0

Mjello,

I'm struggling with this function that prevents users from uploading more photos than what their membership are entitled to.

So they have 10 photos to upload. When they've reached 0 they should no longer be able to upload a photo. As it is now, the image that they're uploading when they've have reached 0 is not inserted in their profile, but it's still uploaded to the server. My error message does not fire either.

I'm a bit confused on what I'm missing here.

This is what the function looks like:

/**
     * Uploads image
     */
    public static function uploadImage($file) {
        require_once(ABSPATH.'wp-admin/includes/image.php');
        $attachment=array('ID' => 0);


        if(!empty($file['name'])) {
            $uploads=wp_upload_dir();
            $filetype=wp_check_filetype($file['name'], null);
            $filename=wp_unique_filename($uploads['path'], 'o.'.$filetype['ext']);
            $filepath=$uploads['path'].'/'.$filename;           

            //validate file
            if (!in_array($filetype['ext'], array('jpg', 'JPG', 'jpeg', 'JPEG', 'png', 'PNG'))) {
                SWPInterface::$messages[]=__('Only JPG and PNG images are allowed.', );
            } else if(move_uploaded_file($file['tmp_name'], $filepath)) {

                    //upload image
                    $attachment=array(
                        'guid' => $uploads['url'].'/'.$filename,
                        'post_mime_type' => $filetype['type'],
                        'post_title' => sanitize_title(current(explode('.', $filename))),
                        'post_content' => '',
                        'post_status' => 'inherit',
                        'post_author' => get_current_user_id(),
                    );

                    //add image
                    $attachment['ID']=wp_insert_attachment($attachment, $attachment['guid'], 0);
                    update_post_meta($attachment['ID'], '_wp_attached_file', substr($uploads['subdir'], 1).'/'.$filename);

                    //add thumbnails
                    $metadata=wp_generate_attachment_metadata($attachment['ID'], $filepath);
                    wp_update_attachment_metadata($attachment['ID'], $metadata);

            } else {
                SWPInterface::$messages[]=__('This image is too large for uploading.');
            }
        }

        return $attachment;
    }
}

And here's what the actual form looks like:

<div class="widget clearfix">
    <h4 class="widget-title clearfix">
        <span class="left"><?php _e('Photos'); ?> </span>
        <span class="widget-options">
            <?php if(SWPUser::isProfile()) { ?>
            <form action="" enctype="multipart/form-data" method="POST" class="upload-form popup-container">
                <label for="user_photo" title="<?php _e('Upload a new image'); ?>"></label>
                <input type="file" id="user_photo" name="user_photo" class="shifted" />
                <input type="hidden" name="user_action" value="add_photo" />
                <input type="hidden" name="nonce" value="<?php echo wp_create_nonce(SWP_PREFIX.'nonce'); ?>" />
                <?php if(SWPUser::$data['user']['membership']['photos']<=0) { ?> 
                <div class="popup hidden">
                    <ul class="error">
                        <li><?php _e('You are not allowed to upload more images.'); ?></li>
                    </ul>
                </div>
                <?php } ?>              
            </form>
            <?php } ?>
        </span> 
    </h4>
    <?php if(empty(SWPUser::$data['active_user']['photos'])) { ?>
    <span class="secondary"><?php _e('You have not uploaded any photos yet.'); ?></span>
    <?php } else { ?>
    <div class="SWP-slider carousel-slider">                        
        <ul>
            <?php
            $counter=0;
            foreach(SWPUser::sortPhotos(SWPUser::$data['active_user']['photos']) as $photo) {
            $thumbnail=wp_get_attachment_image_src($photo['ID'], 'full');
            $fullsize=wp_get_attachment_image_src($photo['ID'], 'extended');
            $counter++;
            if($counter==1) {
            ?>
            <li class="clearfix">
            <?php } ?>
                <div class="fourcol static-column <?php if($counter==3) { ?>last<?php } ?>">
                    <div class="profile-preview widget-profile">
                        <div class="profile-image popup-container">
                            <a href="<?php echo $fullsize[0]; ?>" class="colorbox" data-group="photos"><img src="<?php echo SWP_resize($thumbnail[0], 150, 150); ?>" class="fullwidth" alt="" /></a>
                            <?php if(!is_user_logged_in()) { ?>
                            <div class="popup hidden">
                                <ul class="error">
                                    <li><?php _e('Please login ); ?></li>
                                </ul>
                            </div>
                            <?php } ?>
                        </div>
                        <?php if(SWPUser::isProfile()) { ?>
                        <div class="profile-options clearfix">
                            <div class="profile-option">
                                <form class="ajax-form" action="<?php echo AJAX_URL; ?>" method="POST">
                                    <?php if(SWPUser::isFeaturedPhoto($photo['ID'])) { ?>
                                    <a href="#" title="<?php _e('Unfeature Photo'); ?>" data-title="<?php _e('Feature Photo'); ?>" class="icon-star submit-button current"></a>
                                    <input type="hidden" class="toggle" name="user_action" value="unfeature_photo" data-value="feature_photo" />
                                    <?php } else { ?>
                                    <a href="#" title="<?php _e('Feature Photo'); ?>" data-title="<?php _e('Unfeature Photo'); ?>" class="icon-star submit-button"></a>
                                    <input type="hidden" class="toggle" name="user_action" value="feature_photo" data-value="unfeature_photo" />
                                    <?php } ?>
                                    <input type="hidden" name="user_photo" value="<?php echo $photo['ID']; ?>" />
                                    <input type="hidden" class="nonce" value="<?php echo wp_create_nonce(SWP_PREFIX.'nonce'); ?>" />
                                    <input type="hidden" class="action" value="<?php echo SWP_PREFIX; ?>update_user" />         
                                </form>
                            </div>
                            <div class="profile-option">
                                <form action="" method="POST">
                                    <a href="#" title="<?php _e('Remove Photo'); ?>" class="submit-button icon-remove"></a>                                 
                                    <input type="hidden" name="user_photo" value="<?php echo $photo['ID']; ?>" />
                                    <input type="hidden" name="user_action" value="remove_photo" />
                                    <input type="hidden" name="nonce" value="<?php echo wp_create_nonce(SWP_PREFIX.'nonce'); ?>" />
                                </form>
                            </div>
                        </div>
                        <?php } ?>  
                    </div>                                      
                </div>
            <?php 
            if($counter==3) {
            $counter=0;
            ?>
            </li>
            <?php 
                }
            }
            if($counter!==0) {
            ?>
            </li>
            <?php } ?>
        </ul>
    </div>
    <?php } ?>
</div>

Update: I was able to prevent the upload by adding this before the validation:

if(TiliaUser::$data['user']['membership']['photos']<=0) {
             return $file;
}   

However, I'm unable to get the error message to show up. Any ideas?

1
  • I suppose the users won't upload another image if it's not uploaded to their user profile. But it's still possible. Could anyone give me some hints on how I'm suppose to get the error to show at least?
    – dkl
    Commented Mar 5, 2015 at 14:22

1 Answer 1

1

In general your problem is that you check the condition on the front end but not on the backend. You have to check if a user is a allowed to upload a file before moving it to the uploads directory and adding it as an attachment.

If the limitation you put are kind of nice to have it might be enough to limit upload in the UI, but if it has business or law related implications then the only way is server side checks.

1
  • So bascially, the function works as intended, but without displaying the error... As it is now it does limit the upload in the UI, the problem is ofcourse that my server gets filled with photos if the users keeps uploading images. There's nothing there to restrict the user from flodding the server with images. Especially since the error message refuses to show. :(
    – dkl
    Commented Mar 5, 2015 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.