WordPress.org
Get WordPress

Plugin Directory

Changeset 3460447


Ignore:
Timestamp:
02/13/2026 01:54:03 AM (5 days ago)
Author:
GamerZ
Message:

Deploying wp-downloadmanager from GitHub

Location:
wp-downloadmanager/trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • wp-downloadmanager/trunk/download-manager.php

    r3137641 r3460447  
    140140                                $file_upload_to = $file_upload_to . '/';
    141141                            }
    142                             if(move_uploaded_file($_FILES['file_upload']['tmp_name'], $file_path.$file_upload_to.basename($_FILES['file_upload']['name']))) {
    143                                 $file = $file_upload_to.basename($_FILES['file_upload']['name']);
    144                                 $file = download_rename_file($file_path, $file);
    145                                 $file_size = filesize($file_path.$file);
     142                            $validate = wp_check_filetype_and_ext( $_FILES['file_upload']['tmp_name'], basename( $_FILES['file_upload']['name'] ) );
     143                            if ( $validate['type'] === false ) {
     144                                    $text = '<p style="color: red;">' . __('File type is invalid', 'wp-downloadmanager') . '</p>';
     145                                    break;
     146                            }
     147                            if( move_uploaded_file( $_FILES['file_upload']['tmp_name'], $file_path.$file_upload_to . basename( $_FILES['file_upload']['name'] ) ) ) {
     148                                $file = $file_upload_to . basename( $_FILES['file_upload']['name'] );
     149                                $file = download_rename_file( $file_path, $file );
     150                                $file_size = filesize( $file_path . $file );
    146151                            } else {
    147                                 $text = '<p style="color: red;">'.__('Error In Uploading File', 'wp-downloadmanager').'</p>';
     152                                $text = '<p style="color: red;">' . __('Error In Uploading File', 'wp-downloadmanager') . '</p>';
    148153                                break;
    149154                            }
    150155                        } else {
    151                             $text = '<p style="color: red;">'.__('Error In Uploading File', 'wp-downloadmanager').'</p>';
     156                            $text = '<p style="color: red;">' . __('Error In Uploading File', 'wp-downloadmanager') . '</p>';
    152157                            break;
    153158                        }
    … …  
    209214            check_admin_referer('wp-downloadmanager_delete-file');
    210215            $file_id  = ! empty( $_POST['file_id'] ) ? intval( $_POST['file_id'] ) : 0;
    211             $file = ! empty( $_POST['file'] ) ? sanitize_text_field( $_POST['file'] ) : '';
    212             $file_name = ! empty( $_POST['file_name'] ) ? sanitize_text_field( $_POST['file_name'] ) : '';
     216            $file = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->downloads WHERE file_id = %d", $file_id ) );
    213217            $unlinkfile = ! empty( $_POST['unlinkfile'] ) ? intval( $_POST['unlinkfile'] ) : 0;
    214             if($unlinkfile == 1) {
    215                 if(!unlink($file_path.$file)) {
    216                     $text = '<p style="color: red;">'.sprintf(__('Error In Deleting File \'%s (%s)\' From Server', 'wp-downloadmanager'), $file_name, $file).'</p>';
     218            if ( $unlinkfile === 1 ) {
     219                if ( ! unlink( $file_path . $file->file ) ) {
     220                    $text = '<p style="color: red;">' . sprintf( __( 'Error In Deleting File \'%s (%s)\' From Server', 'wp-downloadmanager' ), $file->file_name, $file->file ) . '</p>';
    217221                } else {
    218                     $text = '<p style="color: green;">'.sprintf(__('File \'%s (%s)\' Deleted From Server Successfully', 'wp-downloadmanager'), $file_name, $file).'</p>';
     222                    $text = '<p style="color: green;">' . sprintf( __( 'File \'%s (%s)\' Deleted From Server Successfully', 'wp-downloadmanager' ), $file->file_name, $file->file ) . '</p>';
    219223                }
    220224            }
    221             $deletefile = $wpdb->query("DELETE FROM $wpdb->downloads WHERE file_id = $file_id");
    222             if(!$deletefile) {
    223                 $text .= '<p style="color: red;">'.sprintf(__('Error In Deleting File \'%s (%s)\'', 'wp-downloadmanager'), $file_name, $file).'</p>';
     225            $deletefile = $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->downloads WHERE file_id = %d", $file->file_id ) );
     226            if ( ! $deletefile ) {
     227                $text .= '<p style="color: red;">' . sprintf( __('Error In Deleting File \'%s (%s)\'', 'wp-downloadmanager'), $file->file_name, $file->file) . '</p>';
    224228            } else {
    225                 $text .= '<p style="color: green;">'.sprintf(__('File \'%s (%s)\' Deleted Successfully', 'wp-downloadmanager'), $file_name, $file).'</p>';
     229                $text .= '<p style="color: green;">' . sprintf( __('File \'%s (%s)\' Deleted Successfully', 'wp-downloadmanager'), $file->file_name, $file->file) . '</p>';
    226230            }
    227231            break;
    … …  
    377381        <!-- Delete A File -->
    378382        <form method="post" action="<?php echo admin_url('admin.php?page='.plugin_basename(__FILE__)); ?>">
    379             <input type="hidden" name="file_id" value="<?php echo intval($file->file_id); ?>" />
    380             <input type="hidden" name="file" value="<?php echo esc_attr( removeslashes( $file->file ) ); ?>" />
    381             <input type="hidden" name="file_name" value="<?php echo esc_attr( removeslashes( $file->file_name ) ); ?>" />
     383            <input type="hidden" name="file_id" value="<?php echo esc_attr( intval( $file->file_id ) ); ?>" />
    382384            <?php wp_nonce_field('wp-downloadmanager_delete-file'); ?>
    383385            <div class="wrap">

  • wp-downloadmanager/trunk/download-options.php

    r3294467 r3460447  
    4040   
    4141    // Validate
    42     if ( substr( $download_path, 0, strlen( WP_CONTENT_DIR ) ) !== WP_CONTENT_DIR ) {
     42    $real_download_path = realpath( $download_path );
     43    $real_wp_content_dir = realpath( WP_CONTENT_DIR );
     44
     45    if ( false === $real_download_path || false === $real_wp_content_dir || strpos( $real_download_path . DIRECTORY_SEPARATOR, $real_wp_content_dir ) !== 0 || strpos( $download_path, '../' ) !== false ) {
    4346        $download_path = WP_CONTENT_DIR;
    4447    }

  • wp-downloadmanager/trunk/readme.txt

    r3364847 r3460447  
    44Tags: file, files, download, downloads, manager, downloadmanager, downloadsmanager, filemanager, filesmanager 
    55Requires at least: 4.0 
    6 Tested up to: 6.8 
    7 Stable tag: 1.69  
     6Tested up to: 6.9 
     7Stable tag: 1.69.1 
    88License: GPLv2 
    99
    … …  
    5959
    6060## Changelog
     61
     62### Version 1.69.1
     63* FIXED: Use file_id to fetch file again before deleting files.
     64* FIXED: Don't allow directory traversal for download_path
     65
    6166### Version 1.69
    6267* FIXED: Only allow certain files to be uploaded based on `wp_check_filetype_and_ext()`

  • wp-downloadmanager/trunk/wp-downloadmanager.php

    r3364847 r3460447  
    44Plugin URI: https://lesterchan.net/portfolio/programming/php/
    55Description: Adds a simple download manager to your WordPress blog.
    6 Version: 1.69
     6Version: 1.69.1
    77Author: Lester 'GaMerZ' Chan
    88Author URI: https://lesterchan.net
    … …  
    3131
    3232### Version
    33 define( 'WP_DOWNLOADMANAGER_VERSION', '1.69' );
     33define( 'WP_DOWNLOADMANAGER_VERSION', '1.69.1' );
    3434
    3535### Create text domain for translations
    … …  
    10751075            $template_download_embedded = str_replace("%FILE_CATEGORY_ID%", (int) $file->file_category, $template_download_embedded);
    10761076            $template_download_embedded = str_replace("%FILE_CATEGORY_NAME%", stripslashes($download_categories[(int) $file->file_category]), $template_download_embedded);
    1077             $template_download_embedded = str_replace("%FILE_DATE%",  mysql2date(get_option('date_format'), gmdate('Y-m-d H:i:s', $file->file_date)), $template_download_embedded);
    1078             $template_download_embedded = str_replace("%FILE_TIME%",  mysql2date(get_option('time_format'), gmdate('Y-m-d H:i:s', $file->file_date)), $template_download_embedded);
    1079             $template_download_embedded = str_replace("%FILE_UPDATED_DATE%",  mysql2date(get_option('date_format'), gmdate('Y-m-d H:i:s', $file->file_updated_date)), $template_download_embedded);
    1080             $template_download_embedded = str_replace("%FILE_UPDATED_TIME%",  mysql2date(get_option('time_format'), gmdate('Y-m-d H:i:s', $file->file_updated_date)), $template_download_embedded);
     1077            $template_download_embedded = str_replace("%FILE_DATE%",  mysql2date(get_option('date_format'), gmdate('Y-m-d H:i:s', (int) $file->file_date)), $template_download_embedded);
     1078            $template_download_embedded = str_replace("%FILE_TIME%",  mysql2date(get_option('time_format'), gmdate('Y-m-d H:i:s', (int) $file->file_date)), $template_download_embedded);
     1079            $template_download_embedded = str_replace("%FILE_UPDATED_DATE%",  mysql2date(get_option('date_format'), gmdate('Y-m-d H:i:s', (int) $file->file_updated_date)), $template_download_embedded);
     1080            $template_download_embedded = str_replace("%FILE_UPDATED_TIME%",  mysql2date(get_option('time_format'), gmdate('Y-m-d H:i:s', (int) $file->file_updated_date)), $template_download_embedded);
    10811081            $template_download_embedded = str_replace("%FILE_HITS%", number_format_i18n($file->file_hits), $template_download_embedded);
    10821082            $template_download_embedded = str_replace("%FILE_DOWNLOAD_URL%", download_file_url($file->file_id, $file->file), $template_download_embedded);
Note: See TracChangeset for help on using the changeset viewer.