FileXXXXXXXXXXX

dvadf

File manager - Edit - /home/centroca/public_html/wp/wp-content/plugins/nextgen-gallery/src/Legacy/admin/ajax.php

Back
<?php add_action( 'wp_ajax_ngg_ajax_operation', 'ngg_ajax_operation' ); /** * Resolve an NGG image id to its parent gallery's author and check current user can edit. * * Owner of the parent gallery, or holder of 'NextGEN Manage others gallery', passes. * Missing image returns true so the caller emits its own not-found response shape. * * @param int $image_id NGG picture id (pid). * @return bool / function ngg_ajax_user_can_edit_image( $image_id ) { $image_id = (int) $image_id; if ( $image_id <= 0 ) { return false; } $image = nggdb::find_image( $image_id ); if ( ! $image ) { return true; } $gallery_id = isset( $image->galleryid ) ? (int) $image->galleryid : 0; if ( $gallery_id <= 0 ) { // phpcs:ignore WordPress.WP.Capabilities.Unknown return current_user_can( 'NextGEN Manage others gallery' ); } $gallery = \Imagely\NGG\DataMappers\Gallery::get_instance()->find( $gallery_id ); if ( ! $gallery ) { // phpcs:ignore WordPress.WP.Capabilities.Unknown return current_user_can( 'NextGEN Manage others gallery' ); } if ( get_current_user_id() === (int) $gallery->author ) { return true; } // phpcs:ignore WordPress.WP.Capabilities.Unknown return current_user_can( 'NextGEN Manage others gallery' ); } /* * Image edit functions via AJAX * * @author Alex Rabe * * @return void / function ngg_ajax_operation() { // if nonce is not correct it returns -1. // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- check_ajax_referer handles nonce verification internally check_ajax_referer( 'ngg-ajax', 'nonce' ); // check for correct capability. if ( ! is_user_logged_in() ) { die( '-1' ); } if ( ! wp_verify_nonce( isset( $_POST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ) : '', 'ngg-ajax' ) ) { die( '-1' ); } // check for correct NextGEN capability. // phpcs:ignore WordPress.WP.Capabilities.Unknown if ( ! current_user_can( 'NextGEN Upload images' ) && ! current_user_can( 'NextGEN Manage gallery' ) ) { die( '-1' ); } // include the ngg function. include_once __DIR__ . '/functions.php'; // Get the image id. if ( isset( $_POST['image'] ) ) { $id = (int) sanitize_text_field( wp_unslash( $_POST['image'] ) ); if ( ! ngg_ajax_user_can_edit_image( $id ) ) { die( '-1' ); } // let's get the image data. // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- $_POST['image'] is sanitized on line 36 $picture = nggdb::find_image( $id ); // what do you want to do ? $operation = isset( $_POST['operation'] ) ? sanitize_text_field( wp_unslash( $_POST['operation'] ) ) : ''; // Bounds the dynamic ngg_ajax_<operation> hook to addon-registered op names. $allowed_dynamic_operations = (array) apply_filters( 'ngg_ajax_operation_allowlist', [] ); switch ( $operation ) { case 'create_thumbnail': $result = nggAdmin::create_thumbnail( $picture ); break; case 'resize_image': $result = nggAdmin::resize_image( $picture ); break; case 'rotate_cw': $result = nggAdmin::rotate_image( $picture, 'CW' ); nggAdmin::create_thumbnail( $picture ); break; case 'rotate_ccw': $result = nggAdmin::rotate_image( $picture, 'CCW' ); nggAdmin::create_thumbnail( $picture ); break; case 'set_watermark': $result = nggAdmin::set_watermark( $picture ); break; case 'recover_image': $result = nggAdmin::recover_image( $id ) ? '1' : '0'; break; case 'import_metadata': $result = \Imagely\NGG\DataMappers\Image::get_instance()->reimport_metadata( $id ) ? '1' : '0'; break; case 'get_image_ids': $result = nggAdmin::get_image_ids( $id ); break; // This will read the EXIF and then write it with the Orientation tag reset. case 'strip_orientation_tag': $storage = \Imagely\NGG\DataStorage\Manager::get_instance(); $image_path = $storage->get_image_abspath( $id ); $backup_path = $image_path . '_backup'; // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged $exif_abspath = @file_exists( $backup_path ) ? $backup_path : $image_path; // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged $exif_iptc = @\Imagely\NGG\DataStorage\EXIFWriter::read_metadata( $exif_abspath ); foreach ( $storage->get_image_sizes( $id ) as $size ) { if ( $size === 'backup' ) { continue; } // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged @\Imagely\NGG\DataStorage\EXIFWriter::write_metadata( $storage->get_image_abspath( $id, $size ), $exif_iptc ); } $result = '1'; break; default: if ( $operation !== '' && in_array( $operation, $allowed_dynamic_operations, true ) ) { do_action( 'ngg_ajax_' . $operation, $id ); } die( '-1' ); } // A success should return a '1'. // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $result contains safe response data for AJAX die( $result ); } // The script should never stop here. die( '0' ); } add_action( 'wp_ajax_createNewThumb', 'createNewThumb' ); function createNewThumb() { // check for correct capability. if ( ! is_user_logged_in() ) { die( '-1' ); } // check for correct NextGEN capability. // phpcs:ignore WordPress.WP.Capabilities.Unknown if ( ! current_user_can( 'NextGEN Manage gallery' ) ) { die( '-1' ); } if ( ! wp_verify_nonce( isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '', 'ngg_update_thumbnail' ) ) { die( '-1' ); } $id = (int) ( isset( $_POST['id'] ) ? sanitize_text_field( wp_unslash( $_POST['id'] ) ) : 0 ); if ( ! ngg_ajax_user_can_edit_image( $id ) ) { die( '-1' ); } $x = round( ( isset( $_POST['x'] ) ? floatval( sanitize_text_field( wp_unslash( $_POST['x'] ) ) ) : 0 ) ( isset( $_POST['rr'] ) ? floatval( sanitize_text_field( wp_unslash( $_POST['rr'] ) ) ) : 1 ), 0 ); $y = round( ( isset( $_POST['y'] ) ? floatval( sanitize_text_field( wp_unslash( $_POST['y'] ) ) ) : 0 ) * ( isset( $_POST['rr'] ) ? floatval( sanitize_text_field( wp_unslash( $_POST['rr'] ) ) ) : 1 ), 0 ); $w = round( ( isset( $_POST['w'] ) ? floatval( sanitize_text_field( wp_unslash( $_POST['w'] ) ) ) : 0 ) * ( isset( $_POST['rr'] ) ? floatval( sanitize_text_field( wp_unslash( $_POST['rr'] ) ) ) : 1 ), 0 ); $h = round( ( isset( $_POST['h'] ) ? floatval( sanitize_text_field( wp_unslash( $_POST['h'] ) ) ) : 0 ) * ( isset( $_POST['rr'] ) ? floatval( sanitize_text_field( wp_unslash( $_POST['rr'] ) ) ) : 1 ), 0 ); $crop_frame = [ 'x' => $x, 'y' => $y, 'width' => $w, 'height' => $h, ]; $storage = \Imagely\NGG\DataStorage\Manager::get_instance(); // XXX NextGEN Legacy wasn't handling watermarks or reflections at this stage, so we're forcefully disabling them to maintain compatibility. $params = [ 'watermark' => false, 'reflection' => false, 'crop' => true, 'crop_frame' => $crop_frame, ]; $result = $storage->generate_thumbnail( $id, $params ); if ( $result ) { echo 'OK'; } else { header( 'HTTP/1.1 500 Internal Server Error' ); echo 'KO'; } exit(); } add_action( 'wp_ajax_rotateImage', 'ngg_rotateImage' ); function ngg_rotateImage() { // check for correct capability. if ( ! is_user_logged_in() ) { die( '-1' ); } if ( ! wp_verify_nonce( isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '', 'ngg-rotate-image' ) ) { die( '-1' ); } // check for correct NextGEN capability. // phpcs:ignore WordPress.WP.Capabilities.Unknown if ( ! current_user_can( 'NextGEN Manage gallery' ) ) { die( '-1' ); } require_once dirname( __DIR__ ) . '/ngg-config.php'; // include the ngg function. include_once __DIR__ . '/functions.php'; $id = (int) ( isset( $_POST['id'] ) ? sanitize_text_field( wp_unslash( $_POST['id'] ) ) : 0 ); if ( ! ngg_ajax_user_can_edit_image( $id ) ) { die( '-1' ); } $result = '-1'; $ra = isset( $_POST['ra'] ) ? sanitize_text_field( wp_unslash( $_POST['ra'] ) ) : ''; switch ( $ra ) { case 'cw': $result = nggAdmin::rotate_image( $id, 'CW' ); break; case 'ccw': $result = nggAdmin::rotate_image( $id, 'CCW' ); break; case 'fv': // Note: H/V have been inverted here to make it more intuitive. $result = nggAdmin::rotate_image( $id, 0, 'H' ); break; case 'fh': // Note: H/V have been inverted here to make it more intuitive. $result = nggAdmin::rotate_image( $id, 0, 'V' ); break; } // recreate the thumbnail. nggAdmin::create_thumbnail( $id ); if ( $result == 1 ) { die( '1' ); } header( 'HTTP/1.1 500 Internal Server Error' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $result contains safe error response data die( $result ); }

dvadf

dvadf