Changeset 30354

Timestamp:

11/16/2014 05:46:35 AM (10 years ago)

Author:

johnbillion

Message:

Add some specific JSON responses when there are user permission errors for AJAX file uploads. Replace some usage of wp_json_encode() with wp_send_json_*().

See #25849
Props gcorne

Location:

trunk/src/wp-admin

Files:

• async-upload.php (modified) (2 diffs)
• includes/ajax-actions.php (modified) (4 diffs)

trunk/src/wp-admin/async-upload.php

@@ -33 +33 @@
 require_once( ABSPATH . 'wp-admin/admin.php' );
 
-if ( !current_user_can('upload_files') )
-    wp_die(__('You do not have permission to upload files.'));
-
-header('Content-Type: text/html; charset=' . get_option('blog_charset'));
-
 if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) {
     include( ABSPATH . 'wp-admin/includes/ajax-actions.php' );
@@ -47 +42 @@
     die( '0' );
 }
+
+
+
+
+
+
 
 // just fetch the detail form for that attachment

trunk/src/wp-admin/includes/ajax-actions.php

@@ -1834 +1834 @@
     check_ajax_referer( 'media-form' );
 
-    if ( ! current_user_can( 'upload_files' ) )
-        wp_die();
+    if ( ! current_user_can( 'upload_files' ) ) {
+        wp_send_json_error( array(
+            'message'  => __( "You don't have permission to upload files." ),
+            'filename' => $_FILES['async-upload']['name'],
+        ) );
+    }
 
     if ( isset( $_REQUEST['post_id'] ) ) {
         $post_id = $_REQUEST['post_id'];
-        if ( ! current_user_can( 'edit_post', $post_id ) )
-            wp_die();
+        if ( ! current_user_can( 'edit_post', $post_id ) ) {
+            wp_send_json_error( array(
+                'message'  => __( "You don't have permission to attach files to this post." ),
+                'filename' => $_FILES['async-upload']['name'],
+            ) );
+        }
     } else {
         $post_id = null;
@@ -1851 +1859 @@
         $wp_filetype = wp_check_filetype_and_ext( $_FILES['async-upload']['tmp_name'], $_FILES['async-upload']['name'], false );
         if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) ) {
-            echo wp_json_encode( array(
-                'success' => false,
-                'data'    => array(
-                    'message'  => __( 'The uploaded file is not a valid image. Please try again.' ),
-                    'filename' => $_FILES['async-upload']['name'],
-                )
+            wp_send_json_error( array(
+                'message'  => __( 'The uploaded file is not a valid image. Please try again.' ),
+                'filename' => $_FILES['async-upload']['name'],
             ) );
-
-            wp_die();
         }
     }
@@ -1866 +1869 @@
 
     if ( is_wp_error( $attachment_id ) ) {
-        echo wp_json_encode( array(
-            'success' => false,
-            'data'    => array(
-                'message'  => $attachment_id->get_error_message(),
-                'filename' => $_FILES['async-upload']['name'],
-            )
+        wp_send_json_error( array(
+            'message'  => $attachment_id->get_error_message(),
+            'filename' => $_FILES['async-upload']['name'],
         ) );
-
-        wp_die();
     }
 
@@ -1888 +1886 @@
         wp_die();
 
-    echo wp_json_encode( array(
-        'success' => true,
-        'data'    => $attachment,
-    ) );
-
-    wp_die();
+    wp_send_json_success( $attachment );
 }