Forum Replies Created

Viewing 15 replies - 46 through 60 (of 78 total)
  • Thread Starter normadize

    (@normadize)

    Hi Jake, good to hear!

    I actually did look through the recent threads but didn’t spot your name but I admit I didn’t look too hard. I see that this issue was reported before a few months back and that you replied then saying the same thing as here. I know it’s not nice to ask this, but do you have a rough any ETA on the update release date?

    Thread Starter normadize

    (@normadize)

    The fix is to change .text(n[0]) to .html(n[0]) in scripts.js line 220 in here:

    $.fn.wpcf7RefillQuiz = function(quiz) {
    	return this.each(function() {
    		var form = $(this);
    
    		$.each(quiz, function(i, n) {
    			form.find(':input[name="' + i + '"]').clearFields();
    			form.find(':input[name="' + i + '"]').siblings('span.wpcf7-quiz-label').html(n[0]);
    			form.find('input:hidden[name="_wpcf7_quiz_answer_' + i + '"]').attr('value', n[1]);
    		});
    	});
    };

    @jasonvincik: you and me both … I also wrote about this and posted a solution here: http://wordpress.org/support/topic/uploaded-files-are-deleted-even-on-successful-email

    Thread Starter normadize

    (@normadize)

    For anyone interested, if you want your uploaded files to be accessible after upload via a URL, and also to have that URL in the email sent by WPCF7, then here’s a solution I used in my plugin.

    If you don’t use classes, then replace the array with just the function name. Note that this is for one file only, use a foreach() loop if your form has multiple upload files.

    You may also want to change the chmod() permissions to suit your server. In my case, SuPHP requires 644 or else it denies access.

    class MyPlugin
    {
        /**
         * Relative to the WP uploads dir.
         */
        public $dir_uploaded = 'foo';
    
        function __construct ()
        {
            add_action('wpcf7_before_send_mail', array($this, 'WPCF7_BeforeSendMail'));
        }
    
        /**
         * Fetch uploaded files and modify email body to point to uploaded file url.
         * @param WPCF7_ContactForm $cf7
         */
        public function WPCF7_BeforeSendMail (WPCF7_ContactForm $cf7)
        {
            if (empty($cf7->uploaded_files['fileupload']))
                return;
            $dest = wp_upload_dir();
            $dest_dir = $dest['basedir'].$this->dir_uploaded;
            $dest_url = $dest['baseurl'].$this->dir_uploaded;
            wp_mkdir_p($dest_dir);
            $dest_file = wp_unique_filename($dest_dir, basename($cf7->uploaded_files['fileupload']));
            $dest_path = "$dest_dir/$dest_file";
            @rename($cf7->uploaded_files['fileupload'], $dest_path);
            // avoid SuPHP denying access since WPCF7 hardcodes 0400 (...)
            chmod($dest_path, 0644);
            $cf7->mail['body'] = "Uploaded: $dest_url/$dest_file\n\n" . $cf7->mail['body'];
        }
    }

    Cheers.

    Thread Starter normadize

    (@normadize)

    You would make a bike security/privacy risk if you left files uploaded through a public contact form.

    Not if you move the files to a folder outside the WP web space. You however chose to move them in the public WP uploads folder… which is not only unnecessary given you only want to attach them to the email, it actually creates some security risk (yes, I know there is a htaccess file).

    It’s the 3rd time that you (oh so friendly) tell me that my suggestions are high-risk/security threats, being actually wrong and providing little explanation.

    P.S. Your code actually does have security holes, which until now I was willing to report.

    Thread Starter normadize

    (@normadize)

    The wpcf7_before_send_mail hook worked just fine. I had to move the file to another directory though so that CF7 won’t delete it.

    You may still want to consider including something like this as a core feature (big file uploads as download URL in the email).

    One small thing: I’m using SuPHP in a setup that requires 0644 for files and and 0755 for dirs. CF7 forces files to be 0400 and I understand the reason behind it, but it introduces some difficulty in SuPHP setups.

    Cheers, and keep up the good work.

    Thread Starter normadize

    (@normadize)

    Yes, it seems that’s the case … they are deleted regardless. In classes.php in the submit() method lines 409, all uploaded files are deleted:

    foreach ( (array) $this->uploaded_files as $name => $path ) {
    	@unlink( $path );
    }

    File that are too big can’t be attached so CF7 could offer the option of leaving them in the upload folder and place an url to them in the email. The email could have a url for download and one for delete, e.g. via a GET ?do=delete.

    Something for you to consider.

    Is there a way to add hooks/filters into CF7 so I can process the submitted data and modify the email body (e.g. to include such a URL to uploaded files)?

    EDIT: Just found wpcf7_before_send_mail … I’ll see what I can do with that.

    Cheers

    Thread Starter normadize

    (@normadize)

    Your current code is not any more secure. More importantly, you should leave the choice to the user, not making the decision for them.

    I have a need for this for an internal project. As far as i can tell, currently you

    – require an extension (not all files have one)
    – force an extension filter
    – are not willing to even consider this since you marked this as resolved

    Those are not very healthy choices. We are talking about an admin option so security wise it’s fine and you can still leave the default to require an extension.

    I see only benefits from adding an option like filetyperegex: for the expert users.

    Thread Starter normadize

    (@normadize)

    I ended up commenting lines 116-123 and 144-146 and added line 147 as follows:

    $file_type_pattern = '/' . $file_type_pattern . '/i';

    This allows any Regex as in filetype:. For me this is ok. Would be nice if you added a filetyperegex: option as well.

    Security wise it’s not worse than before but given this is a WP Admin Panel option, it should be Ok (if an attacker gets into WP Panel, this is the least of the owner’s worries).

    Thread Starter normadize

    (@normadize)

    Got it. It was the suphp config file which had a umask of 0077. Edit /etc/suphp/suphp.conf (or wherever you keep yours) and set umask=0022 to get 644 files and 755 dirs.

    Surprising that I haven’t seen this solution in these threads, although other people discussed suphp, or maybe I just missed it.

    It might be worth adding this info in WPSC … for the Admin Panel test, if it can’t read back the .html files then it could tell the user some possible causes. Currently it just says “failed to read”.

    Cheers

    Thread Starter normadize

    (@normadize)

    My pleasure. I try to behave the way I’d like the users of my software to 🙂

    Thread Starter normadize

    (@normadize)

    The solution is not to check the post type — this plugin should be available on all post types

    But Oshouki’s fix doesn’t check the post type, and the dropbown box is indeed available for all post types. His fix prevents multiple copies of the same dropdown box, which is the problem I reported. Your fix works too, thanks.

    Thread Starter normadize

    (@normadize)

    This bug is actually still present in 2.3-dev (pulled from github). I fixed it again. Will post a bug on Github and also the patch.

    Thread Starter normadize

    (@normadize)

    Ok. I’m posting a fix here too, just in case others are interested in patching their Pods too. In pick.php line 383 in PodsField_Pick::data(). Append after:

    $result[ $search_data->field_index ] = trim( $result[ $search_data->field_index ] );

    the line:

    if ( $search_data->field_index == 'post_title' )
        $result[ 'post_title' ] = apply_filters( 'the_title', $result[ 'post_title' ] );

    It’s crude, I know, but you get the point.

    Thread Starter normadize

    (@normadize)

    @everett, is there a clean way of hooking into CCTM from outside to make it recognize relationship fields that are split onto multiple rows rather than the expected JSON array strings? Are you using direct SQL queries to fetch post meta data or the WP API?

    Basically, I could can fetch all fields with the requested meta_key and if multiple rows are returned, put them into a JSON string fro CCTM. But if you’re directly SQL querying the DB then I can’t do much.

    @scott, it seems that running pods_no_conflict_on( 'post' ) on init actually does break Pods. Saving a post ignores changes done in custom fields, at least for relationship ones. After saving, it comes back with the old settings. Looking in the DB, nothing is changes (the wp_postmeta and wp_postrel entries are the same as before).

    Pods does populate the custom fields and displays the right widgets in the edit windows and everything, but fails upon saving. Is this a bug or expected?

Viewing 15 replies - 46 through 60 (of 78 total)