From e35d2d39b497c56ddf88b546f64094a0b9afaae4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rabbi=20Islam=20Rony=20=E2=9A=A1=EF=B8=8F?=
 <35329385+RabbiIslamRony@users.noreply.github.com>
Date: Sun, 2 Aug 2026 12:03:58 +0600
Subject: [PATCH] fix: preserve Windows upload paths

---
 includes/classes/class-ajax-handler.php                      | 5 ++---
 .../multi-directory-setup/class-multi-directory-manager.php  | 2 +-
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/includes/classes/class-ajax-handler.php b/includes/classes/class-ajax-handler.php
index 9c66973f78..d1cdf96c2c 100644
--- a/includes/classes/class-ajax-handler.php
+++ b/includes/classes/class-ajax-handler.php
@@ -953,8 +953,7 @@ public function atbdp_post_attachment_upload() {
                     $upload_token = isset( $_POST['upload_token'] ) ? sanitize_text_field( wp_unslash( $_POST['upload_token'] ) ) : '';
                     $token_data   = $upload_token ? get_transient( 'directorist_file_upload_' . $upload_token ) : false;
 
-                    if (
-                        empty( $token_data )
+                    if ( empty( $token_data )
                         || ! is_array( $token_data )
                         || (int) ( $token_data['directory'] ?? 0 ) !== $directory
                         || (string) ( $token_data['field_key'] ?? '' ) !== $field_id
@@ -985,7 +984,7 @@ public function atbdp_post_attachment_upload() {
                 }
 
                 $field_id   = sanitize_text_field( $field_config['field_key'] );
-                $fixed_file = ( ! empty( $_FILES[ $field_id . 'async-upload' ] ) ) ? directorist_clean( wp_unslash( $_FILES[ $field_id . 'async-upload' ] ) ) : '';
+                $fixed_file = ( ! empty( $_FILES[ $field_id . 'async-upload' ] ) ) ? directorist_clean( $_FILES[ $field_id . 'async-upload' ] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Unslashing corrupts Windows upload paths in raw $_FILES data.
 
                 if ( empty( $fixed_file ) ) {
                     throw new \Exception( __( 'No file supplied.', 'directorist' ), 400 );
diff --git a/includes/modules/multi-directory-setup/class-multi-directory-manager.php b/includes/modules/multi-directory-setup/class-multi-directory-manager.php
index 3631ad34b1..72de52ec93 100644
--- a/includes/modules/multi-directory-setup/class-multi-directory-manager.php
+++ b/includes/modules/multi-directory-setup/class-multi-directory-manager.php
@@ -530,7 +530,7 @@ public function save_imported_post_type_data() {
 
         $term_id        = ( ! empty( $_POST[ 'term_id' ] ) ) ? absint( $_POST[ 'term_id' ] ) : 0;
         $directory_name = ( ! empty( $_POST[ 'directory-name' ] ) ) ? sanitize_text_field( wp_unslash( $_POST[ 'directory-name' ] ) ) : '';
-        $json_file      = ( ! empty( $_FILES[ 'directory-import-file' ] ) ) ? directorist_clean( wp_unslash( $_FILES[ 'directory-import-file' ] ) ) : '';
+        $json_file      = ( ! empty( $_FILES[ 'directory-import-file' ] ) ) ? directorist_clean( $_FILES[ 'directory-import-file' ] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Unslashing corrupts Windows upload paths in raw $_FILES data.
 
         // Validation
         $response = [