WordPress.org
Get WordPress

Plugin Directory

Changeset 3391342


Ignore:
Timestamp:
11/06/2025 06:01:20 PM (5 months ago)
Author:
elextensions
Message:

Updated to v3.3.0

Location:
elex-helpdesk-customer-support-ticket-system
Files:
1 deleted
6 edited
21 copied

Legend:

Unmodified
Added
Removed

  • elex-helpdesk-customer-support-ticket-system/tags/3.3.0/elex-helpdesk-customer-support-ticket-system.php

    r3332203 r3391342  
    44 * Plugin URI: https://elextensions.com/plugin/wsdesk-wordpress-helpdesk-plugin-free-version/
    55 * Description: Enhances your customer service and enables efficient handling of customer issues.
    6  * Version: 3.2.9
     6 * Version: 3.3.0
    77 * Author: ELEXtensions
    88 * Author URI: https://elextensions.com/

  • elex-helpdesk-customer-support-ticket-system/tags/3.3.0/includes/class-crm-ajax-functions-three.php

    r3094599 r3391342  
    13941394                }
    13951395
     1396                // ✅ Secure MIME/type validation added here
     1397                self::eh_crm_validate_file_type( $files['name'][ $key ], $files['tmp_name'][ $key ] );
     1398
    13961399                $file              = array(
    13971400                    'name'     => time() . '.' . $file_ext,
    … …  
    14491452                }
    14501453
     1454                // ✅ Secure MIME/type validation using helper
     1455                self::eh_crm_validate_file_type( $files['name'][ $key ], $files['tmp_name'][ $key ] );
     1456
    14511457                add_filter( 'upload_dir', array( 'CRM_Ajax', 'wsdesk_upload_dir' ) );
    14521458
    … …  
    14711477
    14721478        return $attachment;
     1479    }
     1480
     1481    /**
     1482     * Validate uploaded file's MIME type and extension.
     1483     *
     1484     * @param string $file_name  The original file name.
     1485     * @param string $tmp_name   The temporary file path.
     1486     *
     1487     * @return void|array        Returns wp_check_filetype_and_ext result if valid, dies with JSON error otherwise.
     1488     */
     1489    public static function eh_crm_validate_file_type( $file_name, $tmp_name ) {
     1490        $original_filename = sanitize_file_name( $file_name );
     1491        $filetype          = wp_check_filetype_and_ext( $tmp_name, $original_filename );
     1492
     1493        if ( ! $filetype['ext'] || ! $filetype['type'] ) {
     1494            die(
     1495                wp_json_encode(
     1496                    array(
     1497                        'status'  => 'error',
     1498                        'message' => 'File type is not allowed.',
     1499                    )
     1500                )
     1501            );
     1502        }
     1503
     1504        return $filetype;
    14731505    }
    14741506

  • elex-helpdesk-customer-support-ticket-system/tags/3.3.0/includes/class-crm-ajax-functions.php

    r3094599 r3391342  
    258258
    259259    public static function eh_crm_ticket_single_view_client() {
    260         if ( wp_verify_nonce( isset( $_POST['nonce'] ) ? sanitize_text_field( $_POST['nonce'] ) : '', 'wsdesk_nonce' ) ) {
    261             $ticket_id = isset( $_POST['ticket_id'] ) ? sanitize_text_field( $_POST['ticket_id'] ) : '';
    262             $content   = self::eh_crm_ticket_single_view_client_gen( $ticket_id );
    263             wp_send_json_success( array( 'page' => $content ) );
    264             die;
    265         }
    266     }
     260        $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
     261        if ( ! wp_verify_nonce( $nonce, 'wsdesk_nonce' ) ) {
     262            wp_send_json_error( array( 'message' => __( 'Invalid request.', 'wsdesk' ) ), 400 );
     263            wp_die();
     264        }
     265
     266        $ticket_id = isset( $_POST['ticket_id'] ) ? absint( $_POST['ticket_id'] ) : 0;
     267        $current = eh_crm_get_ticket( array( 'ticket_id' => $ticket_id ) );
     268        if ( empty( $current ) || empty( $current[0]['ticket_author'] ) ) {
     269            wp_send_json_error( array( 'message' => __( 'Ticket not found or invalid.', 'wsdesk' ) ), 404 );
     270            wp_die();
     271        }
     272
     273        $ticket_author_id = intval( $current[0]['ticket_author'] );
     274        $current_user_id  = get_current_user_id();
     275
     276        $current_user = wp_get_current_user();
     277        $user_roles   = (array) $current_user->roles;
     278
     279        $allowed_roles = array( 'administrator', 'WSDesk_Agents', 'WSDesk_Supervisor' );
     280        $has_allowed_role = array_intersect( $allowed_roles, $user_roles );
     281
     282        if ( ( $ticket_author_id !== $current_user_id ) && empty( $has_allowed_role ) ) {
     283            wp_send_json_error( array( 'message' => __( 'You are not authorized to view this ticket.', 'wsdesk' ) ), 403 );
     284            wp_die();
     285        }
     286
     287        // Authorized → Generate content.
     288        $content = self::eh_crm_ticket_single_view_client_gen( $ticket_id );
     289
     290        wp_send_json_success( array( 'page' => $content ) );
     291        wp_die();
     292    }
     293
    267294
    268295    public static function eh_crm_ticket_single_view_client_gen( $ticket_id ) {
    … …  
    21032130                }
    21042131
     2132                self::eh_crm_validate_file_type( $files['name'][ $key ], $files['tmp_name'][ $key ] );
     2133
    21052134                $file = array(
    21062135                    'name'     => microtime( true ) . '.' . $file_ext,

  • elex-helpdesk-customer-support-ticket-system/tags/3.3.0/readme.txt

    r3332203 r3391342  
    55Tested up to: 6.8
    66Requires PHP: 7.1.8
    7 Stable tag: 3.2.9
     7Stable tag: 3.3.0
    88License: GPLv2 or later
    99URI: https://elextensions.com/plugin/wsdesk-wordpress-helpdesk-plugin-free-version/
    … …  
    121121== Changelog ==
    122122
     123= 3.3.0 =
     124* Code cleanup and Improvement.
     125
    123126= 3.2.9 =
    124127* Made compatible with WooCommerce 10.0.0
    … …  
    201204== Upgrade Notice ==
    202205
     206= 3.3.0 =
     207* Code cleanup and Improvement.
     208
    203209= 3.2.9 =
    204210* Made compatible with WooCommerce 10.0.0

  • elex-helpdesk-customer-support-ticket-system/trunk/elex-helpdesk-customer-support-ticket-system.php

    r3332203 r3391342  
    44 * Plugin URI: https://elextensions.com/plugin/wsdesk-wordpress-helpdesk-plugin-free-version/
    55 * Description: Enhances your customer service and enables efficient handling of customer issues.
    6  * Version: 3.2.9
     6 * Version: 3.3.0
    77 * Author: ELEXtensions
    88 * Author URI: https://elextensions.com/

  • elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-ajax-functions-three.php

    r3094599 r3391342  
    13941394                }
    13951395
     1396                // ✅ Secure MIME/type validation added here
     1397                self::eh_crm_validate_file_type( $files['name'][ $key ], $files['tmp_name'][ $key ] );
     1398
    13961399                $file              = array(
    13971400                    'name'     => time() . '.' . $file_ext,
    … …  
    14491452                }
    14501453
     1454                // ✅ Secure MIME/type validation using helper
     1455                self::eh_crm_validate_file_type( $files['name'][ $key ], $files['tmp_name'][ $key ] );
     1456
    14511457                add_filter( 'upload_dir', array( 'CRM_Ajax', 'wsdesk_upload_dir' ) );
    14521458
    … …  
    14711477
    14721478        return $attachment;
     1479    }
     1480
     1481    /**
     1482     * Validate uploaded file's MIME type and extension.
     1483     *
     1484     * @param string $file_name  The original file name.
     1485     * @param string $tmp_name   The temporary file path.
     1486     *
     1487     * @return void|array        Returns wp_check_filetype_and_ext result if valid, dies with JSON error otherwise.
     1488     */
     1489    public static function eh_crm_validate_file_type( $file_name, $tmp_name ) {
     1490        $original_filename = sanitize_file_name( $file_name );
     1491        $filetype          = wp_check_filetype_and_ext( $tmp_name, $original_filename );
     1492
     1493        if ( ! $filetype['ext'] || ! $filetype['type'] ) {
     1494            die(
     1495                wp_json_encode(
     1496                    array(
     1497                        'status'  => 'error',
     1498                        'message' => 'File type is not allowed.',
     1499                    )
     1500                )
     1501            );
     1502        }
     1503
     1504        return $filetype;
    14731505    }
    14741506

  • elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-ajax-functions.php

    r3094599 r3391342  
    258258
    259259    public static function eh_crm_ticket_single_view_client() {
    260         if ( wp_verify_nonce( isset( $_POST['nonce'] ) ? sanitize_text_field( $_POST['nonce'] ) : '', 'wsdesk_nonce' ) ) {
    261             $ticket_id = isset( $_POST['ticket_id'] ) ? sanitize_text_field( $_POST['ticket_id'] ) : '';
    262             $content   = self::eh_crm_ticket_single_view_client_gen( $ticket_id );
    263             wp_send_json_success( array( 'page' => $content ) );
    264             die;
    265         }
    266     }
     260        $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
     261        if ( ! wp_verify_nonce( $nonce, 'wsdesk_nonce' ) ) {
     262            wp_send_json_error( array( 'message' => __( 'Invalid request.', 'wsdesk' ) ), 400 );
     263            wp_die();
     264        }
     265
     266        $ticket_id = isset( $_POST['ticket_id'] ) ? absint( $_POST['ticket_id'] ) : 0;
     267        $current = eh_crm_get_ticket( array( 'ticket_id' => $ticket_id ) );
     268        if ( empty( $current ) || empty( $current[0]['ticket_author'] ) ) {
     269            wp_send_json_error( array( 'message' => __( 'Ticket not found or invalid.', 'wsdesk' ) ), 404 );
     270            wp_die();
     271        }
     272
     273        $ticket_author_id = intval( $current[0]['ticket_author'] );
     274        $current_user_id  = get_current_user_id();
     275
     276        $current_user = wp_get_current_user();
     277        $user_roles   = (array) $current_user->roles;
     278
     279        $allowed_roles = array( 'administrator', 'WSDesk_Agents', 'WSDesk_Supervisor' );
     280        $has_allowed_role = array_intersect( $allowed_roles, $user_roles );
     281
     282        if ( ( $ticket_author_id !== $current_user_id ) && empty( $has_allowed_role ) ) {
     283            wp_send_json_error( array( 'message' => __( 'You are not authorized to view this ticket.', 'wsdesk' ) ), 403 );
     284            wp_die();
     285        }
     286
     287        // Authorized → Generate content.
     288        $content = self::eh_crm_ticket_single_view_client_gen( $ticket_id );
     289
     290        wp_send_json_success( array( 'page' => $content ) );
     291        wp_die();
     292    }
     293
    267294
    268295    public static function eh_crm_ticket_single_view_client_gen( $ticket_id ) {
    … …  
    21032130                }
    21042131
     2132                self::eh_crm_validate_file_type( $files['name'][ $key ], $files['tmp_name'][ $key ] );
     2133
    21052134                $file = array(
    21062135                    'name'     => microtime( true ) . '.' . $file_ext,

  • elex-helpdesk-customer-support-ticket-system/trunk/readme.txt

    r3332203 r3391342  
    55Tested up to: 6.8
    66Requires PHP: 7.1.8
    7 Stable tag: 3.2.9
     7Stable tag: 3.3.0
    88License: GPLv2 or later
    99URI: https://elextensions.com/plugin/wsdesk-wordpress-helpdesk-plugin-free-version/
    … …  
    121121== Changelog ==
    122122
     123= 3.3.0 =
     124* Code cleanup and Improvement.
     125
    123126= 3.2.9 =
    124127* Made compatible with WooCommerce 10.0.0
    … …  
    201204== Upgrade Notice ==
    202205
     206= 3.3.0 =
     207* Code cleanup and Improvement.
     208
    203209= 3.2.9 =
    204210* Made compatible with WooCommerce 10.0.0
Note: See TracChangeset for help on using the changeset viewer.