| @@ -1,6 +1,18 @@ | ||
| 1 | 1 | <?php |
| 2 | - | |
| 2 | + if(!function_exists('wpdocs_secure_url')){ | |
| 3 | + function wpdocs_secure_url($file_id=''){ | |
| 4 | + | |
| 5 | + $ret = add_query_arg( | |
| 6 | + array( | |
| 7 | + 'wpdocs_dl' => $file_id, | |
| 8 | + 'wpdocs_nonce' => wp_create_nonce('wpdocs_dl_'.$file_id), | |
| 9 | + ), | |
| 10 | + home_url('/') | |
| 11 | + ); | |
| 12 | + return $ret; | |
| 13 | + } | |
| 14 | + } | |
| 3 | 15 | if(!function_exists('wp_docs_get_memphis_dir_option_id')){ |
| 4 | 16 | function wp_docs_get_option_id($option_name){ |
| 5 | 17 | global $wpdb; |
| 6 | 18 | $option_name = esc_sql( $option_name ); |
| @@ -44,8 +56,10 @@ | ||
| 44 | 56 | function wpdocs_admin_enqueue_script() |
| 45 | 57 | { |
| 46 | 58 | if (isset($_GET['page']) && $_GET['page'] == 'wpdocs') { |
| 47 | 59 | |
| 60 | + //pree(get_option('mdocs-list'));exit; | |
| 61 | + | |
| 48 | 62 | global $wpdocs_pro, $wpdocs_options; |
| 49 | 63 | |
| 50 | 64 | wp_enqueue_script('wpdocs_boostrap', plugin_dir_url(dirname(__FILE__)) . 'js/bootstrap.min.js', array('jquery')); |
| 51 | 65 | wp_enqueue_style('wpdocs-boostrap', plugins_url('css/bootstrap.min.css', dirname(__FILE__))); |
| @@ -65,8 +79,9 @@ | ||
| 65 | 79 | wp_enqueue_style('wpdocs-common', plugins_url('css/common-styles.css', dirname(__FILE__)), array(), date('Ymdhi')); |
| 66 | 80 | wp_enqueue_style('wpdocs-admin', plugins_url('css/admin-styles.css', dirname(__FILE__)), array(), date('Ymdhi')); |
| 67 | 81 | |
| 68 | 82 | wp_enqueue_script('wpdocs_admin_scripts', plugin_dir_url(dirname(__FILE__)) . 'js/admin-scripts.js', array('jquery', 'jquery-ui-dialog'), time()); |
| 83 | + wp_enqueue_script('wpdocs_verify_scripts', plugin_dir_url(dirname(__FILE__)) . 'js/verify-scripts.js', array('jquery', 'jquery-ui-dialog'), time()); | |
| 69 | 84 | |
| 70 | 85 | if($wpdocs_pro){ |
| 71 | 86 | wp_enqueue_script('wpdocs_pro_scripts', plugin_dir_url(dirname(__FILE__)) . 'pro/wp-docs-admin.js?t='.time(), array('jquery')); |
| 72 | 87 | } |
| @@ -110,8 +125,55 @@ | ||
| 110 | 125 | 'rename_confirm' => __('Please enter new folder name:', 'wp-docs'), |
| 111 | 126 | |
| 112 | 127 | ) |
| 113 | 128 | ); |
| 129 | + | |
| 130 | + wp_localize_script( | |
| 131 | + 'wpdocs_verify_scripts', | |
| 132 | + 'wpdocs_vars', | |
| 133 | + array( | |
| 134 | + 'ajax_url' => admin_url('admin-ajax.php'), | |
| 135 | + 'url' => admin_url('options-general.php?page=wpdocs'), | |
| 136 | + 'nonce' => wp_create_nonce('wpdocs_verify_nonce'), | |
| 137 | + 'preparing_queue' => __('Preparing verification queue...', 'wp-docs'), | |
| 138 | + 'unable_to_start' => __('Unable to start verification.', 'wp-docs'), | |
| 139 | + 'ajax_error' => __('AJAX error.', 'wp-docs'), | |
| 140 | + 'verification_failed' => __('Verification failed.', 'wp-docs'), | |
| 141 | + 'verification_completed' => __('Verification completed.', 'wp-docs'), | |
| 142 | + 'verification_interrupted' => __('Verification interrupted.', 'wp-docs'), | |
| 143 | + 'checking_folder' => __('Checking Folder:', 'wp-docs'), | |
| 144 | + 'checking_file' => __('Checking File:', 'wp-docs'), | |
| 145 | + 'unknown_file' => __('Unknown File', 'wp-docs'), | |
| 146 | + 'items_processed' => __('items processed', 'wp-docs'), | |
| 147 | + 'total_folders' => __('Total Folders', 'wp-docs'), | |
| 148 | + 'verified_folders' => __('Verified Folders', 'wp-docs'), | |
| 149 | + 'missing_folders' => __('Missing Folders', 'wp-docs'), | |
| 150 | + 'total_files' => __('Total Files', 'wp-docs'), | |
| 151 | + 'verified_files' => __('Verified Files', 'wp-docs'), | |
| 152 | + 'missing_files' => __('Missing Files', 'wp-docs'), | |
| 153 | + 'missing_folder' => __('MISSING FOLDER', 'wp-docs'), | |
| 154 | + 'missing_file' => __('MISSING FILE', 'wp-docs'), | |
| 155 | + 'no_items_display' => __('No items to display.', 'wp-docs'), | |
| 156 | + 'import_in_progress' => __('Import is already in progress. Please wait.', 'wp-docs'), | |
| 157 | + 'import_missing_confirm' => __('This will import only missing folders and files. Do you want to continue?', 'wp-docs'), | |
| 158 | + 'initializing' => __('Initializing...', 'wp-docs'), | |
| 159 | + 'preparing_import_queue' => __('Preparing import queue...', 'wp-docs'), | |
| 160 | + 'unable_to_start_import' => __('Unable to start import.', 'wp-docs'), | |
| 161 | + 'import_failed' => __('Import failed.', 'wp-docs'), | |
| 162 | + 'import_completed' => __('Import completed!', 'wp-docs'), | |
| 163 | + 'refreshing_results' => __('Refreshing verification results...', 'wp-docs'), | |
| 164 | + 'import_interrupted' => __('Import interrupted. Please try again.', 'wp-docs'), | |
| 165 | + 'creating_folder' => __('Creating Folder:', 'wp-docs'), | |
| 166 | + 'importing_file' => __('Importing File:', 'wp-docs'), | |
| 167 | + 'path' => __('Path:', 'wp-docs'), | |
| 168 | + 'target' => __('Target:', 'wp-docs'), | |
| 169 | + 'folders_imported' => __('Folders imported:', 'wp-docs'), | |
| 170 | + 'files_imported' => __('Files imported:', 'wp-docs'), | |
| 171 | + 'failed' => __('Failed:', 'wp-docs'), | |
| 172 | + 'please_wait' => __('Please wait...', 'wp-docs'), | |
| 173 | + 'import_missing_items' => __('Import Missing Items Only', 'wp-docs'), | |
| 174 | + ) | |
| 175 | + ); | |
| 114 | 176 | } |
| 115 | 177 | } |
| 116 | 178 | |
| 117 | 179 | add_filter( 'ajax_query_attachments_args', 'wpdocs_filter_media'); |
| @@ -604,10 +666,30 @@ | ||
| 604 | 666 | //pree($ret); |
| 605 | 667 | |
| 606 | 668 | return $ret; |
| 607 | 669 | } |
| 670 | + function wpdocs_create_folder_post( $post_parent, $post_title = "New Folder" ) { | |
| 671 | + | |
| 672 | + if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) { | |
| 673 | + return 0; | |
| 674 | + } | |
| 608 | 675 | |
| 609 | - function wpdocs_create_folder_post($post_parent, $post_title = "New Folder") | |
| 676 | + $post_parent = absint( $post_parent ); | |
| 677 | + $post_title = sanitize_text_field( $post_title ); | |
| 678 | + | |
| 679 | + $my_post = array( | |
| 680 | + 'post_title' => $post_title, | |
| 681 | + 'post_content' => '', | |
| 682 | + 'post_status' => 'hidden', | |
| 683 | + 'post_author' => get_current_user_id(), | |
| 684 | + 'post_type' => 'wpdocs_folder', | |
| 685 | + 'post_parent' => ( ( $post_parent > 0 && wpdocs_folder_exists( $post_parent ) ) ? $post_parent : 0 ), | |
| 686 | + 'post_category' => array(), | |
| 687 | + ); | |
| 688 | + | |
| 689 | + return wp_insert_post( $my_post ); | |
| 690 | + } | |
| 691 | + /*function wpdocs_create_folder_post($post_parent, $post_title = "New Folder") | |
| 610 | 692 | { |
| 611 | 693 | |
| 612 | 694 | $my_post = array( |
| 613 | 695 | 'post_title' => $post_title, |
| @@ -621,9 +703,9 @@ | ||
| 621 | 703 | |
| 622 | 704 | $dir_id = wp_insert_post($my_post); |
| 623 | 705 | |
| 624 | 706 | return $dir_id; |
| 625 | - } | |
| 707 | + }*/ | |
| 626 | 708 | |
| 627 | 709 | add_action('wp_ajax_wpdocs_create_folder', 'wpdocs_create_folder'); |
| 628 | 710 | |
| 629 | 711 | function wpdocs_create_folder() |
| @@ -747,8 +829,9 @@ | ||
| 747 | 829 | |
| 748 | 830 | |
| 749 | 831 | |
| 750 | 832 | return array( |
| 833 | + 'file_id' => $item, | |
| 751 | 834 | 'file_url' => esc_url($file_url), |
| 752 | 835 | 'ext' => esc_attr($ext), |
| 753 | 836 | 'filename' => esc_attr($filename), |
| 754 | 837 | 'title' => esc_html($filename), |
| @@ -758,11 +841,68 @@ | ||
| 758 | 841 | |
| 759 | 842 | } |
| 760 | 843 | } |
| 761 | 844 | |
| 845 | + /** | |
| 846 | + * Centralize the "can this user edit this folder?" decision. | |
| 847 | + * Admins always pass; otherwise require the folder to be owned by the user. | |
| 848 | + */ | |
| 849 | + function wpdocs_user_can_edit_folder( $dir_id ) { | |
| 850 | + if ( current_user_can( 'manage_options' ) ) { | |
| 851 | + return true; | |
| 852 | + } | |
| 853 | + | |
| 854 | + $dir = get_post( $dir_id ); | |
| 855 | + if ( ! $dir || 'wpdocs_folder' !== $dir->post_type ) { // adjust CPT slug | |
| 856 | + return false; | |
| 857 | + } | |
| 858 | + | |
| 859 | + return (int) $dir->post_author === get_current_user_id(); | |
| 860 | + } | |
| 861 | + | |
| 762 | 862 | add_action('wp_ajax_wpdocs_add_files', 'wpdocs_add_files'); |
| 763 | 863 | |
| 764 | - function wpdocs_add_files(){ | |
| 864 | + function wpdocs_add_files() { | |
| 865 | + | |
| 866 | + // 1) Capability FIRST — before nonce, before anything. | |
| 867 | + if ( ! is_user_logged_in() || ! current_user_can( 'upload_files' ) ) { | |
| 868 | + wp_send_json_error( array( 'message' => __( 'Insufficient permissions.', 'wp-docs' ) ), 403 ); | |
| 869 | + } | |
| 870 | + | |
| 871 | + // 2) Nonce check. | |
| 872 | + if ( empty( $_POST['nonce'] ) | |
| 873 | + || ! wp_verify_nonce( | |
| 874 | + sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), | |
| 875 | + 'wpdocs_update_options_nonce' | |
| 876 | + ) | |
| 877 | + ) { | |
| 878 | + wp_send_json_error( array( 'message' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 879 | + } | |
| 880 | + | |
| 881 | + // 3) Input validation. | |
| 882 | + $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0; | |
| 883 | + if ( ! $dir_id ) { | |
| 884 | + wp_send_json_error( array( 'message' => __( 'Invalid folder.', 'wp-docs' ) ), 400 ); | |
| 885 | + } | |
| 886 | + | |
| 887 | + // 4) Per-folder ownership / capability gate. | |
| 888 | + if ( ! wpdocs_user_can_edit_folder( $dir_id ) ) { | |
| 889 | + wp_send_json_error( array( 'message' => __( 'You cannot modify this folder.', 'wp-docs' ) ), 403 ); | |
| 890 | + } | |
| 891 | + | |
| 892 | + $files = isset( $_POST['files'] ) ? sanitize_wpdocs_data( $_POST['files'] ) : array(); | |
| 893 | + $files = is_array( $files ) ? $files : array( $files ); | |
| 894 | + $files = array_filter( array_map( 'absint', $files ) ); | |
| 895 | + | |
| 896 | + wpdocs_update_files_meta( $dir_id, $files ); | |
| 897 | + | |
| 898 | + $ret = ! empty( $files ) ? wpdocs_list_added_items( $dir_id ) : ''; | |
| 899 | + | |
| 900 | + echo $ret; | |
| 901 | + exit; | |
| 902 | + } | |
| 903 | + | |
| 904 | + /*function wpdocs_add_files_old(){ | |
| 765 | 905 | |
| 766 | 906 | $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce'])); |
| 767 | 907 | |
| 768 | 908 | if (!empty($_POST) && isset($_POST['nonce']) && ! wp_verify_nonce( $nonce, 'wpdocs_update_options_nonce' ) ) |
| @@ -788,9 +928,9 @@ | ||
| 788 | 928 | } |
| 789 | 929 | |
| 790 | 930 | echo $ret; |
| 791 | 931 | exit; |
| 792 | - } | |
| 932 | + }*/ | |
| 793 | 933 | function wpdocs_list_added_items($dir) |
| 794 | 934 | { |
| 795 | 935 | |
| 796 | 936 | global $wpdocs_options, $icon_sub_path, $wpdocs_url; |
| @@ -813,9 +953,9 @@ | ||
| 813 | 953 | |
| 814 | 954 | $item_data = wpd_get_item_type_icon_url($item); |
| 815 | 955 | extract($item_data); |
| 816 | 956 | |
| 817 | - //pree($item_data); | |
| 957 | + //pree($item_data);exit; | |
| 818 | 958 | //pree($wp_uploads_path);exit; |
| 819 | 959 | |
| 820 | 960 | $icon_str = '<img src="' . esc_url($icon_url) . '" style="" alt="' . esc_attr($title) . '">'; |
| 821 | 961 | |
| @@ -877,10 +1017,14 @@ | ||
| 877 | 1017 | //$class .= 'fa-file'; |
| 878 | 1018 | break; |
| 879 | 1019 | } |
| 880 | 1020 | $class = ''; |
| 1021 | + | |
| 1022 | + | |
| 1023 | + $secured_file_url = wpdocs_secure_url($file_id); | |
| 1024 | + | |
| 881 | 1025 | $files_list[ $title ] = '<li data-id="' . esc_attr( $item ) . '" data-dir="' . esc_attr( $dir ) . '" title="' . esc_attr( $filename ) . '"> |
| 882 | - <a href="' . esc_url( $file_url ) . '" target="_blank" class="file ' . esc_attr( $class ) . '"> ' . $icon_str . ' </a> | |
| 1026 | + <a href="' . esc_url( $secured_file_url ) . '" target="_blank" class="file ' . esc_attr( $class ) . '"> ' . $icon_str . ' </a> | |
| 883 | 1027 | <a class="ftitle" title="' . esc_attr( $title ) . '">' . esc_html( $title ) . '</a> |
| 884 | 1028 | <span class="wpd_action_span"> |
| 885 | 1029 | <a href="' . esc_url( 'upload.php?item=' . $item ) . '" target="_blank" class="wpd-edit" title="' . esc_attr__( 'Click here to edit', 'wp-docs' ) . '"></a> |
| 886 | 1030 | <span class="wpd_action_span_inner"> |
| @@ -1416,14 +1560,16 @@ | ||
| 1416 | 1560 | default: |
| 1417 | 1561 | //$class .= 'fa-file'; |
| 1418 | 1562 | break; |
| 1419 | 1563 | } |
| 1564 | + | |
| 1565 | + $secured_file_url = wpdocs_secure_url($file_id); | |
| 1420 | 1566 | |
| 1421 | 1567 | $file_list_row = ' |
| 1422 | 1568 | |
| 1423 | 1569 | <div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_shallow" style="cursor: pointer;" data-id="'.esc_attr($file).'"> |
| 1424 | 1570 | <figure class="figure file_view p-1"> |
| 1425 | - <a href="'.esc_url($file_url).'" target="_blank" class="file"> | |
| 1571 | + <a href="'.esc_url($secured_file_url).'" target="_blank" class="file"> | |
| 1426 | 1572 | <img class="my-3" src="'.esc_url($icon_url).'" /> |
| 1427 | 1573 | </a> |
| 1428 | 1574 | <figcaption class="figure-caption text-center">'.esc_html($title).'</figcaption> |
| 1429 | 1575 | </figure> |
| @@ -1501,14 +1647,16 @@ | ||
| 1501 | 1647 | default: |
| 1502 | 1648 | //$class .= 'fa-file'; |
| 1503 | 1649 | break; |
| 1504 | 1650 | } |
| 1651 | + | |
| 1652 | + $secured_file_url = wpdocs_secure_url($file_id); | |
| 1505 | 1653 | |
| 1506 | 1654 | $file_list_row = ' |
| 1507 | 1655 | |
| 1508 | 1656 | <div title="'.esc_attr($filename).'" class="col-4 col-md-3 is_file text-center is_deep" style="cursor: pointer;" data-id="'.esc_attr($file).'"> |
| 1509 | 1657 | <figure class="figure file_view p-1"> |
| 1510 | - <a href="'.esc_url($file_url).'" target="_blank" class="file"> | |
| 1658 | + <a href="'.esc_url($secured_file_url).'" target="_blank" class="file"> | |
| 1511 | 1659 | <img class="my-3" src="'.esc_url($icon_url).'" /> |
| 1512 | 1660 | </a> |
| 1513 | 1661 | <figcaption class="figure-caption text-center">'.esc_html($title).'</figcaption> |
| 1514 | 1662 | </figure> |
| @@ -1601,13 +1749,15 @@ | ||
| 1601 | 1749 | extract($file_data); |
| 1602 | 1750 | |
| 1603 | 1751 | |
| 1604 | 1752 | if(trim($file_url)){ |
| 1753 | + | |
| 1754 | + $secured_file_url = wpdocs_secure_url($file_id); | |
| 1605 | 1755 | |
| 1606 | 1756 | $file_list_row = ' |
| 1607 | 1757 | <div title="'.esc_attr($filename).'" class="col-12 file_wrapper is_file" style="cursor: pointer;" data-id="'.$file.'"> |
| 1608 | 1758 | <figure class="figure file_view p-3"> |
| 1609 | - <a href="'.$file_url.'" target="_blank" class="file" ><img class="mb-2" src="'.$icon_url.'" style="width: 25px; height: 25px"></a> | |
| 1759 | + <a href="'.$secured_file_url.'" target="_blank" class="file" ><img class="mb-2" src="'.$icon_url.'" style="width: 25px; height: 25px"></a> | |
| 1610 | 1760 | <small class="text-center">'.$title.'</small> |
| 1611 | 1761 | </figure> |
| 1612 | 1762 | </div>'; |
| 1613 | 1763 | |
| @@ -1798,11 +1948,11 @@ | ||
| 1798 | 1948 | extract($file_data); |
| 1799 | 1949 | //pree($ts); |
| 1800 | 1950 | |
| 1801 | 1951 | if(trim($icon_url)){ |
| 1802 | - | |
| 1952 | + $secured_file_url = wpdocs_secure_url($file_id); | |
| 1803 | 1953 | $files_list_row = ' |
| 1804 | - <tr title="'.esc_attr($filename).'" data-url="'.$file_url.'" class="file_view file_link is_file" style="cursor: pointer;" data-id="'.$file.'"> | |
| 1954 | + <tr title="'.esc_attr($filename).'" data-url="'.$secured_file_url.'" class="file_view file_link is_file" style="cursor: pointer;" data-id="'.$file.'"> | |
| 1805 | 1955 | |
| 1806 | 1956 | <td> |
| 1807 | 1957 | |
| 1808 | 1958 | <figure class="figure file_view"> |
| @@ -1855,11 +2005,13 @@ | ||
| 1855 | 2005 | extract($file_data); |
| 1856 | 2006 | //pree($ts); |
| 1857 | 2007 | |
| 1858 | 2008 | if(trim($icon_url)){ |
| 2009 | + | |
| 2010 | + $secured_file_url = wpdocs_secure_url($file_id); | |
| 1859 | 2011 | |
| 1860 | 2012 | $files_list_row = ' |
| 1861 | - <tr title="'.esc_attr($filename).'" data-url="'.$file_url.'" class="file_view file_link is_file is_deep" style="cursor: pointer;" data-id="'.$file.'"> | |
| 2013 | + <tr title="'.esc_attr($filename).'" data-url="'.$secured_file_url.'" class="file_view file_link is_file is_deep" style="cursor: pointer;" data-id="'.$file.'"> | |
| 1862 | 2014 | |
| 1863 | 2015 | <td> |
| 1864 | 2016 | |
| 1865 | 2017 | <figure class="figure file_view"> |
| @@ -2043,8 +2195,53 @@ | ||
| 2043 | 2195 | add_action('wp_ajax_wpdocs_update_folder', 'wpdocs_update_folder'); |
| 2044 | 2196 | |
| 2045 | 2197 | function wpdocs_update_folder() { |
| 2046 | 2198 | |
| 2199 | + if ( ! current_user_can( 'manage_options' ) ) { | |
| 2200 | + wp_send_json_error( array( 'msg' => __( 'Unauthorized access.', 'wp-docs' ) ), 403 ); | |
| 2201 | + } | |
| 2202 | + | |
| 2203 | + if ( | |
| 2204 | + empty( $_POST['nonce'] ) || | |
| 2205 | + ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) | |
| 2206 | + ) { | |
| 2207 | + wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 2208 | + } | |
| 2209 | + | |
| 2210 | + $dir_id = absint( $_POST['dir_id'] ?? 0 ); | |
| 2211 | + $resource_id = base64_decode( sanitize_text_field( $_POST['resource_id'] ?? '' ) ); | |
| 2212 | + $new_name = sanitize_text_field( $_POST['new_name'] ?? '' ); | |
| 2213 | + | |
| 2214 | + if ( ! $dir_id || $resource_id != $dir_id || ! wpdocs_folder_exists( $dir_id ) ) { | |
| 2215 | + wp_send_json_error( array( 'msg' => __( 'Invalid folder ID or resource mismatch.', 'wp-docs' ) ), 400 ); | |
| 2216 | + } | |
| 2217 | + | |
| 2218 | + global $wpdb, $wpdocs_post_types, $wpdocs_post_status; | |
| 2219 | + | |
| 2220 | + $updated = $wpdb->query( | |
| 2221 | + $wpdb->prepare( | |
| 2222 | + "UPDATE $wpdb->posts | |
| 2223 | + SET post_title = %s | |
| 2224 | + WHERE ID = %d | |
| 2225 | + AND post_type IN ('" . implode( "','", array_map( 'esc_sql', $wpdocs_post_types ) ) . "') | |
| 2226 | + AND post_status = %s", | |
| 2227 | + htmlspecialchars_decode( $new_name ), | |
| 2228 | + $dir_id, | |
| 2229 | + $wpdocs_post_status | |
| 2230 | + ) | |
| 2231 | + ); | |
| 2232 | + | |
| 2233 | + wp_send_json_success( | |
| 2234 | + array( | |
| 2235 | + 'msg' => $updated | |
| 2236 | + ? __( 'Successfully updated.', 'wp-docs' ) | |
| 2237 | + : __( 'No changes were made. Input seems the same as before.', 'wp-docs' ), | |
| 2238 | + ) | |
| 2239 | + ); | |
| 2240 | + } | |
| 2241 | + | |
| 2242 | + /*function wpdocs_update_folder() { | |
| 2243 | + | |
| 2047 | 2244 | |
| 2048 | 2245 | if ( ! current_user_can('edit_posts') ) { |
| 2049 | 2246 | wp_send_json_error(['msg' => __('Unauthorized access.', 'wp-docs')]); |
| 2050 | 2247 | } |
| @@ -2090,14 +2287,35 @@ | ||
| 2090 | 2287 | $ret['msg'] = __('Invalid folder ID or resource mismatch.', 'wp-docs'); |
| 2091 | 2288 | } |
| 2092 | 2289 | |
| 2093 | 2290 | wp_send_json_success($ret); |
| 2094 | - } | |
| 2291 | + }*/ | |
| 2095 | 2292 | |
| 2096 | 2293 | |
| 2097 | 2294 | add_action('wp_ajax_wpdocs_delete_folder', 'wpdocs_delete_folder'); |
| 2098 | 2295 | |
| 2099 | - function wpdocs_delete_folder() | |
| 2296 | + function wpdocs_delete_folder() { | |
| 2297 | + | |
| 2298 | + if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) { | |
| 2299 | + wp_send_json_error( array( 'msg' => __( 'Unauthorized user', 'wp-docs' ) ), 403 ); | |
| 2300 | + } | |
| 2301 | + | |
| 2302 | + if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) { | |
| 2303 | + wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 2304 | + } | |
| 2305 | + | |
| 2306 | + $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0; | |
| 2307 | + $resource_id = base64_decode( sanitize_wpdocs_data( $_POST['resource_id'] ?? '' ) ); | |
| 2308 | + | |
| 2309 | + if ( ! $dir_id || $dir_id != $resource_id || ! wpdocs_folder_exists( $dir_id ) ) { | |
| 2310 | + wp_send_json_error( array( 'msg' => __( 'Invalid folder.', 'wp-docs' ) ), 400 ); | |
| 2311 | + } | |
| 2312 | + | |
| 2313 | + wpdocs_recursive_delete_folder( $dir_id ); | |
| 2314 | + | |
| 2315 | + wp_send_json_success(); | |
| 2316 | + } | |
| 2317 | + /*function wpdocs_delete_folder() | |
| 2100 | 2318 | { |
| 2101 | 2319 | |
| 2102 | 2320 | if ( ! current_user_can( 'manage_options' ) ) { |
| 2103 | 2321 | wp_send_json_error( __( 'Unauthorized user', 'wp-docs' ) ); |
| @@ -2116,9 +2334,9 @@ | ||
| 2116 | 2334 | wpdocs_recursive_delete_folder($dir_id); |
| 2117 | 2335 | } |
| 2118 | 2336 | |
| 2119 | 2337 | exit; |
| 2120 | - } | |
| 2338 | + } */ | |
| 2121 | 2339 | |
| 2122 | 2340 | |
| 2123 | 2341 | |
| 2124 | 2342 | add_action('wp_ajax_wpdocs_delete_files', 'wpdocs_delete_files'); |
| @@ -2198,11 +2416,59 @@ | ||
| 2198 | 2416 | return update_post_meta($dir_id, 'wpdocs_items', $wpdocs_items); |
| 2199 | 2417 | } |
| 2200 | 2418 | } |
| 2201 | 2419 | } |
| 2420 | + | |
| 2421 | + function wpdocs_delete_files() { | |
| 2422 | + if ( ! is_user_logged_in() || ! current_user_can( 'delete_posts' ) ) { | |
| 2423 | + wp_send_json_error( array( 'message' => __( 'Insufficient permissions.', 'wp-docs' ) ), 403 ); | |
| 2424 | + } | |
| 2425 | + | |
| 2426 | + if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) { | |
| 2427 | + wp_send_json_error( array( 'message' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 2428 | + } | |
| 2429 | + | |
| 2430 | + $dir_id = isset( $_POST['dir_id'] ) ? absint( $_POST['dir_id'] ) : 0; | |
| 2431 | + $files = isset( $_POST['files'] ) ? (array) $_POST['files'] : array(); | |
| 2432 | + $files = array_values( array_unique( array_filter( array_map( 'absint', $files ) ) ) ); | |
| 2433 | + | |
| 2434 | + if ( ! $dir_id || ! wpdocs_folder_exists( $dir_id ) || empty( $files ) ) { | |
| 2435 | + wp_send_json_error( array( 'message' => __( 'Invalid request.', 'wp-docs' ) ), 400 ); | |
| 2436 | + } | |
| 2437 | + | |
| 2438 | + $is_admin = current_user_can( 'manage_options' ); | |
| 2439 | + $is_owner = wpdocs_user_can_edit_folder( $dir_id ); | |
| 2440 | + | |
| 2441 | + if ( ! $is_admin && ! $is_owner ) { | |
| 2442 | + wp_send_json_error( array( 'message' => __( 'You cannot delete files from this folder.', 'wp-docs' ) ), 403 ); | |
| 2443 | + } | |
| 2444 | + | |
| 2445 | + $allowed = array(); | |
| 2446 | + foreach ( $files as $file_id ) { | |
| 2447 | + $attachment = get_post( $file_id ); | |
| 2448 | + if ( ! $attachment || 'attachment' !== $attachment->post_type ) { | |
| 2449 | + continue; | |
| 2450 | + } | |
| 2451 | + if ( $is_admin || current_user_can( 'edit_post', $file_id ) ) { | |
| 2452 | + $allowed[] = $file_id; | |
| 2453 | + } | |
| 2454 | + } | |
| 2455 | + | |
| 2456 | + if ( empty( $allowed ) ) { | |
| 2457 | + wp_send_json_error( array( 'message' => __( 'None of the specified files can be deleted by you.', 'wp-docs' ) ), 403 ); | |
| 2458 | + } | |
| 2459 | + | |
| 2460 | + wpdocs_del_items_by_user( $dir_id, $allowed, get_current_user_id() ); | |
| 2461 | + | |
| 2462 | + $wpdocs_items = wpdocs_added_items( $dir_id ); | |
| 2463 | + $wpdocs_items = array_values( array_unique( array_diff( (array) $wpdocs_items, $allowed ) ) ); | |
| 2464 | + | |
| 2465 | + update_post_meta( $dir_id, 'wpdocs_items', $wpdocs_items ); | |
| 2466 | + | |
| 2467 | + wp_send_json_success( array( 'dir_id' => $dir_id, 'files' => $allowed ) ); | |
| 2468 | + } | |
| 2202 | 2469 | |
| 2203 | - | |
| 2204 | - | |
| 2470 | + /* | |
| 2205 | 2471 | function wpdocs_delete_files() |
| 2206 | 2472 | { |
| 2207 | 2473 | |
| 2208 | 2474 | $dir_id = sanitize_wpdocs_data($_POST['dir_id']); |
| @@ -2226,9 +2492,9 @@ | ||
| 2226 | 2492 | } |
| 2227 | 2493 | |
| 2228 | 2494 | |
| 2229 | 2495 | exit; |
| 2230 | - } | |
| 2496 | + } */ | |
| 2231 | 2497 | |
| 2232 | 2498 | function wpd_admin_footer(){ |
| 2233 | 2499 | |
| 2234 | 2500 | ?> |
| @@ -2524,11 +2790,46 @@ | ||
| 2524 | 2790 | } |
| 2525 | 2791 | } |
| 2526 | 2792 | |
| 2527 | 2793 | add_action('wp_ajax_wpdocs_update_view', 'wpdocs_update_view'); |
| 2528 | - add_action('wp_ajax_nopriv_wpdocs_update_view', 'wpdocs_update_view'); | |
| 2529 | - | |
| 2530 | - if(!function_exists('wpdocs_update_view')){ | |
| 2794 | + | |
| 2795 | + | |
| 2796 | + if ( ! function_exists( 'wpdocs_update_view' ) ) { | |
| 2797 | + function wpdocs_update_view() { | |
| 2798 | + | |
| 2799 | + if ( ! is_user_logged_in() || ! current_user_can( 'read' ) ) { | |
| 2800 | + wp_send_json_error( array( 'msg' => __( 'Unauthorized access.', 'wp-docs' ) ), 403 ); | |
| 2801 | + } | |
| 2802 | + | |
| 2803 | + if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_wpdocs_data( wp_unslash( $_POST['nonce'] ) ), 'wpdocs_update_options_nonce' ) ) { | |
| 2804 | + wp_send_json_error( array( 'msg' => __( 'Sorry, your nonce did not verify.', 'wp-docs' ) ), 403 ); | |
| 2805 | + } | |
| 2806 | + | |
| 2807 | + $uid = get_current_user_id(); | |
| 2808 | + $key = 'wpdocs_view_rl_' . $uid; | |
| 2809 | + $hits = (int) get_transient( $key ); | |
| 2810 | + | |
| 2811 | + if ( $hits >= 60 ) { | |
| 2812 | + wp_send_json_error( array( 'msg' => __( 'Too many requests.', 'wp-docs' ) ), 429 ); | |
| 2813 | + } | |
| 2814 | + set_transient( $key, $hits + 1, MINUTE_IN_SECONDS ); | |
| 2815 | + | |
| 2816 | + if ( isset( $_POST['update_view'] ) ) { | |
| 2817 | + | |
| 2818 | + $wpdocs_view = get_option( 'wpdocs_view', array() ); | |
| 2819 | + $wpdocs_view = is_array( $wpdocs_view ) ? $wpdocs_view : array(); | |
| 2820 | + | |
| 2821 | + $parent_dir = sanitize_wpdocs_data( $_POST['parent_dir'] ?? '' ); | |
| 2822 | + $view_val = sanitize_wpdocs_data( $_POST['update_view'] ); | |
| 2823 | + | |
| 2824 | + $wpdocs_view[ $parent_dir ] = $view_val; | |
| 2825 | + update_option( 'wpdocs_view', $wpdocs_view ); | |
| 2826 | + } | |
| 2827 | + | |
| 2828 | + wp_send_json_success(); | |
| 2829 | + } | |
| 2830 | + } | |
| 2831 | + /*if(!function_exists('wpdocs_update_view')){ | |
| 2531 | 2832 | function wpdocs_update_view(){ |
| 2532 | 2833 | |
| 2533 | 2834 | $nonce = sanitize_wpdocs_data(wp_unslash($_POST['nonce'])); |
| 2534 | 2835 | |
| @@ -2546,9 +2847,9 @@ | ||
| 2546 | 2847 | |
| 2547 | 2848 | } |
| 2548 | 2849 | exit; |
| 2549 | 2850 | } |
| 2550 | - } | |
| 2851 | + }*/ | |
| 2551 | 2852 | function wpdocs_init_session() { |
| 2552 | 2853 | if(!session_id()) { |
| 2553 | 2854 | session_start(); |
| 2554 | 2855 | } |
| @@ -2744,13 +3045,91 @@ | ||
| 2744 | 3045 | return $ret; |
| 2745 | 3046 | |
| 2746 | 3047 | } |
| 2747 | 3048 | } |
| 3049 | + if(!function_exists('wpdocs_file_download')){ | |
| 3050 | + function wpdocs_file_download(){ | |
| 3051 | + | |
| 3052 | + if(empty($_GET['wpdocs_dl'])){ | |
| 3053 | + return; | |
| 3054 | + } | |
| 3055 | + | |
| 3056 | + $file_id = absint( | |
| 3057 | + wp_unslash($_GET['wpdocs_dl']) | |
| 3058 | + ); | |
| 3059 | + | |
| 3060 | + if(!$file_id){ | |
| 3061 | + status_header(404); | |
| 3062 | + exit; | |
| 3063 | + } | |
| 3064 | + | |
| 3065 | + $nonce = isset($_GET['wpdocs_nonce']) | |
| 3066 | + ? sanitize_text_field( | |
| 3067 | + wp_unslash($_GET['wpdocs_nonce']) | |
| 3068 | + ) | |
| 3069 | + : ''; | |
| 3070 | + | |
| 3071 | + if( | |
| 3072 | + !wp_verify_nonce( | |
| 3073 | + $nonce, | |
| 3074 | + 'wpdocs_dl_' . $file_id | |
| 3075 | + ) | |
| 3076 | + ){ | |
| 3077 | + status_header(403); | |
| 3078 | + exit; | |
| 3079 | + } | |
| 3080 | + | |
| 3081 | + // Adjust this according to where you store the file | |
| 3082 | + $file = get_attached_file($file_id); | |
| 3083 | + | |
| 3084 | + if( | |
| 3085 | + !$file || | |
| 3086 | + !file_exists($file) | |
| 3087 | + ){ | |
| 3088 | + status_header(404); | |
| 3089 | + exit; | |
| 3090 | + } | |
| 3091 | + | |
| 3092 | + $uploads = wp_get_upload_dir(); | |
| 3093 | + $base_real = realpath($uploads['basedir']); | |
| 3094 | + $file_real = realpath($file); | |
| 3095 | + | |
| 3096 | + if( | |
| 3097 | + !$base_real || | |
| 3098 | + !$file_real || | |
| 3099 | + strpos( | |
| 3100 | + $file_real, | |
| 3101 | + $base_real . DIRECTORY_SEPARATOR | |
| 3102 | + ) !== 0 | |
| 3103 | + ){ | |
| 3104 | + status_header(403); | |
| 3105 | + exit; | |
| 3106 | + } | |
| 3107 | + | |
| 3108 | + $mime = wp_check_filetype($file_real); | |
| 3109 | + $mime = !empty($mime['type']) | |
| 3110 | + ? $mime['type'] | |
| 3111 | + : 'application/octet-stream'; | |
| 3112 | + | |
| 3113 | + header('Content-Type: ' . $mime); | |
| 3114 | + header('Content-Length: ' . filesize($file_real)); | |
| 3115 | + header( | |
| 3116 | + 'Content-Disposition: inline; filename="' . | |
| 3117 | + basename($file_real) . | |
| 3118 | + '"' | |
| 3119 | + ); | |
| 3120 | + | |
| 3121 | + readfile($file_real); | |
| 3122 | + exit; | |
| 3123 | + } | |
| 3124 | + } | |
| 2748 | 3125 | |
| 2749 | 3126 | add_action('init', 'wpdocs_dir_actions'); |
| 2750 | 3127 | if(!function_exists('wpdocs_dir_actions')){ |
| 2751 | 3128 | function wpdocs_dir_actions(){ |
| 2752 | 3129 | |
| 3130 | + wpdocs_file_download(); | |
| 3131 | + | |
| 2753 | 3132 | if(is_admin() && get_option('wpdocs_memphis_uninstall')){ |
| 2754 | 3133 | if(wp_docs_memphis_folder_preserve('mdocs_2', 'mdocs')){ |
| 2755 | 3134 | update_option('wpdocs_memphis_uninstall', false); |
| 2756 | 3135 | } |
| @@ -3264,8 +3643,10 @@ | ||
| 3264 | 3643 | |
| 3265 | 3644 | if(!empty($dir_list)){ |
| 3266 | 3645 | foreach($dir_list as $dir_id){ |
| 3267 | 3646 | update_post_meta($attachment_id, '_wpdocs_memphis_media_file', true); |
| 3647 | + update_post_meta($attachment_id, '_wpdocs_memphis_file_id', $file_data['id']); | |
| 3648 | + | |
| 3268 | 3649 | $wpdocs_imported_files[] = $attachment_id; |
| 3269 | 3650 | wpdocs_update_files_meta($dir_id, $files); |
| 3270 | 3651 | } |
| 3271 | 3652 | unset($memphis_files_array[$file_index]); |
| @@ -3661,4 +4042,5 @@ | ||
| 3661 | 4042 | function wpdoc_humanize($str){ |
| 3662 | 4043 | return ucwords(str_replace(array('-', '_'), ' ', $str)); |
| 3663 | 4044 | } |
| 3664 | 4045 | } |
| 4046 | + include_once('functions-verify.php'); | |
