| @@ -1,6 +1,18 @@ | ||
| 1 | 1 | <?php |
| 2 | - | |
| 2 | + if(!function_exists('wpdocs_secure_url')){ | |
| 3 | + function wpdocs_secure_url($file_id=''){ | |
| 4 | + | |
| 5 | + $ret = add_query_arg( | |
| 6 | + array( | |
| 7 | + 'wpdocs_dl' => $file_id, | |
| 8 | + 'wpdocs_nonce' => wp_create_nonce('wpdocs_dl_'.$file_id), | |
| 9 | + ), | |
| 10 | + home_url('/') | |
| 11 | + ); | |
| 12 | + return $ret; | |
| 13 | + } | |
| 14 | + } | |
| 3 | 15 | if(!function_exists('wp_docs_get_memphis_dir_option_id')){ |
| 4 | 16 | function wp_docs_get_option_id($option_name){ |
| 5 | 17 | global $wpdb; |
| 6 | 18 | $option_name = esc_sql( $option_name ); |
| @@ -44,8 +56,10 @@ | ||
| 44 | 56 | function wpdocs_admin_enqueue_script() |
| 45 | 57 | { |
| 46 | 58 | if (isset($_GET['page']) && $_GET['page'] == 'wpdocs') { |
| 47 | 59 | |
| 60 | + //pree(get_option('mdocs-list'));exit; | |
| 61 | + | |
| 48 | 62 | global $wpdocs_pro, $wpdocs_options; |
| 49 | 63 | |
| 50 | 64 | wp_enqueue_script('wpdocs_boostrap', plugin_dir_url(dirname(__FILE__)) . 'js/bootstrap.min.js', array('jquery')); |
| 51 | 65 | wp_enqueue_style('wpdocs-boostrap', plugins_url('css/bootstrap.min.css', dirname(__FILE__))); |
| @@ -65,8 +79,9 @@ | ||
| 65 | 79 | wp_enqueue_style('wpdocs-common', plugins_url('css/common-styles.css', dirname(__FILE__)), array(), date('Ymdhi')); |
| 66 | 80 | wp_enqueue_style('wpdocs-admin', plugins_url('css/admin-styles.css', dirname(__FILE__)), array(), date('Ymdhi')); |
| 67 | 81 | |
| 68 | 82 | wp_enqueue_script('wpdocs_admin_scripts', plugin_dir_url(dirname(__FILE__)) . 'js/admin-scripts.js', array('jquery', 'jquery-ui-dialog'), time()); |
| 83 | + wp_enqueue_script('wpdocs_verify_scripts', plugin_dir_url(dirname(__FILE__)) . 'js/verify-scripts.js', array('jquery', 'jquery-ui-dialog'), time()); | |
| 69 | 84 | |
| 70 | 85 | if($wpdocs_pro){ |
| 71 | 86 | wp_enqueue_script('wpdocs_pro_scripts', plugin_dir_url(dirname(__FILE__)) . 'pro/wp-docs-admin.js?t='.time(), array('jquery')); |
| 72 | 87 | } |
| @@ -83,8 +98,9 @@ | ||
| 83 | 98 | 'wpdocs_admin_scripts', |
| 84 | 99 | 'wpdocs_ajax_object', |
| 85 | 100 | array( |
| 86 | 101 | 'ajax_url' => admin_url('admin-ajax.php'), |
| 102 | + 'nonce' => wp_create_nonce('wpdocs_update_options_nonce'), | |
| 87 | 103 | 'url' => admin_url('options-general.php?page=wpdocs'), |
| 88 | 104 | 'wpdocs_pro' => $wpdocs_pro, |
| 89 | 105 | 'wpdocs_delete_msg' => __('Do you want to delete this directory and data as well?', 'wp-docs'), |
| 90 | 106 | 'wpdocs_delete_shortcut_msg' => __('Do you want to delete this shortcut?', 'wp-docs'), |
| @@ -100,16 +116,64 @@ | ||
| 100 | 116 | 'undo_import_confirm' => __('Do you want to rollback the import?', 'wp-docs'), |
| 101 | 117 | 'select_role_str' => __('Select roles to allow upload', 'wp-docs'), |
| 102 | 118 | 'rename_confirm' => __('Do you want to rename this directory?', 'wp-docs'), |
| 103 | 119 | 'reset_confirm' => __('Do you want to reset all settings and clear directories?', 'wp-docs'), |
| 104 | - 'nonce' => wp_create_nonce('wpdocs_update_options_nonce'), | |
| 120 | + | |
| 105 | 121 | 'empty_settings' => empty($wpdocs_options), |
| 106 | 122 | 'wc_os_pg' => (isset($_GET['pg'])?esc_attr($_GET['pg']):'0'), |
| 107 | 123 | 'wc_os_tab' => (isset($_GET['t'])?esc_attr($_GET['t']):'0'), |
| 108 | - 'all_dirs' => $dir_id_to_titles | |
| 124 | + 'all_dirs' => $dir_id_to_titles, | |
| 125 | + 'rename_confirm' => __('Please enter new folder name:', 'wp-docs'), | |
| 109 | 126 | |
| 110 | 127 | ) |
| 111 | 128 | ); |
| 129 | + | |
| 130 | + wp_localize_script( | |
| 131 | + 'wpdocs_verify_scripts', | |
| 132 | + 'wpdocs_vars', | |
| 133 | + array( | |
| 134 | + 'ajax_url' => admin_url('admin-ajax.php'), | |
| 135 | + 'url' => admin_url('options-general.php?page=wpdocs'), | |
| 136 | + 'nonce' => wp_create_nonce('wpdocs_verify_nonce'), | |
| 137 | + 'preparing_queue' => __('Preparing verification queue...', 'wp-docs'), | |
| 138 | + 'unable_to_start' => __('Unable to start verification.', 'wp-docs'), | |
| 139 | + 'ajax_error' => __('AJAX error.', 'wp-docs'), | |
| 140 | + 'verification_failed' => __('Verification failed.', 'wp-docs'), | |
| 141 | + 'verification_completed' => __('Verification completed.', 'wp-docs'), | |
| 142 | + 'verification_interrupted' => __('Verification interrupted.', 'wp-docs'), | |
| 143 | + 'checking_folder' => __('Checking Folder:', 'wp-docs'), | |
| 144 | + 'checking_file' => __('Checking File:', 'wp-docs'), | |
| 145 | + 'unknown_file' => __('Unknown File', 'wp-docs'), | |
| 146 | + 'items_processed' => __('items processed', 'wp-docs'), | |
| 147 | + 'total_folders' => __('Total Folders', 'wp-docs'), | |
| 148 | + 'verified_folders' => __('Verified Folders', 'wp-docs'), | |
| 149 | + 'missing_folders' => __('Missing Folders', 'wp-docs'), | |
| 150 | + 'total_files' => __('Total Files', 'wp-docs'), | |
| 151 | + 'verified_files' => __('Verified Files', 'wp-docs'), | |
| 152 | + 'missing_files' => __('Missing Files', 'wp-docs'), | |
| 153 | + 'missing_folder' => __('MISSING FOLDER', 'wp-docs'), | |
| 154 | + 'missing_file' => __('MISSING FILE', 'wp-docs'), | |
| 155 | + 'no_items_display' => __('No items to display.', 'wp-docs'), | |
| 156 | + 'import_in_progress' => __('Import is already in progress. Please wait.', 'wp-docs'), | |
| 157 | + 'import_missing_confirm' => __('This will import only missing folders and files. Do you want to continue?', 'wp-docs'), | |
| 158 | + 'initializing' => __('Initializing...', 'wp-docs'), | |
| 159 | + 'preparing_import_queue' => __('Preparing import queue...', 'wp-docs'), | |
| 160 | + 'unable_to_start_import' => __('Unable to start import.', 'wp-docs'), | |
| 161 | + 'import_failed' => __('Import failed.', 'wp-docs'), | |
| 162 | + 'import_completed' => __('Import completed!', 'wp-docs'), | |
| 163 | + 'refreshing_results' => __('Refreshing verification results...', 'wp-docs'), | |
| 164 | + 'import_interrupted' => __('Import interrupted. Please try again.', 'wp-docs'), | |
| 165 | + 'creating_folder' => __('Creating Folder:', 'wp-docs'), | |
| 166 | + 'importing_file' => __('Importing File:', 'wp-docs'), | |
| 167 | + 'path' => __('Path:', 'wp-docs'), | |
| 168 | + 'target' => __('Target:', 'wp-docs'), | |
| 169 | + 'folders_imported' => __('Folders imported:', 'wp-docs'), | |
| 170 | + 'files_imported' => __('Files imported:', 'wp-docs'), | |
| 171 | + 'failed' => __('Failed:', 'wp-docs'), | |
| 172 | + 'please_wait' => __('Please wait...', 'wp-docs'), | |
| 173 | + 'import_missing_items' => __('Import Missing Items Only', 'wp-docs'), | |
| 174 | + ) | |
| 175 | + ); | |
| 112 | 176 | } |
| 113 | 177 | } |
| 114 | 178 | |
| 115 | 179 | add_filter( 'ajax_query_attachments_args', 'wpdocs_filter_media'); |
| @@ -419,8 +483,10 @@ | ||
| 419 | 483 | $dir_id = (!$dir_id && array_key_exists('dir', $_GET)?sanitize_wpdocs_data($_GET['dir']):0); |
| 420 | 484 | |
| 421 | 485 | $params_array = array( |
| 422 | 486 | 'dir_id' => $dir_id, |
| 487 | + | |
| 488 | + 'nonce' => wp_create_nonce('wpdocs_update_options_nonce'), | |
| 423 | 489 | 'parent_dir' => get_permalink($post->ID).'/?dir=', |
| 424 | 490 | 'wpdocs_pro' => $wpdocs_pro, |
| 425 | 491 | 'details_view_sorting' => $details_view_sorting, |
| 426 | 492 | 'ajax_based_deep_search' => $ajax_based_deep_search, |
| @@ -436,9 +502,8 @@ | ||
| 436 | 502 | 'block_ui' => __('Please wait...', 'wp-docs'), |
| 437 | 503 | 'is_ajax' => $is_ajax, |
| 438 | 504 | 'is_ajax_url' => $is_ajax_url, |
| 439 | 505 | 'del_from_front' => array_key_exists('del_from_front', $wpdocs_options), |
| 440 | - 'nonce' => wp_create_nonce('wpdocs_update_options_nonce'), | |
| 441 | 506 | 'restriction_load' => isset($_GET['wpdocs_restriction']), |
| 442 | 507 | 'restriction_id' => isset($_GET['wpdocs_restriction']) ? $_GET['wpdocs_restriction'] : '', |
| 443 | 508 | 'restriction_container' => isset($_GET['wpdocs_container']) ? $_GET['wpdocs_container'] : '', |
| 444 | 509 | 'current_user_id' => get_current_user_id(), |
| @@ -601,10 +666,30 @@ | ||
| 601 | 666 | //pree($ret); |
| 602 | 667 | |
| 603 | 668 | return $ret; |
| 604 | 669 | } |
| 670 | + function wpdocs_create_folder_post( $post_parent, $post_title = "New Folder" ) { | |
| 671 | + | |
| 672 | + if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) { | |
| 673 | + return 0; | |
| 674 | + } | |
| 605 | 675 | |
| 606 | - function wpdocs_create_folder_post($post_parent, $post_title = "New Folder") | |
| 676 | + $post_parent = absint( $post_parent ); | |
| 677 | + $post_title = sanitize_text_field( $post_title ); | |
| 678 | + | |
| 679 | + $my_post = array( | |
| 680 | + 'post_title' => $post_title, | |
| 681 | + 'post_content' => '', | |
| 682 | + 'post_status' => 'hidden', | |
| 683 | + 'post_author' => get_current_user_id(), | |
| 684 | + 'post_type' => 'wpdocs_folder', | |
| 685 | + 'post_parent' => ( ( $post_parent > 0 && wpdocs_folder_exists( $post_parent ) ) ? $post_parent : 0 ), | |
| 686 | + 'post_category' => array(), | |
| 687 | + ); | |
| 688 | + | |
| 689 | + return wp_insert_post( $my_post ); | |
| 690 | + } | |
| 691 | + /*function wpdocs_create_folder_post($post_parent, $post_title = "New Folder") | |
| 607 | 692 | { |
| 608 | 693 | |
| 609 | 694 | $my_post = array( |
| 610 | 695 | 'post_title' => $post_title, |
| @@ -618,14 +703,19 @@ | ||
| 618 | 703 | |
| 619 | 704 | $dir_id = wp_insert_post($my_post); |
| 620 | 705 | |
| 621 | 706 | return $dir_id; |
| 622 | - } | |
| 707 | + }*/ | |
| 623 | 708 | |
| 624 | 709 | add_action('wp_ajax_wpdocs_create_folder', 'wpdocs_create_folder'); |
| 625 | 710 | |
| 626 | 711 | function wpdocs_create_folder() |
| 627 | 712 | { |
| 713 | + if ( ! current_user_can( 'manage_options' ) ) { | |
| 714 | + wp_send_json_error( __("Unauthorized user", 'wp-docs') ); | |
| 715 | + wp_die(); | |
| 716 | + } | |
| 717 | + | |
| 628 | 718 | $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce'])); |
| 629 | 719 | |
| 630 | 720 | if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) ) |
| 631 | 721 | die (__("Sorry, your nonce did not verify.", 'wp-docs')); |
| @@ -639,9 +729,29 @@ | ||
| 639 | 729 | $list = array('id'=>$list_obj->ID, 'content'=>$list_obj->post_content, 'title'=>$list_obj->post_title, 'type'=>$list_obj->post_type, 'guid'=>$list_obj->guid); |
| 640 | 730 | |
| 641 | 731 | $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']); |
| 642 | 732 | |
| 643 | - echo '<li class="ab-dir ab-new" data-id="'.$dir_id.'" data-resource='.base64_encode($dir_id).'" data-linked="'.$list['content'].'" data-guid="'.($is_shortcut?$list['guid']:'').'"><a class="folder fa fa-folder"></a><a class="dtitle" title="'.__('Click here to rename', 'wp-docs').'">'.__('New Folder', 'wp-docs').'</a><span class="wpd_action_span"><a class="wpd-edit" title="'.__('Click here to edit', 'wp-docs').'"></a><span class="wpd_action_span_inner"><a class="wpd-copy" title="'.__('Click here to copy', 'wp-docs').'"></a><a class="wpd-move" title="'.__('Click here to move', 'wp-docs').'"></a></span><a class="wpd-trash" title="'.__('Click here to delete', 'wp-docs').'"></a></span></li>'; | |
| 733 | + echo '<li class="ab-dir ab-new" | |
| 734 | + data-id="' . esc_attr($dir_id) . '" | |
| 735 | + data-resource="' . esc_attr(base64_encode($dir_id)) . '" | |
| 736 | + data-linked="' . esc_attr($list['content']) . '" | |
| 737 | + data-guid="' . ($is_shortcut ? esc_attr($list['guid']) : '') . '"> | |
| 738 | + | |
| 739 | + <a class="folder fa fa-folder"></a> | |
| 740 | + | |
| 741 | + <a class="dtitle" title="' . esc_attr(__('Click here to rename', 'wp-docs')) . '"> | |
| 742 | + ' . esc_html__('New Folder', 'wp-docs') . ' | |
| 743 | + </a> | |
| 744 | + | |
| 745 | + <span class="wpd_action_span"> | |
| 746 | + <a class="wpd-edit" title="' . esc_attr(__('Click here to edit', 'wp-docs')) . '"></a> | |
| 747 | + <span class="wpd_action_span_inner"> | |
| 748 | + <a class="wpd-copy" title="' . esc_attr(__('Click here to copy', 'wp-docs')) . '"></a> | |
| 749 | + <a class="wpd-move" title="' . esc_attr(__('Click here to move', 'wp-docs')) . '"></a> | |
| 750 | + </span> | |
| 751 | + <a class="wpd-trash" title="' . esc_attr(__('Click here to delete', 'wp-docs')) . '"></a> | |
| 752 | + </span> | |
| 753 | + </li>'; | |
| 644 | 754 | |
| 645 | 755 | exit; |
| 646 | 756 | } |
| 647 | 757 | |
| @@ -718,25 +828,81 @@ | ||
| 718 | 828 | } |
| 719 | 829 | |
| 720 | 830 | |
| 721 | 831 | |
| 832 | + return array( | |
| 833 | + 'file_id' => $item, | |
| 834 | + 'file_url' => esc_url($file_url), | |
| 835 | + 'ext' => esc_attr($ext), | |
| 836 | + 'filename' => esc_attr($filename), | |
| 837 | + 'title' => esc_html($filename), | |
| 838 | + 'icon_url' => esc_url($icon_url) | |
| 839 | + ); | |
| 722 | 840 | |
| 723 | - return array( | |
| 724 | 841 | |
| 725 | - 'file_url' => $file_url, | |
| 726 | - 'ext' => $ext, | |
| 727 | - 'filename' => $filename, | |
| 728 | - 'title' => $filename, | |
| 729 | - 'icon_url' => $icon_url | |
| 730 | - ); | |
| 842 | + } | |
| 843 | + } | |
| 731 | 844 | |
| 845 | + /** | |
| 846 | + * Centralize the "can this user edit this folder?" decision. | |
| 847 | + * Admins always pass; otherwise require the folder to be owned by the user. | |
| 848 | + */ | |
| 849 | + function wpdocs_user_can_edit_folder( $dir_id ) { | |
| 850 | + if ( current_user_can( 'manage_options' ) ) { | |
| 851 | + return true; | |
| 852 | + } | |
| 732 | 853 | |
| 854 | + $dir = get_post( $dir_id ); | |
| 855 | + if ( ! $dir || 'wpdocs_folder' !== $dir->post_type ) { // adjust CPT slug | |
| 856 | + return false; | |
| 733 | 857 | } |
| 858 | + | |
| 859 | + return (int) $dir->post_author === get_current_user_id(); | |
| 734 | 860 | } |
| 735 | 861 | |
| 736 | 862 | add_action('wp_ajax_wpdocs_add_files', 'wpdocs_add_files'); |
| 737 | 863 | |
| 738 | - function wpdocs_add_files(){ | |
| 864 | + function wpdocs_add_files() { | |
| 865 | + | |
| 866 | + // 1) Capability FIRST — before nonce, before anything. | |
| 867 | + if ( ! is_user_logged_in() || ! current_user_can( 'upload_files' ) ) { | |
| 868 | + wp_send_json_error( array( 'message' => __( 'Insufficient permissions.', 'wp-docs' ) ), 403 ); | |
| 869 | + } | |
| 870 | + | |
| 871 | + // 2) Nonce check. | |
| 872 | + if ( empty( $_POST['nonce'] ) | |
| 873 | + || ! wp_verify_nonce( | |
| 874 | + sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), | |
| 875 | + 'wpdocs_update_options_nonce' | |
| 876 | + ) | |
| 877 | + ) { | |
| 878 | + wp_send_json_error( array( 'message' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 879 | + } | |
| 880 | + | |
| 881 | + // 3) Input validation. | |
| 882 | + $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0; | |
| 883 | + if ( ! $dir_id ) { | |
| 884 | + wp_send_json_error( array( 'message' => __( 'Invalid folder.', 'wp-docs' ) ), 400 ); | |
| 885 | + } | |
| 886 | + | |
| 887 | + // 4) Per-folder ownership / capability gate. | |
| 888 | + if ( ! wpdocs_user_can_edit_folder( $dir_id ) ) { | |
| 889 | + wp_send_json_error( array( 'message' => __( 'You cannot modify this folder.', 'wp-docs' ) ), 403 ); | |
| 890 | + } | |
| 891 | + | |
| 892 | + $files = isset( $_POST['files'] ) ? sanitize_wpdocs_data( $_POST['files'] ) : array(); | |
| 893 | + $files = is_array( $files ) ? $files : array( $files ); | |
| 894 | + $files = array_filter( array_map( 'absint', $files ) ); | |
| 895 | + | |
| 896 | + wpdocs_update_files_meta( $dir_id, $files ); | |
| 897 | + | |
| 898 | + $ret = ! empty( $files ) ? wpdocs_list_added_items( $dir_id ) : ''; | |
| 899 | + | |
| 900 | + echo $ret; | |
| 901 | + exit; | |
| 902 | + } | |
| 903 | + | |
| 904 | + /*function wpdocs_add_files_old(){ | |
| 739 | 905 | |
| 740 | 906 | $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce'])); |
| 741 | 907 | |
| 742 | 908 | if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) ) |
| @@ -762,13 +928,13 @@ | ||
| 762 | 928 | } |
| 763 | 929 | |
| 764 | 930 | echo $ret; |
| 765 | 931 | exit; |
| 766 | - } | |
| 932 | + }*/ | |
| 767 | 933 | function wpdocs_list_added_items($dir) |
| 768 | 934 | { |
| 769 | 935 | |
| 770 | - global $wpdocs_options; | |
| 936 | + global $wpdocs_options, $icon_sub_path, $wpdocs_url; | |
| 771 | 937 | |
| 772 | 938 | $wp_get_upload_dir = wp_get_upload_dir(); |
| 773 | 939 | $wp_uploads_path = $wp_get_upload_dir['basedir']; |
| 774 | 940 | $wp_uploads_url = $wp_get_upload_dir['baseurl']; |
| @@ -787,12 +953,12 @@ | ||
| 787 | 953 | |
| 788 | 954 | $item_data = wpd_get_item_type_icon_url($item); |
| 789 | 955 | extract($item_data); |
| 790 | 956 | |
| 791 | - //pree($item_data); | |
| 957 | + //pree($item_data);exit; | |
| 792 | 958 | //pree($wp_uploads_path);exit; |
| 793 | 959 | |
| 794 | - $icon_str = '<img src="'.$icon_url.'" style="">'; | |
| 960 | + $icon_str = '<img src="' . esc_url($icon_url) . '" style="" alt="' . esc_attr($title) . '">'; | |
| 795 | 961 | |
| 796 | 962 | switch ($ext) { |
| 797 | 963 | case 'png': |
| 798 | 964 | case 'jpg': |
| @@ -817,18 +983,30 @@ | ||
| 817 | 983 | |
| 818 | 984 | $file_url_thumb = str_replace('.pdf', '.png', strtolower($item_data['file_url'])); |
| 819 | 985 | $file_url_thumb_path = str_replace($wp_uploads_url, $wp_uploads_path, $file_url_thumb); |
| 820 | 986 | |
| 821 | - if(!file_exists($file_url_thumb_path)){ | |
| 987 | + if(!file_exists($file_url_thumb_path) && class_exists('imagick')){ | |
| 822 | 988 | |
| 823 | - $im = new imagick($item_data['file_url']); | |
| 824 | - $im->setIteratorIndex(0); | |
| 825 | - $im->setImageFormat('png'); | |
| 826 | - $im->writeImage($file_url_thumb_path); | |
| 989 | + try { | |
| 990 | + $im = new imagick($item_data['file_url']); | |
| 991 | + $im->setIteratorIndex(0); | |
| 992 | + $im->setImageFormat('png'); | |
| 993 | + $im->writeImage($file_url_thumb_path); | |
| 994 | + } catch (ImagickException $e) { | |
| 995 | + | |
| 996 | + if(defined('WP_DEBUG') && WP_DEBUG && defined('WP_DEBUG_LOG') && WP_DEBUG_LOG){ | |
| 997 | + error_log("Imagick error: " . $e->getMessage()); | |
| 998 | + error_log('file_url: '.$item_data['file_url']); | |
| 999 | + error_log('file_url_thumb_path: '.$file_url_thumb_path); | |
| 1000 | + } | |
| 1001 | + | |
| 1002 | + $file_url_thumb = $wpdocs_url.$icon_sub_path.$ext.'.png'; | |
| 1003 | + } | |
| 827 | 1004 | |
| 1005 | + | |
| 828 | 1006 | } |
| 829 | 1007 | |
| 830 | - $icon_str = '<img src="'.$file_url_thumb.'" style="">'; | |
| 1008 | + $icon_str = '<img src="' . esc_url( $file_url_thumb ) . '" style="" alt="' . esc_attr( $title ) . '">'; | |
| 831 | 1009 | |
| 832 | 1010 | } |
| 833 | 1011 | |
| 834 | 1012 | } |
| @@ -839,21 +1017,24 @@ | ||
| 839 | 1017 | //$class .= 'fa-file'; |
| 840 | 1018 | break; |
| 841 | 1019 | } |
| 842 | 1020 | $class = ''; |
| 843 | - $files_list[$title] = '<li data-id="' . $item . '" data-dir="'.$dir. '" title="'.esc_attr($filename).'"> | |
| 844 | - <a href="' . $file_url . '" target="_blank" class="file ' . $class . '"> '.$icon_str.' </a> | |
| 845 | - <a class="ftitle" title="' . $title . '">' . $title . '</a> | |
| 846 | - <span class="wpd_action_span"> | |
| 847 | - <a href="upload.php?item='.$item.'" target="_blank" class="wpd-edit" title="'.__('Click here to edit', 'wp-docs').'"></a> | |
| 848 | - <span class="wpd_action_span_inner"> | |
| 849 | - <a class="wpd-copy" title="'.__('Click here to copy', 'wp-docs').'"></a> | |
| 850 | - <a class="wpd-move" title="'.__('Click here to move', 'wp-docs').'"></a> | |
| 851 | - </span> | |
| 852 | - | |
| 853 | - <a href="upload.php?search='.esc_attr($filename).'" target="_blank" class="wpd-trash" title="'.__('Click here to delete', 'wp-docs').'"></a> | |
| 854 | - </span> | |
| 855 | - </li>'; | |
| 1021 | + | |
| 1022 | + | |
| 1023 | + $secured_file_url = wpdocs_secure_url($file_id); | |
| 1024 | + | |
| 1025 | + $files_list[ $title ] = '<li data-id="' . esc_attr( $item ) . '" data-dir="' . esc_attr( $dir ) . '" title="' . esc_attr( $filename ) . '"> | |
| 1026 | + <a href="' . esc_url( $secured_file_url ) . '" target="_blank" class="file ' . esc_attr( $class ) . '"> ' . $icon_str . ' </a> | |
| 1027 | + <a class="ftitle" title="' . esc_attr( $title ) . '">' . esc_html( $title ) . '</a> | |
| 1028 | + <span class="wpd_action_span"> | |
| 1029 | + <a href="' . esc_url( 'upload.php?item=' . $item ) . '" target="_blank" class="wpd-edit" title="' . esc_attr__( 'Click here to edit', 'wp-docs' ) . '"></a> | |
| 1030 | + <span class="wpd_action_span_inner"> | |
| 1031 | + <a class="wpd-copy" title="' . esc_attr__( 'Click here to copy', 'wp-docs' ) . '"></a> | |
| 1032 | + <a class="wpd-move" title="' . esc_attr__( 'Click here to move', 'wp-docs' ) . '"></a> | |
| 1033 | + </span> | |
| 1034 | + <a href="' . esc_url( 'upload.php?search=' . rawurlencode( $filename ) ) . '" target="_blank" class="wpd-trash" title="' . esc_attr__( 'Click here to delete', 'wp-docs' ) . '"></a> | |
| 1035 | + </span> | |
| 1036 | +</li>'; | |
| 856 | 1037 | } |
| 857 | 1038 | } |
| 858 | 1039 | |
| 859 | 1040 | ksort($files_list); |
| @@ -928,9 +1109,9 @@ | ||
| 928 | 1109 | |
| 929 | 1110 | |
| 930 | 1111 | //pree($atts); |
| 931 | 1112 | ob_start(); |
| 932 | - global $wpdocs_url, $wpdocs_options, $wpdocs_pro, $wpdocs_post_types, $pdf_thumb_selected; | |
| 1113 | + global $wpdocs_url, $wpdocs_options, $wpdocs_pro, $wpdocs_post_types, $pdf_thumb_selected, $icon_sub_path; | |
| 933 | 1114 | |
| 934 | 1115 | $pdf_thumb_selected = (array_key_exists('pdf_thumb', $wpdocs_options)?$wpdocs_options['pdf_thumb']:'default'); |
| 935 | 1116 | |
| 936 | 1117 | $wpdocs_view = get_option('wpdocs_view', array()); |
| @@ -1122,12 +1303,19 @@ | ||
| 1122 | 1303 | |
| 1123 | 1304 | ?> |
| 1124 | 1305 | |
| 1125 | 1306 | |
| 1126 | - <div class="container-fluid wpdoc_container" data-dir_restrictions = "<?php echo wpdocs_get_dir_restrictions($dir, 'base64'); ?>" data-del_from_front="<?php echo $is_del_from_front; ?>" data-dir="<?php echo $dir; ?>" data-home="<?php echo $home_id; ?>"> | |
| 1127 | - <?php wp_nonce_field( 'wpdocs_front_list_nonce', 'wpdocs_front_list_nonce_field' ); ?> | |
| 1128 | - <input type="hidden" class="wpd_home_id" value="<?php echo esc_html($home_id); ?>" /> | |
| 1129 | - <input type="hidden" class="wpd_del_file_id" value="" /> | |
| 1307 | +<div class="container-fluid wpdoc_container" | |
| 1308 | + data-dir_restrictions="<?php echo esc_attr( wpdocs_get_dir_restrictions( $dir, 'base64' ) ); ?>" | |
| 1309 | + data-del_from_front="<?php echo esc_attr( $is_del_from_front ); ?>" | |
| 1310 | + data-dir="<?php echo esc_attr( $dir ); ?>" | |
| 1311 | + data-home="<?php echo esc_attr( $home_id ); ?>"> | |
| 1312 | + | |
| 1313 | + <?php wp_nonce_field( 'wpdocs_front_list_nonce', 'wpdocs_front_list_nonce_field' ); ?> | |
| 1314 | + | |
| 1315 | + <input type="hidden" class="wpd_home_id" value="<?php echo esc_attr( $home_id ); ?>" /> | |
| 1316 | + <input type="hidden" class="wpd_del_file_id" value="" /> | |
| 1317 | + | |
| 1130 | 1318 | <?php |
| 1131 | 1319 | |
| 1132 | 1320 | $wpdocs_view = array_key_exists($home_id, $wpdocs_view) ? $wpdocs_view[$home_id] : trim($default_view); |
| 1133 | 1321 | |
| @@ -1139,9 +1327,13 @@ | ||
| 1139 | 1327 | <ol class="breadcrumb bg-light" style="border-bottom:1px solid #dee2e6;border-radius: 0; min-height: 40px;"> |
| 1140 | 1328 | |
| 1141 | 1329 | <?php if (!empty($breadcrumb_array)) { ?> |
| 1142 | 1330 | |
| 1143 | - <li class="breadcrumb-item bread_home_url"><a class="wpd_bread_item" href="<?php echo $get_permalink ?>" data-id="0"><?php _e('Home', 'wp-docs'); ?></a></li> | |
| 1331 | + <li class="breadcrumb-item bread_home_url"> | |
| 1332 | + <a class="wpd_bread_item" href="<?php echo esc_url($get_permalink); ?>" data-id="0"> | |
| 1333 | + <?php echo esc_html__('Home', 'wp-docs'); ?> | |
| 1334 | + </a> | |
| 1335 | +</li> | |
| 1144 | 1336 | <?php |
| 1145 | 1337 | |
| 1146 | 1338 | foreach (array_reverse($breadcrumb_array) as $bread_key => $bread_value) { |
| 1147 | 1339 | $active = ''; |
| @@ -1147,9 +1339,9 @@ | ||
| 1147 | 1339 | $active = ''; |
| 1148 | 1340 | $page = ''; |
| 1149 | 1341 | $permalink = stripos($get_permalink, '?'); |
| 1150 | 1342 | $permalink_c = ($permalink!='' && is_numeric($permalink) && $permalink>=0); |
| 1151 | - $link = '<a class="wpd_bread_item" href="' . $get_permalink . ($permalink_c?'&':'?').'dir=' . $bread_value . '" data-id="'.$bread_value.'" >' . get_the_title($bread_value) . '</a>'; | |
| 1343 | + $link = '<a class="wpd_bread_item" href="' . esc_url($get_permalink . ($permalink_c ? '&' : '?') . 'dir=' . $bread_value) . '" data-id="' . esc_attr($bread_value) . '">' . (get_the_title($bread_value)) . '</a>'; | |
| 1152 | 1344 | if ($bread_value == 0) { |
| 1153 | 1345 | continue; |
| 1154 | 1346 | } |
| 1155 | 1347 | if ($bread_value == $dir) { |
| @@ -1159,9 +1351,11 @@ | ||
| 1159 | 1351 | } |
| 1160 | 1352 | |
| 1161 | 1353 | |
| 1162 | 1354 | ?> |
| 1163 | - <li class="breadcrumb-item <?php echo $active ?>" aria-current="<?php echo $page; ?>"><?php echo $link; ?></li> | |
| 1355 | + <li class="breadcrumb-item <?php echo esc_attr($active); ?>" aria-current="<?php echo esc_attr($page); ?>"> | |
| 1356 | + <?php echo wp_kses_post($link); ?> | |
| 1357 | +</li> | |
| 1164 | 1358 | |
| 1165 | 1359 | <?php } ?> |
| 1166 | 1360 | <?php |
| 1167 | 1361 | } |
| @@ -1170,16 +1364,21 @@ | ||
| 1170 | 1364 | |
| 1171 | 1365 | </ol> |
| 1172 | 1366 | |
| 1173 | 1367 | <?php if($is_del_from_front):?> |
| 1368 | +<i style="opacity: 0.5;" | |
| 1369 | + class="fa fa-trash fa-1x position-absolute wp_docs_del_file <?php echo esc_attr(is_user_logged_in() ? 'logged_in' : 'logged_out'); ?>" | |
| 1370 | + title="<?php echo esc_attr__('Click here to delete selected files', 'wp-docs'); ?>"> | |
| 1371 | +</i> | |
| 1174 | 1372 | |
| 1175 | - <i style="opacity: 0.5;" class="fa fa-trash fa-1x position-absolute wp_docs_del_file <?php echo (is_user_logged_in()?'logged_in':'logged_out'); ?>" title="<?php _e('Click here to delete selected files', 'wp-docs'); ?>"></i> | |
| 1176 | - | |
| 1177 | 1373 | <?php endif; ?> |
| 1178 | 1374 | |
| 1179 | 1375 | <?php if($wpdocs_pro && $dir != 0 && wpdocs_can_current_user_upload_file($dir) && $is_file):?> |
| 1180 | 1376 | |
| 1181 | - <i class="fa fa-upload fa-1x wpdocs-front-add-media position-absolute" id="wpdocs_front_file_add_<?php echo $dir; ?>" title="<?php _e('Click here to add files', 'wp-docs'); ?>"></i> | |
| 1377 | +<i class="fa fa-upload fa-1x wpdocs-front-add-media position-absolute" | |
| 1378 | + id="wpdocs_front_file_add_<?php echo esc_attr( $dir ); ?>" | |
| 1379 | + title="<?php echo esc_attr__( 'Click here to add files', 'wp-docs' ); ?>"> | |
| 1380 | +</i> | |
| 1182 | 1381 | |
| 1183 | 1382 | <?php endif; ?> |
| 1184 | 1383 | </nav> |
| 1185 | 1384 | <?php |
| @@ -1212,10 +1411,9 @@ | ||
| 1212 | 1411 | pree($posts_array); |
| 1213 | 1412 | */ |
| 1214 | 1413 | ?> |
| 1215 | 1414 | |
| 1216 | - <?php echo $warning_msg?'<div class="card-body">'.$warning_msg.'</div>':''; ?> | |
| 1217 | - | |
| 1415 | + <?php echo $warning_msg ? '<div class="card-body">' . wp_kses_post( $warning_msg ) . '</div>' : ''; ?> | |
| 1218 | 1416 | <?php if($is_searchbox || $ajax_based_deep_search): ?> |
| 1219 | 1417 | <div class="wpdocs-searchbox"> |
| 1220 | 1418 | <input type="text" placeholder="<?php echo ($ajax_based_deep_search?__('Type here to search...', 'wp-docs'):__('Type here to filter...', 'wp-docs')); ?>" /> |
| 1221 | 1419 | </div> |
| @@ -1237,14 +1435,22 @@ | ||
| 1237 | 1435 | //$wpdocs_child_files_list = wpdocs_added_items($list['id']); |
| 1238 | 1436 | $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']); |
| 1239 | 1437 | ?> |
| 1240 | 1438 | |
| 1241 | - <div class="col-4 col-md-3 file_wrapper is_dir" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['link']:''; ?>"> | |
| 1242 | - <figure class="figure file_view p-0"> | |
| 1243 | - <span class="fa fa-folder text-warning" style="<?php echo $customize_icon_size; ?>"></span> | |
| 1244 | - <figcaption class="figure-caption text-center" style="<?php echo $customize_font_size; ?>"><?php echo $list['title']; ?></figcaption> | |
| 1245 | - </figure> | |
| 1246 | - </div> | |
| 1439 | +<div class="col-4 col-md-3 file_wrapper is_dir" style="cursor: pointer;" | |
| 1440 | + data-id="<?php echo esc_attr($list['id']); ?>" | |
| 1441 | + data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>" | |
| 1442 | + data-linked="<?php echo esc_attr($list['content']); ?>" | |
| 1443 | + data-guid="<?php echo esc_attr($is_shortcut ? $list['link'] : ''); ?>"> | |
| 1444 | + | |
| 1445 | + <figure class="figure file_view p-0"> | |
| 1446 | + <span class="fa fa-folder text-warning" style="<?php echo esc_attr($customize_icon_size); ?>"></span> | |
| 1447 | + <figcaption class="figure-caption text-center" style="<?php echo esc_attr($customize_font_size); ?>"> | |
| 1448 | + <?php echo esc_html($list['title']); ?> | |
| 1449 | + </figcaption> | |
| 1450 | + </figure> | |
| 1451 | + | |
| 1452 | +</div> | |
| 1247 | 1453 | <?php |
| 1248 | 1454 | } |
| 1249 | 1455 | } else { |
| 1250 | 1456 | $no_dir_found = true; |
| @@ -1261,14 +1467,23 @@ | ||
| 1261 | 1467 | $list = array('id'=>$list_obj->ID, 'content'=>$list_obj->post_content, 'title'=>$list_obj->post_title, 'type'=>$list_obj->post_type, 'guid'=>$list_obj->guid); |
| 1262 | 1468 | $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']); |
| 1263 | 1469 | |
| 1264 | 1470 | ?> |
| 1265 | - <div class="col-4 col-md-3 file_wrapper is_dir is_deep" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['guid']:''; ?>"> | |
| 1266 | - <figure class="figure file_view p-0"> | |
| 1267 | - <span class="fa fa-folder text-warning" style="<?php echo $customize_icon_size; ?>"></span> | |
| 1268 | - <figcaption class="figure-caption text-center" style="<?php echo $customize_font_size; ?>"><?php echo $list['title']; ?></figcaption> | |
| 1269 | - </figure> | |
| 1270 | - </div> | |
| 1471 | +<div class="col-4 col-md-3 file_wrapper is_dir is_deep" style="cursor: pointer;" | |
| 1472 | + data-id="<?php echo esc_attr($list['id']); ?>" | |
| 1473 | + data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>" | |
| 1474 | + data-linked="<?php echo esc_attr($list['content']); ?>" | |
| 1475 | + data-guid="<?php echo esc_attr($is_shortcut ? $list['guid'] : ''); ?>"> | |
| 1476 | + | |
| 1477 | + <figure class="figure file_view p-0"> | |
| 1478 | + <span class="fa fa-folder text-warning" style="<?php echo esc_attr($customize_icon_size); ?>"></span> | |
| 1479 | + | |
| 1480 | + <figcaption class="figure-caption text-center" style="<?php echo esc_attr($customize_font_size); ?>"> | |
| 1481 | + <?php echo esc_html($list['title']); ?> | |
| 1482 | + </figcaption> | |
| 1483 | + </figure> | |
| 1484 | + | |
| 1485 | +</div> | |
| 1271 | 1486 | <?php |
| 1272 | 1487 | } |
| 1273 | 1488 | } |
| 1274 | 1489 | } |
| @@ -1311,17 +1526,30 @@ | ||
| 1311 | 1526 | |
| 1312 | 1527 | $file_url_thumb = str_replace('.pdf', '.png', strtolower($file_data['file_url'])); |
| 1313 | 1528 | $file_url_thumb_path = str_replace($wp_uploads_url, $wp_uploads_path, $file_url_thumb); |
| 1314 | 1529 | |
| 1315 | - if(!file_exists($file_url_thumb_path)){ | |
| 1316 | - | |
| 1317 | - $im = new imagick($file_data['file_url']); | |
| 1318 | - $im->setIteratorIndex(0); | |
| 1319 | - $im->setImageFormat('png'); | |
| 1320 | - $im->writeImage($file_url_thumb_path); | |
| 1530 | + if(!file_exists($file_url_thumb_path) && class_exists('imagick')){ | |
| 1531 | + | |
| 1532 | + try { | |
| 1533 | + $im = new imagick($item_data['file_url']); | |
| 1534 | + $im->setIteratorIndex(0); | |
| 1535 | + $im->setImageFormat('png'); | |
| 1536 | + $im->writeImage($file_url_thumb_path); | |
| 1537 | + } catch (ImagickException $e) { | |
| 1538 | + | |
| 1539 | + if(defined('WP_DEBUG') && WP_DEBUG && defined('WP_DEBUG_LOG') && WP_DEBUG_LOG){ | |
| 1540 | + error_log("Imagick error: " . $e->getMessage()); | |
| 1541 | + error_log('file_url: '.$item_data['file_url']); | |
| 1542 | + error_log('file_url_thumb_path: '.$file_url_thumb_path); | |
| 1543 | + } | |
| 1544 | + | |
| 1545 | + $file_url_thumb = $wpdocs_url.$icon_sub_path.$ext.'.png'; | |
| 1546 | + } | |
| 1321 | 1547 | |
| 1548 | + | |
| 1322 | 1549 | } |
| 1323 | 1550 | |
| 1551 | + | |
| 1324 | 1552 | $icon_url = $file_url_thumb; |
| 1325 | 1553 | |
| 1326 | 1554 | } |
| 1327 | 1555 | |
| @@ -1332,21 +1560,23 @@ | ||
| 1332 | 1560 | default: |
| 1333 | 1561 | //$class .= 'fa-file'; |
| 1334 | 1562 | break; |
| 1335 | 1563 | } |
| 1564 | + | |
| 1565 | + $secured_file_url = wpdocs_secure_url($file_id); | |
| 1336 | 1566 | |
| 1337 | 1567 | $file_list_row = ' |
| 1338 | - | |
| 1339 | - | |
| 1340 | - <div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_shallow" style="cursor: pointer;" data-id="'.$file.'"> | |
| 1341 | - <figure class="figure file_view p-1"> | |
| 1342 | - <a href="'.$file_url.'" target="_blank" class="file" ><img class="my-3" src="'.$icon_url.'" /></a> | |
| 1343 | - <figcaption class="figure-caption text-center">'.$title.'</figcaption> | |
| 1344 | - </figure> | |
| 1345 | - </div> | |
| 1346 | - | |
| 1347 | - | |
| 1348 | - '; | |
| 1568 | + | |
| 1569 | +<div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_shallow" style="cursor: pointer;" data-id="'.esc_attr($file).'"> | |
| 1570 | + <figure class="figure file_view p-1"> | |
| 1571 | + <a href="'.esc_url($secured_file_url).'" target="_blank" class="file"> | |
| 1572 | + <img class="my-3" src="'.esc_url($icon_url).'" /> | |
| 1573 | + </a> | |
| 1574 | + <figcaption class="figure-caption text-center">'.esc_html($title).'</figcaption> | |
| 1575 | + </figure> | |
| 1576 | +</div> | |
| 1577 | + | |
| 1578 | +'; | |
| 1349 | 1579 | $list = wpdocs_list_population($list, $file_data, $file_list_row, $default_orderby); |
| 1350 | 1580 | |
| 1351 | 1581 | } |
| 1352 | 1582 | |
| @@ -1417,21 +1647,23 @@ | ||
| 1417 | 1647 | default: |
| 1418 | 1648 | //$class .= 'fa-file'; |
| 1419 | 1649 | break; |
| 1420 | 1650 | } |
| 1651 | + | |
| 1652 | + $secured_file_url = wpdocs_secure_url($file_id); | |
| 1421 | 1653 | |
| 1422 | 1654 | $file_list_row = ' |
| 1423 | - | |
| 1424 | - | |
| 1425 | - <div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_deep" style="cursor: pointer;" data-id="'.$file.'"> | |
| 1426 | - <figure class="figure file_view p-1"> | |
| 1427 | - <a href="'.$file_url.'" target="_blank" class="file" ><img class="my-3" src="'.$icon_url.'" /></a> | |
| 1428 | - <figcaption class="figure-caption text-center">'.$title.'</figcaption> | |
| 1429 | - </figure> | |
| 1430 | - </div> | |
| 1431 | - | |
| 1432 | - | |
| 1433 | - '; | |
| 1655 | + | |
| 1656 | +<div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_deep" style="cursor: pointer;" data-id="'.esc_attr($file).'"> | |
| 1657 | + <figure class="figure file_view p-1"> | |
| 1658 | + <a href="'.esc_url($secured_file_url).'" target="_blank" class="file"> | |
| 1659 | + <img class="my-3" src="'.esc_url($icon_url).'" /> | |
| 1660 | + </a> | |
| 1661 | + <figcaption class="figure-caption text-center">'.esc_html($title).'</figcaption> | |
| 1662 | + </figure> | |
| 1663 | +</div> | |
| 1664 | + | |
| 1665 | +'; | |
| 1434 | 1666 | $list = wpdocs_list_population($list, $file_data, $file_list_row, $default_orderby); |
| 1435 | 1667 | |
| 1436 | 1668 | } |
| 1437 | 1669 | |
| @@ -1466,12 +1698,16 @@ | ||
| 1466 | 1698 | foreach ($wpdocs_list as $list) { |
| 1467 | 1699 | $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']); |
| 1468 | 1700 | ?> |
| 1469 | 1701 | |
| 1470 | - <div class="col-12 file_wrapper is_dir" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['link']:''; ?>"> | |
| 1702 | +<div class="col-12 file_wrapper is_dir" style="cursor: pointer;" | |
| 1703 | + data-id="<?php echo esc_attr($list['id']); ?>" | |
| 1704 | + data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>" | |
| 1705 | + data-linked="<?php echo esc_attr($list['content']); ?>" | |
| 1706 | + data-guid="<?php echo esc_attr($is_shortcut ? $list['link'] : ''); ?>"> | |
| 1471 | 1707 | <figure class="figure file_view p-2"> |
| 1472 | 1708 | <span class="fa fa-folder text-warning" style="font-size:25px"></span> |
| 1473 | - <small class="text-center"><?php echo $list['title']; ?></small> | |
| 1709 | + <small class="text-center"><?php echo esc_html($list['title']); ?></small> | |
| 1474 | 1710 | </figure> |
| 1475 | 1711 | </div> |
| 1476 | 1712 | <?php |
| 1477 | 1713 | } |
| @@ -1488,12 +1724,16 @@ | ||
| 1488 | 1724 | $list = array('id'=>$list_obj->ID, 'content'=>$list_obj->post_content, 'title'=>$list_obj->post_title, 'type'=>$list_obj->post_type, 'guid'=>$list_obj->guid); |
| 1489 | 1725 | $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']); |
| 1490 | 1726 | |
| 1491 | 1727 | ?> |
| 1492 | - <div class="col-12 file_wrapper is_dir is_deep" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['guid']:''; ?>"> | |
| 1728 | + <div class="col-12 file_wrapper is_dir is_deep" style="cursor: pointer;" | |
| 1729 | + data-id="<?php echo esc_attr($list['id']); ?>" | |
| 1730 | + data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>" | |
| 1731 | + data-linked="<?php echo esc_attr($list['content']); ?>" | |
| 1732 | + data-guid="<?php echo esc_attr($is_shortcut ? $list['guid'] : ''); ?>"> | |
| 1493 | 1733 | <figure class="figure file_view p-2"> |
| 1494 | 1734 | <span class="fa fa-folder text-warning" style="font-size:25px"></span> |
| 1495 | - <small class="text-center"><?php echo $list['title']; ?></small> | |
| 1735 | + <small class="text-center"><?php echo esc_html($list['title']); ?></small> | |
| 1496 | 1736 | </figure> |
| 1497 | 1737 | </div> |
| 1498 | 1738 | <?php |
| 1499 | 1739 | } |
| @@ -1509,13 +1749,15 @@ | ||
| 1509 | 1749 | extract($file_data); |
| 1510 | 1750 | |
| 1511 | 1751 | |
| 1512 | 1752 | if(trim($file_url)){ |
| 1753 | + | |
| 1754 | + $secured_file_url = wpdocs_secure_url($file_id); | |
| 1513 | 1755 | |
| 1514 | 1756 | $file_list_row = ' |
| 1515 | 1757 | <div title="'.esc_attr($filename).'" class="col-12 file_wrapper is_file" style="cursor: pointer;" data-id="'.$file.'"> |
| 1516 | 1758 | <figure class="figure file_view p-3"> |
| 1517 | - <a href="'.$file_url.'" target="_blank" class="file" ><img class="mb-2" src="'.$icon_url.'" style="width: 25px; height: 25px"></a> | |
| 1759 | + <a href="'.$secured_file_url.'" target="_blank" class="file" ><img class="mb-2" src="'.$icon_url.'" style="width: 25px; height: 25px"></a> | |
| 1518 | 1760 | <small class="text-center">'.$title.'</small> |
| 1519 | 1761 | </figure> |
| 1520 | 1762 | </div>'; |
| 1521 | 1763 | |
| @@ -1589,14 +1831,27 @@ | ||
| 1589 | 1831 | <div class="table-responsive" style="zoom:70%"> |
| 1590 | 1832 | <table class="table"> |
| 1591 | 1833 | <thead class="thead"> |
| 1592 | 1834 | <tr> |
| 1593 | - <th><?php _e('Name', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th> | |
| 1594 | - <?php if($details_date_created): ?> <th><?php _e('Created Date', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th><?php endif; ?> | |
| 1595 | - <?php if($details_date): ?> <th><?php _e('Modified Date', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th><?php endif; ?> | |
| 1596 | - <?php if($details_type): ?> <th><?php _e('Type', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th><?php endif; ?> | |
| 1597 | - <?php if($details_size): ?> <th><?php _e('Size', 'wp-docs'); ?> <?php echo $d_v_caret; ?></th><?php endif; ?> | |
| 1598 | - </tr> | |
| 1835 | + <th><?php esc_html_e('Name', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th> | |
| 1836 | + | |
| 1837 | +<?php if ( $details_date_created ) : ?> | |
| 1838 | + <th><?php esc_html_e('Created Date', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th> | |
| 1839 | +<?php endif; ?> | |
| 1840 | + | |
| 1841 | +<?php if ( $details_date ) : ?> | |
| 1842 | + <th><?php esc_html_e('Modified Date', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th> | |
| 1843 | +<?php endif; ?> | |
| 1844 | + | |
| 1845 | +<?php if ( $details_type ) : ?> | |
| 1846 | + <th><?php esc_html_e('Type', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th> | |
| 1847 | +<?php endif; ?> | |
| 1848 | + | |
| 1849 | +<?php if ( $details_size ) : ?> | |
| 1850 | + <th><?php esc_html_e('Size', 'wp-docs'); ?> <?php echo wp_kses_post($d_v_caret); ?></th> | |
| 1851 | +<?php endif; ?> | |
| 1852 | + | |
| 1853 | +</tr> | |
| 1599 | 1854 | </thead> |
| 1600 | 1855 | <?php |
| 1601 | 1856 | $no_dir_found = false; |
| 1602 | 1857 | $no_file_found = false; |
| @@ -1603,13 +1858,13 @@ | ||
| 1603 | 1858 | if (!empty($wpdocs_list)) { |
| 1604 | 1859 | foreach ($wpdocs_list as $list) { |
| 1605 | 1860 | $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']); |
| 1606 | 1861 | ?> |
| 1607 | - <tr title="<?php echo $list['id']; ?>" class="file_wrapper file_view is_dir" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['link']:''; ?>"> | |
| 1862 | + <tr title="<?php echo esc_attr($list['id']); ?>" class="file_wrapper file_view is_dir" style="cursor: pointer;" data-id="<?php echo esc_attr($list['id']); ?>" data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>" data-linked="<?php echo esc_attr($list['content']); ?>" data-guid="<?php echo $is_shortcut?esc_url($list['link']):''; ?>"> | |
| 1608 | 1863 | <td> |
| 1609 | 1864 | <figure class="figure "> |
| 1610 | 1865 | <span class="fa fa-folder text-warning" style="font-size:25px"></span> |
| 1611 | - <small class="text-center mb-1"><?php echo $list['title']; ?></small> | |
| 1866 | + <small class="text-center mb-1"><?php echo esc_html($list['title']); ?></small> | |
| 1612 | 1867 | </figure> |
| 1613 | 1868 | </td> |
| 1614 | 1869 | |
| 1615 | 1870 | <?php if($details_date_created): ?> <td data-time="<?php get_post_time('U', false, $list['id']) ?>"><small><?php echo get_the_date(get_option( 'date_format' ), $list['id']) . ' ' . get_the_time(get_option( 'time_format' ), $list['id']) ?></small></td><?php endif; ?> |
| @@ -1647,13 +1902,13 @@ | ||
| 1647 | 1902 | $list = array('id'=>$list_obj->ID, 'content'=>$list_obj->post_content, 'title'=>$list_obj->post_title, 'type'=>$list_obj->post_type, 'guid'=>$list_obj->guid); |
| 1648 | 1903 | $is_shortcut = ($list['type']==$wpdocs_post_types['shortcut']); |
| 1649 | 1904 | |
| 1650 | 1905 | ?> |
| 1651 | - <tr title="<?php echo $list['id']; ?>" class="file_wrapper file_view is_dir is_deep" style="cursor: pointer;" data-id="<?php echo $list['id']; ?>" data-resource="<?php echo base64_encode($list['id']); ?>" data-linked="<?php echo $list['content']; ?>" data-guid="<?php echo $is_shortcut?$list['guid']:''; ?>"> | |
| 1906 | + <tr title="<?php echo esc_attr($list['id']); ?>" class="file_wrapper file_view is_dir is_deep" style="cursor: pointer;" data-id="<?php echo esc_attr($list['id']); ?>" data-resource="<?php echo esc_attr(base64_encode($list['id'])); ?>" data-linked="<?php echo esc_attr($list['content']); ?>" data-guid="<?php echo $is_shortcut?esc_attr($list['guid']):''; ?>"> | |
| 1652 | 1907 | <td> |
| 1653 | 1908 | <figure class="figure "> |
| 1654 | 1909 | <span class="fa fa-folder text-warning" style="font-size:25px"></span> |
| 1655 | - <small class="text-center mb-1"><?php echo $list['title']; ?></small> | |
| 1910 | + <small class="text-center mb-1"><?php echo esc_html($list['title']); ?></small> | |
| 1656 | 1911 | </figure> |
| 1657 | 1912 | </td> |
| 1658 | 1913 | |
| 1659 | 1914 | <?php if($details_date_created): ?> <td data-time="<?php get_post_time('U', false, $list['id']) ?>"><small><?php echo get_the_date(get_option( 'date_format' ), $list['id']) . ' ' . get_the_time(get_option( 'time_format' ), $list['id']) ?></small></td><?php endif; ?> |
| @@ -1693,11 +1948,11 @@ | ||
| 1693 | 1948 | extract($file_data); |
| 1694 | 1949 | //pree($ts); |
| 1695 | 1950 | |
| 1696 | 1951 | if(trim($icon_url)){ |
| 1697 | - | |
| 1952 | + $secured_file_url = wpdocs_secure_url($file_id); | |
| 1698 | 1953 | $files_list_row = ' |
| 1699 | - <tr title="'.esc_attr($filename).'" data-url="'.$file_url.'" class="file_view file_link is_file" style="cursor: pointer;" data-id="'.$file.'"> | |
| 1954 | + <tr title="'.esc_attr($filename).'" data-url="'.$secured_file_url.'" class="file_view file_link is_file" style="cursor: pointer;" data-id="'.$file.'"> | |
| 1700 | 1955 | |
| 1701 | 1956 | <td> |
| 1702 | 1957 | |
| 1703 | 1958 | <figure class="figure file_view"> |
| @@ -1750,11 +2005,13 @@ | ||
| 1750 | 2005 | extract($file_data); |
| 1751 | 2006 | //pree($ts); |
| 1752 | 2007 | |
| 1753 | 2008 | if(trim($icon_url)){ |
| 2009 | + | |
| 2010 | + $secured_file_url = wpdocs_secure_url($file_id); | |
| 1754 | 2011 | |
| 1755 | 2012 | $files_list_row = ' |
| 1756 | - <tr title="'.esc_attr($filename).'" data-url="'.$file_url.'" class="file_view file_link is_file is_deep" style="cursor: pointer;" data-id="'.$file.'"> | |
| 2013 | + <tr title="'.esc_attr($filename).'" data-url="'.$secured_file_url.'" class="file_view file_link is_file is_deep" style="cursor: pointer;" data-id="'.$file.'"> | |
| 1757 | 2014 | |
| 1758 | 2015 | <td> |
| 1759 | 2016 | |
| 1760 | 2017 | <figure class="figure file_view"> |
| @@ -1820,9 +2077,9 @@ | ||
| 1820 | 2077 | </div> |
| 1821 | 2078 | <?php if($is_bootstrap): ?> |
| 1822 | 2079 | <div class="wpdocs_loader wpd_modal d-none"> |
| 1823 | 2080 | <div class="modal_content"> |
| 1824 | - <img src="<?php echo $wpdocs_url.'img/loader.gif' ?>" width="50px" height="50px"> | |
| 2081 | + <img src="<?php echo esc_url($wpdocs_url.'img/loader.gif'); ?>" width="50px" height="50px"> | |
| 1825 | 2082 | </div> |
| 1826 | 2083 | </div> |
| 1827 | 2084 | <?php endif; ?> |
| 1828 | 2085 | |
| @@ -1935,56 +2192,137 @@ | ||
| 1935 | 2192 | |
| 1936 | 2193 | |
| 1937 | 2194 | |
| 1938 | 2195 | add_action('wp_ajax_wpdocs_update_folder', 'wpdocs_update_folder'); |
| 1939 | - function wpdocs_update_folder() | |
| 1940 | - { | |
| 2196 | + | |
| 2197 | + function wpdocs_update_folder() { | |
| 2198 | + | |
| 2199 | + if ( ! current_user_can( 'manage_options' ) ) { | |
| 2200 | + wp_send_json_error( array( 'msg' => __( 'Unauthorized access.', 'wp-docs' ) ), 403 ); | |
| 2201 | + } | |
| 2202 | + | |
| 2203 | + if ( | |
| 2204 | + empty( $_POST['nonce'] ) || | |
| 2205 | + ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) | |
| 2206 | + ) { | |
| 2207 | + wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 2208 | + } | |
| 2209 | + | |
| 2210 | + $dir_id = absint( $_POST['dir_id'] ?? 0 ); | |
| 2211 | + $resource_id = base64_decode( sanitize_text_field( $_POST['resource_id'] ?? '' ) ); | |
| 2212 | + $new_name = sanitize_text_field( $_POST['new_name'] ?? '' ); | |
| 2213 | + | |
| 2214 | + if ( ! $dir_id || $resource_id != $dir_id || ! wpdocs_folder_exists( $dir_id ) ) { | |
| 2215 | + wp_send_json_error( array( 'msg' => __( 'Invalid folder ID or resource mismatch.', 'wp-docs' ) ), 400 ); | |
| 2216 | + } | |
| 2217 | + | |
| 2218 | + global $wpdb, $wpdocs_post_types, $wpdocs_post_status; | |
| 2219 | + | |
| 2220 | + $updated = $wpdb->query( | |
| 2221 | + $wpdb->prepare( | |
| 2222 | + "UPDATE $wpdb->posts | |
| 2223 | + SET post_title = %s | |
| 2224 | + WHERE ID = %d | |
| 2225 | + AND post_type IN ('" . implode( "','", array_map( 'esc_sql', $wpdocs_post_types ) ) . "') | |
| 2226 | + AND post_status = %s", | |
| 2227 | + htmlspecialchars_decode( $new_name ), | |
| 2228 | + $dir_id, | |
| 2229 | + $wpdocs_post_status | |
| 2230 | + ) | |
| 2231 | + ); | |
| 2232 | + | |
| 2233 | + wp_send_json_success( | |
| 2234 | + array( | |
| 2235 | + 'msg' => $updated | |
| 2236 | + ? __( 'Successfully updated.', 'wp-docs' ) | |
| 2237 | + : __( 'No changes were made. Input seems the same as before.', 'wp-docs' ), | |
| 2238 | + ) | |
| 2239 | + ); | |
| 2240 | + } | |
| 1941 | 2241 | |
| 1942 | - $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce'])); | |
| 2242 | + /*function wpdocs_update_folder() { | |
| 2243 | + | |
| 1943 | 2244 | |
| 1944 | - if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) ) | |
| 1945 | - die (__("Sorry, your nonce did not verify.", 'wp-docs')); | |
| 1946 | - | |
| 1947 | - $dir_id = sanitize_wpdocs_data($_POST['dir_id']); | |
| 1948 | - $dir_id_compare = base64_decode(sanitize_wpdocs_data($_POST['resource_id'])); | |
| 1949 | - //pree($dir_id_compare.'=='.$dir_id.' - '.wpdocs_folder_exists($dir_id));exit; | |
| 2245 | + if ( ! current_user_can('edit_posts') ) { | |
| 2246 | + wp_send_json_error(['msg' => __('Unauthorized access.', 'wp-docs')]); | |
| 2247 | + } | |
| 2248 | + | |
| 2249 | + | |
| 2250 | + if ( | |
| 2251 | + empty($_POST['nonce']) || | |
| 2252 | + ! wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'wpdocs_update_options_nonce') | |
| 2253 | + ) { | |
| 2254 | + wp_send_json_error(['msg' => __('Sorry, your nonce did not verify.', 'wp-docs')]); | |
| 2255 | + } | |
| 2256 | + | |
| 1950 | 2257 | |
| 1951 | - $ret = array('msg'=>''); | |
| 1952 | - | |
| 1953 | - if ($dir_id>0 && $dir_id_compare==$dir_id && wpdocs_folder_exists($dir_id)) { | |
| 1954 | - | |
| 2258 | + $dir_id = absint($_POST['dir_id'] ?? 0); | |
| 2259 | + $resource_id = base64_decode(sanitize_text_field($_POST['resource_id'] ?? '')); | |
| 2260 | + $new_name = sanitize_text_field($_POST['new_name'] ?? ''); | |
| 2261 | + | |
| 2262 | + $ret = ['msg' => '']; | |
| 2263 | + | |
| 2264 | + if ( $dir_id > 0 && $resource_id == $dir_id && wpdocs_folder_exists($dir_id) ) { | |
| 2265 | + | |
| 1955 | 2266 | global $wpdb, $wpdocs_post_types, $wpdocs_post_status; |
| 1956 | - | |
| 1957 | - $my_post = array( | |
| 1958 | - 'post_title' => htmlspecialchars_decode(sanitize_wpdocs_data($_POST['new_name'])), | |
| 1959 | - 'ID' => $dir_id, | |
| 2267 | + | |
| 2268 | + $updated = $wpdb->query( | |
| 2269 | + $wpdb->prepare( | |
| 2270 | + "UPDATE $wpdb->posts | |
| 2271 | + SET post_title = %s | |
| 2272 | + WHERE ID = %d | |
| 2273 | + AND post_type IN ('" . implode("','", array_map('esc_sql', $wpdocs_post_types)) . "') | |
| 2274 | + AND post_status = %s", | |
| 2275 | + htmlspecialchars_decode($new_name), | |
| 2276 | + $dir_id, | |
| 2277 | + $wpdocs_post_status | |
| 2278 | + ) | |
| 1960 | 2279 | ); |
| 1961 | - //pree($my_post);exit; | |
| 1962 | - //wp_update_post($my_post); | |
| 1963 | - $rename_query = $wpdb->prepare("UPDATE $wpdb->posts SET post_title=%s WHERE ID=%d AND post_type IN ('".implode("','", $wpdocs_post_types)."') AND post_status=%s", | |
| 1964 | - $my_post['post_title'], | |
| 1965 | - $dir_id, | |
| 1966 | - $wpdocs_post_status | |
| 1967 | - ); | |
| 1968 | - //pree($rename_query);exit; | |
| 1969 | - $updated = $wpdb->query($rename_query); | |
| 1970 | - | |
| 1971 | - | |
| 1972 | - if($updated){ | |
| 1973 | - $ret['msg'] = __("Successfully updated.", 'wp-docs'); | |
| 1974 | - }else{ | |
| 1975 | - $ret['msg'] = __("No changes are made, input seems the same as before.", 'wp-docs'); | |
| 2280 | + | |
| 2281 | + if ( $updated ) { | |
| 2282 | + $ret['msg'] = __('Successfully updated.', 'wp-docs'); | |
| 2283 | + } else { | |
| 2284 | + $ret['msg'] = __('No changes were made. Input seems the same as before.', 'wp-docs'); | |
| 1976 | 2285 | } |
| 2286 | + } else { | |
| 2287 | + $ret['msg'] = __('Invalid folder ID or resource mismatch.', 'wp-docs'); | |
| 1977 | 2288 | } |
| 2289 | + | |
| 2290 | + wp_send_json_success($ret); | |
| 2291 | + }*/ | |
| 1978 | 2292 | |
| 1979 | - echo wp_json_encode($ret); | |
| 1980 | - exit; | |
| 1981 | - } | |
| 1982 | 2293 | |
| 1983 | 2294 | add_action('wp_ajax_wpdocs_delete_folder', 'wpdocs_delete_folder'); |
| 1984 | 2295 | |
| 1985 | - function wpdocs_delete_folder() | |
| 2296 | + function wpdocs_delete_folder() { | |
| 2297 | + | |
| 2298 | + if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) { | |
| 2299 | + wp_send_json_error( array( 'msg' => __( 'Unauthorized user', 'wp-docs' ) ), 403 ); | |
| 2300 | + } | |
| 2301 | + | |
| 2302 | + if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) { | |
| 2303 | + wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 2304 | + } | |
| 2305 | + | |
| 2306 | + $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0; | |
| 2307 | + $resource_id = base64_decode( sanitize_wpdocs_data( $_POST['resource_id'] ?? '' ) ); | |
| 2308 | + | |
| 2309 | + if ( ! $dir_id || $dir_id != $resource_id || ! wpdocs_folder_exists( $dir_id ) ) { | |
| 2310 | + wp_send_json_error( array( 'msg' => __( 'Invalid folder.', 'wp-docs' ) ), 400 ); | |
| 2311 | + } | |
| 2312 | + | |
| 2313 | + wpdocs_recursive_delete_folder( $dir_id ); | |
| 2314 | + | |
| 2315 | + wp_send_json_success(); | |
| 2316 | + } | |
| 2317 | + /*function wpdocs_delete_folder() | |
| 1986 | 2318 | { |
| 2319 | + | |
| 2320 | + if ( ! current_user_can( 'manage_options' ) ) { | |
| 2321 | + wp_send_json_error( __( 'Unauthorized user', 'wp-docs' ) ); | |
| 2322 | + wp_die(); | |
| 2323 | + } | |
| 2324 | + | |
| 1987 | 2325 | $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce'])); |
| 1988 | 2326 | |
| 1989 | 2327 | if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) ) |
| 1990 | 2328 | die (__("Sorry, your nonce did not verify.", 'wp-docs')); |
| @@ -1996,9 +2334,9 @@ | ||
| 1996 | 2334 | wpdocs_recursive_delete_folder($dir_id); |
| 1997 | 2335 | } |
| 1998 | 2336 | |
| 1999 | 2337 | exit; |
| 2000 | - } | |
| 2338 | + } */ | |
| 2001 | 2339 | |
| 2002 | 2340 | |
| 2003 | 2341 | |
| 2004 | 2342 | add_action('wp_ajax_wpdocs_delete_files', 'wpdocs_delete_files'); |
| @@ -2078,11 +2416,59 @@ | ||
| 2078 | 2416 | return update_post_meta($dir_id, 'wpdocs_items', $wpdocs_items); |
| 2079 | 2417 | } |
| 2080 | 2418 | } |
| 2081 | 2419 | } |
| 2420 | + | |
| 2421 | + function wpdocs_delete_files() { | |
| 2422 | + if ( ! is_user_logged_in() || ! current_user_can( 'delete_posts' ) ) { | |
| 2423 | + wp_send_json_error( array( 'message' => __( 'Insufficient permissions.', 'wp-docs' ) ), 403 ); | |
| 2424 | + } | |
| 2425 | + | |
| 2426 | + if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) { | |
| 2427 | + wp_send_json_error( array( 'message' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 2428 | + } | |
| 2429 | + | |
| 2430 | + $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0; | |
| 2431 | + $files = isset( $_POST['files'] ) ? (array) $_POST['files'] : array(); | |
| 2432 | + $files = array_values( array_unique( array_filter( array_map( 'absint', $files ) ) ) ); | |
| 2433 | + | |
| 2434 | + if ( ! $dir_id || ! wpdocs_folder_exists( $dir_id ) || empty( $files ) ) { | |
| 2435 | + wp_send_json_error( array( 'message' => __( 'Invalid request.', 'wp-docs' ) ), 400 ); | |
| 2436 | + } | |
| 2437 | + | |
| 2438 | + $is_admin = current_user_can( 'manage_options' ); | |
| 2439 | + $is_owner = wpdocs_user_can_edit_folder( $dir_id ); | |
| 2440 | + | |
| 2441 | + if ( ! $is_admin && ! $is_owner ) { | |
| 2442 | + wp_send_json_error( array( 'message' => __( 'You cannot delete files from this folder.', 'wp-docs' ) ), 403 ); | |
| 2443 | + } | |
| 2444 | + | |
| 2445 | + $allowed = array(); | |
| 2446 | + foreach ( $files as $file_id ) { | |
| 2447 | + $attachment = get_post( $file_id ); | |
| 2448 | + if ( ! $attachment || 'attachment' !== $attachment->post_type ) { | |
| 2449 | + continue; | |
| 2450 | + } | |
| 2451 | + if ( $is_admin || current_user_can( 'edit_post', $file_id ) ) { | |
| 2452 | + $allowed[] = $file_id; | |
| 2453 | + } | |
| 2454 | + } | |
| 2455 | + | |
| 2456 | + if ( empty( $allowed ) ) { | |
| 2457 | + wp_send_json_error( array( 'message' => __( 'None of the specified files can be deleted by you.', 'wp-docs' ) ), 403 ); | |
| 2458 | + } | |
| 2459 | + | |
| 2460 | + wpdocs_del_items_by_user( $dir_id, $allowed, get_current_user_id() ); | |
| 2461 | + | |
| 2462 | + $wpdocs_items = wpdocs_added_items( $dir_id ); | |
| 2463 | + $wpdocs_items = array_values( array_unique( array_diff( (array) $wpdocs_items, $allowed ) ) ); | |
| 2464 | + | |
| 2465 | + update_post_meta( $dir_id, 'wpdocs_items', $wpdocs_items ); | |
| 2466 | + | |
| 2467 | + wp_send_json_success( array( 'dir_id' => $dir_id, 'files' => $allowed ) ); | |
| 2468 | + } | |
| 2082 | 2469 | |
| 2083 | - | |
| 2084 | - | |
| 2470 | + /* | |
| 2085 | 2471 | function wpdocs_delete_files() |
| 2086 | 2472 | { |
| 2087 | 2473 | |
| 2088 | 2474 | $dir_id = sanitize_wpdocs_data($_POST['dir_id']); |
| @@ -2106,9 +2492,9 @@ | ||
| 2106 | 2492 | } |
| 2107 | 2493 | |
| 2108 | 2494 | |
| 2109 | 2495 | exit; |
| 2110 | - } | |
| 2496 | + } */ | |
| 2111 | 2497 | |
| 2112 | 2498 | function wpd_admin_footer(){ |
| 2113 | 2499 | |
| 2114 | 2500 | ?> |
| @@ -2124,152 +2510,157 @@ | ||
| 2124 | 2510 | add_action('wp_ajax_wpdocs_update_option', 'wpdocs_update_option'); |
| 2125 | 2511 | |
| 2126 | 2512 | if(!function_exists('wpdocs_update_option')){ |
| 2127 | 2513 | function wpdocs_update_option(){ |
| 2514 | + | |
| 2515 | + if ( ! current_user_can('manage_options') ) { | |
| 2516 | + wp_send_json_error('Insufficient permissions.'); | |
| 2517 | + } | |
| 2128 | 2518 | |
| 2519 | + if ( | |
| 2520 | + ! isset($_POST['wpdocs_update_option_nonce']) || | |
| 2521 | + ! wp_verify_nonce($_POST['wpdocs_update_option_nonce'], 'wpdocs_update_options_nonce') | |
| 2522 | + ) { | |
| 2523 | + wp_send_json_error('Invalid nonce '.$_POST['wpdocs_update_option_nonce']); | |
| 2524 | + } else { | |
| 2525 | + //wp_send_json_success('Nonce valid!'); | |
| 2526 | + } | |
| 2129 | 2527 | |
| 2528 | + $return = array( | |
| 2130 | 2529 | |
| 2131 | - if(isset($_POST['wpdocs_update_option_nonce'])){ | |
| 2530 | + 'option_update' => false, | |
| 2531 | + 'dir_move' => false, | |
| 2532 | + ); | |
| 2132 | 2533 | |
| 2133 | - $nonce = sanitize_wpdocs_data(wp_unslash($_POST['wpdocs_update_option_nonce'])); | |
| 2534 | + | |
| 2134 | 2535 | |
| 2135 | - $return = array( | |
| 2536 | + if(isset($_POST['wpdocs_options'])){ | |
| 2136 | 2537 | |
| 2137 | - 'option_update' => false, | |
| 2138 | - 'dir_move' => false, | |
| 2139 | - ); | |
| 2538 | + $wpdocs_options = isset($_POST['wpdocs_options']) ? sanitize_wpdocs_data($_POST['wpdocs_options']) : array(); | |
| 2140 | 2539 | |
| 2141 | - if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) ) | |
| 2142 | - die (__("Sorry, your nonce did not verify.", 'wp-docs')); | |
| 2540 | + $wpdocs_dir_id = isset($_POST['wpdocs_dir_id']) ? sanitize_wpdocs_data($_POST['wpdocs_dir_id']) : 0; | |
| 2143 | 2541 | |
| 2144 | - if(isset($_POST['wpdocs_options'])){ | |
| 2145 | 2542 | |
| 2146 | - $wpdocs_options = isset($_POST['wpdocs_options']) ? sanitize_wpdocs_data($_POST['wpdocs_options']) : array(); | |
| 2543 | + $sanitized_option = sanitize_wpdocs_data($wpdocs_options); | |
| 2544 | + $sanitized_option['allowed_role'] = $sanitized_option['allowed_role'] !== 'empty' ? $sanitized_option['allowed_role'] : array(); | |
| 2147 | 2545 | |
| 2148 | - $wpdocs_dir_id = isset($_POST['wpdocs_dir_id']) ? sanitize_wpdocs_data($_POST['wpdocs_dir_id']) : 0; | |
| 2149 | 2546 | |
| 2547 | + if($wpdocs_dir_id == 0){ | |
| 2150 | 2548 | |
| 2151 | - $sanitized_option = sanitize_wpdocs_data($wpdocs_options); | |
| 2152 | - $sanitized_option['allowed_role'] = $sanitized_option['allowed_role'] !== 'empty' ? $sanitized_option['allowed_role'] : array(); | |
| 2549 | + $update = update_option('wpdocs_options', $sanitized_option); | |
| 2153 | 2550 | |
| 2551 | + }else{ | |
| 2154 | 2552 | |
| 2155 | - if($wpdocs_dir_id == 0){ | |
| 2553 | + $update = update_post_meta($wpdocs_dir_id, '_wpdocs_dir_options', $sanitized_option); | |
| 2554 | + $child_dir_list = wpdoc_get_dir_children($wpdocs_dir_id); | |
| 2555 | + if(!empty($child_dir_list)){ | |
| 2556 | + foreach ($child_dir_list as $child_dir) { | |
| 2156 | 2557 | |
| 2157 | - $update = update_option('wpdocs_options', $sanitized_option); | |
| 2558 | + $update = update_post_meta($child_dir, '_wpdocs_dir_options', $sanitized_option); | |
| 2158 | 2559 | |
| 2159 | - }else{ | |
| 2160 | - | |
| 2161 | - $update = update_post_meta($wpdocs_dir_id, '_wpdocs_dir_options', $sanitized_option); | |
| 2162 | - $child_dir_list = wpdoc_get_dir_children($wpdocs_dir_id); | |
| 2163 | - if(!empty($child_dir_list)){ | |
| 2164 | - foreach ($child_dir_list as $child_dir) { | |
| 2165 | - | |
| 2166 | - $update = update_post_meta($child_dir, '_wpdocs_dir_options', $sanitized_option); | |
| 2167 | - | |
| 2168 | - # code... | |
| 2169 | - } | |
| 2560 | + # code... | |
| 2170 | 2561 | } |
| 2562 | + } | |
| 2171 | 2563 | |
| 2172 | - | |
| 2564 | + | |
| 2173 | 2565 | |
| 2174 | - } | |
| 2175 | - } | |
| 2566 | + } | |
| 2567 | + } | |
| 2176 | 2568 | |
| 2177 | 2569 | |
| 2178 | 2570 | |
| 2179 | - if(isset($_POST['wpdocs_move_selected_dir'])){ | |
| 2571 | + if(isset($_POST['wpdocs_move_selected_dir'])){ | |
| 2180 | 2572 | |
| 2181 | - $wpdocs_move_selected_dir = sanitize_wpdocs_data($_POST['wpdocs_move_selected_dir']); | |
| 2182 | - $action_type = $wpdocs_move_selected_dir['action_type']; | |
| 2183 | - | |
| 2573 | + $wpdocs_move_selected_dir = sanitize_wpdocs_data($_POST['wpdocs_move_selected_dir']); | |
| 2574 | + $action_type = $wpdocs_move_selected_dir['action_type']; | |
| 2575 | + | |
| 2184 | 2576 | |
| 2185 | - $is_file = array_key_exists('is_file', $wpdocs_move_selected_dir) ? $wpdocs_move_selected_dir['is_file']: false; | |
| 2186 | - $is_file = $is_file == 'false' ? false: true; | |
| 2577 | + $is_file = array_key_exists('is_file', $wpdocs_move_selected_dir) ? $wpdocs_move_selected_dir['is_file']: false; | |
| 2578 | + $is_file = $is_file == 'false' ? false: true; | |
| 2187 | 2579 | |
| 2188 | 2580 | |
| 2189 | - if(!$is_file && array_key_exists('dir_selected', $wpdocs_move_selected_dir) && | |
| 2190 | - array_key_exists('dir_id', $wpdocs_move_selected_dir)){ | |
| 2581 | + if(!$is_file && array_key_exists('dir_selected', $wpdocs_move_selected_dir) && | |
| 2582 | + array_key_exists('dir_id', $wpdocs_move_selected_dir)){ | |
| 2583 | + | |
| 2584 | + switch($action_type){ | |
| 2585 | + default: | |
| 2586 | + case 'move': | |
| 2587 | + | |
| 2588 | + | |
| 2589 | + $update = wp_update_post( | |
| 2590 | + array( | |
| 2591 | + 'ID' => $wpdocs_move_selected_dir['dir_selected'], | |
| 2592 | + 'post_parent' => $wpdocs_move_selected_dir['dir_id'] | |
| 2593 | + ) | |
| 2594 | + ); | |
| 2191 | 2595 | |
| 2192 | - switch($action_type){ | |
| 2193 | - default: | |
| 2194 | - case 'move': | |
| 2596 | + if($update == $wpdocs_move_selected_dir['dir_selected']){ | |
| 2597 | + $return['dir_move'] = true; | |
| 2598 | + } | |
| 2195 | 2599 | |
| 2196 | - | |
| 2197 | - $update = wp_update_post( | |
| 2198 | - array( | |
| 2199 | - 'ID' => $wpdocs_move_selected_dir['dir_selected'], | |
| 2200 | - 'post_parent' => $wpdocs_move_selected_dir['dir_id'] | |
| 2201 | - ) | |
| 2202 | - ); | |
| 2600 | + break; | |
| 2601 | + | |
| 2602 | + case 'copy': | |
| 2603 | + $existing_dir = get_post($wpdocs_move_selected_dir['dir_selected']); | |
| 2604 | + $existing_dir = (is_object($existing_dir)?(array)$existing_dir:array()); | |
| 2605 | + if(!empty($existing_dir) && array_key_exists('ID', $existing_dir) && function_exists('wpdocs_recursive_copy_folder')){ | |
| 2203 | 2606 | |
| 2204 | - if($update == $wpdocs_move_selected_dir['dir_selected']){ | |
| 2205 | - $return['dir_move'] = true; | |
| 2206 | - } | |
| 2607 | + wpdocs_recursive_copy_folder($wpdocs_move_selected_dir['dir_id'], $existing_dir); | |
| 2207 | 2608 | |
| 2208 | - break; | |
| 2609 | + $return['dir_move'] = true; | |
| 2610 | + | |
| 2611 | + } | |
| 2209 | 2612 | |
| 2210 | - case 'copy': | |
| 2211 | - $existing_dir = get_post($wpdocs_move_selected_dir['dir_selected']); | |
| 2212 | - $existing_dir = (is_object($existing_dir)?(array)$existing_dir:array()); | |
| 2213 | - if(!empty($existing_dir) && array_key_exists('ID', $existing_dir) && function_exists('wpdocs_recursive_copy_folder')){ | |
| 2214 | - | |
| 2215 | - wpdocs_recursive_copy_folder($wpdocs_move_selected_dir['dir_id'], $existing_dir); | |
| 2216 | - | |
| 2217 | - $return['dir_move'] = true; | |
| 2218 | - | |
| 2219 | - } | |
| 2220 | - | |
| 2221 | - | |
| 2222 | - break; | |
| 2223 | - } | |
| 2224 | - | |
| 2225 | - | |
| 2226 | - | |
| 2227 | - } | |
| 2228 | - //exit; | |
| 2613 | + | |
| 2614 | + break; | |
| 2615 | + } | |
| 2616 | + | |
| 2617 | + | |
| 2618 | + | |
| 2619 | + } | |
| 2620 | + //exit; | |
| 2229 | 2621 | |
| 2230 | - if($is_file){ | |
| 2622 | + if($is_file){ | |
| 2231 | 2623 | |
| 2232 | - $file_id = $wpdocs_move_selected_dir['files']; | |
| 2233 | - | |
| 2234 | - $current_dir = $wpdocs_move_selected_dir['file_dir']; | |
| 2624 | + $file_id = $wpdocs_move_selected_dir['files']; | |
| 2625 | + | |
| 2626 | + $current_dir = $wpdocs_move_selected_dir['file_dir']; | |
| 2627 | + | |
| 2628 | + $new_dir = $wpdocs_move_selected_dir['dir_id']; | |
| 2629 | + | |
| 2630 | + $files = wpdocs_added_items($current_dir); | |
| 2631 | + | |
| 2632 | + $file_id = is_array($file_id) ? $file_id : array($file_id); | |
| 2633 | + $files = array_diff($files, $file_id); | |
| 2634 | + | |
| 2635 | + | |
| 2636 | + switch($action_type){ | |
| 2637 | + default: | |
| 2638 | + case 'move': | |
| 2639 | + | |
| 2640 | + update_post_meta($current_dir, 'wpdocs_items', $files); | |
| 2641 | + | |
| 2642 | + break; | |
| 2235 | 2643 | |
| 2236 | - $new_dir = $wpdocs_move_selected_dir['dir_id']; | |
| 2237 | - | |
| 2238 | - $files = wpdocs_added_items($current_dir); | |
| 2239 | - | |
| 2240 | - $file_id = is_array($file_id) ? $file_id : array($file_id); | |
| 2241 | - $files = array_diff($files, $file_id); | |
| 2242 | - | |
| 2243 | - | |
| 2244 | - switch($action_type){ | |
| 2245 | - default: | |
| 2246 | - case 'move': | |
| 2247 | - | |
| 2248 | - update_post_meta($current_dir, 'wpdocs_items', $files); | |
| 2249 | - | |
| 2250 | - break; | |
| 2644 | + case 'copy': | |
| 2251 | 2645 | |
| 2252 | - case 'copy': | |
| 2253 | - | |
| 2254 | - break; | |
| 2255 | - | |
| 2256 | - } | |
| 2646 | + break; | |
| 2647 | + | |
| 2648 | + } | |
| 2257 | 2649 | |
| 2258 | - $update = wpdocs_update_files_meta($new_dir, $file_id); | |
| 2259 | - | |
| 2260 | - if($update === true){ | |
| 2261 | - $return['dir_move'] = true; | |
| 2262 | - } | |
| 2650 | + $update = wpdocs_update_files_meta($new_dir, $file_id); | |
| 2651 | + | |
| 2652 | + if($update === true){ | |
| 2653 | + $return['dir_move'] = true; | |
| 2654 | + } | |
| 2263 | 2655 | |
| 2264 | - } | |
| 2265 | - } | |
| 2656 | + } | |
| 2657 | + } | |
| 2266 | 2658 | |
| 2267 | - echo wp_json_encode($return); | |
| 2659 | + echo wp_json_encode($return); | |
| 2268 | 2660 | |
| 2269 | - } | |
| 2270 | 2661 | |
| 2271 | - wp_die(); | |
| 2662 | + wp_die(); | |
| 2272 | 2663 | |
| 2273 | 2664 | } |
| 2274 | 2665 | } |
| 2275 | 2666 | |
| @@ -2326,9 +2717,9 @@ | ||
| 2326 | 2717 | |
| 2327 | 2718 | if(!array_key_exists('id', $wp_dir)) continue; |
| 2328 | 2719 | $wpdocs_list_child = wpdocs_list($wp_dir['id']); |
| 2329 | 2720 | |
| 2330 | - $option .= '<option value="'.$wp_dir['id'].'" data-parent="'.$dir.'">'.str_repeat(str_replace(' ', ' ', $str), $level).$wp_dir['title'].'</option>'; | |
| 2721 | + $option .= '<option value="'.esc_attr($wp_dir['id']).'" data-parent="'.esc_attr($dir).'">'.str_repeat(str_replace(' ', ' ', $str), $level).esc_html($wp_dir['title']).'</option>'; | |
| 2331 | 2722 | |
| 2332 | 2723 | |
| 2333 | 2724 | if(!empty($wpdocs_list_child)){ |
| 2334 | 2725 | |
| @@ -2362,9 +2753,9 @@ | ||
| 2362 | 2753 | |
| 2363 | 2754 | <nav aria-label="breadcrumb" class="wpdocs-nav"> |
| 2364 | 2755 | <ol class="breadcrumb bg-light" style="border-bottom:1px solid #dee2e6;border-radius: 0;"> |
| 2365 | 2756 | |
| 2366 | - <li class="breadcrumb-item bread_home_url"><a class="wpd_bread_item" href="<?php echo $get_permalink ?>" data-id="0"><?php _e('Home', 'wp-docs'); ?></a></li> | |
| 2757 | + <li class="breadcrumb-item bread_home_url"><a class="wpd_bread_item" href="<?php echo esc_url($get_permalink); ?>" data-id="0"><?php _e('Home', 'wp-docs'); ?></a></li> | |
| 2367 | 2758 | <?php |
| 2368 | 2759 | |
| 2369 | 2760 | foreach (array_reverse($breadcrumb_array) as $bread_key => $bread_value) { |
| 2370 | 2761 | $active = ''; |
| @@ -2381,9 +2772,9 @@ | ||
| 2381 | 2772 | } |
| 2382 | 2773 | |
| 2383 | 2774 | |
| 2384 | 2775 | ?> |
| 2385 | - <li class="breadcrumb-item <?php echo $active ?>" aria-current="<?php echo $page; ?>"><?php echo $link ?></li> | |
| 2776 | + <li class="breadcrumb-item <?php echo esc_attr($active); ?>" aria-current="<?php echo esc_attr($page); ?>"><?php echo ($link); ?></li> | |
| 2386 | 2777 | |
| 2387 | 2778 | <?php |
| 2388 | 2779 | } |
| 2389 | 2780 | |
| @@ -2399,11 +2790,46 @@ | ||
| 2399 | 2790 | } |
| 2400 | 2791 | } |
| 2401 | 2792 | |
| 2402 | 2793 | add_action('wp_ajax_wpdocs_update_view', 'wpdocs_update_view'); |
| 2403 | - add_action('wp_ajax_nopriv_wpdocs_update_view', 'wpdocs_update_view'); | |
| 2404 | - | |
| 2405 | - if(!function_exists('wpdocs_update_view')){ | |
| 2794 | + | |
| 2795 | + | |
| 2796 | + if ( ! function_exists( 'wpdocs_update_view' ) ) { | |
| 2797 | + function wpdocs_update_view() { | |
| 2798 | + | |
| 2799 | + if ( ! is_user_logged_in() || ! current_user_can( 'read' ) ) { | |
| 2800 | + wp_send_json_error( array( 'msg' => __( 'Unauthorized access.', 'wp-docs' ) ), 403 ); | |
| 2801 | + } | |
| 2802 | + | |
| 2803 | + if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) { | |
| 2804 | + wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 2805 | + } | |
| 2806 | + | |
| 2807 | + $uid = get_current_user_id(); | |
| 2808 | + $key = 'wpdocs_view_rl_' . $uid; | |
| 2809 | + $hits = (int) get_transient( $key ); | |
| 2810 | + | |
| 2811 | + if ( $hits >= 60 ) { | |
| 2812 | + wp_send_json_error( array( 'msg' => __( 'Too many requests.', 'wp-docs' ) ), 429 ); | |
| 2813 | + } | |
| 2814 | + set_transient( $key, $hits + 1, MINUTE_IN_SECONDS ); | |
| 2815 | + | |
| 2816 | + if ( isset( $_POST['update_view'] ) ) { | |
| 2817 | + | |
| 2818 | + $wpdocs_view = get_option( 'wpdocs_view', array() ); | |
| 2819 | + $wpdocs_view = is_array( $wpdocs_view ) ? $wpdocs_view : array(); | |
| 2820 | + | |
| 2821 | + $parent_dir = sanitize_wpdocs_data( $_POST['parent_dir'] ?? '' ); | |
| 2822 | + $view_val = sanitize_wpdocs_data( $_POST['update_view'] ); | |
| 2823 | + | |
| 2824 | + $wpdocs_view[ $parent_dir ] = $view_val; | |
| 2825 | + update_option( 'wpdocs_view', $wpdocs_view ); | |
| 2826 | + } | |
| 2827 | + | |
| 2828 | + wp_send_json_success(); | |
| 2829 | + } | |
| 2830 | + } | |
| 2831 | + /*if(!function_exists('wpdocs_update_view')){ | |
| 2406 | 2832 | function wpdocs_update_view(){ |
| 2407 | 2833 | |
| 2408 | 2834 | $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce'])); |
| 2409 | 2835 | |
| @@ -2421,9 +2847,9 @@ | ||
| 2421 | 2847 | |
| 2422 | 2848 | } |
| 2423 | 2849 | exit; |
| 2424 | 2850 | } |
| 2425 | - } | |
| 2851 | + }*/ | |
| 2426 | 2852 | function wpdocs_init_session() { |
| 2427 | 2853 | if(!session_id()) { |
| 2428 | 2854 | session_start(); |
| 2429 | 2855 | } |
| @@ -2619,13 +3045,91 @@ | ||
| 2619 | 3045 | return $ret; |
| 2620 | 3046 | |
| 2621 | 3047 | } |
| 2622 | 3048 | } |
| 3049 | + if(!function_exists('wpdocs_file_download')){ | |
| 3050 | + function wpdocs_file_download(){ | |
| 3051 | + | |
| 3052 | + if(empty($_GET['wpdocs_dl'])){ | |
| 3053 | + return; | |
| 3054 | + } | |
| 3055 | + | |
| 3056 | + $file_id = absint( | |
| 3057 | + wp_unslash($_GET['wpdocs_dl']) | |
| 3058 | + ); | |
| 3059 | + | |
| 3060 | + if(!$file_id){ | |
| 3061 | + status_header(404); | |
| 3062 | + exit; | |
| 3063 | + } | |
| 3064 | + | |
| 3065 | + $nonce = isset($_GET['wpdocs_nonce']) | |
| 3066 | + ? sanitize_text_field( | |
| 3067 | + wp_unslash($_GET['wpdocs_nonce']) | |
| 3068 | + ) | |
| 3069 | + : ''; | |
| 3070 | + | |
| 3071 | + if( | |
| 3072 | + !wp_verify_nonce( | |
| 3073 | + $nonce, | |
| 3074 | + 'wpdocs_dl_' . $file_id | |
| 3075 | + ) | |
| 3076 | + ){ | |
| 3077 | + status_header(403); | |
| 3078 | + exit; | |
| 3079 | + } | |
| 3080 | + | |
| 3081 | + // Adjust this according to where you store the file | |
| 3082 | + $file = get_attached_file($file_id); | |
| 3083 | + | |
| 3084 | + if( | |
| 3085 | + !$file || | |
| 3086 | + !file_exists($file) | |
| 3087 | + ){ | |
| 3088 | + status_header(404); | |
| 3089 | + exit; | |
| 3090 | + } | |
| 3091 | + | |
| 3092 | + $uploads = wp_get_upload_dir(); | |
| 3093 | + $base_real = realpath($uploads['basedir']); | |
| 3094 | + $file_real = realpath($file); | |
| 3095 | + | |
| 3096 | + if( | |
| 3097 | + !$base_real || | |
| 3098 | + !$file_real || | |
| 3099 | + strpos( | |
| 3100 | + $file_real, | |
| 3101 | + $base_real . DIRECTORY_SEPARATOR | |
| 3102 | + ) !== 0 | |
| 3103 | + ){ | |
| 3104 | + status_header(403); | |
| 3105 | + exit; | |
| 3106 | + } | |
| 3107 | + | |
| 3108 | + $mime = wp_check_filetype($file_real); | |
| 3109 | + $mime = !empty($mime['type']) | |
| 3110 | + ? $mime['type'] | |
| 3111 | + : 'application/octet-stream'; | |
| 3112 | + | |
| 3113 | + header('Content-Type: ' . $mime); | |
| 3114 | + header('Content-Length: ' . filesize($file_real)); | |
| 3115 | + header( | |
| 3116 | + 'Content-Disposition: inline; filename="' . | |
| 3117 | + basename($file_real) . | |
| 3118 | + '"' | |
| 3119 | + ); | |
| 3120 | + | |
| 3121 | + readfile($file_real); | |
| 3122 | + exit; | |
| 3123 | + } | |
| 3124 | + } | |
| 2623 | 3125 | |
| 2624 | 3126 | add_action('init', 'wpdocs_dir_actions'); |
| 2625 | 3127 | if(!function_exists('wpdocs_dir_actions')){ |
| 2626 | 3128 | function wpdocs_dir_actions(){ |
| 2627 | 3129 | |
| 3130 | + wpdocs_file_download(); | |
| 3131 | + | |
| 2628 | 3132 | if(is_admin() && get_option('wpdocs_memphis_uninstall')){ |
| 2629 | 3133 | if(wp_docs_memphis_folder_preserve('mdocs_2', 'mdocs')){ |
| 2630 | 3134 | update_option('wpdocs_memphis_uninstall', false); |
| 2631 | 3135 | } |
| @@ -3076,31 +3580,34 @@ | ||
| 3076 | 3580 | |
| 3077 | 3581 | } |
| 3078 | 3582 | } |
| 3079 | 3583 | |
| 3584 | + | |
| 3080 | 3585 | if(!function_exists('wp_docs_relocate_memphis_meta')){ |
| 3081 | 3586 | function wp_docs_relocate_memphis_meta($dir_id){ |
| 3082 | 3587 | global $wpdocs_imported_files, $wpdocs_imported_folder; |
| 3588 | + | |
| 3589 | + // Ensure arrays are initialized properly before using them | |
| 3590 | + $wpdocs_imported_files = (is_array($wpdocs_imported_files) ? $wpdocs_imported_files : array()); | |
| 3591 | + $wpdocs_imported_folder = (is_array($wpdocs_imported_folder) ? $wpdocs_imported_folder : array()); | |
| 3592 | + | |
| 3083 | 3593 | $wpdocs_items = get_post_meta($dir_id, 'wpdocs_items', true); |
| 3084 | 3594 | $wpdocs_items = (is_array($wpdocs_items) ? $wpdocs_items : array()); |
| 3085 | 3595 | $dir_slug = get_post_meta($dir_id, '_wpdocs_memphis_slug', true); |
| 3086 | - | |
| 3087 | - $wpdocs_imported_files = (is_array($wpdocs_imported_files)?$wpdocs_imported_files:array()); | |
| 3088 | - | |
| 3596 | + | |
| 3089 | 3597 | if(!empty($wpdocs_items)){ |
| 3090 | - | |
| 3091 | 3598 | $wpdocs_imported_files = array_diff($wpdocs_imported_files, $wpdocs_items); |
| 3092 | 3599 | } |
| 3093 | - | |
| 3600 | + | |
| 3094 | 3601 | if($dir_slug){ |
| 3095 | 3602 | $wpdocs_imported_folder = array_diff($wpdocs_imported_folder, array($dir_slug)); |
| 3096 | 3603 | } |
| 3097 | - | |
| 3604 | + | |
| 3098 | 3605 | update_option('wpdocs_imported_folder', $wpdocs_imported_folder); |
| 3099 | 3606 | update_option('wpdocs_imported_files', $wpdocs_imported_files); |
| 3607 | + } | |
| 3608 | + } | |
| 3100 | 3609 | |
| 3101 | - }; | |
| 3102 | - } | |
| 3103 | 3610 | |
| 3104 | 3611 | if(!function_exists('wp_docs_memphis_import_files')){ |
| 3105 | 3612 | function wp_docs_memphis_import_files(){ |
| 3106 | 3613 | global $memphis_folders_id, $memphis_files_array, $wpdocs_imported_files, $wpdocs_memphis_list, $wpdocs_post_types; |
| @@ -3136,8 +3643,10 @@ | ||
| 3136 | 3643 | |
| 3137 | 3644 | if(!empty($dir_list)){ |
| 3138 | 3645 | foreach($dir_list as $dir_id){ |
| 3139 | 3646 | update_post_meta($attachment_id, '_wpdocs_memphis_media_file', true); |
| 3647 | + update_post_meta($attachment_id, '_wpdocs_memphis_file_id', $file_data['id']); | |
| 3648 | + | |
| 3140 | 3649 | $wpdocs_imported_files[] = $attachment_id; |
| 3141 | 3650 | wpdocs_update_files_meta($dir_id, $files); |
| 3142 | 3651 | } |
| 3143 | 3652 | unset($memphis_files_array[$file_index]); |
| @@ -3318,15 +3827,15 @@ | ||
| 3318 | 3827 | $default_ext = ''; |
| 3319 | 3828 | |
| 3320 | 3829 | $breadcrumb = get_the_title($dir); |
| 3321 | 3830 | ?> |
| 3322 | - <small class="alert alert-success d-block"><i class="fas fa-chevron-right"></i> <?php echo $breadcrumb; ?></small> | |
| 3831 | + <small class="alert alert-success d-block"><i class="fas fa-chevron-right"></i> <?php echo esc_html($breadcrumb); ?></small> | |
| 3323 | 3832 | <?php |
| 3324 | 3833 | |
| 3325 | 3834 | } |
| 3326 | 3835 | ?> |
| 3327 | 3836 | <label for="wpdocs_options_file"> |
| 3328 | - <input <?php checked($is_file); ?> type="checkbox" class="<?php echo $dir_option_class; ?>" name="wpdocs_options[file_upload]" value="file_upload" id="wpdocs_options_file" /> | |
| 3837 | + <input <?php checked($is_file); ?> type="checkbox" class="<?php echo esc_attr($dir_option_class); ?>" name="wpdocs_options[file_upload]" value="file_upload" id="wpdocs_options_file" /> | |
| 3329 | 3838 | <?php echo __('File Upload Front-end', 'wp-docs'); ?> <small><?php echo $wpdocs_pro?__('(Optional)', 'wp-docs'):__('(Premium)', 'wp-docs'); ?></small> <i title="<?php echo __('This icon will appear on front-end for users', 'wp-docs'); ?>" class="fa fa-upload" style="color:#ffc107"></i> |
| 3330 | 3839 | <a href="https://www.youtube.com/embed/flFmqpJCwYk" target="_blank"><?php echo __('Video Tutorial', 'wp-docs'); ?></a> |
| 3331 | 3840 | </label> |
| 3332 | 3841 | |
| @@ -3334,9 +3843,9 @@ | ||
| 3334 | 3843 | |
| 3335 | 3844 | <ul class="ml-4 <?php echo $is_file ? '' : 'd-none'?>"> |
| 3336 | 3845 | <li> |
| 3337 | 3846 | <label for="wpdocs_options_current_user_files"> |
| 3338 | - <input class="<?php echo $dir_option_class; ?>" <?php checked($is_file && $is_current_user_files); ?> type="checkbox" name="wpdocs_options[current_user_files]" value="current_user_files" id="wpdocs_options_current_user_files" /> | |
| 3847 | + <input class="<?php echo esc_attr($dir_option_class); ?>" <?php checked($is_file && $is_current_user_files); ?> type="checkbox" name="wpdocs_options[current_user_files]" value="current_user_files" id="wpdocs_options_current_user_files" /> | |
| 3339 | 3848 | <?php echo __('Do not make files public uploaded by users', 'wp-docs'); ?> <small><?php echo $wpdocs_pro?__('(Optional)', 'wp-docs'):__('(Premium)', 'wp-docs'); ?></small> |
| 3340 | 3849 | </label> |
| 3341 | 3850 | </li> |
| 3342 | 3851 | |
| @@ -3341,9 +3850,9 @@ | ||
| 3341 | 3850 | </li> |
| 3342 | 3851 | |
| 3343 | 3852 | <li> |
| 3344 | 3853 | <label for="wpdocs_options_del_from_front"> |
| 3345 | - <input class="<?php echo $dir_option_class; ?>" <?php checked($is_file && $is_del_from_front); ?> type="checkbox" name="wpdocs_options[del_from_front]" value="del_from_front" id="wpdocs_options_del_from_front" /> | |
| 3854 | + <input class="<?php echo esc_attr($dir_option_class); ?>" <?php checked($is_file && $is_del_from_front); ?> type="checkbox" name="wpdocs_options[del_from_front]" value="del_from_front" id="wpdocs_options_del_from_front" /> | |
| 3346 | 3855 | <?php echo __('User can delete the files from front-end?', 'wp-docs'); ?> <small><?php echo $wpdocs_pro?__('(Optional)', 'wp-docs'):__('(Premium)', 'wp-docs'); ?></small> <i class="fas fa-trash-alt" style="color:#ffc107"></i> |
| 3347 | 3856 | </label> |
| 3348 | 3857 | </li> |
| 3349 | 3858 | |
| @@ -3353,9 +3862,9 @@ | ||
| 3353 | 3862 | </label> |
| 3354 | 3863 | |
| 3355 | 3864 | |
| 3356 | 3865 | |
| 3357 | - <select class="wpdocs_options_allowed_role <?php echo $dir_option_class; ?>" name="wpdocs_options[allowed_role]" data-name="allowed_role" id="wpdocs_options_allowed_role" multiple placeholder="<?php echo __('Select roles to allow upload', 'wp-docs'); ?>"> | |
| 3866 | + <select class="wpdocs_options_allowed_role <?php echo esc_attr($dir_option_class); ?>" name="wpdocs_options[allowed_role]" data-name="allowed_role" id="wpdocs_options_allowed_role" multiple placeholder="<?php echo __('Select roles to allow upload', 'wp-docs'); ?>"> | |
| 3358 | 3867 | |
| 3359 | 3868 | <?php echo wpdocs_get_user_roles_options($allowed_role) ?> |
| 3360 | 3869 | |
| 3361 | 3870 | </select> |
| @@ -3366,9 +3875,9 @@ | ||
| 3366 | 3875 | <li> |
| 3367 | 3876 | <label for="wpdocs_options_allowed_ext"> |
| 3368 | 3877 | <?php echo __('Allowed File Types', 'wp-docs'); ?> <?php echo ($wpdocs_pro?'':'<small>'.__('(Premium)', 'wp-docs').'</small> '); ?> <i class="fas fa-photo-video" style="color:#ffc107"></i> |
| 3369 | 3878 | </label> |
| 3370 | - <input type="text" class="form-control <?php echo $dir_option_class; ?>" name="wpdocs_options[allowed_ext]" data-name="allowed_ext" value="<?php echo $allowed_ext; ?>" id="wpdocs_options_allowed_ext" title="<?php _e('Leave blank if you want to allow all type of files', 'wp-docs'); ?>" placeholder="<?php echo $default_ext; ?>" /> | |
| 3879 | + <input type="text" class="form-control <?php echo esc_attr($dir_option_class); ?>" name="wpdocs_options[allowed_ext]" data-name="allowed_ext" value="<?php echo esc_attr($allowed_ext); ?>" id="wpdocs_options_allowed_ext" title="<?php _e('Leave blank if you want to allow all type of files', 'wp-docs'); ?>" placeholder="<?php echo esc_attr($default_ext); ?>" /> | |
| 3371 | 3880 | |
| 3372 | 3881 | </li> |
| 3373 | 3882 | |
| 3374 | 3883 | </ul> |
| @@ -3533,4 +4042,5 @@ | ||
| 3533 | 4042 | function wpdoc_humanize($str){ |
| 3534 | 4043 | return ucwords(str_replace(array('-', '_'), ' ', $str)); |
| 3535 | 4044 | } |
| 3536 | 4045 | } |
| 4046 | + include_once('functions-verify.php'); | |
