Current path: home/webdevt/www/wdp/wp-content/plugins/supportcandy/includes/rest-api/
?? Go up: /home/webdevt/www/wdp/wp-content/plugins/supportcandy/includes
<?php
if ( ! defined( 'ABSPATH' ) ) {
exit; // Exit if accessed directly!
}
if ( ! class_exists( 'WPSC_REST_Attachment' ) ) :
final class WPSC_REST_Attachment {
/**
* Initialize this class
*
* @return void
*/
public static function init() {
add_action( 'init', array( __CLASS__, 'check_download_file' ), 99 );
add_action( 'wpsc_rest_register_routes', array( __CLASS__, 'register_routes' ) );
}
/**
* Register routes
*
* @return void
*/
public static function register_routes() {
// list statuses.
register_rest_route(
'supportcandy/v2',
'/attachments',
array(
'methods' => 'POST',
'callback' => array( __CLASS__, 'new_attachment' ),
'permission_callback' => 'is_user_logged_in',
),
);
// list individual status.
register_rest_route(
'supportcandy/v2',
'/attachments/(?P<id>\d+)',
array(
'methods' => 'GET',
'callback' => array( __CLASS__, 'get_individual_attachment' ),
'args' => array(
'id' => array(
'validate_callback' => array( __CLASS__, 'validate_id' ),
),
),
'permission_callback' => 'is_user_logged_in',
),
);
}
/**
* Create new attachment
*
* @param WP_REST_Request $request - request object.
* @return WP_Error|WP_REST_Response
*/
public static function new_attachment( $request ) {
$file_parameters = $request->get_file_params();
if ( ! isset( $file_parameters['file'] ) ) {
return new WP_Error( 'rest_missing_callback_param', 'Missing parameter(s): file', array( 'status' => 400 ) );
}
$file = $file_parameters['file'];
$file_settings = get_option( 'wpsc-gs-file-attachments' );
$filename = time() . '_' . sanitize_file_name( $file['name'] );
$extension = strtolower( pathinfo( $filename, PATHINFO_EXTENSION ) );
$today = new DateTime();
$upload_dir = wp_upload_dir();
// Allowed file extension.
$allowed_file_extensions = explode( ',', $file_settings['allowed-file-extensions'] );
$allowed_file_extensions = array_map( 'trim', $allowed_file_extensions );
$allowed_file_extensions = array_map( 'strtolower', $allowed_file_extensions );
if ( ! ( in_array( $extension, $allowed_file_extensions ) ) ) {
wp_send_json_error( 'File extension not allowed!', 400 );
}
// Allowed file size.
$allowed_file_size = intval( $file_settings['attachments-max-filesize'] ) * 1000000;
if ( ! ( isset( $file['size'] ) && $file['size'] <= $allowed_file_size ) ) {
wp_send_json_error( 'File size exceeds allowed limit!', 400 );
}
// Init attachment data.
$data = array(
'name' => sanitize_file_name( $file['name'] ),
'date_created' => $today->format( 'Y-m-d H:i:s' ),
);
// Check for image type. Add a ".txt" extension to non-image file to prevent executing uploaded files on server.
$img_extensions = array( 'png', 'jpeg', 'jpg', 'bmp', 'pdf', 'gif' );
if ( ! in_array( $extension, $img_extensions ) ) {
$data['is_image'] = 0;
} else {
$data['is_image'] = 1;
}
// File path.
$file_path = $upload_dir['basedir'] . '/wpsc/' . $today->format( 'Y' ) . '/' . $today->format( 'm' );
if ( ! file_exists( $file_path ) ) {
mkdir( $file_path, 0755, true );
}
$file_path .= '/' . $filename;
$filepath_short = '/wpsc/' . $today->format( 'Y' ) . '/' . $today->format( 'm' ) . '/' . $filename;
$data['file_path'] = $filepath_short;
// Insert record in database.
if ( move_uploaded_file( $file['tmp_name'], $file_path ) ) {
$attachment = WPSC_Attachment::insert( $data );
if ( ! $attachment->id ) {
wp_send_json_error( 'Something went wrong, attachment record not created!', 500 );
}
$data = array(
'id' => intval( $attachment->id ),
'name' => $attachment->name,
);
return new WP_REST_Response( $data, 200 );
}
wp_send_json_error( 'Something went wrong, file not saved!', 500 );
}
/**
* Single attachment
*
* @param WP_REST_Request $request - request object.
* @return WP_Error|WP_REST_Response
*/
public static function get_individual_attachment( $request ) {
$current_user = WPSC_Current_User::$current_user;
$attachment = new WPSC_Attachment( $request->get_param( 'id' ) );
$url = home_url( '/' ) . '?wpsc_attachment=' . $attachment->id . '&user=' . $current_user->user->ID . '&auth_code=' . $current_user->get_attachment_auth();
$data = array(
'id' => intval( $attachment->id ),
'name' => $attachment->name,
'url' => $url,
);
return new WP_REST_Response( $data, 200 );
}
/**
* Validate id
*
* @param string $param - parameter value.
* @param WP_REST_Request $request - request object.
* @param string $key - filter key.
* @return boolean
*/
public static function validate_id( $param, $request, $key ) {
$current_user = WPSC_Current_User::$current_user;
$attachment = new WPSC_Attachment( $param );
if ( ! $attachment->id || ! $attachment->is_active ) {
return new WP_Error( 'invalid_id', 'Invalid attachment id', array( 'status' => 400 ) );
}
switch ( $attachment->source ) {
case 'cf':
if ( in_array( $cf->field, array( 'ticket', 'agentonly' ) ) ) { // ticket field.
$ticket = new WPSC_Ticket( $attachment->ticket_id );
if ( ! $ticket->id ) {
return new WP_Error( 'invalid_id', 'Invalid attachment id', array( 'status' => 400 ) );
}
WPSC_Individual_Ticket::$ticket = $ticket;
if ( ! (
( $current_user->is_agent && WPSC_Individual_Ticket::has_ticket_cap( 'view' ) ) ||
WPSC_Individual_Ticket::is_customer()
) ) {
return new WP_Error( 'unauthorized', 'You are not authorized to access this attachment!', array( 'status' => 401 ) );
}
} else { // customer field.
$customer = new WPSC_Customer( intval( $attachment->customer_id ) );
$ticket_widgets = get_option( 'wpsc-ticket-widget', array() );
$raised_by = $ticket_widgets['raised-by'];
if ( ! (
$current_user->customer->id == $customer->id ||
(
$current_user->is_agent &&
in_array( $current_user->agent->role, $raised_by['allowed-agent-roles'] )
) )
) {
return new WP_Error( 'unauthorized', 'You are not authorized to access this attachment!', array( 'status' => 401 ) );
}
}
break;
case 'reply':
case 'report':
$ticket = new WPSC_Ticket( $attachment->ticket_id );
if ( ! $ticket->id ) {
return new WP_Error( 'invalid_id', 'Invalid attachment id', array( 'status' => 400 ) );
}
WPSC_Individual_Ticket::$ticket = $ticket;
if ( ! (
( $current_user->is_agent && WPSC_Individual_Ticket::has_ticket_cap( 'view' ) ) ||
WPSC_Individual_Ticket::is_customer()
) ) {
return new WP_Error( 'unauthorized', 'You are not authorized to access this attachment!', array( 'status' => 401 ) );
}
break;
case 'note':
$ticket = new WPSC_Ticket( $attachment->ticket_id );
if ( ! $ticket->id ) {
return new WP_Error( 'invalid_id', 'Invalid attachment id', array( 'status' => 400 ) );
}
WPSC_Individual_Ticket::$ticket = $ticket;
if ( ! (
$current_user->is_agent && WPSC_Individual_Ticket::has_ticket_cap( 'pn' )
) ) {
return new WP_Error( 'unauthorized', 'You are not authorized to access this attachment!', array( 'status' => 401 ) );
}
break;
}
return true;
}
/**
* Check for rest attachment
*
* @return void
*/
public static function check_download_file() {
// phpcs:disable
if ( isset( $_REQUEST['wpsc_attachment'] ) && isset( $_REQUEST['user'] ) && isset( $_REQUEST['auth_code'] ) ) {
$user = get_user_by( 'id', intval( $_REQUEST['user'] ) );
if ( $user ) {
$current_user = WPSC_Current_User::change_current_user( $user->user_email );
if ( $_REQUEST['auth_code'] != $current_user->get_attachment_auth() ) {
wp_send_json_error( __( 'Unauthorized access!', 'supportcandy' ), 401 );
}
}
}
// phpcs:enable
}
}
endif;
WPSC_REST_Attachment::init();