WordPress.org
Get WordPress

Plugin Directory

Changeset 3475121


Ignore:
Timestamp:
03/05/2026 05:19:49 AM (3 weeks ago)
Author:
glenwpcoder
Message:

Releasing Version 1.3.96

  • Bug Fix - replaced cookies with localstorage.
  • Security Issue Fixed (User able to upload php5-php8 and bypass blacklist extension)
Location:
drag-and-drop-multiple-file-upload-contact-form-7
Files:
33 added
7 edited

Legend:

Unmodified
Added
Removed

  • drag-and-drop-multiple-file-upload-contact-form-7/trunk/assets/js/codedropz-uploader-jquery.js

    r3428236 r3475121  
    33 * Copyright 2018 Glen Mongaya
    44 * CodeDrop Drag&Drop Uploader
    5  * @version 1.3.9.3
     5 * @version 1.3.9.6
    66 * @author CodeDropz, Glen Don L. Mongaya
    77 * @license The MIT License (MIT)
    … …  
    99
    1010// CodeDropz Drag and Drop Plugin
    11 !function(e){e.fn.CodeDropz_Uploader=function(a){this.each(function(){var d=e(this),r=e.extend({handler:d,color:"#000",background:"",server_max_error:"Uploaded file exceeds the maximum upload size of your server.",max_file:d.data("max")?d.data("max"):10,max_upload_size:d.data("limit")?d.data("limit"):"10485760",supported_type:d.data("type")?d.data("type"):"jpg|jpeg|JPG|png|gif|pdf|doc|docx|ppt|pptx|odt|avi|ogg|m4a|mov|mp3|mp4|mpg|wav|wmv|xls",text:"Drag & Drop Files Here",separator:"or",button_text:"Browse Files",on_success:""},a),t=d.data("name")+"_count_files";localStorage.setItem(t,1);var s='<div class="codedropz-upload-handler"><div class="codedropz-upload-container"><div class="codedropz-upload-inner"><'+dnd_cf7_uploader.drag_n_drop_upload.tag+">"+r.text+"</"+dnd_cf7_uploader.drag_n_drop_upload.tag+"><span>"+r.separator+'</span><div class="codedropz-btn-wrap"><a class="cd-upload-btn" href="#">'+r.button_text+'</a></div></div></div><span class="dnd-upload-counter"><span>0</span> '+dnd_cf7_uploader.dnd_text_counter+" "+parseInt(r.max_file)+"</span></div>";r.handler.wrapAll('<div class="codedropz-upload-wrapper"></div>'),r.supported_type=r.supported_type.replace(/[^a-zA-Z0-9| ]/g,"");var o=r.handler.parents("form"),n=r.handler.parents(".codedropz-upload-wrapper"),p=e('input[type="submit"], button[type="submit"]',o);r.handler.after(s),e(".codedropz-upload-handler",n).on("drag dragstart dragend dragover dragenter dragleave drop",function(e){e.preventDefault(),e.stopPropagation()}),e(".codedropz-upload-handler",n).on("dragover dragenter",function(a){e(this).addClass("codedropz-dragover")}),e(".codedropz-upload-handler",n).on("dragleave dragend drop",function(a){e(this).removeClass("codedropz-dragover")}),e("a.cd-upload-btn",n).on("click",function(e){e.preventDefault(),r.handler.val(null),r.handler.click()}),e(".codedropz-upload-handler",n).on("drop",function(e){l(e.originalEvent.dataTransfer.files,"drop")}),r.handler.on("change",function(e){l(this.files,"click")}),/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent)&&d.removeAttr("accept"),d.attr("data-random-id",function(e=20){let a="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ",d=a.length,r="";for(let t=0;t<e;t++){let s=Math.floor(Math.random()*d);r+=a[s]}let o=Math.floor(Date.now()/1e3);return r+o}());var l=function(a,s){if(!(!a.length>1)){var p=new FormData;p.append("action","dnd_codedropz_upload"),p.append("type",s),p.append("security",dnd_cf7_uploader.ajax_nonce),p.append("form_id",d.data("id")),p.append("upload_name",d.data("name")),p.append("upload_folder",d.data("random-id")),d.data("black-list")&&p.append("blacklist-types",d.data("black-list")),e("span.has-error",r.handler).remove(),e.each(a,function(a,s){if(void 0!==p.delete&&p.delete("upload-file"),localStorage.getItem(t)>r.max_file)return!e("span.has-error-msg",n).length>0&&(err_msg=dnd_cf7_uploader.drag_n_drop_upload.max_file_limit,e(".codedropz-upload-handler",n).next('<span class="has-error-msg">'+err_msg.replace("%count%",r.max_file)+"</span>")),!1;var l=i.createProgressBar(s),u=!1;s.size>r.max_upload_size&&(e(".dnd-upload-details",e("#"+l)).append('<span class="has-error">'+dnd_cf7_uploader.drag_n_drop_upload.large_file+"</span>"),u=!0),regex_type=RegExp("(.*?).("+r.supported_type+")$"),!1!==u||regex_type.test(s.name.toLowerCase())||(e(".dnd-upload-details",e("#"+l)).append('<span class="has-error">'+dnd_cf7_uploader.drag_n_drop_upload.inavalid_type+"</span>"),u=!0),localStorage.setItem(t,Number(localStorage.getItem(t))+1),!1===u&&(p.append("upload-file",s),e.ajax({url:r.ajax_url,type:o.attr("method"),data:p,dataType:"json",cache:!1,contentType:!1,processData:!1,xhr:function(){var e=new window.XMLHttpRequest;return e.upload.addEventListener("progress",function(e){if(e.lengthComputable){var a=parseInt(100*(e.loaded/e.total));i.setProgressBar(l,a-1)}},!1),e},complete:function(){i.setProgressBar(l,100)},success:function(a){a.success?(i.setProgressBar(l,100),e.isFunction(r.on_success)&&r.on_success.call(this,d,l,a)):(e(".dnd-progress-bar",e("#"+l)).remove(),e(".dnd-upload-details",e("#"+l)).append('<span class="has-error">'+a.data+"</span>"),e('input[type="submit"], button[type="submit"]',o).removeClass("disabled").prop("disabled",!1),e("#"+l).removeClass("in-progress"))},error:function(a,d,t){e(".dnd-progress-bar",e("#"+l)).remove(),e(".dnd-upload-details",e("#"+l)).append('<span class="has-error">'+r.server_max_error+"</span>"),e('input[type="submit"],button[type="submit"]',o).removeClass("disabled").prop("disabled",!1),e("#"+l).removeClass("in-progress")}}))})}},i={createProgressBar:function(a){var d=e(".codedropz-upload-handler",n),r="dnd-file-"+Math.random().toString(36).substr(2,9),s='<div class="dnd-upload-image"><span class="file"></span></div><div class="dnd-upload-details"><span class="name"><span>'+a.name+"</span><em>("+i.bytesToSize(a.size)+')</em></span><a href="#" title="'+dnd_cf7_uploader.drag_n_drop_upload.delete.title+'" class="remove-file" data-storage="'+t+'"><span class="dnd-icon-remove"></span></a><span class="dnd-progress-bar"><span></span></span></div>';return d.after('<div id="'+r+'" class="dnd-upload-status">'+s+"</div>"),r},setProgressBar:function(a,d){var r=e(".dnd-progress-bar",e("#"+a));return r.length>0&&(p&&i.disableBtn(p),progress_width=d*r.width()/100,e("#"+a).addClass("in-progress"),100==d?e("span",r).width("100%").text(d+"% "):e("span",r).animate({width:progress_width},10).text(d+"% "),100==d&&e("#"+a).addClass("complete").removeClass("in-progress")),!1},bytesToSize:function(e){return 0===e?"0":fileSize=(kBytes=e/1024)>=1024?(kBytes/1024).toFixed(2)+"MB":kBytes.toFixed(2)+"KB"},disableBtn:function(e){e.length>0&&e.addClass("disable").prop("disabled",!0)}}}),e(document).on("click",".dnd-icon-remove",function(d){d.preventDefault();var r=e(this),t=r.parents(".dnd-upload-status"),s=r.parents(".codedropz-upload-wrapper"),o=r.parent("a").attr("data-storage"),n=Number(localStorage.getItem(o));if(t.hasClass("in-progress"))return!1;if(e(".has-error",t).length>0)return t.remove(),localStorage.setItem(o,n-1),!1;r.addClass("deleting").text(dnd_cf7_uploader.drag_n_drop_upload.delete.text+"...");var p={path:t.find('input[type="hidden"]').val(),action:"dnd_codedropz_upload_delete",security:dnd_cf7_uploader.ajax_nonce};e.post(a.ajax_url,p,function(a){a.success?(t.remove(),localStorage.setItem(o,n-1),e(".dnd-upload-status",s).length<=1&&e("span.has-error-msg",s).remove(),e(".dnd-upload-counter span",s).text(Number(localStorage.getItem(o))-1)):e(".dnd-upload-details",t).append('<span class="has-error-msg">'+a.data+"</span>")}),e("span.has-error-msg").remove()})}}(jQuery);
    12 // End CodeDropz fn.
     11!function(e){e.fn.CodeDropz_Uploader=function(a){this.each(function(){var d=e(this),r=e.extend({handler:d,color:"#000",background:"",server_max_error:"Uploaded file exceeds the maximum upload size of your server.",max_file:d.data("max")?d.data("max"):10,max_upload_size:d.data("limit")?d.data("limit"):"10485760",supported_type:d.data("type")?d.data("type"):"jpg|jpeg|JPG|png|gif|pdf|doc|docx|ppt|pptx|odt|avi|ogg|m4a|mov|mp3|mp4|mpg|wav|wmv|xls",text:"Drag & Drop Files Here",separator:"or",button_text:"Browse Files",on_success:""},a);let t=function(e=20){let a=new Uint8Array(16);crypto.getRandomValues(a),a[6]=15&a[6]|64,a[8]=63&a[8]|128;let d=Array.from(a,e=>e.toString(16).padStart(2,"0")).join("");return d.replace(/^(.{8})(.{4})(.{4})(.{4})(.{12})$/,"$1-$2-$3-$4-$5")};var s=d.data("name")+"_count_files";localStorage.setItem(s,1);var n=dnd_upload_cf7_unique_id();n||(n=t(),localStorage.setItem("dnd_wpcf7_session_id",JSON.stringify({value:n,savedAt:Date.now()})));var o='<div class="codedropz-upload-handler"><div class="codedropz-upload-container"><div class="codedropz-upload-inner"><'+dnd_cf7_uploader.drag_n_drop_upload.tag+">"+r.text+"</"+dnd_cf7_uploader.drag_n_drop_upload.tag+"><span>"+r.separator+'</span><div class="codedropz-btn-wrap"><a class="cd-upload-btn" href="#">'+r.button_text+'</a></div></div></div><span class="dnd-upload-counter"><span>0</span> '+dnd_cf7_uploader.dnd_text_counter+" "+parseInt(r.max_file)+"</span></div>";r.handler.wrapAll('<div class="codedropz-upload-wrapper"></div>'),r.supported_type=r.supported_type.replace(/[^a-zA-Z0-9| ]/g,"");var p=r.handler.parents("form"),l=r.handler.parents(".codedropz-upload-wrapper"),i=e('input[type="submit"], button[type="submit"]',p);r.handler.after(o),e(".codedropz-upload-handler",l).on("drag dragstart dragend dragover dragenter dragleave drop",function(e){e.preventDefault(),e.stopPropagation()}),e(".codedropz-upload-handler",l).on("dragover dragenter",function(a){e(this).addClass("codedropz-dragover")}),e(".codedropz-upload-handler",l).on("dragleave dragend drop",function(a){e(this).removeClass("codedropz-dragover")}),e("a.cd-upload-btn",l).on("click",function(e){e.preventDefault(),r.handler.val(null),r.handler.click()}),e(".codedropz-upload-handler",l).on("drop",function(e){u(e.originalEvent.dataTransfer.files,"drop")}),r.handler.on("change",function(e){u(this.files,"click")}),/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent)&&d.removeAttr("accept"),d.attr("data-random-id",t());var u=function(a,t){if(!(!a.length>1)){var o=new FormData;o.append("action","dnd_codedropz_upload"),o.append("type",t),o.append("security",dnd_cf7_uploader.ajax_nonce),o.append("form_id",d.data("id")),o.append("upload_name",d.data("name")),o.append("upload_folder",n),d.data("black-list")&&o.append("blacklist-types",d.data("black-list")),e("span.has-error",r.handler).remove(),e.each(a,function(a,t){if(void 0!==o.delete&&o.delete("upload-file"),localStorage.getItem(s)>r.max_file)return!e("span.has-error-msg",l).length>0&&(err_msg=dnd_cf7_uploader.drag_n_drop_upload.max_file_limit,e(".codedropz-upload-handler",l).next('<span class="has-error-msg">'+err_msg.replace("%count%",r.max_file)+"</span>")),!1;var n=c.createProgressBar(t),i=!1;t.size>r.max_upload_size&&(e(".dnd-upload-details",e("#"+n)).append('<span class="has-error">'+dnd_cf7_uploader.drag_n_drop_upload.large_file+"</span>"),i=!0),regex_type=RegExp("(.*?).("+r.supported_type+")$"),!1!==i||regex_type.test(t.name.toLowerCase())||(e(".dnd-upload-details",e("#"+n)).append('<span class="has-error">'+dnd_cf7_uploader.drag_n_drop_upload.inavalid_type+"</span>"),i=!0),localStorage.setItem(s,Number(localStorage.getItem(s))+1),!1===i&&(o.append("upload-file",t),e.ajax({url:r.ajax_url,type:p.attr("method"),data:o,dataType:"json",cache:!1,contentType:!1,processData:!1,xhr:function(){var e=new window.XMLHttpRequest;return e.upload.addEventListener("progress",function(e){if(e.lengthComputable){var a=parseInt(100*(e.loaded/e.total));c.setProgressBar(n,a-1)}},!1),e},complete:function(){c.setProgressBar(n,100)},success:function(a){a.success?(c.setProgressBar(n,100),e.isFunction(r.on_success)&&r.on_success.call(this,d,n,a)):(e(".dnd-progress-bar",e("#"+n)).remove(),e(".dnd-upload-details",e("#"+n)).append('<span class="has-error">'+a.data+"</span>"),e('input[type="submit"], button[type="submit"]',p).removeClass("disabled").prop("disabled",!1),e("#"+n).removeClass("in-progress"))},error:function(a,d,t){e(".dnd-progress-bar",e("#"+n)).remove(),e(".dnd-upload-details",e("#"+n)).append('<span class="has-error">'+r.server_max_error+"</span>"),e('input[type="submit"],button[type="submit"]',p).removeClass("disabled").prop("disabled",!1),e("#"+n).removeClass("in-progress")}}))})}},c={createProgressBar:function(a){var d=e(".codedropz-upload-handler",l),r="dnd-file-"+Math.random().toString(36).substr(2,9),t='<div class="dnd-upload-image"><span class="file"></span></div><div class="dnd-upload-details"><span class="name"><span>'+a.name+"</span><em>("+c.bytesToSize(a.size)+')</em></span><a href="#" title="'+dnd_cf7_uploader.drag_n_drop_upload.delete.title+'" class="remove-file" data-storage="'+s+'"><span class="dnd-icon-remove"></span></a><span class="dnd-progress-bar"><span></span></span></div>';return d.after('<div id="'+r+'" class="dnd-upload-status">'+t+"</div>"),r},setProgressBar:function(a,d){var r=e(".dnd-progress-bar",e("#"+a));return r.length>0&&(i&&c.disableBtn(i),progress_width=d*r.width()/100,e("#"+a).addClass("in-progress"),100==d?e("span",r).width("100%").text(d+"% "):e("span",r).animate({width:progress_width},10).text(d+"% "),100==d&&e("#"+a).addClass("complete").removeClass("in-progress")),!1},bytesToSize:function(e){return 0===e?"0":fileSize=(kBytes=e/1024)>=1024?(kBytes/1024).toFixed(2)+"MB":kBytes.toFixed(2)+"KB"},disableBtn:function(e){e.length>0&&e.addClass("disabled").prop("disabled",!0)}}}),e(document).on("click",".dnd-icon-remove",function(d){d.preventDefault();var r=e(this),t=r.parents(".dnd-upload-status"),s=r.parents(".codedropz-upload-wrapper"),n=r.parent("a").attr("data-storage"),o=Number(localStorage.getItem(n)),p=dnd_upload_cf7_unique_id();if(t.hasClass("in-progress"))return!1;if(e(".has-error",t).length>0)return t.remove(),localStorage.setItem(n,o-1),!1;r.addClass("deleting").text(dnd_cf7_uploader.drag_n_drop_upload.delete.text+"...");var l={path:t.find('input[type="hidden"]').val(),action:"dnd_codedropz_upload_delete",security:dnd_cf7_uploader.ajax_nonce,upload_folder:p};e.post(a.ajax_url,l,function(a){a.success?(t.remove(),localStorage.setItem(n,o-1),e(".dnd-upload-status",s).length<=1&&e("span.has-error-msg",s).remove(),e(".dnd-upload-counter span",s).text(Number(localStorage.getItem(n))-1)):e(".dnd-upload-details",t).append('<span class="has-error-msg">'+a.data+"</span>")}),e("span.has-error-msg").remove()})}}(jQuery);
     12// End: CodeDropz Uploader
     13
     14// Get unique id. (reset after 24hours)
     15function dnd_upload_cf7_unique_id() {
     16    const item = localStorage.getItem('dnd_wpcf7_session_id');
     17    if ( ! item ) {
     18        return null;
     19    }
     20
     21    // Parse item
     22    const data = JSON.parse( item );
     23
     24    // Compare date
     25    if ( Date.now() - data.savedAt > ( 24 * 60 * 60 * 1000 ) ) {
     26        localStorage.removeItem('dnd_wpcf7_session_id');
     27        return null;
     28    }
     29
     30    return data.value;
     31}
    1332
    1433jQuery(document).ready(function($){
    … …  
    7493                        const buttonSubmit = $('input[type="submit"], button[type="submit"]', $form);
    7594                        if( buttonSubmit ){
    76                             buttonSubmit.removeAttr('disabled');
     95                            buttonSubmit.removeClass('disabled').removeAttr('disabled');
    7796                        }
    7897                    }, 1);

  • drag-and-drop-multiple-file-upload-contact-form-7/trunk/assets/js/codedropz-uploader-min.js

    r3428236 r3475121  
    33 * Copyright 2018 Glen Mongaya
    44 * CodeDrop Drag&Drop Uploader
    5  * @version 1.3.9.3
     5 * @version 1.3.9.6
    66 * @author CodeDropz, Glen Don L. Mongaya
    77 * @license The MIT License (MIT)
    … …  
    99
    1010// CodeDropz Drag and Drop Plugin
    11 !function(){let e=function(e){let t=document.querySelector("form.wpcf7-form");if(t){let r=new FormData;r.append("action","_wpcf7_check_nonce"),r.append("_ajax_nonce",dnd_cf7_uploader.ajax_nonce),fetch(dnd_cf7_uploader.ajax_url,{method:"POST",body:r}).then(e=>e.json()).then(({data:e,success:t})=>t&&(dnd_cf7_uploader.ajax_nonce=e)).catch(console.error)}var a=this;let d={handler:a,color:"#000",background:"",server_max_error:"Uploaded file exceeds the maximum upload size of your server.",max_file:a.dataset.max?a.dataset.max:10,max_upload_size:a.dataset.limit?a.dataset.limit:"10485760",supported_type:a.dataset.type?a.dataset.type:"jpg|jpeg|JPG|png|gif|pdf|doc|docx|ppt|pptx|odt|avi|ogg|m4a|mov|mp3|mp4|mpg|wav|wmv|xls",text:"Drag & Drop Files Here",separator:"or",button_text:"Browse Files",on_success:""},o=Object.assign({},d,e);var n=a.dataset.name+"_count_files";localStorage.setItem(n,1);let s=`
     11!function(){let e=function(e){let t=document.querySelector("form.wpcf7-form");if(t){let a=new FormData;a.append("action","_wpcf7_check_nonce"),a.append("_ajax_nonce",dnd_cf7_uploader.ajax_nonce),fetch(dnd_cf7_uploader.ajax_url,{method:"POST",body:a}).then(e=>e.json()).then(({data:e,success:t})=>t&&(dnd_cf7_uploader.ajax_nonce=e)).catch(console.error)}var r=this;let d={handler:r,color:"#000",background:"",server_max_error:"Uploaded file exceeds the maximum upload size of your server.",max_file:r.dataset.max?r.dataset.max:10,max_upload_size:r.dataset.limit?r.dataset.limit:"10485760",supported_type:r.dataset.type?r.dataset.type:"jpg|jpeg|JPG|png|gif|pdf|doc|docx|ppt|pptx|odt|avi|ogg|m4a|mov|mp3|mp4|mpg|wav|wmv|xls",text:"Drag & Drop Files Here",separator:"or",button_text:"Browse Files",on_success:""},o=Object.assign({},d,e);var n=r.dataset.name+"_count_files";localStorage.setItem(n,1);var s=dnd_upload_cf7_unique_id();s||(s=function(e=20){let t=new Uint8Array(16);crypto.getRandomValues(t),t[6]=15&t[6]|64,t[8]=63&t[8]|128;let a=Array.from(t,e=>e.toString(16).padStart(2,"0")).join("");return a.replace(/^(.{8})(.{4})(.{4})(.{4})(.{12})$/,"$1-$2-$3-$4-$5")}(),localStorage.setItem("dnd_wpcf7_session_id",JSON.stringify({value:s,savedAt:Date.now()})));let l=`
    1212            <div class="codedropz-upload-handler">
    1313                <div class="codedropz-upload-container">
    … …  
    2020                <span class="dnd-upload-counter"><span>0</span> ${dnd_cf7_uploader.dnd_text_counter} ${parseInt(o.max_file)}</span>
    2121            </div>
    22         `,l=document.createElement("div");l.classList.add("codedropz-upload-wrapper"),o.handler.parentNode.insertBefore(l,o.handler),l.appendChild(o.handler),o.supported_type=o.supported_type.replace(/[^a-zA-Z0-9_| ]/g,"");let p=o.handler.closest("form"),i=o.handler.closest(".codedropz-upload-wrapper"),c=p.querySelector('input[type="submit"], button[type="submit"]');o.handler.insertAdjacentHTML("afterend",s),["drag","dragstart","dragend","dragover","dragenter","dragleave","drop"].forEach(function(e){i.querySelector(".codedropz-upload-handler").addEventListener(e,function(e){e.preventDefault(),e.stopPropagation()})}),["dragover","dragenter"].forEach(function(e){i.querySelector(".codedropz-upload-handler").addEventListener(e,function(e){i.querySelector(".codedropz-upload-handler").classList.add("codedropz-dragover")})}),["dragleave","dragend","drop"].forEach(function(e){i.querySelector(".codedropz-upload-handler").addEventListener(e,function(e){i.querySelector(".codedropz-upload-handler").classList.remove("codedropz-dragover")})}),i.querySelector(".cd-upload-btn").addEventListener("click",function(e){e.preventDefault(),o.handler.value=null,o.handler.click()}),i.querySelector(".codedropz-upload-handler").addEventListener("drop",function(e){u(e.dataTransfer.files,"drop")}),o.handler.addEventListener("change",function(e){u(this.files,"click")}),/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent)&&a.removeAttribute("accept"),a.setAttribute("data-random-id",function(e=20){let t="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ",r=t.length,a="";for(let d=0;d<e;d++){let o=Math.floor(Math.random()*r);a+=t[o]}let n=Math.floor(Date.now()/1e3);return a+n}());var u=function(e,t){if(0==e.length)return;var r=new FormData;r.append("action","dnd_codedropz_upload"),r.append("type",t),r.append("security",dnd_cf7_uploader.ajax_nonce),r.append("form_id",a.dataset.id),r.append("upload_name",a.dataset.name),r.append("upload_folder",a.getAttribute("data-random-id"));let d=o.handler.querySelector(".has-error"),s=i.querySelector(".codedropz-upload-handler");for(let l of(d&&d.remove(),e)){if(void 0!==r.delete&&r.delete("upload-file"),Number(localStorage.getItem(n))>o.max_file){if(!i.querySelector("span.has-error-msg")){var c=dnd_cf7_uploader.drag_n_drop_upload.max_file_limit,u=document.createElement("span");u.className="has-error-msg",u.textContent=c.replace("%count%",o.max_file),s.parentNode.insertBefore(u,s.nextSibling)}return!1}let f=m.createProgressBar(l);var g=!1;if(l.size>o.max_upload_size){let v=document.getElementById(f),h=document.createElement("span");h.classList.add("has-error"),h.textContent=dnd_cf7_uploader.drag_n_drop_upload.large_file,v.querySelector(".dnd-upload-details").appendChild(h),g=!0}if(regex_type=RegExp("(.*?).("+o.supported_type+")$"),!1!==g||regex_type.test(l.name.toLowerCase())||(document.querySelector("#"+f+" .dnd-upload-details").insertAdjacentHTML("beforeend",'<span class="has-error">'+dnd_cf7_uploader.drag_n_drop_upload.inavalid_type+"</span>"),g=!0),localStorage.setItem(n,Number(localStorage.getItem(n))+1),!1===g){r.append("upload-file",l);var y=new XMLHttpRequest;let x=document.getElementById(f),b=x.querySelector(".dnd-progress-bar"),S=x.querySelector(".dnd-upload-details"),$=p.querySelector('input[type="submit"], button[type="submit"]');y.open(p.getAttribute("method"),o.ajax_url),y.onreadystatechange=function(){if(4===this.readyState){if(200===this.status){var e=JSON.parse(this.responseText);e.success?(m.setProgressBar(f,100),"function"==typeof o.on_success&&o.on_success.call(this,a,f,e)):(b.remove(),S.insertAdjacentHTML("beforeend",'<span class="has-error">'+e.data+"</span>"),$&&($.classList.remove("disabled"),$.removeAttribute("disabled")),x.classList.remove("in-progress"))}else b.remove(),S.insertAdjacentHTML("beforeend",'<span class="has-error">'+o.server_max_error+"</span>"),$&&($.classList.remove("disabled"),$.removeAttribute("disabled")),x.classList.remove("in-progress")}},y.upload.addEventListener("progress",function(e){if(e.lengthComputable){var t=parseInt(100*(e.loaded/e.total));m.setProgressBar(f,t-1)}},!1),y.send(r)}}},m={createProgressBar:function(e){var t=i.querySelector(".codedropz-upload-handler"),r="dnd-file-"+Math.random().toString(36).substr(2,9),a=`
     22        `,p=document.createElement("div");p.classList.add("codedropz-upload-wrapper"),o.handler.parentNode.insertBefore(p,o.handler),p.appendChild(o.handler),o.supported_type=o.supported_type.replace(/[^a-zA-Z0-9| ]/g,"");let i=o.handler.closest("form"),c=o.handler.closest(".codedropz-upload-wrapper"),u=i.querySelector('input[type="submit"], button[type="submit"]');o.handler.insertAdjacentHTML("afterend",l),["drag","dragstart","dragend","dragover","dragenter","dragleave","drop"].forEach(function(e){c.querySelector(".codedropz-upload-handler").addEventListener(e,function(e){e.preventDefault(),e.stopPropagation()})}),["dragover","dragenter"].forEach(function(e){c.querySelector(".codedropz-upload-handler").addEventListener(e,function(e){c.querySelector(".codedropz-upload-handler").classList.add("codedropz-dragover")})}),["dragleave","dragend","drop"].forEach(function(e){c.querySelector(".codedropz-upload-handler").addEventListener(e,function(e){c.querySelector(".codedropz-upload-handler").classList.remove("codedropz-dragover")})}),c.querySelector(".cd-upload-btn").addEventListener("click",function(e){e.preventDefault(),o.handler.value=null,o.handler.click()}),c.querySelector(".codedropz-upload-handler").addEventListener("drop",function(e){m(e.dataTransfer.files,"drop")}),o.handler.addEventListener("change",function(e){m(this.files,"click")}),/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent)&&r.removeAttribute("accept");var m=function(e,t){if(0==e.length)return;var a=new FormData;a.append("action","dnd_codedropz_upload"),a.append("type",t),a.append("security",dnd_cf7_uploader.ajax_nonce),a.append("form_id",r.dataset.id),a.append("upload_name",r.dataset.name),a.append("upload_folder",s);let d=o.handler.querySelector(".has-error"),l=c.querySelector(".codedropz-upload-handler");for(let p of(d&&d.remove(),e)){if(void 0!==a.delete&&a.delete("upload-file"),Number(localStorage.getItem(n))>o.max_file){if(!c.querySelector("span.has-error-msg")){var u=dnd_cf7_uploader.drag_n_drop_upload.max_file_limit,m=document.createElement("span");m.className="has-error-msg",m.textContent=u.replace("%count%",o.max_file),l.parentNode.insertBefore(m,l.nextSibling)}return!1}let g=f.createProgressBar(p);var v=!1;if(p.size>o.max_upload_size){let h=document.getElementById(g),y=document.createElement("span");y.classList.add("has-error"),y.textContent=dnd_cf7_uploader.drag_n_drop_upload.large_file,h.querySelector(".dnd-upload-details").appendChild(y),v=!0}if(regex_type=RegExp("(.*?).("+o.supported_type+")$"),!1!==v||regex_type.test(p.name.toLowerCase())||(document.querySelector("#"+g+" .dnd-upload-details").insertAdjacentHTML("beforeend",'<span class="has-error">'+dnd_cf7_uploader.drag_n_drop_upload.inavalid_type+"</span>"),v=!0),localStorage.setItem(n,Number(localStorage.getItem(n))+1),!1===v){a.append("upload-file",p);var x=new XMLHttpRequest;let $=document.getElementById(g),S=$.querySelector(".dnd-progress-bar"),b=$.querySelector(".dnd-upload-details"),q=i.querySelector('input[type="submit"], button[type="submit"]');x.open(i.getAttribute("method"),o.ajax_url),x.onreadystatechange=function(){if(4===this.readyState){if(200===this.status){var e=JSON.parse(this.responseText);e.success?(f.setProgressBar(g,100),"function"==typeof o.on_success&&o.on_success.call(this,r,g,e)):(S.remove(),b.insertAdjacentHTML("beforeend",'<span class="has-error">'+e.data+"</span>"),q&&(q.classList.remove("disabled"),q.removeAttribute("disabled")),$.classList.remove("in-progress"))}else S.remove(),b.insertAdjacentHTML("beforeend",'<span class="has-error">'+o.server_max_error+"</span>"),q&&(q.classList.remove("disabled"),q.removeAttribute("disabled")),$.classList.remove("in-progress")}},x.upload.addEventListener("progress",function(e){if(e.lengthComputable){var t=parseInt(100*(e.loaded/e.total));f.setProgressBar(g,t-1)}},!1),x.send(a)}}},f={createProgressBar:function(e){var t=c.querySelector(".codedropz-upload-handler"),a="dnd-file-"+Math.random().toString(36).substr(2,9),r=`
    2323                    <div class="dnd-upload-image">
    2424                        <span class="file"></span>
    2525                    </div>
    2626                    <div class="dnd-upload-details">
    27                         <span class="name"><span>${e.name}</span><em>(${m.bytesToSize(e.size)})</em></span>
     27                        <span class="name"><span>${e.name}</span><em>(${f.bytesToSize(e.size)})</em></span>
    2828                        <a href="#" title="${dnd_cf7_uploader.drag_n_drop_upload.delete.title}" class="remove-file" data-storage="${n}">
    2929                        <span class="dnd-icon-remove"></span>
    … …  
    3131                        <span class="dnd-progress-bar"><span></span></span>
    3232                    </div>
    33                 `,d=document.createElement("div");return d.id=r,d.className="dnd-upload-status",d.innerHTML=a,t.parentNode.insertBefore(d,t.nextSibling),r},setProgressBar:function(e,t){let r=document.getElementById(e),a=r.querySelector(".dnd-progress-bar");if(a){c&&m.disableBtn(c);let d=t*a.offsetWidth/100;r.classList.add("in-progress"),100==t?(a.querySelector("span").style.width="100%",a.querySelector("span").textContent=`${t}% `):(a.querySelector("span").style.width=d+"px",a.querySelector("span").textContent=`${t}% `),100==t&&(r.classList.add("complete"),r.classList.remove("in-progress"))}return!1},bytesToSize:function(e){return 0===e?"0":fileSize=(kBytes=e/1024)>=1024?(kBytes/1024).toFixed(2)+"MB":kBytes.toFixed(2)+"KB"},disableBtn:function(e){e&&(e.classList.add("disabled"),e.disabled=!0)}}};document.addEventListener("click",function(e){if(e.target.classList.contains("dnd-icon-remove")){e.preventDefault();var t=e.target,r=t.closest(".dnd-upload-status"),a=t.closest(".codedropz-upload-wrapper"),d=t.parentElement.getAttribute("data-storage"),o=Number(localStorage.getItem(d));if(r.classList.contains("in-progress")||r.querySelector(".has-error"))return r.remove(),localStorage.setItem(d,o-1),!1;t.classList.add("deleting"),t.textContent=dnd_cf7_uploader.drag_n_drop_upload.delete.text+"...";var n=new XMLHttpRequest;n.open("POST",dnd_cf7_uploader.ajax_url),n.setRequestHeader("Content-Type","application/x-www-form-urlencoded"),n.onload=function(){if(200===this.status){var e=JSON.parse(this.responseText);if(e.success)r.remove(),localStorage.setItem(d,o-1),a.querySelectorAll(".dnd-upload-status").length<=1&&a.querySelector(".has-error-msg")&&a.querySelector(".has-error-msg").remove(),a.querySelector(".dnd-upload-counter span").textContent=Number(localStorage.getItem(d))-1;else{let t=r.querySelector(".dnd-upload-details");if(t){let n=document.createElement("span");n.classList.add("has-error-msg"),n.textContent=e.data,t.appendChild(n)}}}},n.send("path="+r.querySelector('input[type="hidden"]').value+"&action=dnd_codedropz_upload_delete&security="+dnd_cf7_uploader.ajax_nonce),document.querySelectorAll(".has-error-msg").forEach(function(e){e.remove()})}}),HTMLElement.prototype.CodeDropz_Uploader=e}();
     33                `,d=document.createElement("div");return d.id=a,d.className="dnd-upload-status",d.innerHTML=r,t.parentNode.insertBefore(d,t.nextSibling),a},setProgressBar:function(e,t){let a=document.getElementById(e),r=a.querySelector(".dnd-progress-bar");if(r){u&&f.disableBtn(u);let d=t*r.offsetWidth/100;a.classList.add("in-progress"),100==t?(r.querySelector("span").style.width="100%",r.querySelector("span").textContent=`${t}% `):(r.querySelector("span").style.width=d+"px",r.querySelector("span").textContent=`${t}% `),100==t&&(a.classList.add("complete"),a.classList.remove("in-progress"))}return!1},bytesToSize:function(e){return 0===e?"0":fileSize=(kBytes=e/1024)>=1024?(kBytes/1024).toFixed(2)+"MB":kBytes.toFixed(2)+"KB"},disableBtn:function(e){e&&(e.classList.add("disabled"),e.disabled=!0)}}};document.addEventListener("click",function(e){if(e.target.classList.contains("dnd-icon-remove")){e.preventDefault();var t=e.target,a=t.closest(".dnd-upload-status"),r=t.closest(".codedropz-upload-wrapper"),d=t.parentElement.getAttribute("data-storage"),o=Number(localStorage.getItem(d)),n=dnd_upload_cf7_unique_id();if(a.classList.contains("in-progress")||a.querySelector(".has-error"))return a.remove(),localStorage.setItem(d,o-1),!1;t.classList.add("deleting"),t.textContent=dnd_cf7_uploader.drag_n_drop_upload.delete.text+"...";var s=new XMLHttpRequest;s.open("POST",dnd_cf7_uploader.ajax_url),s.setRequestHeader("Content-Type","application/x-www-form-urlencoded"),s.onload=function(){if(200===this.status){var e=JSON.parse(this.responseText);if(e.success)a.remove(),localStorage.setItem(d,o-1),r.querySelectorAll(".dnd-upload-status").length<=1&&r.querySelector(".has-error-msg")&&r.querySelector(".has-error-msg").remove(),r.querySelector(".dnd-upload-counter span").textContent=Number(localStorage.getItem(d))-1;else{let t=a.querySelector(".dnd-upload-details");if(t){let n=document.createElement("span");n.classList.add("has-error-msg"),n.textContent=e.data,t.appendChild(n)}}}},s.send("path="+a.querySelector('input[type="hidden"]').value+"&action=dnd_codedropz_upload_delete&security="+dnd_cf7_uploader.ajax_nonce+"&upload_folder="+n),document.querySelectorAll(".has-error-msg").forEach(function(e){e.remove()})}}),HTMLElement.prototype.CodeDropz_Uploader=e}();
    3434// END: CodeDropz Uploader function
    3535
    … …  
    4242    });
    4343    target.dispatchEvent(event);
     44}
     45
     46// Get unique id. (reset after 24hours)
     47function dnd_upload_cf7_unique_id() {
     48    const item = localStorage.getItem('dnd_wpcf7_session_id');
     49    if ( ! item ) {
     50        return null;
     51    }
     52
     53    // Parse item
     54    const data = JSON.parse( item );
     55
     56    // Compare date
     57    if ( Date.now() - data.savedAt > ( 24 * 60 * 60 * 1000 ) ) {
     58        localStorage.removeItem('dnd_wpcf7_session_id');
     59        return null;
     60    }
     61
     62    return data.value;
    4463}
    4564

  • drag-and-drop-multiple-file-upload-contact-form-7/trunk/assets/js/dev/jquery-dev.js

    r3391555 r3475121  
    33 * Copyright 2018 Glen Mongaya
    44 * CodeDrop Drag&Drop Uploader
    5  * @version 1.3.8.7
     5 * @version 1.3.9.6
    66 * @author CodeDropz, Glen Don L. Mongaya
    77 * @license The MIT License (MIT)
    … …  
    3333            }, settings);
    3434
     35            // Generate random string
     36            const generateRandomFolder = function( length = 20 ) {
     37                const bytes = new Uint8Array(16);
     38                crypto.getRandomValues(bytes);
     39                bytes[6] = (bytes[6] & 0x0f) | 0x40; // version 4
     40                bytes[8] = (bytes[8] & 0x3f) | 0x80; // variant 10
     41                const hex = Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
     42                return hex.replace(/^(.{8})(.{4})(.{4})(.{4})(.{12})$/, '$1-$2-$3-$4-$5');
     43            }
     44
    3545            // Get storage name
    3646            var dataStorageName = input.data('name') + '_count_files';
    … …  
    3949            localStorage.setItem( dataStorageName, 1);
    4050
    41             // Generate random string
    42             const generateRandomFolder = function( length = 20 ) {
    43                 const characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
    44                 const charactersLength = characters.length;
    45                 let randomString = '';
    46 
    47                 // Generate a random string
    48                 for (let i = 0; i < length; i++) {
    49                     const randomIndex = Math.floor(Math.random() * charactersLength);
    50                     randomString += characters[randomIndex];
    51                 }
    52 
    53                 // Append the current timestamp (in seconds)
    54                 const timestamp = Math.floor(Date.now() / 1000); // Get Unix timestamp in seconds
    55                 return randomString + timestamp;
     51            // Get unique id from local storage.
     52            var sessionID = dnd_upload_cf7_unique_id();
     53
     54            // Unique upload session_id
     55            if ( ! sessionID ) {
     56                sessionID = generateRandomFolder();
     57                localStorage.setItem( 'dnd_wpcf7_session_id', JSON.stringify({ value: sessionID, savedAt: Date.now() }) );
    5658            }
    5759
    … …  
    152154                formData.append('form_id', input.data('id'));
    153155                formData.append('upload_name', input.data('name'));
    154                 formData.append('upload_folder', input.data('random-id') );
     156                formData.append('upload_folder', sessionID );
    155157
    156158                // black list file types
    … …  
    342344            e.preventDefault();
    343345            var _self = $(this),
    344                 _dnd_status = _self.parents('.dnd-upload-status'),
    345                 _parent_wrap = _self.parents('.codedropz-upload-wrapper'),
     346                _dnd_status       = _self.parents('.dnd-upload-status'),
     347                _parent_wrap      = _self.parents('.codedropz-upload-wrapper'),
    346348                removeStorageData = _self.parent('a').attr('data-storage'),
    347                 storageCount = Number( localStorage.getItem( removeStorageData ) );
     349                storageCount      = Number( localStorage.getItem( removeStorageData ) ),
     350                sessionId         = dnd_upload_cf7_unique_id();
    348351
    349352            // If file upload is in progress don't delete
    … …  
    363366            // Request ajax image delete
    364367            var delData = {
    365                 path        : _dnd_status.find('input[type="hidden"]').val(),
    366                 action      : 'dnd_codedropz_upload_delete',
    367                 security    : dnd_cf7_uploader.ajax_nonce
     368                path          : _dnd_status.find('input[type="hidden"]').val(),
     369                action        : 'dnd_codedropz_upload_delete',
     370                security      : dnd_cf7_uploader.ajax_nonce,
     371                upload_folder : sessionId
    368372            };
    369373
    … …  
    394398
    395399}( jQuery ));
     400
     401// Get unique id. (reset after 24hours)
     402function dnd_upload_cf7_unique_id() {
     403    const item = localStorage.getItem('dnd_wpcf7_session_id');
     404    if ( ! item ) {
     405        return null;
     406    }
     407
     408    // Parse item
     409    const data = JSON.parse( item );
     410
     411    // Compare date
     412    if ( Date.now() - data.savedAt > ( 24 * 60 * 60 * 1000 ) ) {
     413        localStorage.removeItem('dnd_wpcf7_session_id');
     414        return null;
     415    }
     416
     417    return data.value;
     418}
    396419
    397420jQuery(document).ready(function($){

  • drag-and-drop-multiple-file-upload-contact-form-7/trunk/assets/js/dev/native-dev.js

    r3450209 r3475121  
    33 * Copyright 2018 Glen Mongaya
    44 * CodeDrop Drag&Drop Uploader
    5  * @version 1.3.8.7
     5 * @version 1.3.9.6
    66 * @author CodeDropz, Glen Don L. Mongaya
    77 * @license The MIT License (MIT)
    … …  
    2727        // Generate random string
    2828        const generateRandomFolder = function( length = 20 ) {
    29             const characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
    30             const charactersLength = characters.length;
    31             let randomString = '';
    32 
    33             // Generate a random string
    34             for (let i = 0; i < length; i++) {
    35                 const randomIndex = Math.floor(Math.random() * charactersLength);
    36                 randomString += characters[randomIndex];
    37             }
    38 
    39             // Append the current timestamp (in seconds)
    40             const timestamp = Math.floor(Date.now() / 1000); // Get Unix timestamp in seconds
    41             return randomString + timestamp;
     29            const bytes = new Uint8Array(16);
     30            crypto.getRandomValues(bytes);
     31            bytes[6] = (bytes[6] & 0x0f) | 0x40; // version 4
     32            bytes[8] = (bytes[8] & 0x3f) | 0x80; // variant 10
     33            const hex = Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
     34            return hex.replace(/^(.{8})(.{4})(.{4})(.{4})(.{12})$/, '$1-$2-$3-$4-$5');
    4235        }
    4336
    … …  
    6962        localStorage.setItem( dataStorageName, 1);
    7063
     64        // Get unique id from local storage.
     65        var sessionID = dnd_upload_cf7_unique_id();
     66
     67        // Unique upload session_id
     68        if ( ! sessionID ) {
     69            sessionID = generateRandomFolder();
     70            localStorage.setItem( 'dnd_wpcf7_session_id', JSON.stringify({ value: sessionID, savedAt: Date.now() }) );
     71        }
     72
    7173        // Template Container
    7274        const cdropz_template = `
    … …  
    153155        }
    154156
    155         // Add unique ID or random string
    156         input.setAttribute( 'data-random-id', generateRandomFolder() );
    157 
    158157        // Setup Uploader
    159158        var DND_Setup_Uploader = function( files, action ) {
    … …  
    175174            formData.append('form_id', input.dataset.id);
    176175            formData.append('upload_name', input.dataset.name);
    177             formData.append('upload_folder', input.getAttribute('data-random-id') );
     176            formData.append('upload_folder', sessionID );
    178177
    179178            // black list file types
    … …  
    405404
    406405        e.preventDefault();
    407         var _self = e.target,
    408             _dnd_status = _self.closest(".dnd-upload-status"),
    409             _parent_wrap = _self.closest(".codedropz-upload-wrapper"),
     406        var _self             = e.target,
     407            _dnd_status       = _self.closest(".dnd-upload-status"),
     408            _parent_wrap      = _self.closest(".codedropz-upload-wrapper"),
    410409            removeStorageData = _self.parentElement.getAttribute("data-storage"),
    411             storageCount = Number(localStorage.getItem(removeStorageData));
     410            storageCount      = Number(localStorage.getItem(removeStorageData)),
     411            sessionId         = dnd_upload_cf7_unique_id();
    412412
    413413        // Direct remove the file if there's any error.
    … …  
    459459            "path=" + _dnd_status.querySelector('input[type="hidden"]').value +
    460460            "&action=dnd_codedropz_upload_delete" +
    461             "&security=" + dnd_cf7_uploader.ajax_nonce
     461            "&security=" + dnd_cf7_uploader.ajax_nonce +
     462            "&upload_folder=" + sessionId
    462463        );
    463464
    … …  
    482483    });
    483484    target.dispatchEvent(event);
     485}
     486
     487// Get unique id. (reset after 24hours)
     488function dnd_upload_cf7_unique_id() {
     489    const item = localStorage.getItem('dnd_wpcf7_session_id');
     490    if ( ! item ) {
     491        return null;
     492    }
     493
     494    // Parse item
     495    const data = JSON.parse( item );
     496
     497    // Compare date
     498    if ( Date.now() - data.savedAt > ( 24 * 60 * 60 * 1000 ) ) {
     499        localStorage.removeItem('dnd_wpcf7_session_id');
     500        return null;
     501    }
     502
     503    return data.value;
    484504}
    485505

  • drag-and-drop-multiple-file-upload-contact-form-7/trunk/drag-n-drop-upload-cf7.php

    r3450244 r3475121  
    77    * Text Domain: drag-and-drop-multiple-file-upload-contact-form-7
    88    * Domain Path: /languages
    9     * Version: 1.3.9.5
     9    * Version: 1.3.9.6
    1010    * Author: Glen Don L. Mongaya
    1111    * Author URI: http://codedropz.com
    … …  
    2222
    2323    /**  Define plugin Version */
    24     define( 'dnd_upload_cf7_version', '1.3.9.5' );
     24    define( 'dnd_upload_cf7_version', '1.3.9.6' );
    2525
    2626    /**  Define constant Plugin Directories  */

  • drag-and-drop-multiple-file-upload-contact-form-7/trunk/inc/dnd-upload-cf7.php

    r3450244 r3475121  
    1717    add_action( 'wpcf7_init', 'dnd_cf7_upload_add_form_tag_file' );
    1818    add_action( 'wpcf7_enqueue_scripts', 'dnd_cf7_scripts' );
    19     add_action( 'wpcf7_enqueue_scripts', 'dnd_cf7_cookie_scripts', 50 );
    2019
    2120    // Hook on plugins loaded
    … …  
    7473    // Return created cookie with unique id.
    7574    function dnd_cf7_get_unique_id() {
    76         if ( isset( $_COOKIE['wpcf7_guest_user_id'] ) ) {
    77             return $_COOKIE['wpcf7_guest_user_id'];
    78         }
     75        print_r( $_POST );
    7976    }
    8077
    … …  
    204201                    if ( is_array( $posted_data ) ) {
    205202                        foreach( $posted_data[$field_name] as $key => $file ) {
    206                             if ( strpos( dirname($file), 'wpcf7-files' ) !== false ) {
    207                                 $file = wp_basename( $file ); // remove duplicate path "/12/file.jpg" to just "/file.jpg"
    208                             }
    209203                            $posted_data[$field_name][$key] = trailingslashit( $uploads_dir['upload_url'] ) . $file;
    210204                        }
    … …  
    253247
    254248    // Get folder path
    255     function dnd_get_upload_dir( $dir = false ) {
     249    function dnd_get_upload_dir( $dir = '' ) {
    256250        $upload      = wp_upload_dir();
    257         $uploads_dir = wpcf7_dnd_dir . '/wpcf7-files';
     251        $uploads_dir = wpcf7_dnd_dir . '/wpcf7-files'; // ie: "/wp_dndcf7_uploads/wpcf7-files"
    258252
    259253        // Send file as links is enabled.
    … …  
    263257
    264258        // Setup random/unique folder, only created if user uploading.
    265         if ( true === $dir ) {
    266             $unique_id = dnd_cf7_get_unique_id();
     259        if ( $dir ) {
     260            $unique_id = sanitize_file_name( $dir );
    267261            if ( ! empty( $unique_id ) ) {
    268                 $unique_id = preg_replace( '/[^a-zA-Z0-9_-]/', '', $unique_id );
    269                 if ( '' !== $unique_id ) {
    270                     $uploads_dir = trailingslashit( $uploads_dir ) . sanitize_file_name( $unique_id );
    271                 }
    272             }
    273         }
     262                $unique_id   = preg_replace( '/[^a-zA-Z0-9_-]/', '', $unique_id );
     263                $uploads_dir = trailingslashit( $uploads_dir ) . $unique_id;
     264            }
     265        }
     266
     267        // Get full dir and url
     268        $full_dir = wp_normalize_path( trailingslashit( $upload['basedir'] ) . $uploads_dir );
     269        $full_url = trailingslashit( $upload['baseurl'] ) . $uploads_dir;
    274270
    275271        // Create directory if not exists.
    276         if ( ! is_dir( trailingslashit( $upload['basedir'] ) . $uploads_dir ) ) {
    277             wp_mkdir_p( trailingslashit( $upload['basedir'] ) . $uploads_dir );
    278             chmod( trailingslashit( $upload['basedir'] ) . $uploads_dir, 0755 );
     272        if ( ! is_dir( $full_dir ) ) {
     273            wp_mkdir_p( $full_dir );
     274            @chmod( $full_dir, 0755 );
    279275        }
    280276
    281277        // Make sure directory exist before returning
    282         if( file_exists( trailingslashit( $upload['basedir'] ) . $uploads_dir ) ) {
     278        if( file_exists( $full_dir ) ) {
    283279            return array(
    284                 'upload_dir'    =>  trailingslashit( $upload['basedir'] ) . $uploads_dir,
    285                 'upload_url'    =>  trailingslashit( $upload['baseurl'] ) . $uploads_dir
     280                'upload_dir'    =>  $full_dir,
     281                'upload_url'    =>  $full_url
    286282            );
    287283        }
    288284
    289         return trailingslashit( $upload['basedir'] ) . $uploads_dir;
     285        return $full_dir;
    290286    }
    291287
    … …  
    586582    }
    587583
    588     // Add inline js for cookie script.
    589     function dnd_cf7_cookie_scripts() {
    590         wp_add_inline_script( 'codedropz-uploader',
    591             "
    592             function dnd_cf7_generateUUIDv4() {
    593                 const bytes = new Uint8Array(16);
    594                 crypto.getRandomValues(bytes);
    595                 bytes[6] = (bytes[6] & 0x0f) | 0x40; // version 4
    596                 bytes[8] = (bytes[8] & 0x3f) | 0x80; // variant 10
    597                 const hex = Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
    598                 return hex.replace(/^(.{8})(.{4})(.{4})(.{4})(.{12})$/, '$1-$2-$3-$4-$5');
    599             }
    600 
    601             document.addEventListener('DOMContentLoaded', function() {
    602                 if ( ! document.cookie.includes('wpcf7_guest_user_id')) {
    603                     document.cookie = 'wpcf7_guest_user_id=' + dnd_cf7_generateUUIDv4() + '; path=/; max-age=' + (12 * 3600) + '; samesite=Lax';
    604                 }
    605             });
    606             "
    607         );
    608     }
    609 
    610584    // Generate tag
    611585    function dnd_cf7_upload_add_form_tag_file() {
    … …  
    913887
    914888        // Get upload dir
    915         $path = dnd_get_upload_dir( true ); // ok
     889        $folder = isset( $_POST['upload_folder'] ) ? sanitize_text_field( $_POST['upload_folder'] ) : null;
     890        $path   = dnd_get_upload_dir( $folder ); // ok
    916891
    917892        // input type file 'name'
    … …  
    939914        $filename = wp_basename( $file['name'] );
    940915        $filename = wpcf7_canonicalize( $filename, 'as-is' );
     916        $filename = sanitize_file_name( $filename ); // sanitize filename
     917
     918        // Check unique name
     919        $filename = wp_unique_filename( $path['upload_dir'], $filename );
    941920
    942921        // Get file extension
    943922        $extension = strtolower( pathinfo( $filename, PATHINFO_EXTENSION ) );
    944923
    945         // Check unique name
    946         $filename = wp_unique_filename( $path['upload_dir'], $filename );
    947 
    948924        // Validate File Types (if supported type is set to "*")
    949925        if ( $supported_type == '*' ) {
    950             $file_type          = wp_check_filetype( $file['name'] );
    951             $not_allowed_ext    = array( 'phar', 'svg', ); // not allowed file type.
     926            $file_type          = wp_check_filetype( $filename );
     927            $not_allowed_ext    = array( 'phar', 'svg', 'php5', 'php7', 'php8' ); // not allowed file type.
    952928            $type_ext           = ( $file_type['ext'] !== false ? strtolower( $file_type['ext'] ) : $extension );
    953929            $error_invalid_type = dnd_cf7_settings('drag_n_drop_error_invalid_file') ?: dnd_cf7_error_msg('invalid_type');
    … …  
    961937
    962938        // validate file type
    963         if ( ( ! preg_match( $file_type_pattern, $file['name'] ) || ! dnd_cf7_validate_type( $extension, $supported_type ) ) && $supported_type != '*' ) {
     939        if ( ( ! preg_match( $file_type_pattern, $filename ) || ! dnd_cf7_validate_type( $extension, $supported_type ) ) && $supported_type != '*' ) {
    964940            wp_send_json_error( dnd_cf7_settings('drag_n_drop_error_invalid_file') ? dnd_cf7_settings('drag_n_drop_error_invalid_file') : dnd_cf7_error_msg('invalid_type') );
    965941        }
    966942
    967943        // validate mime type
    968         if( $supported_type && $supported_type != '*' ){
     944        if ( $supported_type && $supported_type != '*' ){
    969945
    970946            // wheather if we validate mime type
    971947            $validate_mime = apply_filters('dnd_cf7_validate_mime', false );
    972 
    973             if( $validate_mime ){
    974 
    975                 if( ! function_exists('wp_check_filetype_and_ext') ){
     948            if ( $validate_mime ) {
     949                if ( ! function_exists('wp_check_filetype_and_ext') ){
    976950                    require_once ABSPATH .'wp-admin/includes/file.php';
    977951                }
    … …  
    981955                $valid_mimes = explode('|', $supported_type); // array[png, jpg]
    982956
    983                 if( empty( $wp_filetype['type'] ) || empty( $wp_filetype['ext'] ) || ! in_array( $wp_filetype['ext'], $valid_mimes ) ){
     957                if ( empty( $wp_filetype['type'] ) || empty( $wp_filetype['ext'] ) || ! in_array( $wp_filetype['ext'], $valid_mimes ) ){
    984958                    wp_send_json_error( dnd_cf7_settings('drag_n_drop_error_invalid_file') ? dnd_cf7_settings('drag_n_drop_error_invalid_file') : dnd_cf7_error_msg('invalid_type') );
    985959                }
    … …  
    988962
    989963        // validate file size limit
    990         if( isset( $size_limit["$cf7_upload_name"] ) && $file['size'] > $size_limit["$cf7_upload_name"] ) {
     964        if ( isset( $size_limit["$cf7_upload_name"] ) && $file['size'] > $size_limit["$cf7_upload_name"] ) {
    991965            wp_send_json_error( dnd_cf7_settings('drag_n_drop_error_files_too_large') ? dnd_cf7_settings('drag_n_drop_error_files_too_large') : dnd_cf7_error_msg('large_file') );
    992966        }
    993967
    994968        // Check if string is ascii then proceed with antiscript function ( remove or clean filename )
    995         if( dnd_cf7_check_ascii( $filename ) ){
    996             $filename = wpcf7_antiscript_file_name( $filename );
     969        $ascii_name = dnd_cf7_remove_icons( $filename );
     970        if ( dnd_cf7_check_ascii( $ascii_name ) ) {
     971            $filename = wpcf7_antiscript_file_name( $ascii_name );
    997972        }
    998973
    … …  
    10371012    }
    10381013
     1014    // Force to remove emoji in the filename.
     1015    function dnd_cf7_remove_icons( $filename ) {
     1016        return preg_replace(
     1017            '/[\x{1F000}-\x{1FAFF}'
     1018            . '\x{2600}-\x{27BF}'
     1019            . '\x{1F1E6}-\x{1F1FF}'
     1020            . '\x{200D}'
     1021            . '\x{FE00}-\x{FE0F}'
     1022            . '\x{1F3FB}-\x{1F3FF}]/u',
     1023            '',
     1024            $filename
     1025        );
     1026    }
     1027
    10391028    // Check if a string is ASCII.
    10401029    function dnd_cf7_check_ascii( $string ) {
     1030        $string = sanitize_file_name( $string );
     1031
    10411032        if ( function_exists( 'mb_check_encoding' ) ) {
    10421033            if ( mb_check_encoding( $string, 'ASCII' ) ) {
    … …  
    10781069
    10791070            // Validate path if it's match on the current folder
    1080             $unique_id      = dnd_cf7_get_unique_id();
     1071            $unique_id      = isset( $_POST['upload_folder'] ) ? sanitize_file_name( $_POST['upload_folder'] ) : '';
    10811072            $current_folder = trim( dirname( $path ) );
    10821073            $file_name      = wp_basename( $path ); // added Aug 2025
    1083             $current_path   = $dir['upload_dir'] .'/'. sanitize_file_name( $unique_id ) .'/'. $file_name;
     1074            $current_path   = $dir['upload_dir'] .'/'. $unique_id .'/'. $file_name;
    10841075
    10851076            // Validate unique id.
    … …  
    10881079            }
    10891080
    1090             // Validate cookie and current_folder to ensure they match.
     1081            // Validate unique id and current_folder to ensure they match.
    10911082            if ( ( $unique_id !== $current_folder ) || ! file_exists( $current_path ) || preg_match( '#\.\.[/\\\\]#', $path ) ) {
    10921083                wp_send_json_error( 'Error: Unauthorized Request!' );
    … …  
    11451136    // list of not allowed extensions.
    11461137    function dnd_cf7_not_allowed_ext() {
    1147         return array( 'svg', 'phar', 'php', 'php3','php4','phtml','exe','script', 'app', 'asp', 'bas', 'bat', 'cer', 'cgi', 'chm', 'cmd', 'com', 'cpl', 'crt', 'csh', 'csr', 'dll', 'drv', 'fxp', 'flv', 'hlp', 'hta', 'htaccess', 'htm', 'htpasswd', 'inf', 'ins', 'isp', 'jar', 'js', 'jse', 'jsp', 'ksh', 'lnk', 'mdb', 'mde', 'mdt', 'mdw', 'msc', 'msi', 'msp', 'mst', 'ops', 'pcd', 'pif', 'pl', 'prg', 'ps1', 'ps2', 'py', 'rb', 'reg', 'scr', 'sct', 'sh', 'shb', 'shs', 'sys', 'swf', 'tmp', 'torrent', 'url', 'vb', 'vbe', 'vbs', 'vbscript', 'wsc', 'wsf', 'wsf', 'wsh' );
     1138        return array( 'html', 'svg', 'phar', 'php', 'php3','php4','pht', 'php5', 'php7', 'php8', 'xhtml','shtml', 'mhtml', 'dhtml', 'phtml','exe','script', 'app', 'asp', 'bas', 'bat', 'cer', 'cgi', 'chm', 'cmd', 'com', 'cpl', 'crt', 'csh', 'csr', 'dll', 'drv', 'fxp', 'flv', 'hlp', 'hta', 'htaccess', 'htm', 'htpasswd', 'inf', 'ins', 'isp', 'jar', 'js', 'jse', 'jsp', 'ksh', 'lnk', 'mdb', 'mde', 'mdt', 'mdw', 'msc', 'msi', 'msp', 'mst', 'ops', 'pcd', 'pif', 'pl', 'prg', 'ps1', 'ps2', 'py', 'rb', 'reg', 'scr', 'sct', 'sh', 'shb', 'shs', 'sys', 'swf', 'tmp', 'torrent', 'url', 'vb', 'vbe', 'vbs', 'vbscript', 'wsc', 'wsf', 'wsf', 'wsh' );
    11481139    }
    11491140
    … …  
    14261417    }
    14271418
     1419    // Get the default Media max upload size.
    14281420    function dnd_cf7_max_upload() {
    14291421        $max    = wp_max_upload_size();
    … …  
    14351427
    14361428        return round( $max_mb, 2 ) . ' MB';
    1437     }
    1438 
    1439     // Generate cookie (Cookie expiration 12 Hours)
    1440     function dnd_cf7_generate_cookie() {
    1441     ?>
    1442         <script type="text/javascript">
    1443             function dnd_cf7_generateUUIDv4() {
    1444                 const bytes = new Uint8Array(16);
    1445                 crypto.getRandomValues(bytes);
    1446                 bytes[6] = (bytes[6] & 0x0f) | 0x40; // version 4
    1447                 bytes[8] = (bytes[8] & 0x3f) | 0x80; // variant 10
    1448                 const hex = Array.from(bytes, b => b.toString(16).padStart(2, "0")).join("");
    1449                 return hex.replace(/^(.{8})(.{4})(.{4})(.{4})(.{12})$/, "$1-$2-$3-$4-$5");
    1450             }
    1451 
    1452             document.addEventListener("DOMContentLoaded", function() {
    1453                 if ( ! document.cookie.includes("wpcf7_guest_user_id")) {
    1454                     document.cookie = "wpcf7_guest_user_id=" + dnd_cf7_generateUUIDv4() + "; path=/; max-age=" + (12 * 3600) + "; samesite=Lax";
    1455                 }
    1456             });
    1457         </script>
    1458     <?php
    14591429    }
    14601430

  • drag-and-drop-multiple-file-upload-contact-form-7/trunk/readme.txt

    r3465187 r3475121  
    55Requires at least: 3.0.1
    66Tested up to: 6.9
    7 Stable tag: 1.3.9.5
     7Stable tag: 1.3.9.6
    88Requires PHP: 5.2.4
    99License: GPLv2 or later
    … …  
    9595
    9696* [Order Files for WooCommerce](https://www.codedropz.com/woo-order-files/)
    97 An extension that attach files to existing WooCommerce orders, allowing both customers and admins to upload and manage files easily.
     97An extension that attach files to existing **WooCommerce orders**, allowing both customers and admins to upload and manage files easily.
    9898
    9999* [Easy File Upload & Approval](https://wordpress.org/plugins/easy-file-upload-approval/)
    … …  
    185185
    186186== Changelog ==
     187= 1.3.9.6 =
     188- New : Replaced cookies with localStorage for unique upload folder generation.
     189- Security :  Unauthenticated Arbitrary File Upload (Reported by Thomas Sanzey via WordFence) - user able to upload "php5 - php8" for non ascii filename by bypassing extensions present in the blacklists.
     190
    187191= 1.3.9.5 =
    188192- Hot Fix: Minor spelling mistakes.
Note: See TracChangeset for help on using the changeset viewer.