Changeset 11321 for branches/2.3/src/bp-core/classes/class-bp-attachment-avatar.php

Timestamp:

12/22/2016 08:29:52 PM (9 years ago)

Author:

djpaul

Message:

Avatars: improve robustness of crop process by confirming crop data.

For the 2.3 branch.

File:

• branches/2.3/src/bp-core/classes/class-bp-attachment-avatar.php (modified) (1 diff)

branches/2.3/src/bp-core/classes/class-bp-attachment-avatar.php

@@ -199 +199 @@
         }
 
+        if ( ! bp_attachments_current_user_can( 'edit_avatar', $args ) ) {
+            return false;
+        }
+
+        if ( 'user' === $args['object'] ) {
+            $avatar_dir = 'avatars';
+        } else {
+            $avatar_dir = sanitize_key( $args['object'] ) . '-avatars';
+        }
+
+        $args['item_id'] = (int) $args['item_id'];
+
         /**
          * Original file is a relative path to the image
          * eg: /avatars/1/avatar.jpg
          */
-        $relative_path = $args['original_file'];
+        $relative_path = sprintf( '/%s/%s/%s', $avatar_dir, $args['item_id'], basename( $args['original_file'] ) );
         $absolute_path = $this->upload_path . $relative_path;