| @@ -10,8 +10,9 @@ | ||
| 10 | 10 | $self = new self(); |
| 11 | 11 | $self->dispatch_hooks(); |
| 12 | 12 | |
| 13 | 13 | add_filter( 'upload_mimes', [ $self, 'allow_lottie_json_uploads' ] ); |
| 14 | + add_filter( 'upload_mimes', [ $self, 'allow_svg_uploads' ] ); | |
| 14 | 15 | add_filter( 'wp_check_filetype_and_ext', function ( $data, $file, $filename ) { |
| 15 | 16 | $ext = pathinfo( $filename, PATHINFO_EXTENSION ); |
| 16 | 17 | |
| 17 | 18 | if ( 'json' === $ext ) { |
| @@ -16,8 +17,11 @@ | ||
| 16 | 17 | |
| 17 | 18 | if ( 'json' === $ext ) { |
| 18 | 19 | $data['ext'] = 'json'; |
| 19 | 20 | $data['type'] = 'application/json'; |
| 21 | + } elseif ( 'svg' === strtolower( $ext ) && current_user_can( 'unfiltered_html' ) ) { | |
| 22 | + $data['ext'] = 'svg'; | |
| 23 | + $data['type'] = 'image/svg+xml'; | |
| 20 | 24 | } |
| 21 | 25 | |
| 22 | 26 | return $data; |
| 23 | 27 | }, 10, 3 ); |
| @@ -25,8 +29,21 @@ | ||
| 25 | 29 | |
| 26 | 30 | function allow_lottie_json_uploads( $mimes ) { |
| 27 | 31 | $mimes['json'] = 'application/json'; |
| 28 | 32 | $mimes['lottie'] = 'application/json'; |
| 33 | + return $mimes; | |
| 34 | + } | |
| 35 | + | |
| 36 | + // Gated to unfiltered_html (administrators, by default) rather than opened | |
| 37 | + // for every role: an SVG file can carry a <script>, and unlike the Atomic | |
| 38 | + // SVG block's own read path (which strips scripts/handlers before inlining | |
| 39 | + // markup — see atomic-svg/edit.js `cleanSvg`), the raw file the media | |
| 40 | + // library stores is unsanitised and can execute if it is ever opened | |
| 41 | + // directly as a top-level document. | |
| 42 | + function allow_svg_uploads( $mimes ) { | |
| 43 | + if ( current_user_can( 'unfiltered_html' ) ) { | |
| 44 | + $mimes['svg'] = 'image/svg+xml'; | |
| 45 | + } | |
| 29 | 46 | return $mimes; |
| 30 | 47 | } |
| 31 | 48 | |
| 32 | 49 | public function dispatch_hooks() { |
