Changeset 43012 for trunk/src/wp-admin/includes/ajax-actions.php

Timestamp:

04/27/2018 07:53:37 PM (7 years ago)

Author:

azaozz

Message:

Privacy: add means to export personal data by username or email address. Generate a zipped export file containing all data. First run.

Props allendav.
See #43546.

File:

• trunk/src/wp-admin/includes/ajax-actions.php (modified) (7 diffs)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -4328 +4328 @@
 }
 
+/**
+ * Ajax handler for exporting a user's personal data.
+ *
+ * @since 4.9.6
+ */
 function wp_ajax_wp_privacy_export_personal_data() {
-    check_ajax_referer( 'wp-privacy-export-personal-data', 'security' );
+    $request_id  = (int) $_POST['id'];
+
+    if ( empty( $request_id ) ) {
+        wp_send_json_error( __( 'Error: Invalid request ID.' ) );
+    }
 
     if ( ! current_user_can( 'manage_options' ) ) {
@@ -4335 +4344 @@
     }
 
-    $email_address  = sanitize_text_field( $_POST['email'] );
+    check_ajax_referer( 'wp-privacy-export-personal-data-' . $request_id, 'security' );
+
+    // Get the request data.
+    $request = wp_get_user_request_data( $request_id );
+
+    if ( ! $request || 'export_personal_data' !== $request->action_name ) {
+        wp_send_json_error( __( 'Error: Invalid request type.' ) );
+    }
+
+    $email_address = $request->email;
+    if ( ! is_email( $email_address ) ) {
+        wp_send_json_error( __( 'Error: A valid email address must be given.' ) );
+    }
+
     $exporter_index = (int) $_POST['exporter'];
     $page           = (int) $_POST['page'];
+    $send_as_email  = isset( $_POST['sendAsEmail'] ) ? ( "true" === $_POST['sendAsEmail'] ) : false;
 
     /**
@@ -4349 +4372 @@
      *         callback               string  Callable exporter that accepts an email address and
      *                                        a page and returns an array of name => value
-     *                                        pairs of personal data
-     *         exporter_friendly_name string  Translated user facing friendly name for the exporter
+     *                                        pairs of personal data.
+     *         exporter_friendly_name string  Translated user facing friendly name for the exporter.
      *     ]
      * }
@@ -4376 +4399 @@
         }
 
-        // Surprisingly, email addresses can contain mutli-byte characters now
-        $email_address = trim( mb_strtolower( $email_address ) );
-
-        if ( ! is_email( $email_address ) ) {
-            wp_send_json_error( 'A valid email address must be given.' );
-        }
-
         $exporter = $exporters[ $index ];
+
         if ( ! is_array( $exporter ) ) {
             wp_send_json_error( "Expected an array describing the exporter at index {$exporter_index}." );
         }
-        if ( ! array_key_exists( 'callback', $exporter ) ) {
-            wp_send_json_error( "Exporter array at index {$exporter_index} does not include a callback." );
-        }
-        if ( ! is_callable( $exporter['callback'] ) ) {
-            wp_send_json_error( "Exporter callback at index {$exporter_index} is not a valid callback." );
-        }
         if ( ! array_key_exists( 'exporter_friendly_name', $exporter ) ) {
             wp_send_json_error( "Exporter array at index {$exporter_index} does not include a friendly name." );
+        }
+        if ( ! array_key_exists( 'callback', $exporter ) ) {
+            wp_send_json_error( "Exporter does not include a callback: {$exporter['exporter_friendly_name']}." );
+        }
+        if ( ! is_callable( $exporter['callback'] ) ) {
+            wp_send_json_error( "Exporter callback is not a valid callback: {$exporter['exporter_friendly_name']}." );
         }
 
@@ -4418 +4435 @@
         }
     } else {
-        // No exporters, so we're done
+        // No exporters, so we're done.
         $response = array(
             'data' => array(),
@@ -4436 +4453 @@
      * @param string $email_address   The email address associated with this personal data.
      * @param int    $page            The zero-based page for this response.
+     * @param int    $request_id      The privacy request post ID associated with this request.
+     * @param bool   $send_as_email   Whether the final results of the export should be emailed to the user.
      */
-    $response = apply_filters( 'wp_privacy_personal_data_export_page', $response, $exporter_index, $email_address, $page );
+    $response = apply_filters( 'wp_privacy_personal_data_export_page', $response, $exporter_index, $email_address, $page, $request_id, $send_as_email );
+
     if ( is_wp_error( $response ) ) {
         wp_send_json_error( $response );
@@ -4463 +4483 @@
     check_ajax_referer( 'wp-privacy-erase-personal-data-' . $request_id, 'security' );
 
-    // Find the request CPT
+    // Get the request data.
     $request = wp_get_user_request_data( $request_id );