private static function handle_upload(&$file)
 {
     global $ESS_Notices;
     $file = apply_filters('wp_handle_upload_prefilter', $file);
     if (isset($file['error']) && !is_numeric($file['error']) && $file['error']) {
         $ESS_Notices->add_error($file['error']);
     }
     $time = current_time('mysql');
     extract(wp_check_filetype_and_ext($file['tmp_name'], $file['name'], false));
     $ext = !$ext ? $file['mime'] : ltrim(strrchr($file['name'], '.'), '.');
     $type = !$type ? $file['type'] : $type;
     if ((!$type || !$ext) && !current_user_can('unfiltered_upload')) {
         $ESS_Notices->add_error(sprintf(__('Sorry, this file type is not permitted for security reasons (%s or %s).'), $type, $ext));
     }
     if (!(($uploads = wp_upload_dir($time)) && $uploads['error'] === false)) {
         $ESS_Notices->add_error($uploads['error']);
     }
     //var_dump( $uploads );
     //echo "ABSPATH: ". ABSPATH;
     $filename = wp_unique_filename($uploads['path'], $file['name'], null);
     // Move the file to the uploads dir
     $new_file = $uploads['path'] . "/" . $filename . "." . $ext;
     //if ( move_uploaded_file( $file['tmp_name'], $new_file ) === false )
     if (rename($file['tmp_name'], $new_file) === false) {
         $ESS_Notices->add_error(sprintf(__('The uploaded file could not be moved to %s.'), strpos($uploads['basedir'], ABSPATH) === 0 ? str_replace(ABSPATH, '', $uploads['basedir']) . $uploads['subdir'] : basename($uploads['basedir']) . $uploads['subdir']));
     }
     // Set correct file permissions
     $stat = stat(dirname($new_file));
     $perms = $stat['mode'] & 0666;
     @chmod($new_file, $perms);
     if (is_multisite()) {
         delete_transient('dirsize_cache');
     }
     return apply_filters('wp_handle_upload', array('file' => $new_file, 'url' => $uploads['url'] . "/" . $filename . "." . $ext, 'type' => $type), 'upload');
 }

/**
 * Force download of certain file types via ?download=path/filename.type
 *
 * This prompts "Save As" -- handy for MP3, PDF, etc. Only works on local files.
 *
 * This information was useful: http://wordpress.stackexchange.com/questions/3480/how-can-i-force-a-file-download-in-the-wordpress-backend
 *
 * Use add_theme_support( 'ctfw_force_downloads' );
 *
 * @since 0.9
 * @global object $wp_query
 * @global object $wp_filesystem;
 */
function ctfw_force_download()
{
    global $wp_query, $wp_filesystem;
    // Theme supports this?
    if (!current_theme_supports('ctfw-force-downloads')) {
        return;
    }
    // Check if this URL is a request for file download
    if (is_front_page() && !empty($_GET['download'])) {
        // relative file path
        $relative_file_path = ltrim($_GET['download'], '/');
        // remove preceding slash, if any
        // check for directory traversal attack
        if (!validate_file($relative_file_path)) {
            // false means it passed validation
            // path to file in uploads folder (only those can be downloaded)
            $upload_dir = wp_upload_dir();
            $upload_file_path = $upload_dir['basedir'] . '/' . $relative_file_path;
            // file exists in uploads folder?
            if (file_exists($upload_file_path)) {
                // make sure file valid as upload (valid type, extension, etc.)
                $validate = wp_check_filetype_and_ext($upload_file_path, basename($upload_file_path));
                if ($validate['type'] && $validate['ext']) {
                    // empty if type not in upload_mimes, doesn't exist, etc.
                    // headers to prompt "save as"
                    $filename = basename($upload_file_path);
                    $filesize = filesize($upload_file_path);
                    header('Content-Type: application/octet-stream', true, 200);
                    // replace WordPress 404 Not Found with 200 Okay
                    header('Content-Disposition: attachment; filename=' . $filename);
                    header('Expires: 0');
                    header('Cache-Control: must-revalidate');
                    header('Pragma: public');
                    header('Content-Length: ' . $filesize);
                    // clear buffering just in case
                    @ob_end_clean();
                    flush();
                    // Prepare to use WP_Filesystem
                    /* See comments below
                    			if ( ! class_exists( 'WP_Filesystem_Base') ) {
                    				require_once ABSPATH . 'wp-admin/includes/file.php';
                    			}
                    			WP_Filesystem();
                    			*/
                    // Output file contents using Direct method
                    // readfile more efficient; WP_Filesystem security used, causes Theme Check warning
                    //echo $wp_filesystem->get_contents( $upload_file_path );
                    @readfile($upload_file_path);
                    // we're done, stop further execution
                    exit;
                }
            }
        }
        // failure of any type results in 404 file not found
        $wp_query->set_404();
        status_header(404);
    }
}

 /**
  * Constructs instance of Document.
  *
  * @param WP_Post $attachment Attachment object used to initalize fields.
  * @param DG_Gallery $gallery Instance of Gallery class.
  */
 public function __construct($attachment, $gallery)
 {
     // init general document data
     $this->gallery = $gallery;
     $this->description = wptexturize($attachment->post_content);
     $this->ID = $attachment->ID;
     $this->link = $gallery->linkToAttachmentPg() ? get_attachment_link($attachment->ID) : wp_get_attachment_url($attachment->ID);
     $this->title = wptexturize($attachment->post_title);
     $this->title_attribute = esc_attr(strip_tags($this->title));
     $this->path = get_attached_file($attachment->ID);
     $wp_filetype = wp_check_filetype_and_ext($this->path, basename($this->path));
     $this->extension = $wp_filetype['ext'];
     $this->size = size_format(filesize($this->path));
 }

 function file_info($file)
 {
     if (!@is_uploaded_file($file['tmp_name'])) {
         return "something went wrong in the upload process";
     }
     if (!($file['size'] > 0)) {
         return "the file is empty. Please upload something more substantial";
     }
     $file_info = wp_check_filetype_and_ext($file['tmp_name'], $file['name'], false);
     if (!($file_info['type'] && $file_info['ext']) && !current_user_can('unfiltered_upload')) {
         return "the file type is not permitted for security reasons";
     }
     $file['type'] = $file_info['type'];
     $file['ext'] = $file_info['ext'];
     return $file;
 }

/**
 * Upload import file
 *
 * @since 0.3
 */
function wie_upload_import_file()
{
    // Check nonce for security since form was posted
    if (!empty($_POST) && !empty($_FILES['wie_import_file']) && check_admin_referer('wie_import', 'wie_import_nonce')) {
        // check_admin_referer prints fail page and dies
        // Uploaded file
        $uploaded_file = $_FILES['wie_import_file'];
        // Check file type
        // This will also fire if no file uploaded
        $wp_filetype = wp_check_filetype_and_ext($uploaded_file['tmp_name'], $uploaded_file['name'], false);
        if ('wie' != $wp_filetype['ext'] && !wp_match_mime_types('wie', $wp_filetype['type'])) {
            wp_die(__('You must upload a <b>.wie</b> file generated by this plugin.', 'widget-importer-exporter'), '', array('back_link' => true));
        }
        // Check and move file to uploads dir, get file data
        // Will show die with WP errors if necessary (file too large, quota exceeded, etc.)
        $overrides = array('test_form' => false);
        $file_data = wp_handle_upload($uploaded_file, $overrides);
        if (isset($file_data['error'])) {
            wp_die($file_data['error'], '', array('back_link' => true));
        }
        // Process import file
        wie_process_import_file($file_data['file']);
    }
}

 /**
  * Upload the file to be cropped in the second step.
  *
  * @since 4.3.0
  */
 public function handle_upload()
 {
     $uploaded_file = $_FILES['site-icon'];
     $file_type = wp_check_filetype_and_ext($uploaded_file['tmp_name'], $uploaded_file['name']);
     if (!wp_match_mime_types('image', $file_type['type'])) {
         wp_die(__('The uploaded file is not a valid image. Please try again.'));
     }
     $file = wp_handle_upload($uploaded_file, array('test_form' => false));
     if (isset($file['error'])) {
         wp_die($file['error'], __('Image Upload Error'));
     }
     $url = $file['url'];
     $type = $file['type'];
     $file = $file['file'];
     $filename = basename($file);
     // Construct the object array
     $object = array('post_title' => $filename, 'post_content' => $url, 'post_mime_type' => $type, 'guid' => $url, 'context' => 'site-icon');
     // Save the data
     $attachment_id = wp_insert_attachment($object, $file);
     return compact('attachment_id', 'file', 'filename', 'url', 'type');
 }

function wppb_resize_avatar($userID, $userlisting_size = null, $userlisting_crop = null)
{
    // include the admin image API
    require_once ABSPATH . '/wp-admin/includes/image.php';
    // retrieve first a list of all the current custom fields
    $wppb_manage_fields = get_option('wppb_manage_fields');
    foreach ($wppb_manage_fields as $key => $value) {
        if ($value['field'] == 'Avatar') {
            // retrieve width and height of the image
            $width = $height = '';
            //this checks if it only has 1 component
            if (is_numeric($value['avatar-size'])) {
                $width = $height = $value['avatar-size'];
            } else {
                //this checks if the entered value has 2 components
                $sentValue = explode(',', $value['avatar-size']);
                $width = $sentValue[0];
                $height = $sentValue[1];
            }
            $width = !empty($userlisting_size) ? $userlisting_size : $width;
            $height = !empty($userlisting_size) ? $userlisting_size : $height;
            if (!strpos(get_user_meta($userID, 'resized_avatar_' . $value['id'], true), $width . 'x' . $height)) {
                // retrieve the original image (in original size)
                $avatar_directory_path = get_user_meta($userID, 'avatar_directory_path_' . $value['id'], true);
                $image = wp_get_image_editor($avatar_directory_path);
                if (!is_wp_error($image)) {
                    do_action('wppb_before_avatar_resizing', $image, $userID, $value['meta-name'], $value['avatar-size']);
                    $crop = apply_filters('wppb_avatar_crop_resize', !empty($userlisting_crop) ? $userlisting_crop : false);
                    $resize = $image->resize($width, $height, $crop);
                    if ($resize !== FALSE) {
                        do_action('wppb_avatar_resizing', $image, $resize);
                        $fileType = apply_filters('wppb_resized_file_extension', 'png');
                        $wp_upload_array = wp_upload_dir();
                        // Array of key => value pairs
                        //create file(name); both with directory and url
                        $fileName_dir = $image->generate_filename(NULL, $wp_upload_array['basedir'] . '/profile_builder/avatars/', $fileType);
                        if (PHP_OS == "WIN32" || PHP_OS == "WINNT") {
                            $fileName_dir = str_replace('\\', '/', $fileName_dir);
                        }
                        $fileName_url = str_replace(str_replace('\\', '/', $wp_upload_array['basedir']), $wp_upload_array['baseurl'], $fileName_dir);
                        //save the newly created (resized) avatar on the disc
                        $saved_image = $image->save($fileName_dir);
                        /* the image save sometimes doesn't save with the desired extension so we need to see with what extension it saved it with and
                           if it differs replace the extension	in the path and url that we save as meta */
                        $validate_saved_image = wp_check_filetype_and_ext($saved_image['path'], $saved_image['path']);
                        $ext = substr($fileName_dir, strrpos($fileName_dir, '.', -1), strlen($fileName_dir));
                        if (!empty($validate_saved_image['ext']) && $validate_saved_image['ext'] != $ext) {
                            $fileName_url = str_replace($ext, '.' . $validate_saved_image['ext'], $fileName_url);
                            $fileName_dir = str_replace($ext, '.' . $validate_saved_image['ext'], $fileName_dir);
                        }
                        update_user_meta($userID, 'resized_avatar_' . $value['id'], $fileName_url);
                        update_user_meta($userID, 'resized_avatar_' . $value['id'] . '_relative_path', $fileName_dir);
                        do_action('wppb_after_avatar_resizing', $image, $fileName_dir, $fileName_url);
                    }
                }
            }
        }
    }
}

/**
 * Ajax handler for uploading attachments
 *
 * @since 3.3.0
 */
function wp_ajax_upload_attachment()
{
    check_ajax_referer('media-form');
    /*
     * This function does not use wp_send_json_success() / wp_send_json_error()
     * as the html4 Plupload handler requires a text/html content-type for older IE.
     * See https://core.trac.wordpress.org/ticket/31037
     */
    if (!current_user_can('upload_files')) {
        echo wp_json_encode(array('success' => false, 'data' => array('message' => __('You do not have permission to upload files.'), 'filename' => $_FILES['async-upload']['name'])));
        wp_die();
    }
    if (isset($_REQUEST['post_id'])) {
        $post_id = $_REQUEST['post_id'];
        if (!current_user_can('edit_post', $post_id)) {
            echo wp_json_encode(array('success' => false, 'data' => array('message' => __("You don't have permission to attach files to this post."), 'filename' => $_FILES['async-upload']['name'])));
            wp_die();
        }
    } else {
        $post_id = null;
    }
    $post_data = isset($_REQUEST['post_data']) ? $_REQUEST['post_data'] : array();
    // If the context is custom header or background, make sure the uploaded file is an image.
    if (isset($post_data['context']) && in_array($post_data['context'], array('custom-header', 'custom-background'))) {
        $wp_filetype = wp_check_filetype_and_ext($_FILES['async-upload']['tmp_name'], $_FILES['async-upload']['name']);
        if (!wp_match_mime_types('image', $wp_filetype['type'])) {
            echo wp_json_encode(array('success' => false, 'data' => array('message' => __('The uploaded file is not a valid image. Please try again.'), 'filename' => $_FILES['async-upload']['name'])));
            wp_die();
        }
    }
    $attachment_id = media_handle_upload('async-upload', $post_id, $post_data);
    if (is_wp_error($attachment_id)) {
        echo wp_json_encode(array('success' => false, 'data' => array('message' => $attachment_id->get_error_message(), 'filename' => $_FILES['async-upload']['name'])));
        wp_die();
    }
    if (isset($post_data['context']) && isset($post_data['theme'])) {
        if ('custom-background' === $post_data['context']) {
            update_post_meta($attachment_id, '_wp_attachment_is_custom_background', $post_data['theme']);
        }
        if ('custom-header' === $post_data['context']) {
            update_post_meta($attachment_id, '_wp_attachment_is_custom_header', $post_data['theme']);
        }
    }
    if (!($attachment = wp_prepare_attachment_for_js($attachment_id))) {
        wp_die();
    }
    echo wp_json_encode(array('success' => true, 'data' => $attachment));
    wp_die();
}

 $ret = array();
 if (class_exists('finfo')) {
     $finfo = new finfo();
     $fileinfo = $finfo->file($_FILES["userpro_file"]["tmp_name"], FILEINFO_MIME_TYPE);
 } else {
     $fileinfo = $_FILES['userpro_file']['type'];
 }
 $accepted_file_mime_types = array('image/gif', 'image/jpg', 'image/jpeg', 'image/png', 'application/pdf', 'application/zip', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', 'application/msword', 'text/plain', 'audio/wav', 'audio/mp3', 'audio/mp4');
 $file_extension = strtolower(strrchr($_FILES["userpro_file"]["name"], "."));
 if (!in_array($file_extension, array('.gif', '.jpg', '.jpeg', '.png', '.pdf', '.txt', '.zip', '.doc', '.docx', '.wav', '.mp3', '.mp4')) || !in_array($fileinfo, $accepted_file_mime_types)) {
     $ret['status'] = 0;
     echo json_encode($ret);
     die;
 } else {
     if (!is_array($_FILES["userpro_file"]["name"])) {
         $wp_filetype = wp_check_filetype_and_ext($_FILES["userpro_file"]["tmp_name"], $_FILES["userpro_file"]["name"]);
         $ext = empty($wp_filetype['ext']) ? '' : $wp_filetype['ext'];
         $type = empty($wp_filetype['type']) ? '' : $wp_filetype['type'];
         $proper_filename = empty($wp_filetype['proper_filename']) ? '' : $wp_filetype['proper_filename'];
         if ($proper_filename) {
             $file['name'] = $proper_filename;
         }
         if (!$type || !$ext) {
             die;
         }
         if (!$type) {
             $type = $file['type'];
         }
         $unique_id = uniqid();
         $ret = array();
         $target_file = $userpro->get_uploads_dir() . $unique_id . $file_extension;

function wp_ajax_upload_attachment()
{
    check_ajax_referer('media-form');
    if (!current_user_can('upload_files')) {
        wp_die();
    }
    if (isset($_REQUEST['post_id'])) {
        $post_id = $_REQUEST['post_id'];
        if (!current_user_can('edit_post', $post_id)) {
            wp_die();
        }
    } else {
        $post_id = null;
    }
    $post_data = isset($_REQUEST['post_data']) ? $_REQUEST['post_data'] : array();
    // If the context is custom header or background, make sure the uploaded file is an image.
    if (isset($post_data['context']) && in_array($post_data['context'], array('custom-header', 'custom-background'))) {
        $wp_filetype = wp_check_filetype_and_ext($_FILES['async-upload']['tmp_name'], $_FILES['async-upload']['name'], false);
        if (!wp_match_mime_types('image', $wp_filetype['type'])) {
            echo json_encode(array('success' => false, 'data' => array('message' => __('The uploaded file is not a valid image. Please try again.'), 'filename' => $_FILES['async-upload']['name'])));
            wp_die();
        }
    }
    $attachment_id = media_handle_upload('async-upload', $post_id, $post_data);
    if (is_wp_error($attachment_id)) {
        echo json_encode(array('success' => false, 'data' => array('message' => $attachment_id->get_error_message(), 'filename' => $_FILES['async-upload']['name'])));
        wp_die();
    }
    if (isset($post_data['context']) && isset($post_data['theme'])) {
        if ('custom-background' === $post_data['context']) {
            update_post_meta($attachment_id, '_wp_attachment_is_custom_background', $post_data['theme']);
        }
        if ('custom-header' === $post_data['context']) {
            update_post_meta($attachment_id, '_wp_attachment_is_custom_header', $post_data['theme']);
        }
    }
    if (!($attachment = wp_prepare_attachment_for_js($attachment_id))) {
        wp_die();
    }
    echo json_encode(array('success' => true, 'data' => $attachment));
    wp_die();
}

 /**
  * Handle uploading of the files
  *
  * @since 0.4
  *
  * @uses media_handle_sideload
  *
  * @param int  $post_id Parent post id
  * @return array Combined result of media ids and errors if any
  */
 function _upload_files($post_id = 0)
 {
     $media_ids = $errors = array();
     // Bail if there are no files
     if (empty($_FILES)) {
         return false;
     }
     // File field name could be user defined, so we just get the first file
     $files = current($_FILES);
     // There can be multiple files
     // So we need to iterate over each of the files to process
     for ($i = 0; $i < count($files['name']); $i++) {
         $fields = array('name', 'type', 'tmp_name', 'error', 'size');
         foreach ($fields as $field) {
             $k[$field] = $files[$field][$i];
         }
         $k['name'] = sanitize_file_name($k['name']);
         // Skip to the next file if upload went wrong
         if ($k['tmp_name'] == "") {
             continue;
         }
         $typecheck = wp_check_filetype_and_ext($k['tmp_name'], $k['name'], false);
         // Add an error message if MIME-type is not allowed
         if (!in_array($typecheck['type'], (array) $this->allowed_mime_types)) {
             $errors['fu-disallowed-mime-type'][] = array('name' => $k['name'], 'mime' => $k['type']);
             continue;
         }
         // Setup some default values
         // However, you can make additional changes on 'fu_after_upload' action
         $caption = '';
         // Try to set post caption if the field is set on request
         // Fallback to post_content if the field is not set
         if (isset($_POST['caption'])) {
             $caption = sanitize_text_field($_POST['caption']);
         } elseif (isset($_POST['post_content'])) {
             $caption = sanitize_text_field($_POST['post_content']);
         }
         // TODO: remove or refactor
         $filename = !empty($this->settings['default_file_name']) ? $this->settings['default_file_name'] : pathinfo($k['name'], PATHINFO_FILENAME);
         $post_overrides = array('post_status' => $this->_is_public() ? 'publish' : 'private', 'post_title' => isset($_POST['post_title']) && !empty($_POST['post_title']) ? sanitize_text_field($_POST['post_title']) : sanitize_text_field($filename), 'post_content' => empty($caption) ? __('Unnamed', 'frontend-uploader') : $caption, 'post_excerpt' => empty($caption) ? __('Unnamed', 'frontend-uploader') : $caption);
         // Trying to upload the file
         $upload_id = media_handle_sideload($k, (int) $post_id, $post_overrides['post_title'], $post_overrides);
         if (!is_wp_error($upload_id)) {
             $media_ids[] = $upload_id;
         } else {
             $errors['fu-error-media'][] = $k['name'];
         }
     }
     /**
      * $success determines the rest of upload flow
      * Setting this to true if no errors were produced even if there's was no files to upload
      */
     $success = empty($errors) ? true : false;
     if ($success) {
         foreach ($media_ids as $media_id) {
             $this->_save_post_meta_fields($media_id);
         }
     }
     // Allow additional setup
     // Pass array of attachment ids
     do_action('fu_after_upload', $media_ids, $success, $post_id);
     return array('success' => $success, 'media_ids' => $media_ids, 'errors' => $errors);
 }

 /**
  * Handle an Image upload for the background image.
  *
  * @since 3.0.0
  */
 public function handle_upload()
 {
     if (empty($_FILES)) {
         return;
     }
     check_admin_referer('custom-background-upload', '_wpnonce-custom-background-upload');
     $overrides = array('test_form' => false);
     $uploaded_file = $_FILES['import'];
     $wp_filetype = wp_check_filetype_and_ext($uploaded_file['tmp_name'], $uploaded_file['name']);
     if (!wp_match_mime_types('image', $wp_filetype['type'])) {
         wp_die(__('The uploaded file is not a valid image. Please try again.'));
     }
     $file = wp_handle_upload($uploaded_file, $overrides);
     if (isset($file['error'])) {
         wp_die($file['error']);
     }
     $url = $file['url'];
     $type = $file['type'];
     $file = $file['file'];
     $filename = basename($file);
     // Construct the object array
     $object = array('post_title' => $filename, 'post_content' => $url, 'post_mime_type' => $type, 'guid' => $url, 'context' => 'custom-background');
     // Save the data
     $id = wp_insert_attachment($object, $file);
     // Add the meta-data
     wp_update_attachment_metadata($id, wp_generate_attachment_metadata($id, $file));
     update_post_meta($id, '_wp_attachment_is_custom_background', get_option('stylesheet'));
     set_theme_mod('background_image', esc_url_raw($url));
     $thumbnail = wp_get_attachment_image_src($id, 'thumbnail');
     set_theme_mod('background_image_thumb', esc_url_raw($thumbnail[0]));
     /** This action is documented in wp-admin/custom-header.php */
     do_action('wp_create_file_in_uploads', $file, $id);
     // For replication
     $this->updated = true;
 }

 /**
  * Handle uploading of the files
  *
  * @since 0.4
  *
  * @uses media_handle_sideload
  *
  * @param int  $post_id Parent post id
  * @return array Combined result of media ids and errors if any
  */
 function _upload_files($post_id = 0)
 {
     // Only filter mimes just before the upload
     add_filter('upload_mimes', array($this, '_get_mime_types'), 999);
     $media_ids = $errors = array();
     // Bail if there are no files
     if (empty($_FILES)) {
         return array();
     }
     // File field name could be user defined, so we just get the first file
     $files = current($_FILES);
     // There can be multiple files
     // So we need to iterate over each of the files to process
     for ($i = 0; $i < count($files['name']); $i++) {
         $fields = array('name', 'type', 'tmp_name', 'error', 'size');
         foreach ($fields as $field) {
             $k[$field] = $files[$field][$i];
         }
         $k['name'] = sanitize_file_name($k['name']);
         //
         if ($k['error'] === 4) {
             continue;
         }
         // Skip to the next file if upload went wrong
         if ($k['error'] !== 0) {
             $errors['fu-error-media'][] = array('name' => $k['name'], 'code' => $k['error']);
             continue;
         }
         $typecheck = wp_check_filetype_and_ext($k['tmp_name'], $k['name'], false);
         // Add an error message if MIME-type is not allowed
         if (!in_array($typecheck['type'], (array) $this->allowed_mime_types)) {
             $errors['fu-disallowed-mime-type'][] = array('name' => $k['name'], 'mime' => $k['type']);
             continue;
         }
         // Now let's try to catch eval( base64() ) et al
         if (0 !== $this->_invoke_paranoia_on_file_contents(file_get_contents($k['tmp_name']))) {
             $errors['fu-suspicious-file'][] = array('name' => $k['name']);
             continue;
         }
         // Setup some default values
         // However, you can make additional changes on 'fu_after_upload' action
         $caption = '';
         // Try to set post caption if the field is set on request
         // Fallback to post_content if the field is not set
         if (isset($_POST['caption'])) {
             $caption = sanitize_text_field($_POST['caption']);
         } elseif (isset($_POST['post_content'])) {
             $caption = sanitize_text_field($_POST['post_content']);
         }
         $filename = pathinfo($k['name'], PATHINFO_FILENAME);
         $post_overrides = array('post_status' => $this->_is_public() ? 'publish' : 'private', 'post_title' => isset($_POST['post_title']) && !empty($_POST['post_title']) ? sanitize_text_field($_POST['post_title']) : sanitize_text_field($filename), 'post_content' => empty($caption) ? __('Unnamed', 'frontend-uploader') : $caption, 'post_excerpt' => empty($caption) ? __('Unnamed', 'frontend-uploader') : $caption);
         $m = $k;
         // Obfuscate filename if setting is present
         if (isset($this->settings['obfuscate_file_name']) && 'on' == $this->settings['obfuscate_file_name']) {
             $fn = explode('.', $k['name']);
             $m['name'] = uniqid(mt_rand(1, 1000), true) . '.' . end($fn);
         }
         // Trying to upload the file
         $upload_id = media_handle_sideload($m, (int) $post_id, $post_overrides['post_title'], $post_overrides);
         if (!is_wp_error($upload_id)) {
             $media_ids[] = $upload_id;
         } else {
             $errors['fu-error-media'][] = $k['name'];
         }
     }
     /**
      * $success determines the rest of upload flow
      * Setting this to true if no errors were produced even if there's was no files to upload
      */
     $success = empty($errors) ? true : false;
     if ($success) {
         foreach ($media_ids as $media_id) {
             $this->_save_post_meta_fields($media_id);
         }
     }
     // Allow additional setup
     // Pass array of attachment ids
     do_action('fu_after_upload', $media_ids, $success, $post_id);
     return array('success' => $success, 'media_ids' => $media_ids, 'errors' => $errors);
 }

 public static function check_type_and_ext($file, $file_name = '')
 {
     if (empty($file_name)) {
         $file_name = $file['name'];
     }
     $tmp_name = $file['tmp_name'];
     // Whitelist the mime type and extension
     $wp_filetype = wp_check_filetype_and_ext($tmp_name, $file_name);
     $ext = empty($wp_filetype['ext']) ? '' : $wp_filetype['ext'];
     $type = empty($wp_filetype['type']) ? '' : $wp_filetype['type'];
     $proper_filename = empty($wp_filetype['proper_filename']) ? '' : $wp_filetype['proper_filename'];
     if ($proper_filename) {
         return new WP_Error('invalid_file', esc_html__('There was an problem while verifying your file.'));
     }
     if (!$ext) {
         return new WP_Error('illegal_extension', esc_html__('Sorry, this file extension is not permitted for security reasons.'));
     }
     if (!$type) {
         return new WP_Error('illegal_type', esc_html__('Sorry, this file type is not permitted for security reasons.'));
     }
     return true;
 }

function ewf_import_uploadFile()
{
    // check_admin_referer prints fail page and dies
    if (!empty($_POST) && !empty($_FILES['ewf_import_file']) && check_admin_referer('ewf_import', 'ewf_import_nonce')) {
        $uploaded_file = $_FILES['ewf_import_file'];
        $uploaded_file_type = wp_check_filetype_and_ext($uploaded_file['tmp_name'], $uploaded_file['name']);
        if ('txt' != $uploaded_file_type['ext'] && !wp_match_mime_types('txt', $uploaded_file_type['type'])) {
            echo '<div>' . '<strong>' . 'Error: ' . '</strong>' . 'You must upload a <b>.txt</b> file.' . '</div>';
            return false;
        }
        $uploaded_file_data = wp_handle_upload($uploaded_file, array('test_form' => false));
        if (isset($uploaded_file_data['error'])) {
            echo '<div>' . '<strong>' . 'Error: ' . '</strong>' . $uploaded_file_data['error'] . '</div>';
            return false;
        }
        // echo '<pre>';
        // print_r( $uploaded_file_data );
        // echo '</pre>';
        // }else{
        // echo '<div>'.'<strong>'.'Error: '.'</strong>'.'Something went wrong!'.'</div>';
    }
}

 /**
  * Install routine
  * All of the heavy lifting happens here
  */
 public function do_install()
 {
     // Don't time out
     set_time_limit(0);
     // Don't abort the site in a bad state if the connection drops
     ignore_user_abort(true);
     // Ask the API what to do
     $result = $this->api->get_setup_instructions($_POST['site_type'], $_POST['theme_slug']);
     if (is_wp_error($result)) {
         wp_die(__('There was a problem fetching the data', 'gd_quicksetup'));
     } else {
         $result = json_decode($result['body'], true);
     }
     // Start the installation process
     do_action('gd_quicksetup_install');
     // Install plugins
     $this->_current_plugin_options = array();
     $plugin_installer_skin = new GD_QuickSetup_Installer_Skin();
     $plugin_installer = new GD_QuickSetup_Plugin_Upgrader($plugin_installer_skin);
     do_action('gd_quicksetup_install_plugins');
     foreach ((array) $result['plugins'] as $plugin) {
         $this->_current_plugin_options = isset($plugin['options']) ? $plugin['options'] : array();
         $this->flush();
         $plugin_installer->install($plugin['url']);
         $plugin_installer->activate_plugin($plugin['slug']);
         $this->flush();
     }
     do_action('gd_quicksetup_install_plugins_done');
     // Theme
     do_action('gd_quicksetup_install_theme');
     $this->_current_theme_options = isset($result['theme']['options']) ? $result['theme']['options'] : array();
     $theme_installer_skin = new GD_QuickSetup_Installer_Skin();
     $theme_installer = new GD_QuickSetup_Theme_Upgrader($theme_installer_skin);
     $this->flush();
     $theme_installer->install($result['theme']['url']);
     $this->flush();
     $theme_installer->switch_theme($result['theme']['stylesheet']);
     do_action('gd_quicksetup_install_theme_done');
     // Content
     do_action('gd_quicksetup_install_content');
     // Start the menu at 30
     // home = 10
     // gallery = 20
     // location = 700
     // contact = 800
     // blog = 999
     $menu = 30;
     // Create pages
     $this->flush();
     foreach ((array) $_POST['type'] as $k => $v) {
         if (!$_POST['enabled'][$k] || 'false' === $_POST['enabled'][$k]) {
             continue;
         }
         if ('page' === $v) {
             if (!isset($_POST['title'][$k]) || empty($_POST['title'][$k])) {
                 $title = __('Untitled', 'gd_quicksetup');
             } else {
                 $title = $_POST['title'][$k];
             }
             $pageid = wp_insert_post(array('comment_status' => 'closed', 'ping_status' => 'closed', 'post_content' => wp_kses($_POST['content'][$k], wp_kses_allowed_html('post')), 'post_name' => sanitize_title($title), 'post_title' => strip_tags($title), 'post_type' => 'page', 'post_status' => 'publish', 'menu_order' => $_POST['home'][$k] ? 10 : ($menu += 10)));
             if ($_POST['home'][$k] && 0 !== strcasecmp($_POST['home'][$k], 'false')) {
                 update_option('show_on_front', 'page');
                 update_option('page_on_front', $pageid);
             }
         }
     }
     $this->flush();
     // Create gallery
     $this->flush();
     foreach ((array) $_POST['type'] as $k => $v) {
         if (!$_POST['enabled'][$k] || 'false' === $_POST['enabled'][$k]) {
             continue;
         }
         if ('gallery' === $v) {
             $gallery_ids = array();
             foreach ($_FILES as $k2 => $v2) {
                 if (0 === strpos($k2, 'upload_image_' . $k . '_') && is_uploaded_file($_FILES[$k2]['tmp_name'])) {
                     // Check mime type, only allow "image/*" files
                     $info = wp_check_filetype_and_ext($_FILES[$k2]['tmp_name'], $_FILES[$k2]['name']);
                     if (isset($info['type']) && 0 === stripos($info['type'], 'image/')) {
                         $id = media_handle_upload($k2, 0);
                         if (!is_wp_error($id) && is_numeric($id)) {
                             $gallery_ids[] = $id;
                         }
                     }
                 }
             }
             if (empty($gallery_ids)) {
                 continue;
             }
             $pageid = wp_insert_post(array('comment_status' => 'closed', 'ping_status' => 'closed', 'post_content' => '[gallery ids="' . implode(',', $gallery_ids) . '"]', 'post_name' => __('gallery', 'gd_quicksetup'), 'post_title' => __('Gallery', 'gd_quicksetup'), 'post_type' => 'page', 'post_status' => 'publish', 'menu_order' => 20));
             if ($_POST['home'][$k] && 0 !== strcasecmp($_POST['home'][$k], 'false')) {
                 update_option('show_on_front', 'page');
                 update_option('page_on_front', $pageid);
             }
         }
//.........这里部分代码省略.........

/**
 * Clone of wp_handle_upload function
 * with this function, we allowed to define the upload_path and upload_url
 */
function wip_handle_upload(&$file, $overrides = false, $time = null, $upload_path = "", $upload_url = "")
{
    // The default error handler.
    if (!function_exists('wip_handle_upload_error')) {
        function wip_handle_upload_error(&$file, $message)
        {
            return array('error' => $message);
        }
    }
    $file = apply_filters('wp_handle_upload_prefilter', $file);
    // You may define your own function and pass the name in $overrides['upload_error_handler']
    $upload_error_handler = 'wip_handle_upload_error';
    // You may have had one or more 'wp_handle_upload_prefilter' functions error out the file.  Handle that gracefully.
    if (isset($file['error']) && !is_numeric($file['error']) && $file['error']) {
        return $upload_error_handler($file, $file['error']);
    }
    // You may define your own function and pass the name in $overrides['unique_filename_callback']
    $unique_filename_callback = null;
    // $_POST['action'] must be set and its value must equal $overrides['action'] or this:
    $action = 'wip_handle_upload';
    // Courtesy of php.net, the strings that describe the error indicated in $_FILES[{form field}]['error'].
    $upload_error_strings = array(false, __("The uploaded file exceeds the upload_max_filesize directive in php.ini.", 'wip'), __("The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form.", 'wip'), __("The uploaded file was only partially uploaded.", 'wip'), __("No file was uploaded.", 'wip'), '', __("Missing a temporary folder.", 'wip'), __("Failed to write file to disk.", 'wip'), __("File upload stopped by extension.", 'wip'));
    // All tests are on by default. Most can be turned off by $overrides[{test_name}] = false;
    $test_form = true;
    $test_size = true;
    $test_upload = true;
    // If you override this, you must provide $ext and $type!!!!
    $test_type = true;
    $mimes = false;
    // Install user overrides. Did we mention that this voids your warranty?
    if (is_array($overrides)) {
        extract($overrides, EXTR_OVERWRITE);
    }
    // A correct form post will pass this test.
    if ($test_form && (!isset($_POST['action']) || $_POST['action'] != $action)) {
        return call_user_func($upload_error_handler, $file, __('Invalid form submission.', 'wip'));
    }
    // A successful upload will pass this test. It makes no sense to override this one.
    if ($file['error'] > 0) {
        return call_user_func($upload_error_handler, $file, $upload_error_strings[$file['error']]);
    }
    // A non-empty file will pass this test.
    if ($test_size && !($file['size'] > 0)) {
        if (is_multisite()) {
            $error_msg = __('File is empty. Please upload something more substantial.', 'wip');
        } else {
            $error_msg = __('File is empty. Please upload something more substantial. This error could also be caused by uploads being disabled in your php.ini or by post_max_size being defined as smaller than upload_max_filesize in php.ini.', 'wip');
        }
        return call_user_func($upload_error_handler, $file, $error_msg);
    }
    // A properly uploaded file will pass this test. There should be no reason to override this one.
    if ($test_upload && !@is_uploaded_file($file['tmp_name'])) {
        return call_user_func($upload_error_handler, $file, __('Specified file failed upload test.', 'wip'));
    }
    // A correct MIME type will pass this test. Override $mimes or use the upload_mimes filter.
    if ($test_type) {
        $wp_filetype = wp_check_filetype_and_ext($file['tmp_name'], $file['name'], $mimes);
        extract($wp_filetype);
        // Check to see if wp_check_filetype_and_ext() determined the filename was incorrect