?>" aria-current="<?php echo esc_attr($page); ?>"><?php echo ($link); ?></li>
2390 2777
2391 2778 <?php
2392 2779 }
2393 2780
@@ -2403,11 +2790,46 @@
2403 2790 }
2404 2791 }
2405 2792
2406 2793 add_action('wp_ajax_wpdocs_update_view', 'wpdocs_update_view');
2407 - add_action('wp_ajax_nopriv_wpdocs_update_view', 'wpdocs_update_view');
2408 -
2409 - if(!function_exists('wpdocs_update_view')){
2794 +
2795 +
2796 + if ( ! function_exists( 'wpdocs_update_view' ) ) {
2797 + function wpdocs_update_view() {
2798 +
2799 + if ( ! is_user_logged_in() || ! current_user_can( 'read' ) ) {
2800 + wp_send_json_error( array( 'msg' => __( 'Unauthorized access.', 'wp-docs' ) ), 403 );
2801 + }
2802 +
2803 + if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) {
2804 + wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 );
2805 + }
2806 +
2807 + $uid = get_current_user_id();
2808 + $key = 'wpdocs_view_rl_' . $uid;
2809 + $hits = (int) get_transient( $key );
2810 +
2811 + if ( $hits >= 60 ) {
2812 + wp_send_json_error( array( 'msg' => __( 'Too many requests.', 'wp-docs' ) ), 429 );
2813 + }
2814 + set_transient( $key, $hits + 1, MINUTE_IN_SECONDS );
2815 +
2816 + if ( isset( $_POST['update_view'] ) ) {
2817 +
2818 + $wpdocs_view = get_option( 'wpdocs_view', array() );
2819 + $wpdocs_view = is_array( $wpdocs_view ) ? $wpdocs_view : array();
2820 +
2821 + $parent_dir = sanitize_wpdocs_data( $_POST['parent_dir'] ?? '' );
2822 + $view_val = sanitize_wpdocs_data( $_POST['update_view'] );
2823 +
2824 + $wpdocs_view[ $parent_dir ] = $view_val;
2825 + update_option( 'wpdocs_view', $wpdocs_view );
2826 + }
2827 +
2828 + wp_send_json_success();
2829 + }
2830 + }
2831 + /*if(!function_exists('wpdocs_update_view')){
2410 2832 function wpdocs_update_view(){
2411 2833
2412 2834 $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce']));
2413 2835
@@ -2425,9 +2847,9 @@
2425 2847
2426 2848 }
2427 2849 exit;
2428 2850 }
2429 - }
2851 + }*/
2430 2852 function wpdocs_init_session() {
2431 2853 if(!session_id()) {
2432 2854 session_start();
2433 2855 }
@@ -2623,13 +3045,91 @@
2623 3045 return $ret;
2624 3046
2625 3047 }
2626 3048 }
3049 + if(!function_exists('wpdocs_file_download')){
3050 + function wpdocs_file_download(){
3051 +
3052 + if(empty($_GET['wpdocs_dl'])){
3053 + return;
3054 + }
3055 +
3056 + $file_id = absint(
3057 + wp_unslash($_GET['wpdocs_dl'])
3058 + );
3059 +
3060 + if(!$file_id){
3061 + status_header(404);
3062 + exit;
3063 + }
3064 +
3065 + $nonce = isset($_GET['wpdocs_nonce'])
3066 + ? sanitize_text_field(
3067 + wp_unslash($_GET['wpdocs_nonce'])
3068 + )
3069 + : '';
3070 +
3071 + if(
3072 + !wp_verify_nonce(
3073 + $nonce,
3074 + 'wpdocs_dl_' . $file_id
3075 + )
3076 + ){
3077 + status_header(403);
3078 + exit;
3079 + }
3080 +
3081 + // Adjust this according to where you store the file
3082 + $file = get_attached_file($file_id);
3083 +
3084 + if(
3085 + !$file ||
3086 + !file_exists($file)
3087 + ){
3088 + status_header(404);
3089 + exit;
3090 + }
3091 +
3092 + $uploads = wp_get_upload_dir();
3093 + $base_real = realpath($uploads['basedir']);
3094 + $file_real = realpath($file);
3095 +
3096 + if(
3097 + !$base_real ||
3098 + !$file_real ||
3099 + strpos(
3100 + $file_real,
3101 + $base_real . DIRECTORY_SEPARATOR
3102 + ) !== 0
3103 + ){
3104 + status_header(403);
3105 + exit;
3106 + }
3107 +
3108 + $mime = wp_check_filetype($file_real);
3109 + $mime = !empty($mime['type'])
3110 + ? $mime['type']
3111 + : 'application/octet-stream';
3112 +
3113 + header('Content-Type: ' . $mime);
3114 + header('Content-Length: ' . filesize($file_real));
3115 + header(
3116 + 'Content-Disposition: inline; filename="' .
3117 + basename($file_real) .
3118 + '"'
3119 + );
3120 +
3121 + readfile($file_real);
3122 + exit;
3123 + }
3124 + }
2627 3125
2628 3126 add_action('init', 'wpdocs_dir_actions');
2629 3127 if(!function_exists('wpdocs_dir_actions')){
2630 3128 function wpdocs_dir_actions(){
2631 3129
3130 + wpdocs_file_download();
3131 +
2632 3132 if(is_admin() && get_option('wpdocs_memphis_uninstall')){
2633 3133 if(wp_docs_memphis_folder_preserve('mdocs_2', 'mdocs')){
2634 3134 update_option('wpdocs_memphis_uninstall', false);
2635 3135 }
@@ -2836,30 +3336,34 @@
2836 3336 $result_array = array(
2837 3337 'status' => false,
2838 3338 );
2839 3339
2840 - if (!isset($_POST['wp_docs_nonce']) || !wp_verify_nonce( sanitize_wpdocs_data(wp_unslash($_POST['wp_docs_nonce'])), 'wpdocs_update_options_nonce' ) ){
3340 + if(!empty($_POST) && isset($_POST['wp_docs_nonce'])){
2841 3341
2842 - wp_die(__("Sorry, your nonce did not verify.", 'wp-docs'));
2843 -
2844 - }else{
2845 -
2846 - $dir_progress = wp_docs_import_memphis_directories();
2847 - $file_progress = wp_docs_memphis_import_files();
2848 -
2849 - $result_array['status'] = ($dir_progress || $file_progress);
2850 -
2851 - if($result_array['status']){
2852 - wp_docs_whiteflag_memphis_htaccess();
2853 - }
2854 -
2855 - if(!$dir_progress && !$file_progress){
3342 + if (!wp_verify_nonce( sanitize_wpdocs_data(wp_unslash($_POST['wp_docs_nonce'])), 'wpdocs_update_options_nonce' ) ){
2856 3343
2857 - $result_array['remarks'] = __('No directories and files found.', 'wp-docs');
3344 + wp_die(__("Sorry, your nonce did not verify.", 'wp-docs'));
3345 +
3346 + }else{
3347 +
3348 + $dir_progress = wp_docs_import_memphis_directories();
3349 + $file_progress = wp_docs_memphis_import_files();
3350 +
3351 + $result_array['status'] = ($dir_progress || $file_progress);
3352 +
3353 + if($result_array['status']){
3354 + wp_docs_whiteflag_memphis_htaccess();
3355 + }
3356 +
3357 + if(!$dir_progress && !$file_progress){
3358 +
3359 + $result_array['remarks'] = __('No directories and files found.', 'wp-docs');
3360 + }
3361 +
2858 3362 }
2859 3363
2860 3364 }
2861 -
3365 +
2862 3366 wp_send_json($result_array);
2863 3367 }
2864 3368 }
2865 3369
@@ -2871,16 +3375,20 @@
2871 3375 $result_array = array(
2872 3376 'status' => false,
2873 3377 );
2874 3378
2875 - if (!isset($_POST['wp_docs_nonce']) || !wp_verify_nonce( sanitize_wpdocs_data(wp_unslash($_POST['wp_docs_nonce'])), 'wpdocs_update_options_nonce' ) ){
3379 + if(!empty($_POST) && isset($_POST['wp_docs_nonce'])){
2876 3380
2877 - wp_die(__("Sorry, your nonce did not verify.", 'wp-docs'));
2878 -
2879 - }else{
2880 -
2881 - wp_docs_rollback_memphis_import();
2882 - $result_array['status'] = true;
3381 + if (!wp_verify_nonce( sanitize_wpdocs_data(wp_unslash($_POST['wp_docs_nonce'])), 'wpdocs_update_options_nonce' ) ){
3382 +
3383 + wp_die(__("Sorry, your nonce did not verify.", 'wp-docs'));
3384 +
3385 + }else{
3386 +
3387 + wp_docs_rollback_memphis_import();
3388 + $result_array['status'] = true;
3389 + }
3390 +
2883 3391 }
2884 3392
2885 3393 wp_send_json($result_array);
2886 3394 }
@@ -3072,31 +3580,34 @@
3072 3580
3073 3581 }
3074 3582 }
3075 3583
3584 +
3076 3585 if(!function_exists('wp_docs_relocate_memphis_meta')){
3077 3586 function wp_docs_relocate_memphis_meta($dir_id){
3078 3587 global $wpdocs_imported_files, $wpdocs_imported_folder;
3588 +
3589 + // Ensure arrays are initialized properly before using them
3590 + $wpdocs_imported_files = (is_array($wpdocs_imported_files) ? $wpdocs_imported_files : array());
3591 + $wpdocs_imported_folder = (is_array($wpdocs_imported_folder) ? $wpdocs_imported_folder : array());
3592 +
3079 3593 $wpdocs_items = get_post_meta($dir_id, 'wpdocs_items', true);
3080 3594 $wpdocs_items = (is_array($wpdocs_items) ? $wpdocs_items : array());
3081 3595 $dir_slug = get_post_meta($dir_id, '_wpdocs_memphis_slug', true);
3082 -
3083 - $wpdocs_imported_files = (is_array($wpdocs_imported_files)?$wpdocs_imported_files:array());
3084 -
3596 +
3085 3597 if(!empty($wpdocs_items)){
3086 -
3087 3598 $wpdocs_imported_files = array_diff($wpdocs_imported_files, $wpdocs_items);
3088 3599 }
3089 -
3600 +
3090 3601 if($dir_slug){
3091 3602 $wpdocs_imported_folder = array_diff($wpdocs_imported_folder, array($dir_slug));
3092 3603 }
3093 -
3604 +
3094 3605 update_option('wpdocs_imported_folder', $wpdocs_imported_folder);
3095 3606 update_option('wpdocs_imported_files', $wpdocs_imported_files);
3607 + }
3608 + }
3096 3609
3097 - };
3098 - }
3099 3610
3100 3611 if(!function_exists('wp_docs_memphis_import_files')){
3101 3612 function wp_docs_memphis_import_files(){
3102 3613 global $memphis_folders_id, $memphis_files_array, $wpdocs_imported_files, $wpdocs_memphis_list, $wpdocs_post_types;
@@ -3132,8 +3643,10 @@
3132 3643
3133 3644 if(!empty($dir_list)){
3134 3645 foreach($dir_list as $dir_id){
3135 3646 update_post_meta($attachment_id, '_wpdocs_memphis_media_file', true);
3647 + update_post_meta($attachment_id, '_wpdocs_memphis_file_id', $file_data['id']);
3648 +
3136 3649 $wpdocs_imported_files[] = $attachment_id;
3137 3650 wpdocs_update_files_meta($dir_id, $files);
3138 3651 }
3139 3652 unset($memphis_files_array[$file_index]);
@@ -3314,15 +3827,15 @@
3314 3827 $default_ext = '';
3315 3828
3316 3829 $breadcrumb = get_the_title($dir);
3317 3830 ?>
3318 - <small class="alert alert-success d-block"><i class="fas fa-chevron-right"></i> <?php echo $breadcrumb; ?></small>
3831 + <small class="alert alert-success d-block"><i class="fas fa-chevron-right"></i> <?php echo esc_html($breadcrumb); ?></small>
3319 3832 <?php
3320 3833
3321 3834 }
3322 3835 ?>
3323 3836 <label for="wpdocs_options_file">
3324 - <input <?php checked($is_file); ?> type="checkbox" class="<?php echo $dir_option_class; ?>" name="wpdocs_options[file_upload]" value="file_upload" id="wpdocs_options_file" />
3837 + <input <?php checked($is_file); ?> type="checkbox" class="<?php echo esc_attr($dir_option_class); ?>" name="wpdocs_options[file_upload]" value="file_upload" id="wpdocs_options_file" />
3325 3838 <?php echo __('File Upload Front-end', 'wp-docs'); ?> <small><?php echo $wpdocs_pro?__('(Optional)', 'wp-docs'):__('(Premium)', 'wp-docs'); ?></small> <i title="<?php echo __('This icon will appear on front-end for users', 'wp-docs'); ?>" class="fa fa-upload" style="color:#ffc107"></i>
3326 3839 <a href="https://www.youtube.com/embed/flFmqpJCwYk" target="_blank"><?php echo __('Video Tutorial', 'wp-docs'); ?></a>
3327 3840 </label>
3328 3841
@@ -3330,9 +3843,9 @@
3330 3843
3331 3844 <ul class="ml-4 <?php echo $is_file ? '' : 'd-none'?>">
3332 3845 <li>
3333 3846 <label for="wpdocs_options_current_user_files">
3334 - <input class="<?php echo $dir_option_class; ?>" <?php checked($is_file && $is_current_user_files); ?> type="checkbox" name="wpdocs_options[current_user_files]" value="current_user_files" id="wpdocs_options_current_user_files" />
3847 + <input class="<?php echo esc_attr($dir_option_class); ?>" <?php checked($is_file && $is_current_user_files); ?> type="checkbox" name="wpdocs_options[current_user_files]" value="current_user_files" id="wpdocs_options_current_user_files" />
3335 3848 <?php echo __('Do not make files public uploaded by users', 'wp-docs'); ?> <small><?php echo $wpdocs_pro?__('(Optional)', 'wp-docs'):__('(Premium)', 'wp-docs'); ?></small>
3336 3849 </label>
3337 3850 </li>
3338 3851
@@ -3337,9 +3850,9 @@
3337 3850 </li>
3338 3851
3339 3852 <li>
3340 3853 <label for="wpdocs_options_del_from_front">
3341 - <input class="<?php echo $dir_option_class; ?>" <?php checked($is_file && $is_del_from_front); ?> type="checkbox" name="wpdocs_options[del_from_front]" value="del_from_front" id="wpdocs_options_del_from_front" />
3854 + <input class="<?php echo esc_attr($dir_option_class); ?>" <?php checked($is_file && $is_del_from_front); ?> type="checkbox" name="wpdocs_options[del_from_front]" value="del_from_front" id="wpdocs_options_del_from_front" />
3342 3855 <?php echo __('User can delete the files from front-end?', 'wp-docs'); ?> <small><?php echo $wpdocs_pro?__('(Optional)', 'wp-docs'):__('(Premium)', 'wp-docs'); ?></small> <i class="fas fa-trash-alt" style="color:#ffc107"></i>
3343 3856 </label>
3344 3857 </li>
3345 3858
@@ -3349,9 +3862,9 @@
3349 3862 </label>
3350 3863
3351 3864
3352 3865
3353 - <select class="wpdocs_options_allowed_role <?php echo $dir_option_class; ?>" name="wpdocs_options[allowed_role]" data-name="allowed_role" id="wpdocs_options_allowed_role" multiple placeholder="<?php echo __('Select roles to allow upload', 'wp-docs'); ?>">
3866 + <select class="wpdocs_options_allowed_role <?php echo esc_attr($dir_option_class); ?>" name="wpdocs_options[allowed_role]" data-name="allowed_role" id="wpdocs_options_allowed_role" multiple placeholder="<?php echo __('Select roles to allow upload', 'wp-docs'); ?>">
3354 3867
3355 3868 <?php echo wpdocs_get_user_roles_options($allowed_role) ?>
3356 3869
3357 3870 </select>
@@ -3362,9 +3875,9 @@
3362 3875 <li>
3363 3876 <label for="wpdocs_options_allowed_ext">
3364 3877 <?php echo __('Allowed File Types', 'wp-docs'); ?> <?php echo ($wpdocs_pro?'':'<small>'.__('(Premium)', 'wp-docs').'</small> '); ?> <i class="fas fa-photo-video" style="color:#ffc107"></i>
3365 3878 </label>
3366 - <input type="text" class="form-control <?php echo $dir_option_class; ?>" name="wpdocs_options[allowed_ext]" data-name="allowed_ext" value="<?php echo $allowed_ext; ?>" id="wpdocs_options_allowed_ext" title="<?php _e('Leave blank if you want to allow all type of files', 'wp-docs'); ?>" placeholder="<?php echo $default_ext; ?>" />
3879 + <input type="text" class="form-control <?php echo esc_attr($dir_option_class); ?>" name="wpdocs_options[allowed_ext]" data-name="allowed_ext" value="<?php echo esc_attr($allowed_ext); ?>" id="wpdocs_options_allowed_ext" title="<?php _e('Leave blank if you want to allow all type of files', 'wp-docs'); ?>" placeholder="<?php echo esc_attr($default_ext); ?>" />
3367 3880
3368 3881 </li>
3369 3882
3370 3883 </ul>
@@ -3529,4 +4042,5 @@
3529 4042 function wpdoc_humanize($str){
3530 4043 return ucwords(str_replace(array('-', '_'), ' ', $str));
3531 4044 }
3532 4045 }
4046 + include_once('functions-verify.php');