wpstream / hello-wpstream / framework / ajax-upload.php

ajax-upload.php in WpStream – Live Streaming, Video on Demand, Pay Per View 4.8.2, at hello-wpstream/framework/ajax-upload.php

233 lines 6.9 KB

Raw Download Zip

1	<?php
2	/**
3	* Ajax upload
4	*
5	* @package wpstream-theme
6	*/
7
8	add_action( 'wp_ajax_wpstream_me_upload', 'wpstream_me_upload' );
9	/**
10	* Handles AJAX request for file upload.
11	*/
12	function wpstream_me_upload() {
13	if ( ! is_user_logged_in() ) {
14	exit( 'ko' );
15	}
16
17	$button_id = isset( $_POST['button_id'] ) ? sanitize_text_field( $_POST['button_id'] ) : '';
18
19	$file = array( //phpcs:ignore WordPress.Security.NonceVerification.Missing
20	'name' => isset( $_FILES['aaiu_upload_file']['name'] ) ? sanitize_file_name( $_FILES['aaiu_upload_file']['name'] ) : '',
21	'type' => $_FILES['aaiu_upload_file']['type'],
22	'tmp_name' => $_FILES['aaiu_upload_file']['tmp_name'],
23	'error' => $_FILES['aaiu_upload_file']['error'],
24	'size' => $_FILES['aaiu_upload_file']['size'],
25	);
26
27	wpstream_fileupload_process( $file, $button_id);
28	}
29
30	/**
31	* Process uploaded file.
32	*
33	* This function handles the processing of an uploaded file. It calls another function,
34	* wpstream_handle_file(), to handle the file upload and then generates HTML markup
35	* for displaying the uploaded file. If the button ID is 'aaiu-uploader-profile',
36	* it updates the user's profile picture.
37	*
38	* @param array $file The uploaded file data.
39	* @param string $button_id Optional. The ID of the button triggering the upload process.
40	* @return void
41	*/
42	function wpstream_fileupload_process( $file, $button_id = '' ) {
43	$attachment = wpstream_handle_file( $file, $button_id );
44
45	if ( is_array( $attachment ) ) {
46	$html = wpstream_get_html( $attachment );
47
48	if ( 'aaiu-uploader-profile' === $button_id ) {
49	$current_user = wp_get_current_user();
50	$user_id = $current_user->ID;
51	$image_src = wp_get_attachment_image_src( $attachment['id'], 'wpstream_user_image' );
52	if ( isset( $image_src[0] ) ) {
53	update_user_meta( $user_id, 'custom_picture', $image_src[0] );
54	}
55	update_user_meta( $user_id, 'custom_picture_small', $attachment['id'] );
56
57	}
58
59	$response = array(
60	'success' => true,
61	'html' => $html,
62	'attach' => $attachment['id'],
63	'$button_id' => $button_id,
64	);
65
66	if ( isset( $image_src[0] ) ) {
67	$response['profile_image'] = $image_src[0];
68	}
69
70	echo wp_json_encode( $response );
71	exit;
72	}
73
74	$response = array( 'success' => false );
75	echo wp_json_encode( $response );
76	exit;
77	}
78
79	/**
80	* Handle file upload.
81	*
82	* This function handles the upload of a file by using the WordPress function wp_handle_upload().
83	* It processes the uploaded file data and inserts it as an attachment in the media library.
84	* If the upload is intended for a user profile picture (button ID 'aaiu-uploader-profile'),
85	* the attachment is set to be private.
86	*
87	* @param array $upload_data The uploaded file data.
88	* @param string $button_id Optional. The ID of the button triggering the upload process.
89	* @return array\|bool Returns the attachment data on success, or false on failure.
90	*/
91	function wpstream_handle_file( $upload_data, $button_id = '' ) {
92	$return = false;
93	$uploaded_file = wp_handle_upload( $upload_data, array( 'test_form' => false ) );
94
95	if ( isset( $uploaded_file['file'] ) ) {
96	$file_loc = $uploaded_file['file'];
97	$file_name = basename( $upload_data['name'] );
98	$file_type = wp_check_filetype( $file_name );
99
100	$attachment = array(
101	'post_mime_type' => $file_type['type'],
102	'post_title' => preg_replace( '/\.[^.]+$/', '', basename( $file_name ) ),
103	'post_content' => '',
104	'post_status' => 'inherit',
105	);
106
107	if ( isset( $_GET['propid'] ) && is_numeric( $_GET['propid'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended
108	$attachment['post_parent'] = intval( $_GET['propid'] ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended
109	}
110	if ( 'aaiu-uploader-profile' === $button_id ) {
111	$attachment['post_status'] = 'private';
112	}
113
114	$attach_id = wp_insert_attachment( $attachment, $file_loc );
115	$attach_data = wp_generate_attachment_metadata( $attach_id, $file_loc );
116	wp_update_attachment_metadata( $attach_id, $attach_data );
117	$return = array(
118	'data' => $attach_data,
119	'id' => $attach_id,
120	);
121
122	return $return;
123	}
124
125	return $return;
126	}
127
128	/**
129	* Generate HTML markup for displaying an attachment.
130	*
131	* This function generates the HTML markup necessary to display an attachment.
132	* It retrieves the attachment data and constructs the URL to the attachment image.
133	* If the attachment is intended for a user profile picture, it constructs the URL
134	* based on the user's ID.
135	*
136	* @param array $attachment The attachment data.
137	* @return string The HTML markup for displaying the attachment.
138	*/
139	function wpstream_get_html( $attachment ) {
140	$attach_id = $attachment['id'];
141	$file = '';
142	$html = '';
143
144	if ( isset( $attachment['data']['file'] ) ) {
145	$file = explode( '/', $attachment['data']['file'] );
146	$file = array_slice( $file, 0, count( $file ) - 1 );
147	$path = implode( '/', $file );
148
149	$image = $attachment['data']['sizes']['wpstream_featured_unit_cards']['file'];
150
151	$post = get_post( $attach_id );
152	$dir = wp_upload_dir();
153	$path = $dir['baseurl'] . '/' . $path;
154	$html = '';
155
156	$current_user = wp_get_current_user();
157
158	$user_id = $current_user->ID;
159	$html .= $path . '/' . $image;
160
161	}
162
163	return $html;
164	}
165
166	add_action( 'wp_ajax_wpstream_delete_file', 'wpstream_delete_file' );
167
168	if ( ! function_exists( 'wpstream_delete_file' ) ) {
169	/**
170	* Delete an uploaded file.
171	*
172	* This function handles the deletion of an uploaded file. It checks the user's
173	* permissions and verifies the nonce before deleting the file. If the user has
174	* the necessary permissions and the file exists, it is deleted from the media library.
175	*
176	* @return void
177	*/
178	function wpstream_delete_file() {
179	check_ajax_referer( 'wpstream_theme_image_upload', 'security' );
180	$current_user = wp_get_current_user();
181	$user_id = $current_user->ID;
182
183	if ( ! is_user_logged_in() ) {
184	exit( 'ko' );
185	}
186	if ( 0 === $user_id ) {
187	exit( 'out pls' );
188	}
189
190	if ( isset( $_POST['attach_id'] ) ) {
191	$attach_id = intval( sanitize_text_field( wp_unslash( $_POST['attach_id'] ) ) );
192	}
193
194	$the_post = get_post( $attach_id );
195
196	if ( $user_id !== $the_post->post_author ) {
197	exit( 'you don\'t have the right to delete this' );
198	}
199
200	wp_delete_attachment( $attach_id, true );
201	exit;
202	}
203	}
204
205	add_action( 'wp_ajax_aaiu_delete', 'wpstream_me_delete_file' );
206	/**
207	* Delete file
208	*/
209	function wpstream_me_delete_file() {
210	$current_user = wp_get_current_user();
211	$user_id = $current_user->ID;
212
213	if ( ! is_user_logged_in() ) {
214	exit( 'ko' );
215	}
216	if ( 0 === $user_id ) {
217	exit( 'out pls' );
218	}
219
220	if ( isset( $_POST['attach_id'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Missing
221	$attach_id = intval( $_POST['attach_id'] ); //phpcs:ignore WordPress.Security.NonceVerification.Missing
222	}
223	$the_post = get_post( $attach_id );
224
225	if ( $current_user->ID !== $the_post->post_author ) {
226	exit( 'you don\'t have the right to delete this' );
227
228	}
229
230	wp_delete_attachment( $attach_id, true );
231	exit;
232	}
233