Get shortcode attribute for AJAX call

Question

I want to pass my plugin a folder where it can access files, so I can run multiple instances with different folders set. Adding an attribute with the folder name was my first thought.

Because I'm using AJAX I need to access always the attribute of my shortcode. I've found this solution with passing the attribute to the JS and then pass it back when a AJAX call happens: https://wordpress.stackexchange.com/a/184219

I tried it, but it didn't worked. Is there maybe a more elegant way to do this?

Here is the important part of my PHP file:

add_action('init', 'wporg_shortcodes_init');
add_action('wp_enqueue_scripts', 'wporg_enqueue_scripts');

// My global variable for all AJAX processing PHP functions
$scrDir = "";

function wporg_shortcodes_init() {
    add_shortcode('wporg', 'wporg_shortcode');
}

function wporg_shortcode($atts = [], $content = null) {
    global $srcDir;
    $srcDir = $atts['srcdir']; // Here is the attribute set

    return '<h1>Hello World</h1>';
}

function wporg_enqueue_scripts() {
    global $srcDir; // Needs to get right context with 'global'

    wp_register_script('ajaxHandle', plugin_dir_url(__FILE__) . 'js/main.js', array(), false, true);
    wp_enqueue_script('ajaxHandle');
    wp_localize_script('ajaxHandle', 'ajax_object',
        array(
            'ajaxurl' => admin_url('admin-ajax.php'),
            'srcdir' => $srcDir));
}

This is my AJAX call from main.js, which passes the attribute back:

$.ajax({
    url: ajax_object.ajaxurl,
    type: 'POST',
    data:{
        action: 'search_for_files',
        data: 'Test data',
        srcdir: ajax_object.srcdir // Pass attribute back
    },
    success: function(data) {
        console.log("srcdir: " + ajax_object.srcdir); // srcdir is empty although I've set it in wporg_shortcode()
    },
    dataType: "json"
});

And here is the shortshode:

[wporg srcdir="myDirectory"]

The problem is that my Javascript always returns an empty srcdir. What is wrong here?

---

Edit: The search expression in search_for_files with exec looks like this:

"find " . UPLOAD_FILES_PATH . $srcDir . " -iname '*" . $filename . "*' -type f";

Answer 1

The problem is ordering. $srcDir is being set correctly, but when it's set the call to wp_localize_script has already happened.

Instead, consider changing your code to refer to a data attribute in the content that the shortcode returns. This also prevents the code being tied to only allowing a single instance per page.

Additionally, there is a major security issue. By passing in the folder name, you open the site up to directory traversal attacks. Users could craft their own values that include ..\ to look anywhere in the filesystem and retrieve any file they wanted, including wp-config.php. They could then use that information to connect to your database and make steal information or insert their own information, e.g. "You've been hacked send 10,000 bitcoin to xxxxx"

Additionally, your functions and global variables are very generic, and in no way prefixed, so if another plugin used srcDir it would clash, breaking things.

I would also recommend abandoning the Admin AJAX route in favour of the easier to implement and more secure WP REST API

Have you considered using a custom post type with files attached? The same way WordPress creates posts of type attachment for uploaded files? You could have attachment files with a parent post of type document set. This would allow you to eliminate the need for an AJAX endpoint or a REST API endpoint entirely, letting you use the ones that come out of the box with WordPress at /wp-json/wp/v2/etc..