296 lines
10 KiB
PHP
296 lines
10 KiB
PHP
<?php
|
|
|
|
namespace QuadLayers\WOOCCM;
|
|
|
|
/**
|
|
* Upload Class
|
|
*/
|
|
class Upload {
|
|
|
|
protected static $_instance;
|
|
|
|
public function __construct() {
|
|
add_action( 'wp_ajax_wooccm_order_attachment_update', array( $this, 'ajax_delete_attachment' ) );
|
|
|
|
// Checkout
|
|
// -----------------------------------------------------------------------.
|
|
add_action( 'wp_ajax_wooccm_checkout_attachment_upload', array( $this, 'ajax_checkout_attachment_upload' ) );
|
|
add_action( 'wp_ajax_nopriv_wooccm_checkout_attachment_upload', array( $this, 'ajax_checkout_attachment_upload' ) );
|
|
add_action( 'woocommerce_checkout_update_order_meta', array( $this, 'update_attachment_ids' ), 99 );
|
|
}
|
|
|
|
public static function instance() {
|
|
if ( is_null( self::$_instance ) ) {
|
|
self::$_instance = new self();
|
|
}
|
|
return self::$_instance;
|
|
}
|
|
|
|
protected function process_uploads( $files, $key, $post_id = 0 ) {
|
|
if ( ! function_exists( 'media_handle_upload' ) ) {
|
|
require_once ABSPATH . 'wp-admin/includes/file.php';
|
|
require_once ABSPATH . 'wp-admin/includes/media.php';
|
|
require_once ABSPATH . 'wp-admin/includes/image.php';
|
|
}
|
|
|
|
// Security Fix: CVE-2025-12500 - Add upload limits
|
|
$max_files_per_upload = apply_filters( 'wooccm_max_files_per_upload', 10 );
|
|
$file_count = is_array( $files['name'] ) ? count( $files['name'] ) : 0;
|
|
|
|
if ( $file_count > $max_files_per_upload ) {
|
|
wc_add_notice(
|
|
sprintf(
|
|
/* translators: %d: maximum number of files */
|
|
esc_html__( 'You can only upload a maximum of %d files at once.', 'woocommerce-checkout-manager' ),
|
|
$max_files_per_upload
|
|
),
|
|
'error'
|
|
);
|
|
return array();
|
|
}
|
|
|
|
$attachment_ids = array();
|
|
|
|
add_filter(
|
|
'upload_dir',
|
|
function ( $param ) {
|
|
$param['path'] = sprintf( '%s/wooccm_uploads', $param['basedir'] );
|
|
$param['url'] = sprintf( '%s/wooccm_uploads', $param['baseurl'] );
|
|
return $param;
|
|
},
|
|
10
|
|
);
|
|
|
|
foreach ( $files['name'] as $id => $value ) {
|
|
|
|
if ( $files['name'][ $id ] ) {
|
|
|
|
$_FILES[ $key ] = array(
|
|
'name' => $files['name'][ $id ],
|
|
'type' => $files['type'][ $id ],
|
|
'tmp_name' => $files['tmp_name'][ $id ],
|
|
'error' => $files['error'][ $id ],
|
|
'size' => $files['size'][ $id ],
|
|
);
|
|
|
|
$attachment_id = media_handle_upload( $key, $post_id );
|
|
|
|
if ( ! is_wp_error( $attachment_id ) ) {
|
|
$attachment_ids[] = $attachment_id;
|
|
} else {
|
|
wc_add_notice( $attachment_id->get_error_message(), 'error' );
|
|
// wp_send_json_error( $attachment_id->get_error_message() );
|
|
}
|
|
}
|
|
}
|
|
|
|
return $attachment_ids;
|
|
}
|
|
|
|
public function ajax_delete_attachment() {
|
|
if ( ! empty( $_REQUEST ) && check_admin_referer( 'wooccm_upload', 'nonce' ) ) {
|
|
|
|
$array1 = explode( ',', sanitize_text_field( isset( $_REQUEST['all_attachments_ids'] ) ? wp_unslash( $_REQUEST['all_attachments_ids'] ) : '' ) );
|
|
$array2 = explode( ',', sanitize_text_field( isset( $_REQUEST['delete_attachments_ids'] ) ? wp_unslash( $_REQUEST['delete_attachments_ids'] ) : '' ) );
|
|
|
|
if ( empty( $array1 ) || empty( $array2 ) ) {
|
|
wp_send_json_error( esc_html__( 'No attachment selected.', 'woocommerce-checkout-manager' ) );
|
|
}
|
|
|
|
$attachment_ids = array_diff( $array1, $array2 );
|
|
|
|
if ( ! empty( $attachment_ids ) ) {
|
|
|
|
foreach ( $attachment_ids as $key => $attachtoremove ) {
|
|
|
|
// Check the Attachment exists...
|
|
if ( get_post_status( $attachtoremove ) == false ) {
|
|
continue;
|
|
}
|
|
|
|
// Check the Attachment is associated with an Order
|
|
$post_parent = get_post_field( 'post_parent', $attachtoremove );
|
|
|
|
if ( empty( $post_parent ) ) {
|
|
continue;
|
|
} else {
|
|
// if ( get_post_type( $post_parent ) <> 'shop_order' && get_post_type( $post_parent ) <> 'shop_order_placehold' ) {
|
|
if ( ! in_array( get_post_type( $post_parent ), array( 'shop_order', 'shop_order_placehold' ) ) ) {
|
|
continue;
|
|
}
|
|
}
|
|
|
|
$order = wc_get_order( $post_parent );
|
|
|
|
$current_user = wp_get_current_user();
|
|
|
|
$session_handler = WC()->session;
|
|
|
|
// Security Fix: CVE-2025-13930 - Fixed inverted login check
|
|
$is_user_logged = 0 !== $current_user->ID;
|
|
|
|
// For guest orders, require order key validation
|
|
if ( ! $is_user_logged ) {
|
|
// Validate order key for guest orders
|
|
$order_key = isset( $_REQUEST['order_key'] ) ? wc_clean( wp_unslash( $_REQUEST['order_key'] ) ) : '';
|
|
|
|
if ( empty( $order_key ) || ! hash_equals( $order->get_order_key(), $order_key ) ) {
|
|
wp_send_json_error( esc_html__( 'Invalid order key.', 'woocommerce-checkout-manager' ) );
|
|
}
|
|
|
|
// Verify session email matches order email
|
|
$session_customer = $session_handler ? $session_handler->get( 'customer' ) : array();
|
|
$session_customer_email = isset( $session_customer['email'] ) ? $session_customer['email'] : '';
|
|
$order_email = $order->get_billing_email();
|
|
|
|
if ( empty( $session_customer_email ) || $order_email !== $session_customer_email ) {
|
|
wp_send_json_error( esc_html__( 'Email mismatch.', 'woocommerce-checkout-manager' ) );
|
|
}
|
|
} else {
|
|
// For logged-in users, verify ownership or capabilities
|
|
$order_user_id = $order->get_user_id();
|
|
$user_has_capabilities = current_user_can( 'administrator' )
|
|
|| current_user_can( 'edit_others_shop_orders' )
|
|
|| current_user_can( 'delete_others_shop_orders' );
|
|
|
|
if ( ! $user_has_capabilities && $current_user->ID !== $order_user_id ) {
|
|
wp_send_json_error( esc_html__( 'This is not your order.', 'woocommerce-checkout-manager' ) );
|
|
}
|
|
}
|
|
|
|
wp_delete_attachment( $attachtoremove );
|
|
}
|
|
}
|
|
|
|
wp_send_json_success( 'Deleted successfully.', 'woocommerce-checkout-manager' );
|
|
}
|
|
}
|
|
|
|
public function ajax_checkout_attachment_upload() {
|
|
// Security Fix: CVE-2025-12500 - Added proper authorization checks
|
|
|
|
// Step 1: Verify nonce for CSRF protection
|
|
if ( ! check_admin_referer( 'wooccm_upload', 'nonce' ) ) {
|
|
wp_send_json_error( array( 'message' => esc_html__( 'Security check failed.', 'woocommerce-checkout-manager' ) ) );
|
|
}
|
|
|
|
// Step 2: Verify files are present
|
|
if ( ! isset( $_FILES['wooccm_checkout_attachment_upload'] ) ) {
|
|
wp_send_json_error( array( 'message' => esc_html__( 'No files provided.', 'woocommerce-checkout-manager' ) ) );
|
|
}
|
|
|
|
// Step 3: Verify WooCommerce is available and ensure it's loaded
|
|
if ( ! function_exists( 'WC' ) ) {
|
|
wp_send_json_error( array( 'message' => esc_html__( 'WooCommerce is not available.', 'woocommerce-checkout-manager' ) ) );
|
|
}
|
|
|
|
// Ensure WooCommerce is initialized
|
|
$wc = WC();
|
|
if ( ! $wc ) {
|
|
wp_send_json_error( array( 'message' => esc_html__( 'WooCommerce session not initialized.', 'woocommerce-checkout-manager' ) ) );
|
|
}
|
|
|
|
// Step 4: Verify user is in checkout process (applies to ALL users - logged in and guests).
|
|
// This ensures that any user (including subscribers, customers, etc.) must be actively
|
|
// in the checkout process before they can upload files, preventing arbitrary file uploads.
|
|
$is_in_checkout_process = false;
|
|
|
|
// Check 1: Verify cart has items.
|
|
$cart_count = ( $wc->cart ) ? $wc->cart->get_cart_contents_count() : 0;
|
|
if ( $wc->cart && $cart_count > 0 ) {
|
|
$is_in_checkout_process = true;
|
|
}
|
|
|
|
// Check 2: Verify WooCommerce session exists with customer data.
|
|
if ( ! $is_in_checkout_process && $wc->session ) {
|
|
$customer = $wc->session->get( 'customer' );
|
|
// Customer data exists and has at least one field populated.
|
|
if ( ! empty( $customer ) && is_array( $customer ) && count( array_filter( $customer ) ) > 0 ) {
|
|
$is_in_checkout_process = true;
|
|
}
|
|
}
|
|
|
|
// Check 3: For logged-in users, check if they have WooCommerce customer role or cart session.
|
|
if ( ! $is_in_checkout_process && is_user_logged_in() ) {
|
|
$current_user = wp_get_current_user();
|
|
// Allow WooCommerce customers, shop managers, and administrators.
|
|
if ( in_array( 'customer', $current_user->roles, true ) ||
|
|
in_array( 'shop_manager', $current_user->roles, true ) ||
|
|
in_array( 'administrator', $current_user->roles, true ) ) {
|
|
// Verify they have an active WooCommerce session.
|
|
if ( $wc->session && $wc->session->get_customer_id() ) {
|
|
$is_in_checkout_process = true;
|
|
}
|
|
}
|
|
}
|
|
|
|
if ( ! $is_in_checkout_process ) {
|
|
wp_send_json_error( array( 'message' => esc_html__( 'Please start checkout process before uploading files.', 'woocommerce-checkout-manager' ) ) );
|
|
}
|
|
|
|
// It cannot be wp_unslash becouse it has images paths.
|
|
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
|
|
$files = wc_clean( $_FILES['wooccm_checkout_attachment_upload'] );
|
|
|
|
if ( empty( $files ) ) {
|
|
wc_add_notice( esc_html__( 'No uploads were recognized. Files were not uploaded.', 'woocommerce-checkout-manager' ), 'error' );
|
|
wp_send_json_error( array( 'message' => esc_html__( 'No uploads were recognized. Files were not uploaded.', 'woocommerce-checkout-manager' ) ) );
|
|
}
|
|
|
|
$attachment_ids = $this->process_uploads( $files, 'wooccm_checkout_attachment_upload' );
|
|
|
|
if ( count( $attachment_ids ) ) {
|
|
wp_send_json_success( $attachment_ids );
|
|
}
|
|
|
|
wc_add_notice( esc_html__( 'Unknown error.', 'woocommerce-checkout-manager' ), 'error' );
|
|
wp_send_json_error( array( 'message' => esc_html__( 'Unknown error.', 'woocommerce-checkout-manager' ) ) );
|
|
}
|
|
|
|
public function update_attachment_ids( $order_id = 0 ) {
|
|
|
|
require_once ABSPATH . 'wp-admin/includes/file.php';
|
|
require_once ABSPATH . 'wp-admin/includes/media.php';
|
|
require_once ABSPATH . 'wp-admin/includes/image.php';
|
|
|
|
$checkout = WC()->checkout->get_checkout_fields();
|
|
|
|
if ( count( $checkout ) ) {
|
|
|
|
foreach ( $checkout as $field_type => $fields ) {
|
|
|
|
foreach ( $fields as $key => $field ) {
|
|
|
|
if ( isset( $field['type'] ) && 'file' === $field['type'] ) {
|
|
|
|
$order = wc_get_order( $order_id );
|
|
$key = sprintf( '_%s', $field['key'] );
|
|
|
|
$attachments = $order->get_meta( $key, true );
|
|
|
|
if ( $attachments ) {
|
|
|
|
$attachments = (array) explode( ',', $attachments );
|
|
|
|
if ( $attachments ) {
|
|
|
|
foreach ( $attachments as $image_id ) {
|
|
|
|
wp_update_post(
|
|
array(
|
|
'ID' => $image_id,
|
|
'post_parent' => $order_id,
|
|
)
|
|
);
|
|
|
|
wp_update_attachment_metadata( $image_id, wp_generate_attachment_metadata( $image_id, get_attached_file( $image_id ) ) );
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|