Skip to content

Commit ec1dec8

Browse files
hunkhunk
committed
add check_ajax_referer in upload image alternative
1 parent 691ca60 commit ec1dec8

File tree

3 files changed

+87
-69
lines changed

3 files changed

+87
-69
lines changed

‎admin/mf_ajax_call.php‎

Lines changed: 36 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ public function mf_sort_field($data){
2222
$order = $data['order'];
2323
$order = split(',',$order);
2424
array_walk( $order, create_function( '&$v,$k', '$v = str_replace("order_","",$v);' ));
25-
25+
2626
if( $thing = mf_custom_fields::save_order_field( $data['group_id'], $order ) ) {
2727
print "1";
2828
die;
@@ -33,7 +33,7 @@ public function mf_sort_field($data){
3333

3434
public function check_name_post_type($data){
3535
global $mf_domain;
36-
36+
3737
$type = $data['post_type'];
3838
$id = $data['post_type_id'];
3939
$check = mf_posttype::check_post_type($type,$id);
@@ -48,28 +48,28 @@ public function check_name_post_type($data){
4848

4949
public function check_name_custom_group($data){
5050
global $mf_domain;
51-
51+
5252
$name = $data['group_name'];
5353
$post_type = $data['post_type'];
5454
$id = $data['group_id'];
5555
$resp = array('success' => 1);
56-
56+
5757
$check = mf_custom_group::check_group($name,$post_type,$id);
5858
if($check){
5959
$resp = array('success' => 0, 'msg' => __('The name of Group exist in this post type, Please choose a different name.',$mf_domain) );
6060
}
61-
61+
6262
echo json_encode($resp);
6363
}
6464

6565
public function check_name_custom_field($data){
6666
global $mf_domain;
67-
67+
6868
$name = $data['field_name'];
6969
$post_type = $data['post_type'];
7070
$id = $data['field_id'];
7171
$resp = array('success' => 1);
72-
72+
7373
$check = mf_custom_fields::check_group($name,$post_type,$id);
7474
if($check){
7575
$resp = array('success' => 0, 'msg' => __('The name of Field exist in this post type, Please choose a different name.',$mf_domain) );
@@ -79,7 +79,7 @@ public function check_name_custom_field($data){
7979

8080
public function check_type_custom_taxonomy($data){
8181
global $mf_domain;
82-
82+
8383
$type = $data['taxonomy_type'];
8484
$id = $data['taxonomy_id'];
8585
$check = mf_custom_taxonomy::check_custom_taxonomy($type,$id);
@@ -118,13 +118,13 @@ public function change_custom_field($data){
118118

119119
public function set_default_categories($data){
120120
global $wpdb;
121-
121+
122122
$post_type_key = sprintf('_cat_%s',$data['post_type']);
123123
$cats = preg_split('/\|\|\|/', $data['cats']);
124124
$cats = maybe_serialize($cats);
125125

126126
$table = $wpdb->postmeta;
127-
127+
128128
$check_parent = $wpdb->prepare(
129129
"SELECT meta_id FROM $wpdb->postmeta ".
130130
" WHERE meta_key='%s'",
@@ -152,20 +152,35 @@ public function set_default_categories($data){
152152
}
153153
$wpdb->query($sql);
154154
$resp = array('success' => 1);
155-
155+
156156
//update_post_meta(-2, $post_type, $cats);
157-
157+
158158
echo json_encode($resp);
159159
}
160160

161+
public static function remove_upload_file() {
162+
163+
if (isset($_FILES['file']) && (!empty($_FILES['file']['tmp_name']))){
164+
if ($_FILES['file']['error'] == UPLOAD_ERR_OK){
165+
$file_path = $_FILES['file']['tmp_name'];
166+
@unlink($file_path);
167+
}
168+
}
169+
170+
}
171+
161172
public function upload_ajax($data){
162173
global $mf_domain;
163-
// pr($data);
164-
// pr($_FILES);
165-
// $resp = array('ok' => true,$_FILES,$data);
166-
// echo json_encode($resp);
174+
175+
if( !check_ajax_referer( 'mf_nonce_ajax', 'security', false ) ) {
176+
mf_ajax_call::remove_upload_file();
177+
$resp = array('success' => false, 'msg' => __('Sorry, your nonce did not verify..',$mf_domain) );
178+
echo json_encode($resp);
179+
die;
180+
}
167181

168182
if ( !current_user_can('upload_files') ){
183+
mf_ajax_call::remove_upload_file();
169184
$resp = array('success' => false, 'msg' => __('You do not have sufficient permissions to upload images.',$mf_domain) );
170185
echo json_encode($resp);
171186
die;
@@ -184,13 +199,13 @@ public function upload_ajax($data){
184199
$special_chars = array(' ','`','"','\'','\\','/'," ","#","$","%","^","&","*","!","~","‘","\"","’","'","=","?","/","[","]","(",")","|","<",">",";","\\",",","+","-");
185200
$filename = str_replace($special_chars,'',$_FILES['file']['name']);
186201
$filename = time() . $filename;
187-
202+
188203
@move_uploaded_file( $_FILES['file']['tmp_name'], MF_FILES_DIR . $filename );
189204
@chmod(MF_FILES_DIR . $filename, 0644);
190205
$info = pathinfo(MF_FILES_DIR . $filename);
191206

192207
$thumb = aux_image($filename,"w=150&h=120&zc=1",'image_alt');
193-
208+
194209
$resp = array(
195210
'success' => true,
196211
'name' => $filename,
@@ -229,7 +244,7 @@ public function valid_mime($mime,$file_type){
229244
'audio/x-wav',
230245
'audio/mp3'
231246
);
232-
247+
233248
if($file_type == "image"){
234249
if(in_array($mime,$imagesExts)){
235250
return true;
@@ -243,7 +258,7 @@ public function valid_mime($mime,$file_type){
243258
//are safety for the "files" type of field
244259
return true;
245260
}
246-
return false;
261+
return false;
247262
}
248263

249264
public function get_thumb($data){
@@ -273,4 +288,4 @@ public function get_thumb($data){
273288

274289
}
275290

276-
}
291+
}

‎admin/mf_post.php‎

Lines changed: 44 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,13 @@ function mf_check_wp_gallery_version() {
3131
*/
3232
function mf_post_add_metaboxes() {
3333
global $post,$mf_post_values;
34-
35-
//if the user are going to add a new link
34+
35+
//if the user are going to add a new link
3636
//the var $post is not defined and we do nothing
3737
if(!isset($post)) {
3838
return false;
3939
}
40-
40+
4141
$mf_post_values = $this->mf_get_post_values($post->ID);
4242

4343
//Getting the post types
@@ -168,7 +168,7 @@ public function mf_draw_field($field,$group_id,$group_index =1,$field_index =1 ,
168168
$id = sprintf('mf_field_%d_%d_%d_%d_ui',$group_id,$group_index,$field['id'],$field_index);
169169
$delete_id = sprintf('delete_field_repeat-%d_%d_%d_%d',$group_id,$group_index,$field['id'],$field_index);
170170
$add_id = sprintf('mf_field_repeat-%d_%d_%d_%d',$group_id,$group_index,$field['id'],$field_index);
171-
$field_style = ($field_index == 1)? 'style="display: none; "' : '';
171+
$field_style = ($field_index == 1)? 'style="display: none; "' : '';
172172

173173
$name = sprintf('field-%s',$field['name']);
174174
$tool = sprintf('<small class="mf_tip"><em>%s</em><span class="mf_helptext">%s</span></small>',__( 'What\'s this?', $mf_domain ),'%s');
@@ -406,8 +406,8 @@ public function load_js_css_base(){
406406
global $mf_domain;
407407

408408
wp_enqueue_style( 'mf_field_base', MF_BASENAME.'css/mf_field_base.css' );
409-
wp_enqueue_script( 'tmpl', MF_BASENAME.'js/third_party/jquery.tmpl.js');
410-
wp_enqueue_script( 'mf_field_base', MF_BASENAME.'js/mf_field_base.js');
409+
wp_enqueue_script( 'tmpl', MF_BASENAME.'js/third_party/jquery.tmpl.js');
410+
wp_enqueue_script( 'mf_field_base', MF_BASENAME.'js/mf_field_base.js');
411411
wp_enqueue_script( 'mf_sortable_groups', MF_BASENAME.'js/mf_sortable_groups.js', array( 'jquery-ui-sortable' ) );
412412

413413
$mceAddString = "mceAddControl";
@@ -424,18 +424,19 @@ public function load_js_css_base(){
424424
'mf_validation_error_msg' => __('Sorry, some required fields are missing. Please provide values for any highlighted fields and try again.',$mf_domain),
425425
'mf_image_media_set' => __('Insert into field',$mf_domain),
426426
'mf_mceAddString' => $mceAddString,
427-
'mf_mceRemoveString' => $mceRemoveString
427+
'mf_mceRemoveString' => $mceRemoveString,
428+
'mf_nonce_ajax' => wp_create_nonce( "mf_nonce_ajax" )
428429
);
429-
wp_localize_script( 'mf_field_base', 'mf_js', $js_vars );
430-
430+
wp_localize_script( 'mf_field_base', 'mf_js', $js_vars );
431+
431432
}
432433

433434
/* enqueue css and js of fields */
434435
public function load_js_css_fields(){
435-
436-
//Loading any custom field if is required
436+
437+
//Loading any custom field if is required
437438
if( !empty( $_GET['post']) && is_numeric( $_GET['post'] ) ) {//when the post already exists
438-
$post_type = get_post_type($_GET['post']);
439+
$post_type = get_post_type($_GET['post']);
439440
}else{ //Creating a new post
440441
$post_type = (!empty($_GET['post_type'])) ? $_GET['post_type'] : 'post';
441442
}
@@ -458,7 +459,7 @@ public function load_js_css_fields(){
458459
$type = $field."_field";
459460
$type = new $type();
460461
$properties = $type->get_properties();
461-
462+
462463
if ( $properties['js'] ) {
463464
wp_enqueue_script(
464465
'mf_field_'.$field,
@@ -467,7 +468,7 @@ public function load_js_css_fields(){
467468
null,
468469
true
469470
);
470-
471+
471472
/* idear forma por si se necesita mas de dos js*/
472473
if( isset($properties['js_internal']) ){
473474
wp_enqueue_script(
@@ -481,21 +482,21 @@ public function load_js_css_fields(){
481482
}
482483

483484
if ( $properties['css'] ) {
484-
wp_enqueue_style(
485+
wp_enqueue_style(
485486
'mf_field_'.$field,
486487
MF_BASENAME.'field_types/'.$field.'_field/'.$field.'_field.css'
487488
);
488489
}
489-
490+
490491
if ( !empty($properties['css_dependencies'] )) {
491492
foreach($properties['css_dependencies'] as $css_script) {
492493
wp_enqueue_style($css_script);
493494
}
494495
}
495-
496+
496497
/* load css internal */
497498
if(isset($properties['css_internal'])){
498-
wp_enqueue_style(
499+
wp_enqueue_style(
499500
'mf_field_'.preg_replace('/\./','_',$properties['css_internal']),
500501
MF_BASENAME.'field_types/'.$field.'_field/'.$properties['css_internal']
501502
);
@@ -509,41 +510,41 @@ public function check_exist_visual_editor(){
509510

510511
if( isset($_GET['action']) && $_GET['action'] == 'trash' ) {//when the post already exists
511512
return;
512-
}
513+
}
513514

514515
if( !empty( $_GET['post']) && is_numeric( $_GET['post'] ) ) {//when the post already exists
515-
$post_type = get_post_type($_GET['post']);
516+
$post_type = get_post_type($_GET['post']);
516517
}else{ //Creating a new post
517518
$post_type = (!empty($_GET['post_type'])) ? $_GET['post_type'] : 'post';
518519
}
519520

520521
$mf_posttype = new mf_posttype();
521522
$pt = $mf_posttype->get_post_type($post_type);
522-
523+
523524
if ($pt && !isset($pt['support']['editor'])) {
524525
echo "<style>#postdivrich {display:none; }</style>";
525526
}
526-
527+
527528
}
528-
529+
529530
}
530531

531532
public function media_buttons_add_mf(){
532-
533+
533534
print '<div style="display:none;">';
534535
do_action( 'media_buttons' );
535-
print '</div>';
536+
print '</div>';
536537
}
537-
538+
538539
public function register_media_button($buttons) {
539540
array_push($buttons, "separator","add_image","add_video","add_audio","add_media");
540541
return $buttons;
541542
}
542-
543+
543544
public function tmce_not_remove_p_and_br(){
544545
?>
545546
<script type="text/javascript">
546-
//<![CDATA[
547+
//<![CDATA[
547548
jQuery('body').bind('afterPreWpautop', function(e, o){
548549
o.data = o.unfiltered
549550
.replace(/caption\]\[caption/g, 'caption] [caption')
@@ -557,40 +558,40 @@ public function tmce_not_remove_p_and_br(){
557558
</script>
558559
<?php
559560
}
560-
561+
561562
public function general_option_multiline(){
562-
563+
563564
/* load aditional options for multiline */
564565
add_filter('mce_buttons', array($this,'register_media_button'));
565-
566+
566567
if( mf_settings::get('dont_remove_tags') == '1'){
567568
add_action( 'admin_print_footer_scripts', array($this,'tmce_not_remove_p_and_br'), 50 );
568569
}
569-
570+
570571
}
571572

572573
public function categories_of_post_type(){
573-
574+
574575
global $wpdb;
575576
$assignedCategoryIds = array();
576-
577+
577578
if( count($_GET) == 0){ $_GET['post_type'] = 'post'; }
578-
579+
579580
if (isset($_GET['post_type'])) {
580581
$post_type_key = sprintf('_cat_%s',$_GET['post_type']);
581-
582+
582583
$sql ="SELECT meta_value FROM ".$wpdb->postmeta." WHERE meta_key='".$post_type_key."' ";
583584
$check = $wpdb->get_row($sql);
584585
if ($check) {
585586
$cata = $check->meta_value;
586587
$assignedCategoryIds = maybe_unserialize($cata);
587588
}
588589
}
589-
590-
590+
591+
591592
?>
592593
<script type="text/javascript">
593-
var mf_categories = new Array(<?php echo '"'.implode('","',$assignedCategoryIds).'"' ?>);
594+
var mf_categories = new Array(<?php echo '"'.implode('","',$assignedCategoryIds).'"' ?>);
594595
jQuery(document).ready(function($) {
595596

596597
if(mf_categories.length == 1 && mf_categories[0] == "" ){
@@ -606,15 +607,15 @@ public function categories_of_post_type(){
606607
<?php
607608
}
608609
public function set_categories(){
609-
610+
610611
add_action( 'admin_print_footer_scripts', array($this,'categories_of_post_type'), 50 );
611612
}
612-
613+
613614

614615
//MF Meta box for select template
615616
function mf_metabox_template () {
616617
global $post;
617-
618+
618619
if ( 0 != count( get_page_templates() ) ) {
619620

620621
$template = get_post_meta($post->ID, '_wp_mf_page_template', TRUE);
@@ -624,7 +625,7 @@ function mf_metabox_template () {
624625
<option value='default'><?php _e('Default Template'); ?></option>
625626
<?php page_template_dropdown($template); ?>
626627
</select>
627-
<?php
628+
<?php
628629
}
629630
}
630631
}

0 commit comments

Comments
 (0)