← All changes | includes/Core/Util/FileDownloadProvider.php +9 -65 3.1.0 → 2.15.3 View file →

		@@ -1,51 +1,10 @@
1	1	<?php
2	2
3	3	namespace BitCode\BitForm\Core\Util;
4	4
5		-if (!defined('ABSPATH')) {
6		- exit;
7		-}
8		-
9	5	final class FileDownloadProvider
10	6	{
11		- private function isAuthorizedFileRequest($formID, $entryID)
12		- {
13		- if (!is_user_logged_in()) {
14		- return false;
15		- }
16		-
17		- $currentUserId = get_current_user_id();
18		- if (empty($currentUserId)) {
19		- return false;
20		- }
21		-
22		- // If a nonce is provided, verify it. If it's missing/invalid, fall back to an ownership/capability check.
23		- $nonce = isset($_GET['nonce']) && is_scalar($_GET['nonce']) ? sanitize_text_field(wp_unslash((string) $_GET['nonce'])) : '';
24		- $nonceAction = 'bitforms_file_download_' . $formID . '_' . $entryID;
25		- if (!empty($nonce) && wp_verify_nonce($nonce, $nonceAction)) {
26		- return true;
27		- }
28		-
29		- // Capability bypass.
30		- if (current_user_can('manage_bitform') || current_user_can('manage_options')) {
31		- return true;
32		- }
33		-
34		- // Ownership check: non-admin users may only download their own entry files.
35		- $entryModel = new \BitCode\BitForm\Core\Database\FormEntryModel();
36		- $entry = $entryModel->get(
37		- 'id',
38		- [
39		- 'id' => $entryID,
40		- 'form_id' => $formID,
41		- 'user_id' => $currentUserId,
42		- ]
43		- );
44		-
45		- return !is_wp_error($entry) && !empty($entry);
46		- }
47		-
48	7	public function register()
49	8	{
50	9	add_action('template_redirect', [$this, 'authCheckandFrceDownloadHelper']);
51	10	add_shortcode('bitforms-frontend-file', [$this, 'handleFileDownload']);
		@@ -52,9 +11,8 @@
52	11	}
53	12
54	13	public function handleFileDownload()
55	14	{
56		- // File download: form/entry/file IDs read from query string; authorization enforced via isAuthorizedFileRequest() below.
57	15	if (!isset($_GET['formID']) || !isset($_GET['entryID']) || !isset($_GET['fileID'])) {
58	16	global $wp_query;
59	17	$wp_query->set_404();
60	18	status_header(404);
		@@ -60,21 +18,14 @@
60	18	status_header(404);
61	19	get_template_part(404);
62	20	exit();
63	21	}
64		- $formID = intval(sanitize_text_field(wp_unslash($_GET['formID'])));
65		- $entryID = intval(sanitize_text_field(wp_unslash($_GET['entryID'])));
66		- $fileID = sanitize_file_name(wp_unslash($_GET['fileID']));
67		- if (!$this->isAuthorizedFileRequest($formID, $entryID)) {
68		- $this->show404();
69		- }
70		-
71		- $filePath = FileHandler::getEntriesFileUploadDir($formID, $entryID) . DIRECTORY_SEPARATOR . $fileID;
72		-
	22	+ $formID = intval(sanitize_text_field($_GET['formID']));
	23	+ $entryID = intval(sanitize_text_field($_GET['entryID']));
	24	+ $fileID = sanitize_file_name($_GET['fileID']);
	25	+ $filePath = BITFORMS_UPLOAD_DIR . DIRECTORY_SEPARATOR . $formID . DIRECTORY_SEPARATOR . $entryID . DIRECTORY_SEPARATOR . $fileID;
73	26	if (is_readable($filePath)) {
74	27	$this->fileDownloadORView($filePath, true);
75		- } else {
76		- $this->show404();
77	28	}
78	29	}
79	30
80	31	public static function getBaseDownloadURL()
		@@ -151,21 +102,15 @@
151	102	}
152	103
153	104	private function isRequestedFileExists()
154	105	{
155		- // File download: IDs read from query string; authorization enforced via isAuthorizedFileRequest() below.
156	106	if (!isset($_GET['formID']) || !isset($_GET['entryID']) || !isset($_GET['fileID'])) {
157	107	return false;
158	108	}
159		- $formID = intval(sanitize_text_field(wp_unslash($_GET['formID'])));
160		- $entryID = intval(sanitize_text_field(wp_unslash($_GET['entryID'])));
161		- $fileID = sanitize_file_name(wp_unslash($_GET['fileID']));
162		-
163		- if (!$this->isAuthorizedFileRequest($formID, $entryID)) {
164		- return false;
165		- }
166		-
167		- $filePath = FileHandler::getEntriesFileUploadDir($formID, $entryID) . DIRECTORY_SEPARATOR . $fileID;
	109	+ $formID = intval(sanitize_text_field($_GET['formID']));
	110	+ $entryID = intval(sanitize_text_field($_GET['entryID']));
	111	+ $fileID = sanitize_file_name($_GET['fileID']);
	112	+ $filePath = BITFORMS_UPLOAD_DIR . DIRECTORY_SEPARATOR . $formID . DIRECTORY_SEPARATOR . $entryID . DIRECTORY_SEPARATOR . $fileID;
168	113	if (is_readable($filePath)) {
169	114	return $filePath;
170	115	}
171	116
		@@ -184,9 +129,9 @@
184	129	$content_types = 'text/plain';
185	130	if ($fileInfo['type'] && $fileInfo['ext']) {
186	131	$content_types = $fileInfo['type'];
187	132	$ext = $fileInfo['ext'];
188		- if (in_array($ext, ['txt', 'php', 'html', 'xhtml', 'json'], true)) {
	133	+ if (in_array($ext[1], ['txt', 'php', 'html', 'xhtml', 'json'])) {
189	134	$content_types = 'text/plain';
190	135	}
191	136	}
192	137	header('Content-Disposition:filename="' . basename($filePath) . '"');
		@@ -198,9 +143,8 @@
198	143	header('Pragma: public');
199	144	header('Content-Length: ' . filesize($filePath));
200	145	header('Content-Transfer-Encoding: binary ');
201	146	flush();
202		- // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_readfile -- Streaming binary download; WP_Filesystem has no streaming equivalent and get_contents() would load entire file into memory.
203	147	readfile($filePath);
204	148	die();
205	149	}
206	150	}