From 349939ed7535153c1930e84686d23b5ad98bd47f Mon Sep 17 00:00:00 2001 From: Mykyta Synelnikov Date: Tue, 12 Nov 2024 16:50:09 +0200 Subject: [PATCH] * fixed checking profile_photo and cover_photo fields editable condition on profile image upload/crop handlers; --- includes/core/class-files.php | 40 ++++++++++++++++++++++++++++++----- 1 file changed, 35 insertions(+), 5 deletions(-) diff --git a/includes/core/class-files.php b/includes/core/class-files.php index 00f7d16b..8f5389cc 100644 --- a/includes/core/class-files.php +++ b/includes/core/class-files.php @@ -402,8 +402,22 @@ if ( ! class_exists( 'um\core\Files' ) ) { wp_send_json_error( esc_js( __( 'This field doesn\'t support image crop', 'ultimate-member' ) ) ); } - if ( 'profile' === $mode && ! um_can_edit_field( $custom_fields[ $key ] ) ) { - wp_send_json_error( esc_js( __( 'You have no permission to edit this field', 'ultimate-member' ) ) ); + if ( 'profile' === $mode ) { + if ( in_array( $key, array( 'cover_photo', 'profile_photo' ), true ) ) { + if ( 'profile_photo' === $key ) { + $disable_photo_uploader = empty( $post_data['use_custom_settings'] ) ? UM()->options()->get( 'disable_profile_photo_upload' ) : $post_data['disable_photo_upload']; + if ( $disable_photo_uploader ) { + wp_send_json_error( esc_js( __( 'You have no permission to edit this field', 'ultimate-member' ) ) ); + } + } else { + $cover_enabled_uploader = empty( $post_data['use_custom_settings'] ) ? UM()->options()->get( 'profile_cover_enabled' ) : $post_data['cover_enabled']; + if ( ! $cover_enabled_uploader ) { + wp_send_json_error( esc_js( __( 'You have no permission to edit this field', 'ultimate-member' ) ) ); + } + } + } elseif ( ! um_can_edit_field( $custom_fields[ $key ] ) ) { + wp_send_json_error( esc_js( __( 'You have no permission to edit this field', 'ultimate-member' ) ) ); + } } $src = esc_url_raw( $_REQUEST['src'] ); @@ -550,9 +564,25 @@ if ( ! class_exists( 'um\core\Files' ) ) { } } - if ( 'profile' === $mode && ! um_can_edit_field( $custom_fields[ $id ] ) ) { - $ret['error'] = esc_html__( 'You have no permission to edit this field', 'ultimate-member' ); - wp_send_json_error( $ret ); + if ( 'profile' === $mode ) { + if ( in_array( $id, array( 'cover_photo', 'profile_photo' ), true ) ) { + if ( 'profile_photo' === $id ) { + $disable_photo_uploader = empty( $post_data['use_custom_settings'] ) ? UM()->options()->get( 'disable_profile_photo_upload' ) : $post_data['disable_photo_upload']; + if ( $disable_photo_uploader ) { + $ret['error'] = esc_html__( 'You have no permission to edit this field', 'ultimate-member' ); + wp_send_json_error( $ret ); + } + } else { + $cover_enabled_uploader = empty( $post_data['use_custom_settings'] ) ? UM()->options()->get( 'profile_cover_enabled' ) : $post_data['cover_enabled']; + if ( ! $cover_enabled_uploader ) { + $ret['error'] = esc_html__( 'You have no permission to edit this field', 'ultimate-member' ); + wp_send_json_error( $ret ); + } + } + } elseif ( ! um_can_edit_field( $custom_fields[ $id ] ) ) { + $ret['error'] = esc_html__( 'You have no permission to edit this field', 'ultimate-member' ); + wp_send_json_error( $ret ); + } } if ( isset( $_FILES[ $id ]['name'] ) ) {