Changeset 11334 for trunk/src/bp-core/classes/class-bp-attachment-avatar.php

Timestamp:

12/22/2016 09:09:37 PM (8 years ago)

Author:

djpaul

Message:

Avatars: improve robustness of crop process by confirming crop data.

For trunk/2.8.

File:

• trunk/src/bp-core/classes/class-bp-attachment-avatar.php (modified) (1 diff)

trunk/src/bp-core/classes/class-bp-attachment-avatar.php

@@ -205 +205 @@
         }
 
+        if ( ! bp_attachments_current_user_can( 'edit_avatar', $args ) ) {
+            return false;
+        }
+
+        if ( 'user' === $args['object'] ) {
+            $avatar_dir = 'avatars';
+        } else {
+            $avatar_dir = sanitize_key( $args['object'] ) . '-avatars';
+        }
+
+        $args['item_id'] = (int) $args['item_id'];
+
         /**
          * Original file is a relative path to the image
          * eg: /avatars/1/avatar.jpg
          */
-        $relative_path = $args['original_file'];
+        $relative_path = sprintf( '/%s/%s/%s', $avatar_dir, $args['item_id'], basename( $args['original_file'] ) );
         $absolute_path = $this->upload_path . $relative_path;