WordPress.org
Get WordPress

Plugin Directory

Changeset 2590623


Ignore:
Timestamp:
08/30/2021 02:06:45 AM (4 years ago)
Author:
rinatkhaziev
Message:

Merge 7f2c9f1cbfdbeef0dba2f32d6c8952484bd861ca from GitHub

Location:
frontend-uploader/trunk
Files:
1 added
5 edited

Legend:

Unmodified
Added
Removed

  • frontend-uploader/trunk/frontend-uploader.php

    r2008848 r2590623  
    7373        $this->html = new Html_Helper;
    7474
    75         // Either use default settings if no setting set, or try to merge defaults with existing settings
    76         // Needed if new options were added in upgraded version of the plugin
    77         $this->settings = get_option( $this->settings_slug, $this->settings_defaults() );
    7875        register_activation_hook( __FILE__, array( $this, 'activate_plugin' ) );
    7976    }
    … …  
    8380     */
    8481    function action_init() {
     82        // Try to gracefully fallback on default values, as well as merge any potentially new settings coming from an upgrade (:
     83        $this->settings = array_merge( $this->settings_defaults(), (array) get_option( $this->settings_slug, [] ) );
    8584
    8685        load_plugin_textdomain( 'frontend-uploader', false, dirname( plugin_basename( __FILE__ ) ) . '/languages/' );
    … …  
    142141
    143142    /**
    144      * Add extra mime-types
    145      *
    146      * This is mostly legacy, and really should be deprecated or refactored due to unneccessary complexity
    147      *
    148      * @return [type] [description]
     143     * Handle MIME-types:
     144     *
     145     * First we check what's in the plugin setting (if there's nothing we're falling back to Core list)
     146     * If we're falling back to core value, make sure to remove HTML and JS files.
     147     * Then we also explicitly try to remove any variant of PHP, just in case.
     148     *
     149     * After that we pass the value to the filter,
     150     * so if somebody really wants to shoot in the foot they can do so.
     151     *
     152     * @return array the list of allowed for uploading mime types
    149153     */
    150154    function _get_mime_types() {
    151         $mime_types = wp_get_mime_types();
    152         $fu_mime_types = fu_get_mime_types();
    153 
    154         $enabled = isset( $this->settings['enabled_files'] ) && is_array( $this->settings['enabled_files'] ) ?  $this->settings['enabled_files'] : array();
    155 
    156         // $fu_mime_types holds extra mimes that are not allowed by WP
    157         foreach ( $fu_mime_types as $extension => $details ) {
    158             // Skip if it's not in the settings
    159             if ( ! in_array( $extension, $enabled, true ) )
    160                 continue;
    161 
    162             // Files have multiple mimes sometimes, we need to cover all of them
    163             foreach ( $details['mimes'] as $ext_mime ) {
    164                 $mime_types[ $extension . '|' . $extension . sanitize_title_with_dashes( $ext_mime ) ] = $ext_mime;
    165             }
    166         }
    167 
    168         // Configuration filter: fu_allowed_mime_types should return array of allowed mime types (see readme)
    169         $mime_types = apply_filters( 'fu_allowed_mime_types', $mime_types );
    170 
    171         foreach ( $mime_types as $ext_key => $mime ) {
    172             // Check for php just in case
    173             if ( false !== strpos( $mime, 'php' ) )
    174                 unset( $mime_types[$ext_key] );
    175         }
     155        // Use the fallback value but explicitly discard HTML and JS to prevent a possibility of XSS:
     156        // If these types are enabled in the UI they'll end up in $this->settings['enabled_files'].
     157        // $mime_types_orig is needed to re-map the values from the settings lib structure to core WP extension regex => mime-type format.
     158        $mime_types = $mime_types_orig = wp_get_mime_types();
     159        unset( $mime_types['htm|html'] );
     160        unset( $mime_types['js'] );
     161
     162        $enabled = isset( $this->settings['enabled_files'] ) && is_array( $this->settings['enabled_files'] ) && $this->settings['enabled_files'] ? $this->settings['enabled_files'] : $mime_types;
     163
     164        foreach ( $enabled as $ext_key => $mime ) {
     165            // Check for PHP.
     166            if ( false !== strpos( $mime, 'php' ) ) {
     167                unset( $enabled[ $ext_key ] );
     168                trigger_error( __( "Frontend Uploader doesn't support PHP uploads for security reasons", 'frontend-uploader' ) );
     169            }
     170
     171            // We need to re-map the value from our settings to the proper MIME-type instead of regex key for mime check to work correctly.
     172            $enabled[ $ext_key ] = $mime_types_orig[ $ext_key ];
     173        }
     174
     175        /**
     176         * Configuration filter: fu_allowed_mime_types should return array of allowed mime types (see readme)
     177         * @param array $enabled the list of enabled mime-types in core-compatible [ 'ext|ext2' => 'mime/type' ] format.
     178         */
     179        $mime_types = apply_filters( 'fu_allowed_mime_types', $enabled );
    176180
    177181        return $mime_types;
    … …  
    186190        $defaults = array();
    187191        $settings = Frontend_Uploader_Settings::get_settings_fields();
    188         foreach ( $settings[$this->settings_slug] as $setting ) {
     192        foreach ( $settings[ $this->settings_slug ] as $setting ) {
    189193            $defaults[ $setting['name'] ] = $setting['default'];
    190194        }
    … …  
    257261     */
    258262    function _upload_files( $post_id = 0 ) {
    259         // Only filter mimes just before the upload
     263        // Only filter mimes just before the upload.
    260264        add_filter( 'upload_mimes', array( $this, '_get_mime_types' ), 999 );
    261265
    … …  
    284288
    285289            // Skip to the next file if upload went wrong
    286             if ( $k['error'] !== 0  ) {
     290            if ( $k['error'] !== 0 ) {
    287291                $errors['fu-error-media'][] = array( 'name' => $k['name'], 'code' => $k['error'] );
    288292                continue;
    289293            }
    290294
    291             $typecheck = wp_check_filetype_and_ext( $k['tmp_name'], $k['name'], false );
     295            $typecheck = mime_content_type( $k['tmp_name'] );
    292296            // Add an error message if MIME-type is not allowed
    293             if ( ! in_array( $typecheck['type'], (array) $this->allowed_mime_types, true ) ) {
     297            if ( ! in_array( $typecheck, (array) $this->allowed_mime_types, true ) ) {
    294298                $errors['fu-disallowed-mime-type'][] = array( 'name' => $k['name'], 'mime' => $k['type'] );
    295299                continue;
    … …  
    10841088                    'post_type' => 'post',
    10851089                    'category' => '',
    1086                     'suppress_default_fields' => ! ( isset( $this->settings['suppress_default_fields'] ) && 'on' === $this->settings['suppress_default_fields'] ),
     1090                    'suppress_default_fields' => isset( $this->settings['suppress_default_fields'] ) && 'on' === $this->settings['suppress_default_fields'],
    10871091                    'append_to_post' => false,
    10881092                ), $atts ) );

  • frontend-uploader/trunk/lib/php/frontend-uploader-settings.php

    r1971315 r2590623  
    6464     */
    6565    static function get_settings_fields() {
     66        static $settings_fields;
     67
     68        if ( $settings_fields ) {
     69            return $settings_fields;
     70        }
     71
    6672        $default_post_type = array( 'post' => 'Posts' );
     73        $core_mime_types = fu_get_exts_descs();
     74
     75        // Sanitize a bit.
     76        $safe_defaults = $core_mime_types;
     77        unset( $safe_defaults['htm|html'] );
     78        unset( $safe_defaults['js'] );
     79        $safe_defaults_keys = array_keys( $safe_defaults );
     80
    6781        $settings_fields = array(
    6882            'frontend_uploader_settings' => array(
    … …  
    145159                    'desc' => '',
    146160                    'type' => 'multicheck',
    147                     'default' => array(),
    148                     'options' => fu_get_exts_descs(),
     161                    'default' => array_combine( $safe_defaults_keys, $safe_defaults_keys ),
     162                    'options' => $core_mime_types,
    149163                ),
    150164                array(

  • frontend-uploader/trunk/lib/php/functions.php

    r1688580 r2590623  
    55
    66/**
    7  * Get the common MIME-types for extensions
    8  * @return array
    9  */
    10 function fu_get_mime_types() {
    11     // Generated with dyn_php class: http://www.phpclasses.org/package/2923-PHP-Generate-PHP-code-programmatically.html
    12     $mimes_exts = array(
    13         'csv'=>
    14         array(
    15             'label'=> 'Comma Separated Values File',
    16             'mimes'=>
    17             array(
    18                 'text/comma-separated-values',
    19                 'text/csv',
    20                 'application/csv',
    21                 'application/excel',
    22                 'application/vnd.ms-excel',
    23                 'application/vnd.msexcel',
    24                 'text/anytext',
    25             ),
    26         ),
    27         'mp3'=>
    28         array(
    29             'label'=> 'MP3 Audio File',
    30             'mimes'=>
    31             array(
    32                 'audio/mpeg',
    33                 'audio/x-mpeg',
    34                 'audio/mp3',
    35                 'audio/x-mp3',
    36                 'audio/mpeg3',
    37                 'audio/x-mpeg3',
    38                 'audio/mpg',
    39                 'audio/x-mpg',
    40                 'audio/x-mpegaudio',
    41             ),
    42         ),
    43         'avi'=>
    44         array(
    45             'label'=> 'Audio Video Interleave File',
    46             'mimes'=>
    47             array(
    48                 'video/avi',
    49                 'video/msvideo',
    50                 'video/x-msvideo',
    51                 'image/avi',
    52                 'video/xmpg2',
    53                 'application/x-troff-msvideo',
    54                 'audio/aiff',
    55                 'audio/avi',
    56             ),
    57         ),
    58 
    59         'mid'=>
    60         array(
    61             'label'=> 'MIDI File',
    62             'mimes'=>
    63             array(
    64                 'audio/mid',
    65                 'audio/m',
    66                 'audio/midi',
    67                 'audio/x-midi',
    68                 'application/x-midi',
    69                 'audio/soundtrack',
    70             ),
    71         ),
    72         'wav'=>
    73         array(
    74             'label'=> 'WAVE Audio File',
    75             'mimes'=>
    76             array(
    77                 'audio/wav',
    78                 'audio/x-wav',
    79                 'audio/wave',
    80                 'audio/x-pn-wav',
    81             ),
    82         ),
    83         'wma'=>
    84         array(
    85             'label'=> 'Windows Media Audio File',
    86             'mimes'=>
    87             array(
    88                 'audio/x-ms-wma',
    89                 'video/x-ms-asf',
    90             ),
    91         ),
    92     );
    93 
    94     return $mimes_exts;
    95 }
    96 
    97 /**
    987 * Generate slug => description array for Frontend Uploader settings
    998 * @return array
    1009 */
    10110function fu_get_exts_descs() {
    102     $mimes = fu_get_mime_types();
     11    $mimes = wp_get_mime_types();
    10312    $a = array();
    10413
    105     foreach( $mimes as $ext => $mime )
    106         $a[$ext] = sprintf( '%1$s (.%2$s)', $mime['label'], $ext );
     14    foreach( $mimes as $ext => $mime ) {
     15        $a[ $ext ] = sprintf( '%2$s (%1$s)', $mime, str_replace( '|', ', ', $ext ) );
     16    }
    10717
    10818    return $a;

  • frontend-uploader/trunk/readme.md

    r1030331 r2590623  
    11# Frontend Uploader
     2
     3⚠️ _This plugin is not actively maintained._ Any discovered security issues will be patched though. ⚠️
     4
     5If you're interested in becoming a maintainer please let me know.
    26
    37## Description

  • frontend-uploader/trunk/readme.txt

    r2008848 r2590623  
    44Tags: frontend, image, images, media, uploader, upload, video, audio, photo, photos, picture, pictures, file, user generated content, ugc, frontend upload
    55Requires at least: 4.6
    6 Requires PHP: 5.4
    76Tested up to: 5.0
    87Stable tag: 1.3.2
    … …  
    1615
    1716This plugin is a simple way for users to submit content to your site. The plugin uses a set of shortcodes to let you create highly customizable submission forms to your posts and pages. Once the content is submitted, it is held for moderation until you approve it. It’s that easy!
     17
     18**Security**
     19
     20Allowing uploads from unauthenticated users is inherently risky. The plugin relies on the core allow list for files. However, we explicitly remove HTML, JS and PHP files even if they're in the allow list. To modify the list of allowed file types please refer to *fu_allowed_mime_types* configuration filter section for additional details.
    1821
    1922= Exploring Customizations =
    … …  
    334337
    335338This action runs after form was uploaded. Arguments are: (string) $layout (form layout), (array) $result - result of the upload.
    336 `add_action('fu_upload_result', 'my_fu_upload_result', 10, 2 );
     339`add_action( 'fu_upload_result', 'my_fu_upload_result', 10, 2 );
    337340
    338341function my_fu_upload_result( $layout, $result ) {
Note: See TracChangeset for help on using the changeset viewer.