← All changes | core/files/uploads-manager.php +14 -132 4.1.2 → 3.13.3 View file →

		@@ -6,12 +6,9 @@
6	6	use Elementor\Core\Files\File_Types\Base as File_Type_Base;
7	7	use Elementor\Core\Files\File_Types\Json;
8	8	use Elementor\Core\Files\File_Types\Svg;
9	9	use Elementor\Core\Files\File_Types\Zip;
10		-use Elementor\Core\Files\Fonts\Google_Font;
11	10	use Elementor\Core\Utils\Exceptions;
12		-use Elementor\Fonts;
13		-use Elementor\User;
14	11
15	12	if ( ! defined( 'ABSPATH' ) ) {
16	13	exit; // Exit if accessed directly.
17	14	}
		@@ -26,9 +23,8 @@
26	23	class Uploads_Manager extends Base_Object {
27	24
28	25	const UNFILTERED_FILE_UPLOADS_KEY = 'elementor_unfiltered_files_upload';
29	26	const INVALID_FILE_CONTENT = 'Invalid Content In File';
30		- const ELEMENTOR_UPLOAD_DIR = 'elementor';
31	27
32	28	/**
33	29	* @var File_Type_Base[]
34	30	*/
		@@ -75,9 +71,9 @@
75	71	* @since 3.3.0
76	72	* @access public
77	73	*
78	74	* @param string $file_path
79		- * @param array $allowed_file_types
	75	+ * @param array $allowed_file_types
80	76	* @return array|\WP_Error
81	77	*/
82	78	public function extract_and_validate_zip( $file_path, $allowed_file_types = null ) {
83	79	$result = [];
		@@ -122,53 +118,31 @@
122	118	*
123	119	* @since 3.3.0
124	120	* @access public
125	121	*
126		- * @param array $data
	122	+ * @param array $file
127	123	* @param array $allowed_file_extensions Optional. an array of file types that are allowed to pass validation for each
128	124	* upload.
129	125	* @return array|\WP_Error
130	126	*/
131		- public function handle_elementor_upload( array $data, $allowed_file_extensions = null ) {
	127	+ public function handle_elementor_upload( array $file, $allowed_file_extensions = null ) {
132	128	// If $file['fileData'] is set, it signals that the passed file is a Base64 string that needs to be decoded and
133	129	// saved to a temporary file.
134		- if ( isset( $data['fileData'] ) ) {
135		- $data = $this->save_base64_to_tmp_file( $data, $allowed_file_extensions );
	130	+ if ( isset( $file['fileData'] ) ) {
	131	+ $file = $this->save_base64_to_tmp_file( $file );
136	132	}
137	133
138		- if ( is_wp_error( $data ) ) {
139		- return $data;
140		- }
	134	+ $validation_result = $this->validate_file( $file, $allowed_file_extensions );
141	135
142		- if ( ! isset( $data['fileData'] ) ) {
143		- if ( empty( $data['tmp_name'] ) ) {
144		- return new \WP_Error( 'file_error', esc_html__( 'Invalid temporary file path.', 'elementor' ) );
145		- }
146		-
147		- // Path validation only applies to direct calls (e.g. import_template) where
148		- // tmp_name originates from user input. When is_elementor_upload is true, this
149		- // method is used as a WordPress filter (wp_handle_sideload_prefilter) and
150		- // tmp_name is set by WordPress core.
151		- if ( ! $this->is_elementor_upload && ! $this->is_path_in_allowed_dir( $data['tmp_name'] ) ) {
152		- return new \WP_Error( 'file_error', esc_html__( 'Invalid temporary file path.', 'elementor' ) );
153		- }
154		- }
155		-
156		- $validation_result = $this->validate_file( $data, $allowed_file_extensions );
157		-
158	136	if ( is_wp_error( $validation_result ) ) {
159		- if ( ! empty( $data['tmp_name'] ) ) {
160		- $this->remove_file_or_dir( dirname( $data['tmp_name'] ) );
161		- }
162		-
163	137	return $validation_result;
164	138	}
165	139
166		- return $data;
	140	+ return $file;
167	141	}
168	142
169	143	/**
170		- * Is Unfiltered Uploads Enabled
	144	+ * are Unfiltered Uploads Enabled
171	145	*
172	146	* @since 3.5.0
173	147	* @access public
174	148	*
		@@ -174,11 +148,9 @@
174	148	*
175	149	* @return bool
176	150	*/
177	151	final public static function are_unfiltered_uploads_enabled() {
178		- $enabled = (bool) get_option( self::UNFILTERED_FILE_UPLOADS_KEY )
179		- && Svg::file_sanitizer_can_run()
180		- && User::is_current_user_can_upload_json();
	152	+ $enabled = ! ! get_option( self::UNFILTERED_FILE_UPLOADS_KEY ) && Svg::file_sanitizer_can_run();
181	153
182	154	/**
183	155	* Allow Unfiltered Files Upload.
184	156	*
		@@ -272,58 +244,11 @@
272	244	return $data;
273	245	}
274	246
275	247	/**
276		- * Check if path is within the allowed Elementor uploads directory.
277		- *
278		- * Prevents path traversal and arbitrary directory deletion by ensuring the path
279		- * resolves under wp-content/uploads/elementor/ or under the configured temp dir
280		- * (elementor/files/temp-dir filter), so that cleanup works when temp dir is customized.
281		- *
282		- * @since 3.35.4
283		- * @access private
284		- *
285		- * @param string $path
286		- * @return bool
287		- */
288		- private function is_path_in_allowed_dir( $path ) {
289		- if ( ! is_string( $path ) || '' === $path ) {
290		- return false;
291		- }
292		-
293		- $real_path = realpath( $path );
294		-
295		- if ( false === $real_path ) {
296		- $real_path = realpath( dirname( $path ) );
297		- if ( false === $real_path ) {
298		- return false;
299		- }
300		- }
301		-
302		- $wp_upload_dir = wp_upload_dir();
303		- $elementor_base = realpath( $wp_upload_dir['basedir'] . DIRECTORY_SEPARATOR . self::ELEMENTOR_UPLOAD_DIR );
304		-
305		- if ( false !== $elementor_base ) {
306		- $allowed = $real_path === $elementor_base || 0 === strpos( $real_path, $elementor_base . DIRECTORY_SEPARATOR );
307		- if ( $allowed ) {
308		- return true;
309		- }
310		- }
311		-
312		- $temp_dir = realpath( $this->get_temp_dir() );
313		- if ( false !== $temp_dir ) {
314		- $temp_dir = rtrim( $temp_dir, DIRECTORY_SEPARATOR ) . DIRECTORY_SEPARATOR;
315		- return 0 === strpos( $real_path, $temp_dir );
316		- }
317		-
318		- return false;
319		- }
320		-
321		- /**
322	248	* Remove File Or Directory
323	249	*
324	250	* Directory is deleted recursively with all of its contents (subdirectories and files).
325		- * Only paths under wp-content/uploads/elementor/ are allowed (security: prevents arbitrary directory deletion).
326	251	*
327	252	* @since 3.3.0
328	253	* @access public
329	254	*
		@@ -329,15 +254,11 @@
329	254	*
330	255	* @param string $path
331	256	*/
332	257	public function remove_file_or_dir( $path ) {
333		- if ( ! $this->is_path_in_allowed_dir( $path ) ) {
334		- return;
335		- }
336		-
337	258	if ( is_dir( $path ) ) {
338	259	$this->remove_directory_with_files( $path );
339		- } elseif ( is_file( $path ) ) {
	260	+ } else {
340	261	unlink( $path );
341	262	}
342	263	}
343	264
		@@ -353,14 +274,8 @@
353	274	* @param string $file_name
354	275	* @return string|\WP_Error
355	276	*/
356	277	public function create_temp_file( $file_content, $file_name ) {
357		- $file_name = str_replace( ' ', '', sanitize_file_name( $file_name ) );
358		-
359		- if ( empty( $file_name ) ) {
360		- return new \WP_Error( 'invalid_file_name', esc_html__( 'Invalid file name.', 'elementor' ) );
361		- }
362		-
363	278	$temp_filename = $this->create_unique_dir() . $file_name;
364	279
365	280	/**
366	281	* Temp File Path
		@@ -391,9 +306,9 @@
391	306	public function get_temp_dir() {
392	307	if ( ! $this->temp_dir ) {
393	308	$wp_upload_dir = wp_upload_dir();
394	309
395		- $temp_dir = implode( DIRECTORY_SEPARATOR, [ $wp_upload_dir['basedir'], self::ELEMENTOR_UPLOAD_DIR, 'tmp' ] ) . DIRECTORY_SEPARATOR;
	310	+ $temp_dir = implode( DIRECTORY_SEPARATOR, [ $wp_upload_dir['basedir'], 'elementor', 'tmp' ] ) . DIRECTORY_SEPARATOR;
396	311
397	312	/**
398	313	* Temp File Path
399	314	*
		@@ -443,9 +358,8 @@
443	358	* @param Ajax $ajax
444	359	*/
445	360	public function register_ajax_actions( Ajax $ajax ) {
446	361	$ajax->register_ajax_action( 'enable_unfiltered_files_upload', [ $this, 'enable_unfiltered_files_upload' ] );
447		- $ajax->register_ajax_action( 'enqueue_google_fonts', [ $this, 'ajax_enqueue_google_fonts' ] );
448	362	}
449	363
450	364	/**
451	365	* Set Unfiltered Files Upload
		@@ -460,24 +374,8 @@
460	374
461	375	update_option( self::UNFILTERED_FILE_UPLOADS_KEY, 1 );
462	376	}
463	377
464		- public function ajax_enqueue_google_fonts( $data ): bool {
465		- if ( empty( $data['font_name'] ) ) {
466		- return false;
467		- }
468		-
469		- $font_type = Fonts::get_font_type( $data['font_name'] );
470		-
471		- if ( Fonts::GOOGLE !== $font_type ) {
472		- return false;
473		- }
474		-
475		- Google_Font::enqueue( $data['font_name'] );
476		-
477		- return true;
478		- }
479		-
480	378	/**
481	379	* Support Unfiltered File Uploads
482	380	*
483	381	* When uploading a file within Elementor, this method adds the registered
		@@ -584,24 +482,11 @@
584	482	* @since 3.3.0
585	483	* @access private
586	484	*
587	485	* @param $file
588		- * @param array|null $allowed_file_extensions
589		- *
590	486	* @return array|\WP_Error
591	487	*/
592		- private function save_base64_to_tmp_file( $file, $allowed_file_extensions = null ) {
593		- if ( empty( $file['fileName'] ) || empty( $file['fileData'] ) ) {
594		- return new \WP_Error( 'file_error', self::INVALID_FILE_CONTENT );
595		- }
596		-
597		- $file_extension = pathinfo( $file['fileName'], PATHINFO_EXTENSION );
598		- $is_file_type_allowed = $this->is_file_type_allowed( $file_extension, $allowed_file_extensions );
599		-
600		- if ( is_wp_error( $is_file_type_allowed ) ) {
601		- return $is_file_type_allowed;
602		- }
603		-
	488	+ private function save_base64_to_tmp_file( $file ) {
604	489	$file_content = base64_decode( $file['fileData'] ); // phpcs:ignore
605	490
606	491	// If the decode fails
607	492	if ( ! $file_content ) {
		@@ -654,12 +539,9 @@
654	539
655	540	// If there is a File Type Handler for the uploaded file, it means it is a non-standard file type. In this case,
656	541	// we check if unfiltered file uploads are enabled or not before allowing it.
657	542	if ( ! self::are_unfiltered_uploads_enabled() ) {
658		- $error = 'json' === $file_extension
659		- ? esc_html__( 'You do not have permission to upload JSON files.', 'elementor' )
660		- : esc_html__( 'This file is not allowed for security reasons.', 'elementor' );
661		- return new \WP_Error( Exceptions::FORBIDDEN, $error );
	543	+ return new \WP_Error( Exceptions::FORBIDDEN, esc_html__( 'This file is not allowed for security reasons.', 'elementor' ) );
662	544	}
663	545
664	546	// Here is each file type handler's chance to run its own specific validations
665	547	return $file_type_handler->validate_file( $file );
		@@ -727,9 +609,9 @@
727	609
728	610	foreach ( new \RecursiveIteratorIterator( $dir_iterator, \RecursiveIteratorIterator::CHILD_FIRST ) as $name => $item ) {
729	611	if ( is_dir( $name ) ) {
730	612	rmdir( $name );
731		- } elseif ( is_file( $name ) ) {
	613	+ } else {
732	614	unlink( $name );
733	615	}
734	616	}
735	617