Custom Plugin File Upload Form Submission

  • klivie

    (@klivie)


    7 years, 2 months ago

    Ok so I have a WordPress plugin developed and one of the features of it I wanted to add, was an area in the admin where the user can upload a CSV, and when the form is submitted to execute a big ole script I’ve writted.

    So I’ve got the admin form created just like so:

    (Located in a file “PLUGIN_FOLDER/admin/partials/admin-bookings-import-display.php)

    <div id="poststuff">
        <div id="post-body" class="metabox-holder">
            <div id="post-body-content">
                Please upload your XML file here
                <form action="<?php echo admin_url('admin-post.php'); ?>" enctype="multipart/form-data" method="post">
                    <p>Choose a file: <input type="file" name="xml-file" id="xml-file" /></p>
                    <?php submit_button('Upload') ?>
                </form>
            </div>
        </div>
        <br class="clear">
    </div>

    The issue I’m having now, is working out how I can execute my script stuff when this form is submitted?

    All of my script code is located in a file here: PLUGIN_FOLDER/admin/bookings-import.php

    But how to I make my form submission directly call to this file without referencing the file directly?

    Another point, because I’m using a file upload, do I need to physically save this file before I can do anything with it’s contents? I got the script working while using a physical file saved on my machine but obviously i need to get this working using the one that was uploaded within the form.

    And before anyone suggests using a normal file upload plugin, my script has to do a bunch of data manipulation with the contents of the CSV before inserting it into my DB. This is already set up correctly.

    Thanks

Viewing 4 replies - 1 through 4 (of 4 total)
  • Joy

    (@joyously)

    7 years, 2 months ago

    If you leave out the action attribute of the form, it will target the same page it is on.
    You need to add a nonce to your form, and name your form fields with your plugin prefix, so you know they are yours. And check to see if there are results to inform the user of from a previous submission.

    Then your plugin needs a function to check for your form fields and process it if
    * there is a file
    * the nonce is verified
    * the user has the correct capability (probably upload_files)

    Moderator bcworkz

    (@bcworkz)

    7 years, 2 months ago

    admin-post.php is a viable way to handle form submits, but you must use it correctly. Your form must have a hidden field named “action” with an assigned value. That value is used to construct an action hook which admin-post.php fires with do_action(). The hook name is constructed as "admin_post_{$action}" where $action is the passed value. (assuming login required)

    Your plugin thus needs to hook this action with the form handling code. You still need to do the things Joy mentions, except for leaving out the action attribute in the form tag.

    I think I would personally use Joy’s approach in this situation, but admin-post.php can be very useful. It’s worth learning to use it correctly.

    Regardless of how you execute your form handling code, the file upload lands in PHP’s temp folder. You can manipulate it directly there if you like. It will eventually be deleted, but it’s good practice to remove it from temp as soon as it is not needed any more, i.e. it was copied elsewhere or processed and its data saved.

    Your upload file handler needs to do as much checking as possible to verify you are getting the file you expect. Review the source for _wp_handle_upload() for things WP checks in file uploads. Be sure to validate and sanitize all values extracted from the file that you will save in your DB. Handling file uploads can be very risky if proper precautions are not taken.

    Thread Starter klivie

    (@klivie)

    7 years, 2 months ago

    Thank you both @bcworkz and @joyously,

    I went down the route of using admin-post.php to handle the form submit. I created a hidden field in my form with an “action” of “import_booking_file”.

    I’ve then added my hook name like so: add_action( ‘admin_post_import_booking_file’, ‘function_to_fire’);

    The problem is at the moment when I submit my form it just goes to the URL “wp-admin/admin-post.php” and shows me a blank page with no response at all. Why would it not call to my action defined?

    I’ve added a bunch of logic to check my uploaded file but obviously the action doesn’t even seem to be getting that far.

    Moderator bcworkz

    (@bcworkz)

    7 years, 2 months ago

    Your callback function is expected to generate all HTML response content. WP does send related headers prior to your callback’s output. You would need to use typical PHP debugging techniques within your callback to figure out what’s wrong. For starters, insert this as the first line in your “function_to_fire()” declaration:
    wp_die('Action admin_post_import_booking_file has fired.');

    Post a file through the form. If you get a die message box, the admin-post part is working fine. If not, post your current form code here and we’ll take another look.

    Assuming you got the die box, remove that code and continue with further debugging, like ensuring the file landed in the PHP temp folder and verifying all variables contain their expected values.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Custom Plugin File Upload Form Submission’ is closed to new replies.