← All changes | backend/src/Hooks/ImageProxy.php +73 -47 1.0 → 1.5.4.2 View file →

		@@ -1,47 +1,73 @@
1		-<?php
2		-
3		-namespace FL\Assistant\Hooks;
4		-
5		-class ImageProxy {
6		-
7		- public function __construct() {
8		- add_action(
9		- 'init', function() {
10		- if ( ! current_user_can( 'edit_others_posts' ) ) {
11		- return;
12		- }
13		- if ( isset( $_GET['fl_asst_image_proxy'] ) ) {
14		- self::render_image();
15		- }
16		- }
17		- );
18		- }
19		-
20		- public function render_image() {
21		- $url = urldecode( $_GET['fl_asst_image_proxy'] );
22		- $url = str_replace( '?url=', '', $url );
23		-
24		- if ( 0 !== strpos( $url, 'http' ) ) {
25		- return;
26		- }
27		-
28		- $response = wp_remote_get( $url );
29		-
30		- if ( is_wp_error( $response ) ) {
31		- return;
32		- }
33		-
34		- $body = wp_remote_retrieve_body( $response );
35		- $headers = wp_remote_retrieve_headers( $response );
36		-
37		- if ( ! isset( $headers['content-type'] ) ) {
38		- return;
39		- } elseif ( 0 !== strpos( $headers['content-type'], 'image/' ) ) {
40		- return;
41		- }
42		-
43		- header( 'Content-type: ' . $headers['content-type'] );
44		- echo $body;
45		- die();
46		- }
47		-}
	1	+<?php
	2	+
	3	+namespace FL\Assistant\Hooks;
	4	+
	5	+class ImageProxy {
	6	+
	7	+ public function __construct() {
	8	+ add_action(
	9	+ 'init', function() {
	10	+ if ( ! current_user_can( 'edit_others_posts' ) ) {
	11	+ return;
	12	+ }
	13	+ if ( isset( $_GET['fl_asst_image_proxy'] ) ) {
	14	+ self::render_image();
	15	+ }
	16	+ }
	17	+ );
	18	+ }
	19	+
	20	+ public function render_image() {
	21	+ if ( ! isset( $_GET['fl_asst_image_proxy'] ) && ! isset( $_GET['url'] ) ) {
	22	+ return;
	23	+ }
	24	+
	25	+ $url = esc_url_raw( $_GET['url'] );
	26	+ $url = urldecode( $url );
	27	+
	28	+ if ( 0 !== strpos( $url, 'http' ) ) {
	29	+ return;
	30	+ }
	31	+
	32	+ $response = wp_safe_remote_get( $url );
	33	+
	34	+ if ( is_wp_error( $response ) ) {
	35	+ return;
	36	+ }
	37	+
	38	+ $body = wp_remote_retrieve_body( $response );
	39	+ $headers = wp_remote_retrieve_headers( $response );
	40	+
	41	+ // validate image
	42	+ $filesystem = self::filesystem();
	43	+ $tmpfile = tempnam( '/tmp', 'assistant' );
	44	+ $filesystem->put_contents( $tmpfile, $body );
	45	+ $validimage = wp_get_image_mime( $tmpfile );
	46	+ $filesystem->delete( $tmpfile );
	47	+
	48	+ if ( ! $validimage ) {
	49	+ return false;
	50	+ }
	51	+
	52	+ if ( ! isset( $headers['content-type'] ) ) {
	53	+ return;
	54	+ } elseif ( 0 !== strpos( $headers['content-type'], 'image/' ) ) {
	55	+ return;
	56	+ }
	57	+
	58	+ header( 'Content-type: ' . $headers['content-type'] );
	59	+ echo $body;
	60	+ die();
	61	+ }
	62	+
	63	+ private function filesystem() {
	64	+ global $wp_filesystem;
	65	+
	66	+ if ( is_null( $wp_filesystem ) ) {
	67	+ require_once ABSPATH . '/wp-admin/includes/file.php';
	68	+ WP_Filesystem();
	69	+ }
	70	+
	71	+ return $wp_filesystem;
	72	+ }
	73	+}