wpstream / hello-wpstream / framework / ajax-upload.php

ajax-upload.php in WpStream – Live Streaming, Video on Demand, Pay Per View 4.12.4, at hello-wpstream/framework/ajax-upload.php

235 lines 7.0 KB

Raw Download Zip

1	<?php
2	/**
3	* Ajax upload
4	*
5	* @package wpstream-theme
6	*/
7
8	add_action( 'wp_ajax_wpstream_me_upload', 'wpstream_me_upload' );
9	/**
10	* Handles AJAX request for file upload.
11	*/
12	function wpstream_me_upload() {
13	check_ajax_referer( 'aaiu_allow', 'nonce' );
14
15	if ( ! is_user_logged_in() \|\| ! current_user_can( 'upload_files' ) ) {
16	wp_send_json_error( array( 'message' => 'You are not allowed to upload files.' ), 403 );
17	}
18
19	$button_id = isset( $_POST['button_id'] ) ? sanitize_text_field( $_POST['button_id'] ) : '';
20
21	$file = array( //phpcs:ignore WordPress.Security.NonceVerification.Missing
22	'name' => isset( $_FILES['aaiu_upload_file']['name'] ) ? sanitize_file_name( $_FILES['aaiu_upload_file']['name'] ) : '',
23	'type' => $_FILES['aaiu_upload_file']['type'],
24	'tmp_name' => $_FILES['aaiu_upload_file']['tmp_name'],
25	'error' => $_FILES['aaiu_upload_file']['error'],
26	'size' => $_FILES['aaiu_upload_file']['size'],
27	);
28
29	wpstream_fileupload_process( $file, $button_id );
30	}
31
32	/**
33	* Process uploaded file.
34	*
35	* This function handles the processing of an uploaded file. It calls another function,
36	* wpstream_handle_file(), to handle the file upload and then generates HTML markup
37	* for displaying the uploaded file. If the button ID is 'aaiu-uploader-profile',
38	* it updates the user's profile picture.
39	*
40	* @param array $file The uploaded file data.
41	* @param string $button_id Optional. The ID of the button triggering the upload process.
42	* @return void
43	*/
44	function wpstream_fileupload_process( $file, $button_id = '' ) {
45	$attachment = wpstream_handle_file( $file, $button_id );
46
47	if ( is_array( $attachment ) ) {
48	$html = wpstream_get_html( $attachment );
49
50	if ( 'aaiu-uploader-profile' === $button_id ) {
51	$current_user = wp_get_current_user();
52	$user_id = $current_user->ID;
53	$image_src = wp_get_attachment_image_src( $attachment['id'], 'wpstream_user_image' );
54	if ( isset( $image_src[0] ) ) {
55	update_user_meta( $user_id, 'custom_picture', $image_src[0] );
56	}
57	update_user_meta( $user_id, 'custom_picture_small', $attachment['id'] );
58
59	}
60
61	$response = array(
62	'success' => true,
63	'html' => $html,
64	'attach' => $attachment['id'],
65	'$button_id' => $button_id,
66	);
67
68	if ( isset( $image_src[0] ) ) {
69	$response['profile_image'] = $image_src[0];
70	}
71
72	echo wp_json_encode( $response );
73	exit;
74	}
75
76	$response = array( 'success' => false );
77	echo wp_json_encode( $response );
78	exit;
79	}
80
81	/**
82	* Handle file upload.
83	*
84	* This function handles the upload of a file by using the WordPress function wp_handle_upload().
85	* It processes the uploaded file data and inserts it as an attachment in the media library.
86	* If the upload is intended for a user profile picture (button ID 'aaiu-uploader-profile'),
87	* the attachment is set to be private.
88	*
89	* @param array $upload_data The uploaded file data.
90	* @param string $button_id Optional. The ID of the button triggering the upload process.
91	* @return array\|bool Returns the attachment data on success, or false on failure.
92	*/
93	function wpstream_handle_file( $upload_data, $button_id = '' ) {
94	$return = false;
95	$uploaded_file = wp_handle_upload( $upload_data, array( 'test_form' => false ) );
96
97	if ( isset( $uploaded_file['file'] ) ) {
98	$file_loc = $uploaded_file['file'];
99	$file_name = basename( $upload_data['name'] );
100	$file_type = wp_check_filetype( $file_name );
101
102	$attachment = array(
103	'post_mime_type' => $file_type['type'],
104	'post_title' => preg_replace( '/\.[^.]+$/', '', basename( $file_name ) ),
105	'post_content' => '',
106	'post_status' => 'inherit',
107	);
108
109	if ( isset( $_GET['propid'] ) && is_numeric( $_GET['propid'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended
110	$attachment['post_parent'] = intval( $_GET['propid'] ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended
111	}
112	if ( 'aaiu-uploader-profile' === $button_id ) {
113	$attachment['post_status'] = 'private';
114	}
115
116	$attach_id = wp_insert_attachment( $attachment, $file_loc );
117	$attach_data = wp_generate_attachment_metadata( $attach_id, $file_loc );
118	wp_update_attachment_metadata( $attach_id, $attach_data );
119	$return = array(
120	'data' => $attach_data,
121	'id' => $attach_id,
122	);
123
124	return $return;
125	}
126
127	return $return;
128	}
129
130	/**
131	* Generate HTML markup for displaying an attachment.
132	*
133	* This function generates the HTML markup necessary to display an attachment.
134	* It retrieves the attachment data and constructs the URL to the attachment image.
135	* If the attachment is intended for a user profile picture, it constructs the URL
136	* based on the user's ID.
137	*
138	* @param array $attachment The attachment data.
139	* @return string The HTML markup for displaying the attachment.
140	*/
141	function wpstream_get_html( $attachment ) {
142	$attach_id = $attachment['id'];
143	$file = '';
144	$html = '';
145
146	if ( isset( $attachment['data']['file'] ) ) {
147	$file = explode( '/', $attachment['data']['file'] );
148	$file = array_slice( $file, 0, count( $file ) - 1 );
149	$path = implode( '/', $file );
150
151	$image = $attachment['data']['sizes']['wpstream_featured_unit_cards']['file'];
152
153	$post = get_post( $attach_id );
154	$dir = wp_upload_dir();
155	$path = $dir['baseurl'] . '/' . $path;
156	$html = '';
157
158	$current_user = wp_get_current_user();
159
160	$user_id = $current_user->ID;
161	$html .= $path . '/' . $image;
162
163	}
164
165	return $html;
166	}
167
168	add_action( 'wp_ajax_wpstream_delete_file', 'wpstream_delete_file' );
169
170	if ( ! function_exists( 'wpstream_delete_file' ) ) {
171	/**
172	* Delete an uploaded file.
173	*
174	* This function handles the deletion of an uploaded file. It checks the user's
175	* permissions and verifies the nonce before deleting the file. If the user has
176	* the necessary permissions and the file exists, it is deleted from the media library.
177	*
178	* @return void
179	*/
180	function wpstream_delete_file() {
181	check_ajax_referer( 'wpstream_theme_image_upload', 'security' );
182	$current_user = wp_get_current_user();
183	$user_id = $current_user->ID;
184
185	if ( ! is_user_logged_in() ) {
186	exit( 'ko' );
187	}
188	if ( 0 === $user_id ) {
189	exit( 'out pls' );
190	}
191
192	if ( isset( $_POST['attach_id'] ) ) {
193	$attach_id = intval( sanitize_text_field( wp_unslash( $_POST['attach_id'] ) ) );
194	}
195
196	$the_post = get_post( $attach_id );
197
198	if ( $user_id !== $the_post->post_author ) {
199	exit( 'you don\'t have the right to delete this' );
200	}
201
202	wp_delete_attachment( $attach_id, true );
203	exit;
204	}
205	}
206
207	add_action( 'wp_ajax_aaiu_delete', 'wpstream_me_delete_file' );
208	/**
209	* Delete file
210	*/
211	function wpstream_me_delete_file() {
212	$current_user = wp_get_current_user();
213	$user_id = $current_user->ID;
214
215	if ( ! is_user_logged_in() ) {
216	exit( 'ko' );
217	}
218	if ( 0 === $user_id ) {
219	exit( 'out pls' );
220	}
221
222	if ( isset( $_POST['attach_id'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Missing
223	$attach_id = intval( $_POST['attach_id'] ); //phpcs:ignore WordPress.Security.NonceVerification.Missing
224	}
225	$the_post = get_post( $attach_id );
226
227	if ( $current_user->ID !== $the_post->post_author ) {
228	exit( 'you don\'t have the right to delete this' );
229
230	}
231
232	wp_delete_attachment( $attach_id, true );
233	exit;
234	}
235