Discussion:
Delete Row - Refreshes Page but not DB
BenderisGreat
2013-09-25 17:00:18 UTC
Permalink
The following code I wrote to perform two functions. Delete a row matching
the the row[id] and to also erase the associated attachment post. It
functions - The code shows the delete button in every row, and when pressed
the row is deleted. However after pressing delete the page is refreshed (not
sure why, I dont have any onclick or onsubmit events set) and the row
remains until a manual refresh is performed. Need a little assistance
figuring why;

<?php
if (isset($_POST['id'])) {
$id = $_POST['id'];
if (isset($_POST['deleteItem'])) {
get_delete_post_link( get_the_ID($row['file']));
$qry = "DELETE FROM wp_jo_plugin_options WHERE id = ".$id."";
$jo_remove_row = $wpdb->query($qry);
}
}
?>


Here is the code responsible for showing the table.

<?php
$jo_max_rows = get_option( 'jo_plugin_options');
$result_array = $wpdb->get_results('SELECT * FROM '. $wpdb->prefix .
jo_plugin_options .' WHERE user_id = '. $userid .' ORDER BY date DESC',
ARRAY_A);
$i = 0;
$limit = $jo_max_rows['jo_max_records'];
$count = count($result_array);
while ($i < $limit && $i < $count)
{
$row = $result_array[$i];
$jo_pic_icon = wp_get_attachment_url( $row['file'] );
?>




<?php echo $row['date']; ?>
<?php echo $row['length'] . '' . $selected ?>

<?php echo $row['ground'] . '' . $selected ?>

<?php $del_hide = (isset($table_fields['jo_checkbox_del']));
if (!$del_hide) { ?>



<form method="post" action="" />
<input type=&quot;hidden&quot; name=&quot;id&quot; value=&quot;&lt;?php
echo $row['id']; ?>" />
<button type="submit" name="deleteItem" value="delete"
class=""></button>
<?php } else { }; ?>
</form>


<?php if(!empty($row['file'])) { ?>
<a href=&quot;&lt;?php echo $jo_pic_icon; ?>">
<? } else { }; ?>


<?php
++$i; }
?>



--
View this message in context: http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42392.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
BenderisGreat
2013-09-25 17:03:55 UTC
Permalink
The code kept rendering here, so I attached it in a text file;





--
View this message in context: http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
J.D. Grimes
2013-09-25 19:07:00 UTC
Permalink
Post by BenderisGreat
The following code I wrote to perform two functions. Delete a row matching
the the row[id] and to also erase the associated attachment post. It
functions - The code shows the delete button in every row, and when pressed
the row is deleted. However after pressing delete the page is refreshed (not
sure why, I dont have any onclick or onsubmit events set) and the row
remains until a manual refresh is performed. Need a little assistance
figuring why;
I think perhaps you meant to say that the page is NOT automatically refreshed when you hit the delete button? The expected result from your code would be that the page should refresh. There is no way (without interference from some JavaScript somewhere) that anything is getting deleted without a refresh. Could you clarify that?

J.D.
BenderisGreat
2013-09-25 19:09:29 UTC
Permalink
The page does refresh, yes. But the row remains visible, as if it was not
deleted. I must then manually refresh the page for the row to show as
deleted. Cant figure why that is.



--
View this message in context: http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393p42401.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
J.D. Grimes
2013-09-25 19:15:29 UTC
Permalink
Sounds like the code that deletes the row isn't being executed until after the table is displayed.

J.D.
Post by BenderisGreat
The page does refresh, yes. But the row remains visible, as if it was not
deleted. I must then manually refresh the page for the row to show as
deleted. Cant figure why that is.
--
View this message in context: http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393p42401.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
BenderisGreat
2013-09-25 19:22:41 UTC
Permalink
Right you are [again] J.D.

So should I just start sending you paypal payments for your assistance?
One more followup question - I don't know any Ajax- is there a simple way
(now that the form is fixed) to remove that row without a page refresh?

Again, not familiar with ajax so coding that myself isn't an option yet, but
maybe there is a simple way to implement something like that?



--
View this message in context: http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393p42403.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
J.D. Grimes
2013-09-25 19:50:15 UTC
Permalink
It isn't hard to do, I've done it before. Do you know jQuery? jQuery's AJAX handlers are very easy to user (in my opinion, at least). Quick and probably somewhat dirty example:

jQuery( document ).ready( function( $ ) {

// When a button is clicked within the table with id="mytable"
$( '#mytable button' ).click( function( event ) {

// Keep the default action from happening (form submitted/page refreshed)
event.preventDefault();

if ( ! confirm( 'Are you sure you want to continue' ) )
return;

// Get the id of the row to delete.
// I'd recommend just making the button value the row ID, no need for the extra input.
// Then you can access it easier through $( this ).val();
var rowID = $( this ).parent().child( 'input' )[0].val();

// POST data.
var data = {
'action': 'my_delete_row_action',
'rowID': rowID
}

// Send AJAX request to delete this.
$.post(
ajaxurl,
data,
function ( response ) {

// Check if this was successful.
// Assumes you are using http://codex.wordpress.org/Function_Reference/wp_send_json_success
if ( ! response.success ) {

alert( 'Failure!' );
}

// Success! Hide the row.
$( '#mytable tr#myrow-' + rowID ).hide();
}
);
});
});

OK, that probably won't work off the bat, just an example. You'll need to give your table an HTML ID, and give each row a unique ID based on $i (in the example it's myrow-$i.

Also you'll need to see http://codex.wordpress.org/AJAX_in_Plugins for info on how to handle the AJAX request properly within WordPress.

I'm sure you can find some great tutorials out there to help you along, too.

J.D.
Post by BenderisGreat
Right you are [again] J.D.
So should I just start sending you paypal payments for your assistance?
One more followup question - I don't know any Ajax- is there a simple way
(now that the form is fixed) to remove that row without a page refresh?
Again, not familiar with ajax so coding that myself isn't an option yet, but
maybe there is a simple way to implement something like that?
--
View this message in context: http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393p42403.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
BenderisGreat
2013-10-19 07:21:19 UTC
Permalink
*I was having a hard time working out how to implement the ajax into
wordpress with the JSON callback. So, I hired a guy from freelancer. His
job was to setup my form as ajax, but im looking at his code now and it does
not make use the same code you used.

What he did was echo the row-ID in each
(is this safe?) and then created this button:*

<div id=&quot;delete&lt;?php echo $row['id']; ?>">
<input type=&quot;submit&quot; name=&quot;deleteItem&quot;
value=&quot;delete&quot; class=&quot;delete-box&quot;
onclick=&quot;delete1(&lt;?php echo $row['id']; ?>) ">delete
</div>

*and this <div>, which shows inside the
I click delete on:*

<div style=&quot;display:none&quot; id=&quot;areusure&lt;?php echo
$row['id']; ?>"></div>

*Then, in the head of the file this is the script that handles the selection
of the
etc...*




*and finally, here is the ajax call (which isnt written how you suggested
using ajaxurl in wordpress)*


<?php
if ( !isset($wp_did_header) ) {
$wp_did_header = true;
require_once('../../../wp-load.php' );
wp();
require_once( ABSPATH . WPINC . '/template-loader.php' );

}
global $wpdb;
if (isset($_REQUEST['id'])) {
$id = $_REQUEST['id'];
$file = $wpdb->get_var("select file from wp_jo_plugin_options WHERE id =
$id");
//wp_delete_attachment( $file );
$qry2 = $wpdb->prepare("CREATE TABLE IF NOT EXISTS t2 AS SELECT * from
wp_jo_plugin_options WHERE id = %s", $id);
$jo1 = $wpdb->query($qry2);
$qry = $wpdb->prepare("DELETE FROM wp_jo_plugin_options WHERE id = %s",
$id);
$jo_remove_row = $wpdb->query($qry);
}
if (isset($_REQUEST['undo'])) {
$undo = $_REQUEST['undo'];
$qry2 = $wpdb->prepare("insert ignore into wp_jo_plugin_options SELECT *
from t2 WHERE id = %s", $undo);
$jo_remove_row = $wpdb->query($qry2);
}
?>


*Now - I have no idea is this is bad code, but it does not match the same
layout you suggested. Is this safe? It cost me about 100 bucks on
freelancer.com. :-/*
Post by J.D. Grimes
It isn't hard to do, I've done it before. Do you know jQuery? jQuery's
AJAX handlers are very easy to user (in my opinion, at least). Quick and
jQuery( document ).ready( function( $ ) {
// When a button is clicked within the table with id="mytable"
$( '#mytable button' ).click( function( event ) {
// Keep the default action from happening (form submitted/page refreshed)
event.preventDefault();
if ( ! confirm( 'Are you sure you want to continue' ) )
return;
// Get the id of the row to delete.
// I'd recommend just making the button value the row ID, no need for the extra input.
// Then you can access it easier through $( this ).val();
var rowID = $( this ).parent().child( 'input' )[0].val();
// POST data.
var data = {
'action': 'my_delete_row_action',
'rowID': rowID
}
// Send AJAX request to delete this.
$.post(
ajaxurl,
data,
function ( response ) {
// Check if this was successful.
// Assumes you are using
http://codex.wordpress.org/Function_Reference/wp_send_json_success
if ( ! response.success ) {
alert( 'Failure!' );
}
// Success! Hide the row.
$( '#mytable tr#myrow-' + rowID ).hide();
}
);
});
});
OK, that probably won't work off the bat, just an example. You'll need to
give your table an HTML ID, and give each row a unique ID based on $i (in
the example it's myrow-$i.
Also you'll need to see http://codex.wordpress.org/AJAX_in_Plugins for
info on how to handle the AJAX request properly within WordPress.
I'm sure you can find some great tutorials out there to help you along, too.
J.D.
On Sep 25, 2013, at 3:22 PM, BenderisGreat &lt;
Post by BenderisGreat
Right you are [again] J.D.
So should I just start sending you paypal payments for your assistance?
One more followup question - I don't know any Ajax- is there a simple way
(now that the form is fixed) to remove that row without a page refresh?
Again, not familiar with ajax so coding that myself isn't an option yet, but
maybe there is a simple way to implement something like that?
--
http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393p42403.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
It isn't hard to do, I've done it before. Do you know jQuery? jQuery's
AJAX handlers are very easy to user (in my opinion, at least). Quick and
jQuery( document ).ready( function( $ ) {
// When a button is clicked within the table with id="mytable"
$( '#mytable button' ).click( function( event ) {
// Keep the default action from happening (form submitted/page refreshed)
event.preventDefault();
if ( ! confirm( 'Are you sure you want to continue' ) )
return;
// Get the id of the row to delete.
// I'd recommend just making the button value the row ID, no need for the extra input.
// Then you can access it easier through $( this ).val();
var rowID = $( this ).parent().child( 'input' )[0].val();
// POST data.
var data = {
'action': 'my_delete_row_action',
'rowID': rowID
}
// Send AJAX request to delete this.
$.post(
ajaxurl,
data,
function ( response ) {
// Check if this was successful.
// Assumes you are using
http://codex.wordpress.org/Function_Reference/wp_send_json_success
if ( ! response.success ) {
alert( 'Failure!' );
}
// Success! Hide the row.
$( '#mytable tr#myrow-' + rowID ).hide();
}
);
});
});
OK, that probably won't work off the bat, just an example. You'll need to
give your table an HTML ID, and give each row a unique ID based on $i (in
the example it's myrow-$i.
Also you'll need to see http://codex.wordpress.org/AJAX_in_Plugins for
info on how to handle the AJAX request properly within WordPress.
I'm sure you can find some great tutorials out there to help you along, too.
J.D.
On Sep 25, 2013, at 3:22 PM, BenderisGreat &lt;
Post by BenderisGreat
Right you are [again] J.D.
So should I just start sending you paypal payments for your assistance?
One more followup question - I don't know any Ajax- is there a simple way
(now that the form is fixed) to remove that row without a page refresh?
Again, not familiar with ajax so coding that myself isn't an option yet, but
maybe there is a simple way to implement something like that?
--
http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393p42403.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
--
View this message in context: http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393p42560.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
Otto
2013-10-19 14:08:11 UTC
Permalink
On Sat, Oct 19, 2013 at 2:21 AM, BenderisGreat
Post by BenderisGreat
*and finally, here is the ajax call (which isnt written how you suggested
using ajaxurl in wordpress)*
<?php
if ( !isset($wp_did_header) ) {
$wp_did_header = true;
require_once('../../../wp-load.php' );
wp();
require_once( ABSPATH . WPINC . '/template-loader.php' );
}
global $wpdb;
if (isset($_REQUEST['id'])) {
$id = $_REQUEST['id'];
$file = $wpdb->get_var("select file from wp_jo_plugin_options WHERE id =
$id");
//wp_delete_attachment( $file );
$qry2 = $wpdb->prepare("CREATE TABLE IF NOT EXISTS t2 AS SELECT * from
wp_jo_plugin_options WHERE id = %s", $id);
$jo1 = $wpdb->query($qry2);
$qry = $wpdb->prepare("DELETE FROM wp_jo_plugin_options WHERE id = %s",
$id);
$jo_remove_row = $wpdb->query($qry);
}
if (isset($_REQUEST['undo'])) {
$undo = $_REQUEST['undo'];
$qry2 = $wpdb->prepare("insert ignore into wp_jo_plugin_options SELECT *
from t2 WHERE id = %s", $undo);
$jo_remove_row = $wpdb->query($qry2);
}
?>
*Now - I have no idea is this is bad code, but it does not match the same
layout you suggested. Is this safe? It cost me about 100 bucks on
freelancer.com. :-/*
No, that code is not safe. This code at the start, for example, is an
SQL Injection vulnerability:

if (isset($_REQUEST['id'])) {
$id = $_REQUEST['id'];
$file = $wpdb->get_var("select file from wp_jo_plugin_options
WHERE id = $id");

Because he's not prepare'd or otherwise sanitizing the id parameter,
it's easy to inject something there.

In general, anytime you include wp-load.php directly, you're probably
doing-it-wrong. The ajaxurl callback method suggested earlier is
better all around.


-Otto
Nikola Nikolov
2013-10-19 16:26:01 UTC
Permalink
PS: I would do a dispute on Freelancer.com(if that's where you hired your
guy) - that's clearly not a good quality code. And as Otto pointed out it's
a potential security hole to your site(or what could be even worse -
plugin). You might be able to get your money back, or get the job done
better.
Post by Otto
On Sat, Oct 19, 2013 at 2:21 AM, BenderisGreat
Post by BenderisGreat
*and finally, here is the ajax call (which isnt written how you suggested
using ajaxurl in wordpress)*
<?php
if ( !isset($wp_did_header) ) {
$wp_did_header = true;
require_once('../../../wp-load.php' );
wp();
require_once( ABSPATH . WPINC . '/template-loader.php' );
}
global $wpdb;
if (isset($_REQUEST['id'])) {
$id = $_REQUEST['id'];
$file = $wpdb->get_var("select file from wp_jo_plugin_options
WHERE id =
Post by BenderisGreat
$id");
//wp_delete_attachment( $file );
$qry2 = $wpdb->prepare("CREATE TABLE IF NOT EXISTS t2 AS SELECT
* from
Post by BenderisGreat
wp_jo_plugin_options WHERE id = %s", $id);
$jo1 = $wpdb->query($qry2);
$qry = $wpdb->prepare("DELETE FROM wp_jo_plugin_options WHERE id
= %s",
Post by BenderisGreat
$id);
$jo_remove_row = $wpdb->query($qry);
}
if (isset($_REQUEST['undo'])) {
$undo = $_REQUEST['undo'];
$qry2 = $wpdb->prepare("insert ignore into wp_jo_plugin_options
SELECT *
Post by BenderisGreat
from t2 WHERE id = %s", $undo);
$jo_remove_row = $wpdb->query($qry2);
}
?>
*Now - I have no idea is this is bad code, but it does not match the same
layout you suggested. Is this safe? It cost me about 100 bucks on
freelancer.com. :-/*
No, that code is not safe. This code at the start, for example, is an
if (isset($_REQUEST['id'])) {
$id = $_REQUEST['id'];
$file = $wpdb->get_var("select file from wp_jo_plugin_options
WHERE id = $id");
Because he's not prepare'd or otherwise sanitizing the id parameter,
it's easy to inject something there.
In general, anytime you include wp-load.php directly, you're probably
doing-it-wrong. The ajaxurl callback method suggested earlier is
better all around.
-Otto
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
BenderisGreat
2013-10-19 17:25:25 UTC
Permalink
I thought it looked weird. I spent some time last night working out the
correct code pasted here, and got it functioning. I dont think I can get my
money back but I will try. I am so glad I have this resource to check with,
or I would have never had JD showing me the proper way, and then never would
have questioned his code.

I finally got JDs code working but I have to place this in my functions for
ajax to work:

add_action('wp_head','custom_head');

function custom_head()
{
echo '';
}


Is that alright? Otherwise I get ajaxurl undefined error.

Additionally, the json response works too! However one query always fails.

$file = $_POST['file'];
$del_image = wp_delete_attachment( $row['file'] ); - fail

I also tried this as an sql query:

$file = $_POST['file'];
$fileQry = $wpdb->prepare("DELETE FROM wp_posts WHERE id = %s", $file);
$go_fileQry = $wpdb->query($fileQry);

It still fails. It IS possible to run multiple queries this way right?



--
View this message in context: http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393p42566.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
Nikola Nikolov
2013-10-19 17:35:46 UTC
Permalink
About the ajaxurl - yes that is correct. WordPress only defines the global
JS variable ajaxurl on the admin side - so you have to do it yourself in
order to access it on the front-end.

Why are you not using the $file variable in your other code?

// You are assigning $_POST['file'] to the $file variable and not to
$row['file']
$file = $_POST['file'];
$del_image = wp_delete_attachment( $file );
Post by BenderisGreat
I thought it looked weird. I spent some time last night working out the
correct code pasted here, and got it functioning. I dont think I can get my
money back but I will try. I am so glad I have this resource to check with,
or I would have never had JD showing me the proper way, and then never would
have questioned his code.
I finally got JDs code working but I have to place this in my functions for
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
Additionally, the json response works too! However one query always fails.
$file = $_POST['file'];
$del_image = wp_delete_attachment( $row['file'] ); - fail
$file = $_POST['file'];
$fileQry = $wpdb->prepare("DELETE FROM wp_posts WHERE id = %s", $file);
$go_fileQry = $wpdb->query($fileQry);
It still fails. It IS possible to run multiple queries this way right?
--
http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393p42566.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
J.D. Grimes
2013-10-19 17:40:56 UTC
Permalink
Hey man, that's tough. I'm glad you've got the code working though.
Post by BenderisGreat
I finally got JDs code working but I have to place this in my functions for
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
I'm not sure why this would have an effect… If you are using the code on the front end of your site, ajaxurl won't be defined - it is only defined by default in the administration panels. You would need to use wp_localize_script().
Post by BenderisGreat
Additionally, the json response works too! However one query always fails.
$file = $_POST['file'];
$del_image = wp_delete_attachment( $row['file'] ); - fail
$file = $_POST['file'];
$fileQry = $wpdb->prepare("DELETE FROM wp_posts WHERE id = %s", $file);
$go_fileQry = $wpdb->query($fileQry);
It still fails. It IS possible to run multiple queries this way right?
Is it completely failing? The wp_delete_attachment() call will only move the attachment to the trash by default -if you want to delete it permanently you need to set the second parameter to true.

-J.D.
Gregory Lancaster
2013-10-19 17:53:23 UTC
Permalink
Yep, I had to add true. So all this is executing based on the values of
this button:
<button type="submit" name="deleteItem" value="<?php echo $row['id']; ?>"
file="<?php echo $row['file']; ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>

But couldnt someone just change the values of the fileid or rowid and
delete other peoples content?
Post by J.D. Grimes
Hey man, that's tough. I'm glad you've got the code working though.
Post by BenderisGreat
I finally got JDs code working but I have to place this in my functions
for
Post by BenderisGreat
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
I'm not sure why this would have an effect… If you are using the code on
the front end of your site, ajaxurl won't be defined - it is only defined
by default in the administration panels. You would need to use
wp_localize_script().
Post by BenderisGreat
Additionally, the json response works too! However one query always
fails.
Post by BenderisGreat
$file = $_POST['file'];
$del_image = wp_delete_attachment( $row['file'] ); - fail
$file = $_POST['file'];
$fileQry = $wpdb->prepare("DELETE FROM wp_posts WHERE id = %s", $file);
$go_fileQry = $wpdb->query($fileQry);
It still fails. It IS possible to run multiple queries this way right?
Is it completely failing? The wp_delete_attachment() call will only move
the attachment to the trash by default -if you want to delete it
permanently you need to set the second parameter to true.
-J.D.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
J.D. Grimes
2013-10-19 17:56:06 UTC
Permalink
Yes, you should be using nonces - http://codex.wordpress.org/WordPress_Nonces
Post by Gregory Lancaster
Yep, I had to add true. So all this is executing based on the values of
<button type="submit" name="deleteItem" value="<?php echo $row['id']; ?>"
file="<?php echo $row['file']; ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
But couldnt someone just change the values of the fileid or rowid and
delete other peoples content?
Post by J.D. Grimes
Hey man, that's tough. I'm glad you've got the code working though.
Post by BenderisGreat
I finally got JDs code working but I have to place this in my functions
for
Post by BenderisGreat
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
I'm not sure why this would have an effect… If you are using the code on
the front end of your site, ajaxurl won't be defined - it is only defined
by default in the administration panels. You would need to use
wp_localize_script().
Post by BenderisGreat
Additionally, the json response works too! However one query always
fails.
Post by BenderisGreat
$file = $_POST['file'];
$del_image = wp_delete_attachment( $row['file'] ); - fail
$file = $_POST['file'];
$fileQry = $wpdb->prepare("DELETE FROM wp_posts WHERE id = %s", $file);
$go_fileQry = $wpdb->query($fileQry);
It still fails. It IS possible to run multiple queries this way right?
Is it completely failing? The wp_delete_attachment() call will only move
the attachment to the trash by default -if you want to delete it
permanently you need to set the second parameter to true.
-J.D.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Gregory Lancaster
2013-10-19 18:11:52 UTC
Permalink
that would be handled via jquery/ajax though right? the button is
triggered that way.
Post by J.D. Grimes
Yes, you should be using nonces -
http://codex.wordpress.org/WordPress_Nonces
Post by Gregory Lancaster
Yep, I had to add true. So all this is executing based on the values of
<button type="submit" name="deleteItem" value="<?php echo $row['id']; ?>"
file="<?php echo $row['file']; ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
But couldnt someone just change the values of the fileid or rowid and
delete other peoples content?
Post by J.D. Grimes
Hey man, that's tough. I'm glad you've got the code working though.
Post by BenderisGreat
I finally got JDs code working but I have to place this in my functions
for
Post by BenderisGreat
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
I'm not sure why this would have an effect… If you are using the code on
the front end of your site, ajaxurl won't be defined - it is only
defined
Post by Gregory Lancaster
Post by J.D. Grimes
by default in the administration panels. You would need to use
wp_localize_script().
Post by BenderisGreat
Additionally, the json response works too! However one query always
fails.
Post by BenderisGreat
$file = $_POST['file'];
$del_image = wp_delete_attachment( $row['file'] ); - fail
$file = $_POST['file'];
$fileQry = $wpdb->prepare("DELETE FROM wp_posts WHERE id = %s", $file);
$go_fileQry = $wpdb->query($fileQry);
It still fails. It IS possible to run multiple queries this way right?
Is it completely failing? The wp_delete_attachment() call will only move
the attachment to the trash by default -if you want to delete it
permanently you need to set the second parameter to true.
-J.D.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Nikola Nikolov
2013-10-19 18:16:04 UTC
Permalink
So something like this is what you should use instead:

<button type="submit" name="deleteItem" value="<?php echo $row['id']; ?>"
file="<?php echo $row['file']; ?>" data-nonce="<?php echo wp_create_nonce(
'delete_' . $row['id'] . '_' . $row['file'] ); ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>

You would have to add the value of the data-nonce attribute to your AJAX
request(in the below example it's value is set to the 'nonce' parameter)
and then on the PHP side of the request, you should do this:

if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' . $file ) ) {
exit( 'Cheatin, huh?' );
}

This way if someone changes the value of the file OR "value" attributes,
they won't be able to delete the item they were trying to delete.
Post by J.D. Grimes
Yes, you should be using nonces -
http://codex.wordpress.org/WordPress_Nonces
Post by Gregory Lancaster
Yep, I had to add true. So all this is executing based on the values of
<button type="submit" name="deleteItem" value="<?php echo $row['id']; ?>"
file="<?php echo $row['file']; ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
But couldnt someone just change the values of the fileid or rowid and
delete other peoples content?
Post by J.D. Grimes
Hey man, that's tough. I'm glad you've got the code working though.
Post by BenderisGreat
I finally got JDs code working but I have to place this in my functions
for
Post by BenderisGreat
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
I'm not sure why this would have an effect… If you are using the code on
the front end of your site, ajaxurl won't be defined - it is only
defined
Post by Gregory Lancaster
Post by J.D. Grimes
by default in the administration panels. You would need to use
wp_localize_script().
Post by BenderisGreat
Additionally, the json response works too! However one query always
fails.
Post by BenderisGreat
$file = $_POST['file'];
$del_image = wp_delete_attachment( $row['file'] ); - fail
$file = $_POST['file'];
$fileQry = $wpdb->prepare("DELETE FROM wp_posts WHERE id = %s", $file);
$go_fileQry = $wpdb->query($fileQry);
It still fails. It IS possible to run multiple queries this way right?
Is it completely failing? The wp_delete_attachment() call will only move
the attachment to the trash by default -if you want to delete it
permanently you need to set the second parameter to true.
-J.D.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Gregory Lancaster
2013-10-19 18:32:23 UTC
Permalink
like this?

*jQuery( document ).ready( function( $ ) { *
* *
* // When a button is clicked within the table with id="mytable" *
* $( '#mytable button' ).click( function( event ) { *
* *
* event.preventDefault(); *
*
*
* if ( ! confirm( 'Are you sure you want to continue' ) ) *
* return; *
*
*
* var $button = $(this);*
* var nonce = $( this ).attr('data-nonce');*
* ** **var rowID = $( this ).attr('value'); *
* var file = $( this ).attr('file'); *
* *
* $button.closest("tr").css('background-color', '#C60').fadeIn();*
* *
*
*
* var data = { *
* 'action': 'my_delete_row_action', *
* 'id': rowID,*
* 'file': file*
* } *
*
*
* $.post( *
* ajaxurl, *
* data,*
* function ( response ) { *
* if ( ! response.success ) { *
*
*
* alert( 'Failure!' ); *
* } *
* *
* $button.closest("tr").hide();*
* *
* } *
* ); *
* }); *
*}); *
*
*
*
*
*
*
and my remove_row function would function like this?

*function my_delete_row_action() {*
* global $wpdb;*
*
*
* if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' . $file )
) {*
* exit( 'Cheatin, huh?' );*
*}*
*
*
* $id = $_POST['id'];*
* $file = $_POST['file'];*

seems to fail regardless if I change an item or not.
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo $row['id']; ?>"
file="<?php echo $row['file']; ?>" data-nonce="<?php echo wp_create_nonce(
'delete_' . $row['id'] . '_' . $row['file'] ); ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
You would have to add the value of the data-nonce attribute to your AJAX
request(in the below example it's value is set to the 'nonce' parameter)
if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' . $file ) ) {
exit( 'Cheatin, huh?' );
}
This way if someone changes the value of the file OR "value" attributes,
they won't be able to delete the item they were trying to delete.
Post by J.D. Grimes
Yes, you should be using nonces -
http://codex.wordpress.org/WordPress_Nonces
On Oct 19, 2013, at 1:53 PM, Gregory Lancaster <
Post by Gregory Lancaster
Yep, I had to add true. So all this is executing based on the values
of
Post by J.D. Grimes
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo $row['id'];
?>"
Post by J.D. Grimes
Post by Gregory Lancaster
file="<?php echo $row['file']; ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
But couldnt someone just change the values of the fileid or rowid and
delete other peoples content?
Post by J.D. Grimes
Hey man, that's tough. I'm glad you've got the code working though.
Post by BenderisGreat
I finally got JDs code working but I have to place this in my
functions
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
for
Post by BenderisGreat
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
I'm not sure why this would have an effect… If you are using the code
on
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
the front end of your site, ajaxurl won't be defined - it is only
defined
Post by Gregory Lancaster
Post by J.D. Grimes
by default in the administration panels. You would need to use
wp_localize_script().
Post by BenderisGreat
Additionally, the json response works too! However one query always
fails.
Post by BenderisGreat
$file = $_POST['file'];
$del_image = wp_delete_attachment( $row['file'] ); - fail
$file = $_POST['file'];
$fileQry = $wpdb->prepare("DELETE FROM wp_posts WHERE id = %s",
$file);
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Post by BenderisGreat
$go_fileQry = $wpdb->query($fileQry);
It still fails. It IS possible to run multiple queries this way
right?
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Is it completely failing? The wp_delete_attachment() call will only
move
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
the attachment to the trash by default -if you want to delete it
permanently you need to set the second parameter to true.
-J.D.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Nikola Nikolov
2013-10-19 18:35:46 UTC
Permalink
Move your

$id = $_POST['id'];
$file = $_POST['file'];

right after

global $wpdb;

They are just not defined when you try to use them in wp_verify_nonce()


On Sat, Oct 19, 2013 at 9:32 PM, Gregory Lancaster <
Post by Gregory Lancaster
like this?
*jQuery( document ).ready( function( $ ) { *
* *
* // When a button is clicked within the table with id="mytable" *
* $( '#mytable button' ).click( function( event ) { *
* *
* event.preventDefault(); *
*
*
* if ( ! confirm( 'Are you sure you want to continue' ) ) *
* return; *
*
*
* var $button = $(this);*
* var nonce = $( this ).attr('data-nonce');*
* ** **var rowID = $( this ).attr('value'); *
* var file = $( this ).attr('file'); *
* *
* $button.closest("tr").css('background-color', '#C60').fadeIn();*
* *
*
*
* var data = { *
* 'action': 'my_delete_row_action', *
* 'id': rowID,*
* 'file': file*
* } *
*
*
* $.post( *
* ajaxurl, *
* data,*
* function ( response ) { *
* if ( ! response.success ) { *
*
*
* alert( 'Failure!' ); *
* } *
* *
* $button.closest("tr").hide();*
* *
* } *
* ); *
* }); *
*}); *
*
*
*
*
*
*
and my remove_row function would function like this?
*function my_delete_row_action() {*
* global $wpdb;*
*
*
* if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' . $file )
) {*
* exit( 'Cheatin, huh?' );*
*}*
*
*
* $id = $_POST['id'];*
* $file = $_POST['file'];*
seems to fail regardless if I change an item or not.
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo $row['id']; ?>"
file="<?php echo $row['file']; ?>" data-nonce="<?php echo
wp_create_nonce(
Post by Gregory Lancaster
'delete_' . $row['id'] . '_' . $row['file'] ); ?>"
class="delete-box"><span
Post by Gregory Lancaster
class="glyphicon glyphicon-remove"></span></button>
You would have to add the value of the data-nonce attribute to your AJAX
request(in the below example it's value is set to the 'nonce' parameter)
if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' . $file )
)
Post by Gregory Lancaster
{
exit( 'Cheatin, huh?' );
}
This way if someone changes the value of the file OR "value" attributes,
they won't be able to delete the item they were trying to delete.
Post by J.D. Grimes
Yes, you should be using nonces -
http://codex.wordpress.org/WordPress_Nonces
On Oct 19, 2013, at 1:53 PM, Gregory Lancaster <
Post by Gregory Lancaster
Yep, I had to add true. So all this is executing based on the values
of
Post by J.D. Grimes
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo $row['id'];
?>"
Post by J.D. Grimes
Post by Gregory Lancaster
file="<?php echo $row['file']; ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
But couldnt someone just change the values of the fileid or rowid and
delete other peoples content?
Post by J.D. Grimes
Hey man, that's tough. I'm glad you've got the code working though.
Post by BenderisGreat
I finally got JDs code working but I have to place this in my
functions
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
for
Post by BenderisGreat
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
I'm not sure why this would have an effect… If you are using the
code
Post by Gregory Lancaster
on
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
the front end of your site, ajaxurl won't be defined - it is only
defined
Post by Gregory Lancaster
Post by J.D. Grimes
by default in the administration panels. You would need to use
wp_localize_script().
Post by BenderisGreat
Additionally, the json response works too! However one query always
fails.
Post by BenderisGreat
$file = $_POST['file'];
$del_image = wp_delete_attachment( $row['file'] ); - fail
$file = $_POST['file'];
$fileQry = $wpdb->prepare("DELETE FROM wp_posts WHERE id = %s",
$file);
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Post by BenderisGreat
$go_fileQry = $wpdb->query($fileQry);
It still fails. It IS possible to run multiple queries this way
right?
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Is it completely failing? The wp_delete_attachment() call will only
move
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
the attachment to the trash by default -if you want to delete it
permanently you need to set the second parameter to true.
-J.D.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Gregory Lancaster
2013-10-19 18:43:52 UTC
Permalink
Yea I just realized that :-/ Sorry I posted to quickly with the question.
Works great. :)
Post by Nikola Nikolov
Move your
$id = $_POST['id'];
$file = $_POST['file'];
right after
global $wpdb;
They are just not defined when you try to use them in wp_verify_nonce()
On Sat, Oct 19, 2013 at 9:32 PM, Gregory Lancaster <
Post by Gregory Lancaster
like this?
*jQuery( document ).ready( function( $ ) { *
* *
* // When a button is clicked within the table with id="mytable" *
* $( '#mytable button' ).click( function( event ) { *
* *
* event.preventDefault(); *
*
*
* if ( ! confirm( 'Are you sure you want to continue' ) )
*
Post by Gregory Lancaster
* return; *
*
*
* var $button = $(this);*
* var nonce = $( this ).attr('data-nonce');*
* ** **var rowID = $( this
).attr('value'); *
Post by Gregory Lancaster
* var file = $( this ).attr('file'); *
* *
* $button.closest("tr").css('background-color', '#C60').fadeIn();*
* *
*
*
* var data = { *
* 'action': 'my_delete_row_action', *
* 'id': rowID,*
* 'file': file*
* } *
*
*
* $.post( *
* ajaxurl, *
* data,*
* function ( response ) { *
* if ( ! response.success ) { *
*
*
* alert( 'Failure!' ); *
* } *
* *
* $button.closest("tr").hide();*
* *
* } *
* ); *
* }); *
*}); *
*
*
*
*
*
*
and my remove_row function would function like this?
*function my_delete_row_action() {*
* global $wpdb;*
*
*
* if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' . $file
)
Post by Gregory Lancaster
) {*
* exit( 'Cheatin, huh?' );*
*}*
*
*
* $id = $_POST['id'];*
* $file = $_POST['file'];*
seems to fail regardless if I change an item or not.
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo $row['id'];
?>"
Post by Gregory Lancaster
Post by Gregory Lancaster
file="<?php echo $row['file']; ?>" data-nonce="<?php echo
wp_create_nonce(
Post by Gregory Lancaster
'delete_' . $row['id'] . '_' . $row['file'] ); ?>"
class="delete-box"><span
Post by Gregory Lancaster
class="glyphicon glyphicon-remove"></span></button>
You would have to add the value of the data-nonce attribute to your
AJAX
Post by Gregory Lancaster
Post by Gregory Lancaster
request(in the below example it's value is set to the 'nonce'
parameter)
Post by Gregory Lancaster
Post by Gregory Lancaster
if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' . $file
)
Post by Gregory Lancaster
)
Post by Gregory Lancaster
{
exit( 'Cheatin, huh?' );
}
This way if someone changes the value of the file OR "value"
attributes,
Post by Gregory Lancaster
Post by Gregory Lancaster
they won't be able to delete the item they were trying to delete.
Post by J.D. Grimes
Yes, you should be using nonces -
http://codex.wordpress.org/WordPress_Nonces
On Oct 19, 2013, at 1:53 PM, Gregory Lancaster <
Post by Gregory Lancaster
Yep, I had to add true. So all this is executing based on the
values
Post by Gregory Lancaster
Post by Gregory Lancaster
of
Post by J.D. Grimes
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo
$row['id'];
Post by Gregory Lancaster
Post by Gregory Lancaster
?>"
Post by J.D. Grimes
Post by Gregory Lancaster
file="<?php echo $row['file']; ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
But couldnt someone just change the values of the fileid or rowid
and
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by J.D. Grimes
Post by Gregory Lancaster
delete other peoples content?
Post by J.D. Grimes
Hey man, that's tough. I'm glad you've got the code working
though.
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Post by BenderisGreat
I finally got JDs code working but I have to place this in my
functions
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
for
Post by BenderisGreat
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
I'm not sure why this would have an effect… If you are using the
code
Post by Gregory Lancaster
on
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
the front end of your site, ajaxurl won't be defined - it is only
defined
Post by Gregory Lancaster
Post by J.D. Grimes
by default in the administration panels. You would need to use
wp_localize_script().
Post by BenderisGreat
Additionally, the json response works too! However one query
always
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
fails.
Post by BenderisGreat
$file = $_POST['file'];
$del_image = wp_delete_attachment( $row['file'] ); - fail
$file = $_POST['file'];
$fileQry = $wpdb->prepare("DELETE FROM wp_posts WHERE id = %s",
$file);
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Post by BenderisGreat
$go_fileQry = $wpdb->query($fileQry);
It still fails. It IS possible to run multiple queries this way
right?
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Is it completely failing? The wp_delete_attachment() call will
only
Post by Gregory Lancaster
Post by Gregory Lancaster
move
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
the attachment to the trash by default -if you want to delete it
permanently you need to set the second parameter to true.
-J.D.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Gregory Lancaster
2013-10-19 20:37:38 UTC
Permalink
Well it finally all works... and then I tested the user accounts and ajax
is not supported unless I register people as admins. I know I can add a
user role, but is it possible to give them the ability to use ajax?


On Sat, Oct 19, 2013 at 11:32 AM, Gregory Lancaster <
Post by Gregory Lancaster
like this?
*jQuery( document ).ready( function( $ ) { *
* *
* // When a button is clicked within the table with id="mytable" *
* $( '#mytable button' ).click( function( event ) { *
* *
* event.preventDefault(); *
*
*
* if ( ! confirm( 'Are you sure you want to continue' ) ) *
* return; *
*
*
* var $button = $(this);*
* var nonce = $( this ).attr('data-nonce');*
* ** **var rowID = $( this ).attr('value'); *
* var file = $( this ).attr('file'); *
* *
* $button.closest("tr").css('background-color', '#C60').fadeIn();*
* *
*
*
* var data = { *
* 'action': 'my_delete_row_action', *
* 'id': rowID,*
* 'file': file*
* } *
*
*
* $.post( *
* ajaxurl, *
* data,*
* function ( response ) { *
* if ( ! response.success ) { *
*
*
* alert( 'Failure!' ); *
* } *
* *
* $button.closest("tr").hide();*
* *
* } *
* ); *
* }); *
*}); *
*
*
*
*
*
*
and my remove_row function would function like this?
*function my_delete_row_action() {*
* global $wpdb;*
*
*
* if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' . $file
) ) {*
* exit( 'Cheatin, huh?' );*
*}*
*
*
* $id = $_POST['id'];*
* $file = $_POST['file'];*
seems to fail regardless if I change an item or not.
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo $row['id']; ?>"
file="<?php echo $row['file']; ?>" data-nonce="<?php echo wp_create_nonce(
'delete_' . $row['id'] . '_' . $row['file'] ); ?>"
class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
You would have to add the value of the data-nonce attribute to your AJAX
request(in the below example it's value is set to the 'nonce' parameter)
if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' . $file ) ) {
exit( 'Cheatin, huh?' );
}
This way if someone changes the value of the file OR "value" attributes,
they won't be able to delete the item they were trying to delete.
Post by J.D. Grimes
Yes, you should be using nonces -
http://codex.wordpress.org/WordPress_Nonces
On Oct 19, 2013, at 1:53 PM, Gregory Lancaster <
Post by Gregory Lancaster
Yep, I had to add true. So all this is executing based on the values
of
Post by J.D. Grimes
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo $row['id'];
?>"
Post by J.D. Grimes
Post by Gregory Lancaster
file="<?php echo $row['file']; ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
But couldnt someone just change the values of the fileid or rowid and
delete other peoples content?
Post by J.D. Grimes
Hey man, that's tough. I'm glad you've got the code working though.
Post by BenderisGreat
I finally got JDs code working but I have to place this in my
functions
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
for
Post by BenderisGreat
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
I'm not sure why this would have an effect… If you are using the
code on
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
the front end of your site, ajaxurl won't be defined - it is only
defined
Post by Gregory Lancaster
Post by J.D. Grimes
by default in the administration panels. You would need to use
wp_localize_script().
Post by BenderisGreat
Additionally, the json response works too! However one query always
fails.
Post by BenderisGreat
$file = $_POST['file'];
$del_image = wp_delete_attachment( $row['file'] ); - fail
$file = $_POST['file'];
$fileQry = $wpdb->prepare("DELETE FROM wp_posts WHERE id = %s",
$file);
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Post by BenderisGreat
$go_fileQry = $wpdb->query($fileQry);
It still fails. It IS possible to run multiple queries this way
right?
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Is it completely failing? The wp_delete_attachment() call will only
move
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
the attachment to the trash by default -if you want to delete it
permanently you need to set the second parameter to true.
-J.D.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Nikola Nikolov
2013-10-19 20:54:19 UTC
Permalink
What do you mean by "ajax is not supported unless I register people as
admins"?

Does the AJAX never occur, or does the AJAX not trigger the deletion of the
rows?

If the AJAX doesn't occur - then you should look at the code that prints
the AJAX itself - you probably have some sort of a check there that decides
whether to print out the JS or not.

If the deletion of the rows doesn't happen, then it's the code that deletes
the rows that doesn't work.

Also - if you're going to let all kind of users delete data, you should
make sure that they actually have the right to delete that data or not(for
instance check if "is_super_admin()" and if that's true - allow them to
delete without further checks - if it's false, check if the record they're
trying to delete actually belongs to them).


On Sat, Oct 19, 2013 at 11:37 PM, Gregory Lancaster <
Post by Gregory Lancaster
Well it finally all works... and then I tested the user accounts and ajax
is not supported unless I register people as admins. I know I can add a
user role, but is it possible to give them the ability to use ajax?
On Sat, Oct 19, 2013 at 11:32 AM, Gregory Lancaster <
Post by Gregory Lancaster
like this?
*jQuery( document ).ready( function( $ ) { *
* *
* // When a button is clicked within the table with id="mytable" *
* $( '#mytable button' ).click( function( event ) { *
* *
* event.preventDefault(); *
*
*
* if ( ! confirm( 'Are you sure you want to continue' ) )
*
Post by Gregory Lancaster
* return; *
*
*
* var $button = $(this);*
* var nonce = $( this ).attr('data-nonce');*
* ** **var rowID = $( this ).attr('value'); *
* var file = $( this ).attr('file'); *
* *
* $button.closest("tr").css('background-color', '#C60').fadeIn();*
* *
*
*
* var data = { *
* 'action': 'my_delete_row_action', *
* 'id': rowID,*
* 'file': file*
* } *
*
*
* $.post( *
* ajaxurl, *
* data,*
* function ( response ) { *
* if ( ! response.success ) { *
*
*
* alert( 'Failure!' ); *
* } *
* *
* $button.closest("tr").hide();*
* *
* } *
* ); *
* }); *
*}); *
*
*
*
*
*
*
and my remove_row function would function like this?
*function my_delete_row_action() {*
* global $wpdb;*
*
*
* if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' . $file
) ) {*
* exit( 'Cheatin, huh?' );*
*}*
*
*
* $id = $_POST['id'];*
* $file = $_POST['file'];*
seems to fail regardless if I change an item or not.
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo $row['id'];
?>"
Post by Gregory Lancaster
Post by Gregory Lancaster
file="<?php echo $row['file']; ?>" data-nonce="<?php echo
wp_create_nonce(
Post by Gregory Lancaster
Post by Gregory Lancaster
'delete_' . $row['id'] . '_' . $row['file'] ); ?>"
class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
You would have to add the value of the data-nonce attribute to your AJAX
request(in the below example it's value is set to the 'nonce' parameter)
if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' . $file ) ) {
exit( 'Cheatin, huh?' );
}
This way if someone changes the value of the file OR "value" attributes,
they won't be able to delete the item they were trying to delete.
Post by J.D. Grimes
Yes, you should be using nonces -
http://codex.wordpress.org/WordPress_Nonces
On Oct 19, 2013, at 1:53 PM, Gregory Lancaster <
Post by Gregory Lancaster
Yep, I had to add true. So all this is executing based on the
values
Post by Gregory Lancaster
Post by Gregory Lancaster
of
Post by J.D. Grimes
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo
$row['id'];
Post by Gregory Lancaster
Post by Gregory Lancaster
?>"
Post by J.D. Grimes
Post by Gregory Lancaster
file="<?php echo $row['file']; ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
But couldnt someone just change the values of the fileid or rowid
and
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by J.D. Grimes
Post by Gregory Lancaster
delete other peoples content?
Post by J.D. Grimes
Hey man, that's tough. I'm glad you've got the code working though.
Post by BenderisGreat
I finally got JDs code working but I have to place this in my
functions
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
for
Post by BenderisGreat
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
I'm not sure why this would have an effect… If you are using the
code on
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
the front end of your site, ajaxurl won't be defined - it is only
defined
Post by Gregory Lancaster
Post by J.D. Grimes
by default in the administration panels. You would need to use
wp_localize_script().
Post by BenderisGreat
Additionally, the json response works too! However one query
always
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
fails.
Post by BenderisGreat
$file = $_POST['file'];
$del_image = wp_delete_attachment( $row['file'] ); - fail
$file = $_POST['file'];
$fileQry = $wpdb->prepare("DELETE FROM wp_posts WHERE id = %s",
$file);
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Post by BenderisGreat
$go_fileQry = $wpdb->query($fileQry);
It still fails. It IS possible to run multiple queries this way
right?
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Is it completely failing? The wp_delete_attachment() call will only
move
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
the attachment to the trash by default -if you want to delete it
permanently you need to set the second parameter to true.
-J.D.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Gregory Lancaster
2013-10-20 00:53:59 UTC
Permalink
The ajax delete fails on non admin accounts. The form inserts an entry
into a custom table so I think $wpdb access is restricted to admins- which
I do not want to change. However these people need the ability to enter
data. I apologize for my lazy post before by the way, frustration was
setting in.

As for the right to delete or post, I currently am matching the
current_member against the current_user->ID. That seems to control who can
delete what on what users page. Maybe there is a better way? That is the
only connection to the profile page owner I have though.

I feel dumb asking but, maybe you would tell me what part of the codex I
need to read to modify the user roles for posting? This is a little
confusing because the form is unattached to wordpress other than it posts
withinthe wpdb. For that reason the ability to delete and add entries
(seems) as though it would not be controlled by a user role.

I do not want to grant all subscribers the ability to create and delete
posts for the sake of this form.
Post by Nikola Nikolov
What do you mean by "ajax is not supported unless I register people as
admins"?
Does the AJAX never occur, or does the AJAX not trigger the deletion of the
rows?
If the AJAX doesn't occur - then you should look at the code that prints
the AJAX itself - you probably have some sort of a check there that decides
whether to print out the JS or not.
If the deletion of the rows doesn't happen, then it's the code that deletes
the rows that doesn't work.
Also - if you're going to let all kind of users delete data, you should
make sure that they actually have the right to delete that data or not(for
instance check if "is_super_admin()" and if that's true - allow them to
delete without further checks - if it's false, check if the record they're
trying to delete actually belongs to them).
On Sat, Oct 19, 2013 at 11:37 PM, Gregory Lancaster <
Post by Gregory Lancaster
Well it finally all works... and then I tested the user accounts and ajax
is not supported unless I register people as admins. I know I can add a
user role, but is it possible to give them the ability to use ajax?
On Sat, Oct 19, 2013 at 11:32 AM, Gregory Lancaster <
Post by Gregory Lancaster
like this?
*jQuery( document ).ready( function( $ ) { *
* *
* // When a button is clicked within the table with
id="mytable" *
Post by Gregory Lancaster
Post by Gregory Lancaster
* $( '#mytable button' ).click( function( event ) { *
* *
* event.preventDefault(); *
*
*
* if ( ! confirm( 'Are you sure you want to continue' )
)
Post by Gregory Lancaster
*
Post by Gregory Lancaster
* return; *
*
*
* var $button = $(this);*
* var nonce = $( this ).attr('data-nonce');*
* ** **var rowID = $( this
).attr('value');
Post by Gregory Lancaster
Post by Gregory Lancaster
*
* var file = $( this ).attr('file'); *
* *
* $button.closest("tr").css('background-color', '#C60').fadeIn();*
* *
*
*
* var data = { *
* 'action': 'my_delete_row_action', *
* 'id': rowID,*
* 'file': file*
* } *
*
*
* $.post( *
* ajaxurl, *
* data,*
* function ( response ) { *
* if ( ! response.success ) { *
*
*
* alert( 'Failure!' ); *
* } *
* *
* $button.closest("tr").hide();*
* *
* } *
* ); *
* }); *
*}); *
*
*
*
*
*
*
and my remove_row function would function like this?
*function my_delete_row_action() {*
* global $wpdb;*
*
*
* if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' .
$file
Post by Gregory Lancaster
Post by Gregory Lancaster
) ) {*
* exit( 'Cheatin, huh?' );*
*}*
*
*
* $id = $_POST['id'];*
* $file = $_POST['file'];*
seems to fail regardless if I change an item or not.
On Sat, Oct 19, 2013 at 11:16 AM, Nikola Nikolov <
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo $row['id'];
?>"
Post by Gregory Lancaster
Post by Gregory Lancaster
file="<?php echo $row['file']; ?>" data-nonce="<?php echo
wp_create_nonce(
Post by Gregory Lancaster
Post by Gregory Lancaster
'delete_' . $row['id'] . '_' . $row['file'] ); ?>"
class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
You would have to add the value of the data-nonce attribute to your
AJAX
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by Gregory Lancaster
request(in the below example it's value is set to the 'nonce'
parameter)
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by Gregory Lancaster
if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' .
$file )
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by Gregory Lancaster
) {
exit( 'Cheatin, huh?' );
}
This way if someone changes the value of the file OR "value"
attributes,
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by Gregory Lancaster
they won't be able to delete the item they were trying to delete.
Post by J.D. Grimes
Yes, you should be using nonces -
http://codex.wordpress.org/WordPress_Nonces
On Oct 19, 2013, at 1:53 PM, Gregory Lancaster <
Post by Gregory Lancaster
Yep, I had to add true. So all this is executing based on the
values
Post by Gregory Lancaster
Post by Gregory Lancaster
of
Post by J.D. Grimes
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo
$row['id'];
Post by Gregory Lancaster
Post by Gregory Lancaster
?>"
Post by J.D. Grimes
Post by Gregory Lancaster
file="<?php echo $row['file']; ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
But couldnt someone just change the values of the fileid or rowid
and
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by J.D. Grimes
Post by Gregory Lancaster
delete other peoples content?
On Sat, Oct 19, 2013 at 10:40 AM, J.D. Grimes <
Post by J.D. Grimes
Hey man, that's tough. I'm glad you've got the code working
though.
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Post by BenderisGreat
I finally got JDs code working but I have to place this in my
functions
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
for
Post by BenderisGreat
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
I'm not sure why this would have an effect… If you are using the
code on
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
the front end of your site, ajaxurl won't be defined - it is only
defined
Post by Gregory Lancaster
Post by J.D. Grimes
by default in the administration panels. You would need to use
wp_localize_script().
Post by BenderisGreat
Additionally, the json response works too! However one query
always
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
fails.
Post by BenderisGreat
$file = $_POST['file'];
Nikola Nikolov
2013-10-20 09:55:34 UTC
Permalink
I don't think the problem is in the wpdb class. If you take a look at the
source code for the query() method (
http://core.trac.wordpress.org/browser/tags/3.6.1/wp-includes/wp-db.php#L1170
),
you will see that all that the class does is

$this->result = @mysql_query( $query, $this->dbh );

and it will only return false if

if ( ! $this->ready )
return false;

Which on the other hand would happen only if the database connection fails,
or if you call the query() method, before $wpdb->db_connect() is
called(which happens when the $wpdb object is created).

So I would suggest to enable WP_DEBUG and also before you do your query, do

$wpdb->show_errors();

Then look at the AJAX response(you can do that in the "Network" tab of
Google Chrome's developer tools) and see if it says something.


On Sun, Oct 20, 2013 at 3:53 AM, Gregory Lancaster <
Post by Gregory Lancaster
The ajax delete fails on non admin accounts. The form inserts an entry
into a custom table so I think $wpdb access is restricted to admins- which
I do not want to change. However these people need the ability to enter
data. I apologize for my lazy post before by the way, frustration was
setting in.
As for the right to delete or post, I currently am matching the
current_member against the current_user->ID. That seems to control who can
delete what on what users page. Maybe there is a better way? That is the
only connection to the profile page owner I have though.
I feel dumb asking but, maybe you would tell me what part of the codex I
need to read to modify the user roles for posting? This is a little
confusing because the form is unattached to wordpress other than it posts
withinthe wpdb. For that reason the ability to delete and add entries
(seems) as though it would not be controlled by a user role.
I do not want to grant all subscribers the ability to create and delete
posts for the sake of this form.
Post by Nikola Nikolov
What do you mean by "ajax is not supported unless I register people as
admins"?
Does the AJAX never occur, or does the AJAX not trigger the deletion of
the
Post by Nikola Nikolov
rows?
If the AJAX doesn't occur - then you should look at the code that prints
the AJAX itself - you probably have some sort of a check there that
decides
Post by Nikola Nikolov
whether to print out the JS or not.
If the deletion of the rows doesn't happen, then it's the code that
deletes
Post by Nikola Nikolov
the rows that doesn't work.
Also - if you're going to let all kind of users delete data, you should
make sure that they actually have the right to delete that data or
not(for
Post by Nikola Nikolov
instance check if "is_super_admin()" and if that's true - allow them to
delete without further checks - if it's false, check if the record
they're
Post by Nikola Nikolov
trying to delete actually belongs to them).
On Sat, Oct 19, 2013 at 11:37 PM, Gregory Lancaster <
Post by Gregory Lancaster
Well it finally all works... and then I tested the user accounts and
ajax
Post by Nikola Nikolov
Post by Gregory Lancaster
is not supported unless I register people as admins. I know I can
add a
Post by Nikola Nikolov
Post by Gregory Lancaster
user role, but is it possible to give them the ability to use ajax?
On Sat, Oct 19, 2013 at 11:32 AM, Gregory Lancaster <
Post by Gregory Lancaster
like this?
*jQuery( document ).ready( function( $ ) { *
* *
* // When a button is clicked within the table with
id="mytable" *
Post by Gregory Lancaster
Post by Gregory Lancaster
* $( '#mytable button' ).click( function( event ) { *
* *
* event.preventDefault(); *
*
*
* if ( ! confirm( 'Are you sure you want to continue'
)
Post by Nikola Nikolov
)
Post by Gregory Lancaster
*
Post by Gregory Lancaster
* return; *
*
*
* var $button = $(this);*
* var nonce = $( this ).attr('data-nonce');*
* ** **var rowID = $( this
).attr('value');
Post by Gregory Lancaster
Post by Gregory Lancaster
*
* var file = $( this ).attr('file'); *
* *
* $button.closest("tr").css('background-color', '#C60').fadeIn();*
* *
*
*
* var data = { *
* 'action': 'my_delete_row_action', *
* 'id': rowID,*
* 'file': file*
* } *
*
*
* $.post( *
* ajaxurl, *
* data,*
* function ( response ) { *
* if ( ! response.success ) { *
*
*
* alert( 'Failure!' ); *
* } *
* *
* $button.closest("tr").hide();*
* *
* } *
* ); *
* }); *
*}); *
*
*
*
*
*
*
and my remove_row function would function like this?
*function my_delete_row_action() {*
* global $wpdb;*
*
*
* if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' .
$file
Post by Gregory Lancaster
Post by Gregory Lancaster
) ) {*
* exit( 'Cheatin, huh?' );*
*}*
*
*
* $id = $_POST['id'];*
* $file = $_POST['file'];*
seems to fail regardless if I change an item or not.
On Sat, Oct 19, 2013 at 11:16 AM, Nikola Nikolov <
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo
$row['id'];
Post by Nikola Nikolov
Post by Gregory Lancaster
?>"
Post by Gregory Lancaster
Post by Gregory Lancaster
file="<?php echo $row['file']; ?>" data-nonce="<?php echo
wp_create_nonce(
Post by Gregory Lancaster
Post by Gregory Lancaster
'delete_' . $row['id'] . '_' . $row['file'] ); ?>"
class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
You would have to add the value of the data-nonce attribute to your
AJAX
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by Gregory Lancaster
request(in the below example it's value is set to the 'nonce'
parameter)
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by Gregory Lancaster
if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' .
$file )
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by Gregory Lancaster
) {
exit( 'Cheatin, huh?' );
}
This way if someone changes the value of the file OR "value"
attributes,
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by Gregory Lancaster
they won't be able to delete the item they were trying to delete.
Post by J.D. Grimes
Yes, you should be using nonces -
http://codex.wordpress.org/WordPress_Nonces
On Oct 19, 2013, at 1:53 PM, Gregory Lancaster <
Post by Gregory Lancaster
Yep, I had to add true. So all this is executing based on the
values
Post by Gregory Lancaster
Post by Gregory Lancaster
of
Post by J.D. Grimes
Post by Gregory Lancaster
<button type="submit" name="deleteItem" value="<?php echo
$row['id'];
Post by Gregory Lancaster
Post by Gregory Lancaster
?>"
Post by J.D. Grimes
Post by Gregory Lancaster
file="<?php echo $row['file']; ?>" class="delete-box"><span
class="glyphicon glyphicon-remove"></span></button>
But couldnt someone just change the values of the fileid or
rowid
Post by Nikola Nikolov
Post by Gregory Lancaster
and
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by J.D. Grimes
Post by Gregory Lancaster
delete other peoples content?
On Sat, Oct 19, 2013 at 10:40 AM, J.D. Grimes <
Post by J.D. Grimes
Hey man, that's tough. I'm glad you've got the code working
though.
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
Post by BenderisGreat
I finally got JDs code working but I have to place this in my
functions
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
for
Post by BenderisGreat
add_action('wp_head','custom_head');
function custom_head()
{
echo '';
}
Is that alright? Otherwise I get ajaxurl undefined error.
I'm not sure why this would have an effect… If you are using
the
Post by Nikola Nikolov
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by Gregory Lancaster
code on
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
the front end of your site, ajaxurl won't be defined - it is
only
Post by Nikola Nikolov
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by J.D. Grimes
defined
Post by Gregory Lancaster
Post by J.D. Grimes
by default in the administration panels. You would need to use
wp_localize_script().
Post by BenderisGreat
Additionally, the json response works too! However one query
always
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by J.D. Grimes
Post by Gregory Lancaster
Post by J.D. Grimes
fails.
Post by BenderisGreat
$file = $_POST['file'];
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
BenderisGreat
2013-10-20 11:26:43 UTC
Permalink
I enabled the error log, and I have a local error log as well. No new errors
are being generated. Its weird for sure. I am pretty sure this is because
subscribers are not able to delete posts and I am using;

$del_image = wp_delete_attachment( $file, true );

I think it would be smarter to convert that to an sql query (maybe wordpress
wont catch it as a delete post function in sql?)

What do you think? No errors being generated other than a failure alert.



--
View this message in context: http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393p42580.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
Nikola Nikolov
2013-10-20 15:44:28 UTC
Permalink
Well the thing is that WordPress takes care of some extra stuff when an
attachment is deleted - usually if it's an image, WordPress will also
delete all of the sizes for that image, etc.

I'm looking into the core code for wp_delete_attachment and I can't seem to
find anything that would not let an attachment to be deleted, based on the
current user's role(it also doesn't make a lot of sense to have such a
restriction for a core method - usually restrictions occur before a core
method is ran - at the time of parsing a request for instance).

What is the failure alert that you're getting? Does wp_delete_attachment
just return false?
Post by BenderisGreat
I enabled the error log, and I have a local error log as well. No new errors
are being generated. Its weird for sure. I am pretty sure this is because
subscribers are not able to delete posts and I am using;
$del_image = wp_delete_attachment( $file, true );
I think it would be smarter to convert that to an sql query (maybe wordpress
wont catch it as a delete post function in sql?)
What do you think? No errors being generated other than a failure alert.
--
http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393p42580.html
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
J.D. Grimes
2013-10-20 17:02:00 UTC
Permalink
Post by BenderisGreat
$del_image = wp_delete_attachment( $file, true );
I think it would be smarter to convert that to an sql query (maybe wordpress
wont catch it as a delete post function in sql?)
You want to use wp_delete_attachment(), not a custom query. The function does a lot more than a single query, it cleans out all of the attachment's data from the data base, and delete's the image files if there are any.

Are you sure that wp_delete_attachment() is actually being called? Are you sure it isn't failing before then somewhere?
Gregory Lancaster
2013-10-21 20:53:04 UTC
Permalink
Its JSON that is refurning the failure message. I checked the error log
after clearing it and this is the response:

[Mon Oct 21 13:49:11 2013] [warn] Init: Session Cache is not configured
[hint: SSLSessionCache]
[Mon Oct 21 13:49:12 2013] [notice] Digest: generating secret for digest
authentication ...
[Mon Oct 21 13:49:12 2013] [notice] Digest: done
[Mon Oct 21 13:49:12 2013] [notice] Apache/2.2.14 (Unix) DAV/2
mod_ssl/2.2.14 OpenSSL/0.9.8l PHP/5.3.1 mod_perl/2.0.4 Perl/v5.10.1
configured -- resuming normal operations

That relevant?
Post by BenderisGreat
Post by BenderisGreat
$del_image = wp_delete_attachment( $file, true );
I think it would be smarter to convert that to an sql query (maybe
wordpress
Post by BenderisGreat
wont catch it as a delete post function in sql?)
You want to use wp_delete_attachment(), not a custom query. The function
does a lot more than a single query, it cleans out all of the attachment's
data from the data base, and delete's the image files if there are any.
Are you sure that wp_delete_attachment() is actually being called? Are you
sure it isn't failing before then somewhere?
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Gregory Lancaster
2013-10-21 20:55:21 UTC
Permalink
Also- I teste other user roles, and only Authors and higher can delete the
form entries. But anyone can add new.


On Mon, Oct 21, 2013 at 1:53 PM, Gregory Lancaster <
Post by Gregory Lancaster
Its JSON that is refurning the failure message. I checked the error log
[Mon Oct 21 13:49:11 2013] [warn] Init: Session Cache is not configured
[hint: SSLSessionCache]
[Mon Oct 21 13:49:12 2013] [notice] Digest: generating secret for digest
authentication ...
[Mon Oct 21 13:49:12 2013] [notice] Digest: done
[Mon Oct 21 13:49:12 2013] [notice] Apache/2.2.14 (Unix) DAV/2
mod_ssl/2.2.14 OpenSSL/0.9.8l PHP/5.3.1 mod_perl/2.0.4 Perl/v5.10.1
configured -- resuming normal operations
That relevant?
Post by BenderisGreat
Post by BenderisGreat
$del_image = wp_delete_attachment( $file, true );
I think it would be smarter to convert that to an sql query (maybe
wordpress
Post by BenderisGreat
wont catch it as a delete post function in sql?)
You want to use wp_delete_attachment(), not a custom query. The function
does a lot more than a single query, it cleans out all of the attachment's
data from the data base, and delete's the image files if there are any.
Are you sure that wp_delete_attachment() is actually being called? Are
you sure it isn't failing before then somewhere?
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Nikola Nikolov
2013-10-21 20:58:39 UTC
Permalink
Ok - so to recap:

- You are using an AJAX call targeted to /wp-admin/admin-ajax.php with an
"action" attribute set to your custom key
- You are using add_action( 'wp_ajax_*action*', 'action_callback' ); where
"*action*" is the "action" from above and "action_callback" is your
callback function
- In your action_callback function you are checking whether the input is
valid and then just call wp_delete_attachment() for the corresponding image

Is that correct?


On Mon, Oct 21, 2013 at 11:55 PM, Gregory Lancaster <
Post by Gregory Lancaster
Also- I teste other user roles, and only Authors and higher can delete the
form entries. But anyone can add new.
On Mon, Oct 21, 2013 at 1:53 PM, Gregory Lancaster <
Post by Gregory Lancaster
Its JSON that is refurning the failure message. I checked the error log
[Mon Oct 21 13:49:11 2013] [warn] Init: Session Cache is not configured
[hint: SSLSessionCache]
[Mon Oct 21 13:49:12 2013] [notice] Digest: generating secret for digest
authentication ...
[Mon Oct 21 13:49:12 2013] [notice] Digest: done
[Mon Oct 21 13:49:12 2013] [notice] Apache/2.2.14 (Unix) DAV/2
mod_ssl/2.2.14 OpenSSL/0.9.8l PHP/5.3.1 mod_perl/2.0.4 Perl/v5.10.1
configured -- resuming normal operations
That relevant?
Post by BenderisGreat
Post by BenderisGreat
$del_image = wp_delete_attachment( $file, true );
I think it would be smarter to convert that to an sql query (maybe
wordpress
Post by BenderisGreat
wont catch it as a delete post function in sql?)
You want to use wp_delete_attachment(), not a custom query. The function
does a lot more than a single query, it cleans out all of the
attachment's
Post by Gregory Lancaster
Post by BenderisGreat
data from the data base, and delete's the image files if there are any.
Are you sure that wp_delete_attachment() is actually being called? Are
you sure it isn't failing before then somewhere?
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Gregory Lancaster
2013-10-21 21:05:15 UTC
Permalink
Yea :

// enqueue ajax code recommended by JD
function my_enqueue_scripts() {
wp_localize_script(
'load_post',
'wp_ajax',
array(
'url' => admin_url( 'admin-ajax.php' ),
)
);
}
add_action( 'wp_enqueue_scripts', 'my_enqueue_scripts' );



// ajax post code and nonce recommended by Nikola
add_action('wp_ajax_my_delete_row_action', 'my_delete_row_action');
add_action('wp_ajax_nopriv_my_delete_row_action', 'my_delete_row_action');
function my_delete_row_action() {
global $wpdb;
$id = $_POST['id'];
$file = $_POST['file'];
if ( ! wp_verify_nonce( $_POST['nonce'], 'delete_' . $id . '_' . $file ) )
{
exit( 'Cheatin, huh?' ); }

$del_image = wp_delete_attachment( $file, false );
$qry = $wpdb->prepare("DELETE FROM wp_jo_plugin_options WHERE id = %s",
$id);
$go_qry1 = $wpdb->show_errors(); $wpdb->query($qry);
$response = array( 'success' => true );
wp_send_json_success($response);

die();
}
Post by Nikola Nikolov
- You are using an AJAX call targeted to /wp-admin/admin-ajax.php with an
"action" attribute set to your custom key
- You are using add_action( 'wp_ajax_*action*', 'action_callback' ); where
"*action*" is the "action" from above and "action_callback" is your
callback function
- In your action_callback function you are checking whether the input is
valid and then just call wp_delete_attachment() for the corresponding image
Is that correct?
On Mon, Oct 21, 2013 at 11:55 PM, Gregory Lancaster <
Post by Gregory Lancaster
Also- I teste other user roles, and only Authors and higher can delete
the
Post by Gregory Lancaster
form entries. But anyone can add new.
On Mon, Oct 21, 2013 at 1:53 PM, Gregory Lancaster <
Post by Gregory Lancaster
Its JSON that is refurning the failure message. I checked the error
log
Post by Gregory Lancaster
Post by Gregory Lancaster
[Mon Oct 21 13:49:11 2013] [warn] Init: Session Cache is not configured
[hint: SSLSessionCache]
[Mon Oct 21 13:49:12 2013] [notice] Digest: generating secret for
digest
Post by Gregory Lancaster
Post by Gregory Lancaster
authentication ...
[Mon Oct 21 13:49:12 2013] [notice] Digest: done
[Mon Oct 21 13:49:12 2013] [notice] Apache/2.2.14 (Unix) DAV/2
mod_ssl/2.2.14 OpenSSL/0.9.8l PHP/5.3.1 mod_perl/2.0.4 Perl/v5.10.1
configured -- resuming normal operations
That relevant?
Post by BenderisGreat
Post by BenderisGreat
$del_image = wp_delete_attachment( $file, true );
I think it would be smarter to convert that to an sql query (maybe
wordpress
Post by BenderisGreat
wont catch it as a delete post function in sql?)
You want to use wp_delete_attachment(), not a custom query. The
function
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by BenderisGreat
does a lot more than a single query, it cleans out all of the
attachment's
Post by Gregory Lancaster
Post by BenderisGreat
data from the data base, and delete's the image files if there are
any.
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by BenderisGreat
Are you sure that wp_delete_attachment() is actually being called? Are
you sure it isn't failing before then somewhere?
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Gregory Lancaster
2013-10-21 21:07:01 UTC
Permalink
AND I just realized what the problem was. This bit of code I wrote to
block subscribers from reaching wp-admin:


function themeblvd_redirect_admin(){
if ( ! current_user_can( 'edit_posts' ) ){
wp_redirect( site_url() );
exit;
}
}
add_action( 'admin_init', 'themeblvd_redirect_admin' );

Disabling that fixes the problem. So dumb of me I totally forgot I added
that. Another way to block subs from wp-admin?
Post by Nikola Nikolov
- You are using an AJAX call targeted to /wp-admin/admin-ajax.php with an
"action" attribute set to your custom key
- You are using add_action( 'wp_ajax_*action*', 'action_callback' ); where
"*action*" is the "action" from above and "action_callback" is your
callback function
- In your action_callback function you are checking whether the input is
valid and then just call wp_delete_attachment() for the corresponding image
Is that correct?
On Mon, Oct 21, 2013 at 11:55 PM, Gregory Lancaster <
Post by Gregory Lancaster
Also- I teste other user roles, and only Authors and higher can delete
the
Post by Gregory Lancaster
form entries. But anyone can add new.
On Mon, Oct 21, 2013 at 1:53 PM, Gregory Lancaster <
Post by Gregory Lancaster
Its JSON that is refurning the failure message. I checked the error
log
Post by Gregory Lancaster
Post by Gregory Lancaster
[Mon Oct 21 13:49:11 2013] [warn] Init: Session Cache is not configured
[hint: SSLSessionCache]
[Mon Oct 21 13:49:12 2013] [notice] Digest: generating secret for
digest
Post by Gregory Lancaster
Post by Gregory Lancaster
authentication ...
[Mon Oct 21 13:49:12 2013] [notice] Digest: done
[Mon Oct 21 13:49:12 2013] [notice] Apache/2.2.14 (Unix) DAV/2
mod_ssl/2.2.14 OpenSSL/0.9.8l PHP/5.3.1 mod_perl/2.0.4 Perl/v5.10.1
configured -- resuming normal operations
That relevant?
Post by BenderisGreat
Post by BenderisGreat
$del_image = wp_delete_attachment( $file, true );
I think it would be smarter to convert that to an sql query (maybe
wordpress
Post by BenderisGreat
wont catch it as a delete post function in sql?)
You want to use wp_delete_attachment(), not a custom query. The
function
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by BenderisGreat
does a lot more than a single query, it cleans out all of the
attachment's
Post by Gregory Lancaster
Post by BenderisGreat
data from the data base, and delete's the image files if there are
any.
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by BenderisGreat
Are you sure that wp_delete_attachment() is actually being called? Are
you sure it isn't failing before then somewhere?
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Nikola Nikolov
2013-10-21 21:09:04 UTC
Permalink
Now that explains the problem :)

Well just change your code to this:

if ( ! current_user_can( 'edit_posts' ) && ( ! defined( 'DOING_AJAX' )
|| ! DOING_AJAX
) ){

This way you will not redirect the users when the request an AJAX one.


On Tue, Oct 22, 2013 at 12:07 AM, Gregory Lancaster <
Post by Gregory Lancaster
AND I just realized what the problem was. This bit of code I wrote to
function themeblvd_redirect_admin(){
if ( ! current_user_can( 'edit_posts' ) ){
wp_redirect( site_url() );
exit;
}
}
add_action( 'admin_init', 'themeblvd_redirect_admin' );
Disabling that fixes the problem. So dumb of me I totally forgot I added
that. Another way to block subs from wp-admin?
Post by Nikola Nikolov
- You are using an AJAX call targeted to /wp-admin/admin-ajax.php with
an
Post by Nikola Nikolov
"action" attribute set to your custom key
- You are using add_action( 'wp_ajax_*action*', 'action_callback' );
where
Post by Nikola Nikolov
"*action*" is the "action" from above and "action_callback" is your
callback function
- In your action_callback function you are checking whether the input is
valid and then just call wp_delete_attachment() for the corresponding
image
Post by Nikola Nikolov
Is that correct?
On Mon, Oct 21, 2013 at 11:55 PM, Gregory Lancaster <
Post by Gregory Lancaster
Also- I teste other user roles, and only Authors and higher can delete
the
Post by Gregory Lancaster
form entries. But anyone can add new.
On Mon, Oct 21, 2013 at 1:53 PM, Gregory Lancaster <
Post by Gregory Lancaster
Its JSON that is refurning the failure message. I checked the error
log
Post by Gregory Lancaster
Post by Gregory Lancaster
[Mon Oct 21 13:49:11 2013] [warn] Init: Session Cache is not
configured
Post by Nikola Nikolov
Post by Gregory Lancaster
Post by Gregory Lancaster
[hint: SSLSessionCache]
[Mon Oct 21 13:49:12 2013] [notice] Digest: generating secret for
digest
Post by Gregory Lancaster
Post by Gregory Lancaster
authentication ...
[Mon Oct 21 13:49:12 2013] [notice] Digest: done
[Mon Oct 21 13:49:12 2013] [notice] Apache/2.2.14 (Unix) DAV/2
mod_ssl/2.2.14 OpenSSL/0.9.8l PHP/5.3.1 mod_perl/2.0.4 Perl/v5.10.1
configured -- resuming normal operations
That relevant?
Post by BenderisGreat
Post by BenderisGreat
$del_image = wp_delete_attachment( $file, true );
I think it would be smarter to convert that to an sql query (maybe
wordpress
Post by BenderisGreat
wont catch it as a delete post function in sql?)
You want to use wp_delete_attachment(), not a custom query. The
function
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by BenderisGreat
does a lot more than a single query, it cleans out all of the
attachment's
Post by Gregory Lancaster
Post by BenderisGreat
data from the data base, and delete's the image files if there are
any.
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by BenderisGreat
Are you sure that wp_delete_attachment() is actually being called?
Are
Post by Nikola Nikolov
Post by Gregory Lancaster
Post by Gregory Lancaster
Post by BenderisGreat
you sure it isn't failing before then somewhere?
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Gregory Lancaster
2013-10-19 07:25:27 UTC
Permalink
<b>I was having a hard time working out how to implement the ajax into
wordpress with the JSON callback. So, I hired a guy from freelancer. His
job was to setup my form as ajax, but im looking at his code now and it
does not make use the same code you used.

What he did was echo the row-ID in each < tr > (is this safe?) and then
created this button:</b>

< div id="delete<?php echo $row['id']; ?>">
< input type="submit" name="deleteItem" value="delete" class="delete-box"
onclick="delete1(<?php echo $row['id']; ?>) ">delete
< /div>

<b>and this <div>, which shows inside the <tr> I click delete on:</b>

< div style="display:none" id="areusure<?php echo $row['id']; ?>"></ div>

<b>Then, in the head of the file this is the script that handles the
selection of the < tr > etc...</b>

< script type="text/javascript">
var iii=0;
function delete1(id)
{
$.ajax(
{
url: '../../wp-content/plugins/gogonow/ajax1.php?id='+id,
success:function(data){
iii = setTimeout(function(){rm(id)},8000);
$("#areusure"+id).html($("#tr"+id).html());
$("#tr"+id).css("background-color","#FF3700");
$("#tr"+id).html("<td colspan='4'>Are you sure you want to delete it...<a
href='javascript:undo1("+id+")'>Undo</a ></ td >");
}
});
}
function undo1(id) {
$.ajax( {
url: '../../wp-content/plugins/gogonow/ajax1.php?undo='+id,
success:function(data){
clearTimeout(iii);
$("#tr"+id).html($("#areusure"+id).html());
}
})
}
function rm(id) {
$('#tr'+id).fadeOut(400);
}
< /script>


<b>and finally, here is the ajax call (which isnt written how you suggested
using ajaxurl in wordpress)</b>


<?php
if ( !isset($wp_did_header) ) {
$wp_did_header = true;
require_once('../../../wp-load.php' );
wp();
require_once( ABSPATH . WPINC . '/template-loader.php' );

}
global $wpdb;
if (isset($_REQUEST['id'])) {
$id = $_REQUEST['id'];
$file = $wpdb->get_var("select file from wp_jo_plugin_options WHERE id =
$id");
//wp_delete_attachment( $file );
$qry2 = $wpdb->prepare("CREATE TABLE IF NOT EXISTS t2 AS SELECT * from
wp_jo_plugin_options WHERE id = %s", $id);
$jo1 = $wpdb->query($qry2);
$qry = $wpdb->prepare("DELETE FROM wp_jo_plugin_options WHERE id = %s",
$id);
$jo_remove_row = $wpdb->query($qry);
}
if (isset($_REQUEST['undo'])) {
$undo = $_REQUEST['undo'];
$qry2 = $wpdb->prepare("insert ignore into wp_jo_plugin_options SELECT *
from t2 WHERE id = %s", $undo);
$jo_remove_row = $wpdb->query($qry2);
}
?>


<b>Now - I have no idea is this is bad code, but it does not match the same
layout you suggested. Is this safe? It cost me about 100 bucks on
freelancer.com. :-/</b>
Post by J.D. Grimes
It isn't hard to do, I've done it before. Do you know jQuery? jQuery's
AJAX handlers are very easy to user (in my opinion, at least). Quick and
jQuery( document ).ready( function( $ ) {
// When a button is clicked within the table with id="mytable"
$( '#mytable button' ).click( function( event ) {
// Keep the default action from happening (form submitted/page refreshed)
event.preventDefault();
if ( ! confirm( 'Are you sure you want to continue' ) )
return;
// Get the id of the row to delete.
// I'd recommend just making the button value the row ID,
no need for the extra input.
// Then you can access it easier through $( this ).val();
var rowID = $( this ).parent().child( 'input' )[0].val();
// POST data.
var data = {
'action': 'my_delete_row_action',
'rowID': rowID
}
// Send AJAX request to delete this.
$.post(
ajaxurl,
data,
function ( response ) {
// Check if this was successful.
// Assumes you are using
http://codex.wordpress.org/Function_Reference/wp_send_json_success
if ( ! response.success ) {
alert( 'Failure!' );
}
// Success! Hide the row.
$( '#mytable tr#myrow-' + rowID ).hide();
}
);
});
});
OK, that probably won't work off the bat, just an example. You'll need to
give your table an HTML ID, and give each row a unique ID based on $i (in
the example it's myrow-$i.
Also you'll need to see http://codex.wordpress.org/AJAX_in_Plugins for
info on how to handle the AJAX request properly within WordPress.
I'm sure you can find some great tutorials out there to help you along, too.
J.D.
Post by BenderisGreat
Right you are [again] J.D.
So should I just start sending you paypal payments for your assistance?
One more followup question - I don't know any Ajax- is there a simple
way
Post by BenderisGreat
(now that the form is fixed) to remove that row without a page refresh?
Again, not familiar with ajax so coding that myself isn't an option yet,
but
Post by BenderisGreat
maybe there is a simple way to implement something like that?
--
http://wordpress-hackers.1065353.n5.nabble.com/Delete-Row-Refreshes-Page-but-not-DB-tp42393p42403.html
Post by BenderisGreat
Sent from the Wordpress Hackers mailing list archive at Nabble.com.
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers
Loading...