--- a/folders/folders.php
+++ b/folders/folders.php
@@ -2,7 +2,7 @@
/**
* Plugin Name: Folders
* Description: Organize your Media library, Pages, and Posts into folders. You can easily drag and drop items into directories and change the folders tree view.
- * Version: 3.1.5
+ * Version: 3.1.6
* Author: Premio
* Author URI: https://premio.io/downloads/folders/
* Text Domain: folders
@@ -28,7 +28,7 @@
define('WCP_FOLDER_URL', plugin_dir_url(__FILE__));
}
if(!defined("WCP_FOLDER_VERSION")) {
- define('WCP_FOLDER_VERSION', "3.1.5");
+ define('WCP_FOLDER_VERSION', "3.1.6");
}
if(!defined("IS_FOLDERS_DEVELOPER_MODE")) {
define('IS_FOLDERS_DEVELOPER_MODE', false);
@@ -117,7 +117,6 @@
/* Affiliate Class*/
if(is_admin()) {
- include_once plugin_dir_path(__FILE__)."includes/class-affiliate.php";
include_once plugin_dir_path(__FILE__) . "includes/class-review-box.php";
include_once plugin_dir_path(__FILE__) . "includes/class-email-signup.php";
include_once plugin_dir_path(__FILE__) . "includes/class-help.php";
--- a/folders/includes/class-polylang.php
+++ b/folders/includes/class-polylang.php
@@ -73,7 +73,7 @@
if ($this->active) {
if (isset($polylang->curlang) && is_object($polylang->curlang)) {
- if(method_exists($polylang->curlang, 'get_tax_prop')) {
+ if (method_exists($polylang->curlang, 'get_tax_prop')) {
$this->poly_lang_term_taxonomy_id = $polylang->curlang->get_tax_prop('language', 'term_taxonomy_id');
} else {
$this->poly_lang_term_taxonomy_id = $polylang->curlang->term_taxonomy_id;
@@ -83,8 +83,18 @@
add_filter('premio_folder_un_categorized_items', [$this, 'un_categorized_items'], 10, 2);
add_filter('premio_folder_all_categorized_items', [$this, 'all_categorized_items'], 10, 2);
}
- }
+ $user_id = get_current_user_id();
+ $current = pll_current_language();
+ $previous = get_user_meta($user_id, '_admin_lang_last', true);
+ $previous = $previous ? $previous : 'all';
+ $current = $current ? $current : 'all';
+
+ if ($previous !== $current) {
+ delete_transient("premio_folders_without_trash");
+ update_user_meta($user_id, '_admin_lang_last', $current);
+ }
+ }
}//end init()
--- a/folders/includes/class-wpml.php
+++ b/folders/includes/class-wpml.php
@@ -118,6 +118,18 @@
$this->sitepress = $sitepress;
$this->post_translations = $sitepress->post_translations();
+
+ $user_id = get_current_user_id();
+
+ $current = apply_filters('wpml_current_language', null);
+ $previous = get_user_meta($user_id, '_icl_admin_language_last', true);
+ $previous = $previous ? $previous : 'all';
+ $current = $current ? $current : 'all';
+
+ if ($previous !== $current) {
+ delete_transient("premio_folders_without_trash");
+ update_user_meta($user_id, '_icl_admin_language_last', $current);
+ }
}
if ($this->isWPMLActive) {
@@ -185,24 +197,6 @@
$query = $wpdb->prepare($query, [$term_taxonomy_id, $this->lang]);
$all_ids = $wpdb->get_var($query);
-// $counter = 0;
-// if (count($all_ids) > 0) {
-// $select = "SELECT COUNT(P.ID) as total_records FROM {$wpdb->posts} AS P";
-// $where = ["P.ID = (%s)"];
-//
-// if($post_type == 'attachment') {
-// $where[] = " (P.post_status = 'inherit' OR P.post_status = 'private')";
-// } else {
-// $where[] = " P.post_status != 'trash'";
-// }
-//
-// $join = apply_filters( 'folders_count_join_query', "" );
-// $where = apply_filters( 'folders_count_where_query', $where );
-//
-// $query = $select . $join . " WHERE ".implode( ' AND ', $where );
-//// $query = $wpdb->prepare($query, [implode(',', $all_ids)]);
-//// $counter = $wpdb->get_var($query);
-// }
return !empty($all_ids) ? $all_ids : 0;
}//end if
--- a/folders/includes/folders.class.php
+++ b/folders/includes/folders.class.php
@@ -128,9 +128,7 @@
// Update Parent Data
add_action('wp_ajax_wcp_mark_un_mark_folder', [$this, 'wcp_mark_un_mark_folder']);
// Update Parent Data
- add_action('wp_ajax_wcp_make_sticky_folder', [$this, 'wcp_make_sticky_folder']);
- // Update Parent Data
- add_action('wp_ajax_wcp_change_post_folder', [$this, 'wcp_change_post_folder']);
+ add_action('wp_ajax_wcp_make_sticky_folder', [$this, 'wcp_make_sticky_folder']);
// Update Parent Data
add_action('wp_ajax_wcp_change_multiple_post_folder', [$this, 'wcp_change_multiple_post_folder']);
// Update width Data
@@ -716,6 +714,9 @@
if (!isset($postData['nonce']) || empty($postData['nonce'])) {
$response['message'] = esc_html__("Your request is not valid", 'folders');
$errorCounter++;
+ } else if (!current_user_can('manage_options')) {
+ $response['message'] = esc_html__("You have not permission to remove all folders data", 'folders');
+ $errorCounter++;
} else {
$type = self::sanitize_options($postData['type']);
$nonce = self::sanitize_options($postData['nonce']);
@@ -726,6 +727,7 @@
}
if ($errorCounter == 0) {
+
self::$folders = 0;
self::remove_folder_by_taxonomy("media_folder");
self::remove_folder_by_taxonomy("folder");
@@ -736,13 +738,16 @@
"post",
"attachment",
];
+
foreach ($post_types as $post_type) {
if (!in_array($post_type->name, $post_array)) {
self::remove_folder_by_taxonomy($post_type->name.'_folder');
}
}
+ delete_option('folders_settings');
delete_option('default_folders');
+ delete_option('customize_folders');
$response['status'] = 1;
$response['data'] = [
'items' => self::$folders,
@@ -768,7 +773,7 @@
$query = "SELECT * FROM ".$wpdb->term_taxonomy."
LEFT JOIN ".$wpdb->terms."
ON ".$wpdb->term_taxonomy.".term_id = ".$wpdb->terms.".term_id
- WHERE ".$wpdb->term_taxonomy.".taxonomy = '%d'
+ WHERE ".$wpdb->term_taxonomy.".taxonomy = '%s'
ORDER BY parent ASC";
$query = $wpdb->prepare($query, $taxonomy);
$folders = $wpdb->get_results($query);
@@ -1045,8 +1050,9 @@
if ($trash_count == null && isset($trash_folders[$term->term_taxonomy_id]) && !$polylang_is_active) {
$trash_count = $trash_folders[$term->term_taxonomy_id];
} else if ($trash_count == null) {
-
- if ($trash_count === null) {
+ if (isset($trash_folders[$term->term_taxonomy_id])) {
+ $trash_count = $trash_folders[$term->term_taxonomy_id];
+ } else {
$query = "SELECT COUNT(DISTINCT(p.ID))
FROM {$post_table} p
JOIN {$term_table} rl ON p.ID = rl.object_id
@@ -3123,7 +3129,8 @@
$response['data'] = [];
$response['message'] = "";
$postData = filter_input_array(INPUT_POST);
- $errorCounter = 0;
+ $errorCounter = 0;
+
if (!isset($postData['post_ids']) || empty($postData['post_ids'])) {
$response['message'] = esc_html__("Your request is not valid", 'folders');
$errorCounter++;
@@ -3228,7 +3235,10 @@
} else if (!isset($postData['nonce']) || empty($postData['nonce'])) {
$response['message'] = esc_html__("Your request is not valid", 'folders');
$errorCounter++;
- } else {
+ } else if ( !current_user_can( 'edit_posts' ) ) {
+ $response['message'] = esc_html__("You have not permission to undo folder changes", 'folders');
+ $errorCounter++;
+ }else {
if (!wp_verify_nonce($postData['nonce'], 'wcp_folder_nonce_'.$postData['post_type'])) {
$response['message'] = esc_html__("Your request is not valid", 'folders');
$errorCounter++;
@@ -3280,83 +3290,7 @@
}//end wcp_undo_folder_changes()
-
- /**
- * Change post, page, attachment folder
- *
- * @since 1.0.0
- * @access public
- * @return $response
- */
- public function wcp_change_post_folder()
- {
- $response = [];
- $response['status'] = 0;
- $response['error'] = 0;
- $response['data'] = [];
- $response['message'] = "";
- $postData = filter_input_array(INPUT_POST);
- $errorCounter = 0;
- if (!isset($postData['post_id']) || empty($postData['post_id'])) {
- $errorCounter++;
- $response['message'] = esc_html__("Your request is not valid", 'folders');
- } else if (!isset($postData['folder_id']) || empty($postData['folder_id'])) {
- $errorCounter++;
- $response['message'] = esc_html__("Your request is not valid", 'folders');
- } else if (!isset($postData['type']) || empty($postData['type'])) {
- $errorCounter++;
- $response['message'] = esc_html__("Your request is not valid", 'folders');
- } else if (!isset($postData['nonce']) || empty($postData['nonce'])) {
- $response['message'] = esc_html__("Your request is not valid", 'folders');
- $errorCounter++;
- } else if ($postData['type'] == "page" && !current_user_can("edit_pages")) {
- $response['message'] = esc_html__("You have not permission to update folder", 'folders');
- $errorCounter++;
- } else if ($postData['type'] != "page" && !current_user_can("edit_posts")) {
- $response['message'] = esc_html__("You have not permission to update folder", 'folders');
- $errorCounter++;
- } else {
- $term_id = self::sanitize_options($postData['folder_id']);
- if (!wp_verify_nonce($postData['nonce'], 'wcp_folder_term_'.$term_id)) {
- $response['message'] = esc_html__("Your request is not valid", 'folders');
- $errorCounter++;
- }
- }//end if
-
- if ($errorCounter == 0) {
- $postID = self::sanitize_options($postData['post_id']);
- $folderID = self::sanitize_options($postData['folder_id']);
- $type = self::sanitize_options($postData['type']);
- $folder_post_type = self::get_custom_post_type($type);
- $status = 0;
- if (isset($postData['status'])) {
- $status = self::sanitize_options($postData['status']);
- }
-
- $status = ($status == 1) ? true : false;
- $taxonomy = "";
- if (isset($postData['taxonomy'])) {
- $taxonomy = self::sanitize_options($postData['taxonomy']);
- }
-
- $terms = get_the_terms($postID, $folder_post_type);
- if (!empty($terms)) {
- foreach ($terms as $term) {
- if (!empty($taxonomy) && ($term->term_id == $taxonomy || $term->slug == $taxonomy)) {
- wp_remove_object_terms($postID, $term->term_id, $folder_post_type);
- }
- }
- }
-
- wp_set_post_terms($postID, $folderID, $folder_post_type, true);
- $response['status'] = 1;
- }//end if
-
- echo wp_json_encode($response);
- wp_die();
-
- }//end wcp_change_post_folder()
-
+
/**
* Mark/Unmark folder
--- a/folders/includes/media.replace.php
+++ b/folders/includes/media.replace.php
@@ -1180,7 +1180,9 @@
*/
public function handle_folders_file_upload() {
global $wpdb;
+
if(isset($_FILES['new_media_file'])) {
+
if($_FILES['new_media_file']['error'] == 0) {
$attachment_id = isset($_GET['attachment_id']) ? sanitize_text_field($_GET['attachment_id']) : '';
$nonce = isset($_GET['nonce']) ? sanitize_text_field($_GET['nonce']) : '';
@@ -1191,6 +1193,12 @@
if (empty($attachment) || !isset($attachment->guid)) {
return;
}
+
+ // Security: Check if current user has permission to edit this attachment
+ if (!current_user_can('edit_post', $attachment_id) || !current_user_can('upload_files')) {
+ wp_die(esc_html__("Sorry, you don't have permission to replace this media file.", "folders"));
+ }
+
$attachment_url = $attachment->guid;
$url = wp_get_attachment_url($attachment_id);
if(!empty($url)) {
--- a/folders/templates/admin/admin-content.php
+++ b/folders/templates/admin/admin-content.php
@@ -229,7 +229,7 @@
<div class="folder-separator-2"></div>
<div class="folders-action-menu">
<ul>
- <li style="flex: 0 0 22px;"><a href="#" class="no-bg"><input type="checkbox" id="menu-checkbox" ></a></li>
+ <li style="align-items: center; justify-content: center; vertical-align: middle; display: flex;"> <span class="no-bg full-width"><input type="checkbox" id="menu-checkbox" ></span></li>
<li class="folder-inline-tooltip">
<a class="full-width upload-media-action disabled" target="_blank" href="<?php echo esc_url($this->getFoldersUpgradeURL()) ?>">
<span class="inline-tooltip"><?php esc_html_e("Uploading folder is pro feature", "folders"); ?> <span><?php esc_html_e("Upgrade Now 🎉", "folders") ?></span></span>
