| @@ -1,17 +1,12 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | namespace Elementor\Core\Files; |
| 3 | 3 | |
| 4 | 4 | use Elementor\Core\Base\Base_Object; |
| 5 | -use Elementor\Core\Common\Modules\Ajax\Module as Ajax; | |
| 6 | 5 | use Elementor\Core\Files\File_Types\Base as File_Type_Base; |
| 7 | 6 | use Elementor\Core\Files\File_Types\Json; |
| 8 | -use Elementor\Core\Files\File_Types\Svg; | |
| 9 | 7 | use Elementor\Core\Files\File_Types\Zip; |
| 10 | -use Elementor\Core\Files\Fonts\Google_Font; | |
| 11 | 8 | use Elementor\Core\Utils\Exceptions; |
| 12 | -use Elementor\Fonts; | |
| 13 | -use Elementor\User; | |
| 14 | 9 | |
| 15 | 10 | if ( ! defined( 'ABSPATH' ) ) { |
| 16 | 11 | exit; // Exit if accessed directly. |
| 17 | 12 | } |
| @@ -26,9 +21,8 @@ | ||
| 26 | 21 | class Uploads_Manager extends Base_Object { |
| 27 | 22 | |
| 28 | 23 | const UNFILTERED_FILE_UPLOADS_KEY = 'elementor_unfiltered_files_upload'; |
| 29 | 24 | const INVALID_FILE_CONTENT = 'Invalid Content In File'; |
| 30 | - const ELEMENTOR_UPLOAD_DIR = 'elementor'; | |
| 31 | 25 | |
| 32 | 26 | /** |
| 33 | 27 | * @var File_Type_Base[] |
| 34 | 28 | */ |
| @@ -35,12 +29,9 @@ | ||
| 35 | 29 | private $file_type_handlers = []; |
| 36 | 30 | |
| 37 | 31 | private $allowed_file_extensions; |
| 38 | 32 | |
| 39 | - /** | |
| 40 | - * @var bool | |
| 41 | - */ | |
| 42 | - private $is_elementor_upload = false; | |
| 33 | + private $are_unfiltered_files_enabled; | |
| 43 | 34 | |
| 44 | 35 | /** |
| 45 | 36 | * @var string |
| 46 | 37 | */ |
| @@ -51,9 +42,8 @@ | ||
| 51 | 42 | * |
| 52 | 43 | * To Add a new file type to Elementor, with its own handling logic, you need to add it to the $file_types array here. |
| 53 | 44 | * |
| 54 | 45 | * @since 3.3.0 |
| 55 | - * @access public | |
| 56 | 46 | */ |
| 57 | 47 | public function register_file_types() { |
| 58 | 48 | // All file types that have handlers should be included here. |
| 59 | 49 | $file_types = [ |
| @@ -58,9 +48,8 @@ | ||
| 58 | 48 | // All file types that have handlers should be included here. |
| 59 | 49 | $file_types = [ |
| 60 | 50 | 'json' => new Json(), |
| 61 | 51 | 'zip' => new Zip(), |
| 62 | - 'svg' => new Svg(), | |
| 63 | 52 | ]; |
| 64 | 53 | |
| 65 | 54 | foreach ( $file_types as $file_type => $file_handler ) { |
| 66 | 55 | $this->file_type_handlers[ $file_type ] = $file_handler; |
| @@ -71,13 +60,10 @@ | ||
| 71 | 60 | * Extract and Validate Zip |
| 72 | 61 | * |
| 73 | 62 | * This method accepts a $file array (which minimally should include a 'tmp_name') |
| 74 | 63 | * |
| 75 | - * @since 3.3.0 | |
| 76 | - * @access public | |
| 77 | - * | |
| 78 | 64 | * @param string $file_path |
| 79 | - * @param array $allowed_file_types | |
| 65 | + * @param array $allowed_file_types | |
| 80 | 66 | * @return array|\WP_Error |
| 81 | 67 | */ |
| 82 | 68 | public function extract_and_validate_zip( $file_path, $allowed_file_types = null ) { |
| 83 | 69 | $result = []; |
| @@ -87,12 +73,8 @@ | ||
| 87 | 73 | |
| 88 | 74 | // Returns an array of file paths. |
| 89 | 75 | $extracted = $zip_handler->extract( $file_path, $allowed_file_types ); |
| 90 | 76 | |
| 91 | - if ( is_wp_error( $extracted ) ) { | |
| 92 | - return $extracted; | |
| 93 | - } | |
| 94 | - | |
| 95 | 77 | // If there are no extracted file names, no files passed the extraction validation. |
| 96 | 78 | if ( empty( $extracted['files'] ) ) { |
| 97 | 79 | // TODO: Decide what to do if no files passed the extraction validation |
| 98 | 80 | return new \WP_Error( 'file_error', self::INVALID_FILE_CONTENT ); |
| @@ -101,9 +83,9 @@ | ||
| 101 | 83 | $result['extraction_directory'] = $extracted['extraction_directory']; |
| 102 | 84 | |
| 103 | 85 | foreach ( $extracted['files'] as $extracted_file_path ) { |
| 104 | 86 | // Each file is an array with a 'name' (file path) property. |
| 105 | - if ( ! is_wp_error( $this->validate_file( [ 'tmp_name' => $extracted_file_path ] ) ) ) { | |
| 87 | + if ( ! is_wp_error( $this->validate_file( $extracted_file_path ) ) ) { | |
| 106 | 88 | $result['files'][] = $extracted_file_path; |
| 107 | 89 | } |
| 108 | 90 | } |
| 109 | 91 | |
| @@ -119,89 +101,32 @@ | ||
| 119 | 101 | * validation. |
| 120 | 102 | * |
| 121 | 103 | * The file goes through validation; if it passes validation, the file is returned. Otherwise, an error is returned. |
| 122 | 104 | * |
| 123 | - * @since 3.3.0 | |
| 124 | - * @access public | |
| 125 | - * | |
| 126 | - * @param array $data | |
| 105 | + * @param array $file | |
| 127 | 106 | * @param array $allowed_file_extensions Optional. an array of file types that are allowed to pass validation for each |
| 128 | 107 | * upload. |
| 129 | 108 | * @return array|\WP_Error |
| 130 | 109 | */ |
| 131 | - public function handle_elementor_upload( array $data, $allowed_file_extensions = null ) { | |
| 110 | + public function handle_elementor_upload( array $file, $allowed_file_extensions = null ) { | |
| 132 | 111 | // If $file['fileData'] is set, it signals that the passed file is a Base64 string that needs to be decoded and |
| 133 | 112 | // saved to a temporary file. |
| 134 | - if ( isset( $data['fileData'] ) ) { | |
| 135 | - $data = $this->save_base64_to_tmp_file( $data, $allowed_file_extensions ); | |
| 113 | + if ( isset( $file['fileData'] ) ) { | |
| 114 | + $file = $this->save_base64_to_tmp_file( $file ); | |
| 136 | 115 | } |
| 137 | 116 | |
| 138 | - if ( is_wp_error( $data ) ) { | |
| 139 | - return $data; | |
| 140 | - } | |
| 117 | + $validation_result = $this->validate_file( $file['tmp_name'], $allowed_file_extensions ); | |
| 141 | 118 | |
| 142 | - if ( ! isset( $data['fileData'] ) ) { | |
| 143 | - if ( empty( $data['tmp_name'] ) ) { | |
| 144 | - return new \WP_Error( 'file_error', esc_html__( 'Invalid temporary file path.', 'elementor' ) ); | |
| 145 | - } | |
| 146 | - | |
| 147 | - // Path validation only applies to direct calls (e.g. import_template) where | |
| 148 | - // tmp_name originates from user input. When is_elementor_upload is true, this | |
| 149 | - // method is used as a WordPress filter (wp_handle_sideload_prefilter) and | |
| 150 | - // tmp_name is set by WordPress core. | |
| 151 | - if ( ! $this->is_elementor_upload && ! $this->is_path_in_allowed_dir( $data['tmp_name'] ) ) { | |
| 152 | - return new \WP_Error( 'file_error', esc_html__( 'Invalid temporary file path.', 'elementor' ) ); | |
| 153 | - } | |
| 154 | - } | |
| 155 | - | |
| 156 | - $validation_result = $this->validate_file( $data, $allowed_file_extensions ); | |
| 157 | - | |
| 158 | 119 | if ( is_wp_error( $validation_result ) ) { |
| 159 | - if ( ! empty( $data['tmp_name'] ) ) { | |
| 160 | - $this->remove_file_or_dir( dirname( $data['tmp_name'] ) ); | |
| 161 | - } | |
| 162 | - | |
| 163 | 120 | return $validation_result; |
| 164 | 121 | } |
| 165 | 122 | |
| 166 | - return $data; | |
| 123 | + return $file; | |
| 167 | 124 | } |
| 168 | 125 | |
| 169 | 126 | /** |
| 170 | - * Is Unfiltered Uploads Enabled | |
| 171 | - * | |
| 172 | - * @since 3.5.0 | |
| 173 | - * @access public | |
| 174 | - * | |
| 175 | - * @return bool | |
| 176 | - */ | |
| 177 | - final public static function are_unfiltered_uploads_enabled() { | |
| 178 | - $enabled = (bool) get_option( self::UNFILTERED_FILE_UPLOADS_KEY ) | |
| 179 | - && Svg::file_sanitizer_can_run() | |
| 180 | - && User::is_current_user_can_upload_json(); | |
| 181 | - | |
| 182 | - /** | |
| 183 | - * Allow Unfiltered Files Upload. | |
| 184 | - * | |
| 185 | - * Determines whether to enable unfiltered file uploads. | |
| 186 | - * | |
| 187 | - * @since 3.0.0 | |
| 188 | - * | |
| 189 | - * @param bool $enabled Whether upload is enabled or not. | |
| 190 | - */ | |
| 191 | - $enabled = apply_filters( 'elementor/files/allow_unfiltered_upload', $enabled ); | |
| 192 | - | |
| 193 | - return $enabled; | |
| 194 | - } | |
| 195 | - | |
| 196 | - /** | |
| 197 | - * Handle Elementor WP Media Upload | |
| 198 | - * | |
| 199 | 127 | * Runs on the 'wp_handle_upload_prefilter' filter. |
| 200 | 128 | * |
| 201 | - * @since 3.2.0 | |
| 202 | - * @access public | |
| 203 | - * | |
| 204 | 129 | * @param $file |
| 205 | 130 | * @return mixed |
| 206 | 131 | */ |
| 207 | 132 | public function handle_elementor_wp_media_upload( $file ) { |
| @@ -209,9 +134,9 @@ | ||
| 209 | 134 | if ( ! $this->is_elementor_wp_media_upload() ) { |
| 210 | 135 | return $file; |
| 211 | 136 | } |
| 212 | 137 | |
| 213 | - $result = $this->validate_file( $file ); | |
| 138 | + $result = $this->validate_file( $file['tmp_name'] ); | |
| 214 | 139 | |
| 215 | 140 | if ( is_wp_error( $result ) ) { |
| 216 | 141 | $file['error'] = $result->get_error_message(); |
| 217 | 142 | } |
| @@ -225,9 +150,8 @@ | ||
| 225 | 150 | * Initialize the proper file type handler according to the file extension |
| 226 | 151 | * and assign it to the file type handlers array. |
| 227 | 152 | * |
| 228 | 153 | * @since 3.3.0 |
| 229 | - * @access public | |
| 230 | 154 | * |
| 231 | 155 | * @param string|null $file_extension - file extension |
| 232 | 156 | * @return File_Type_Base[]|File_Type_Base |
| 233 | 157 | */ |
| @@ -235,120 +159,13 @@ | ||
| 235 | 159 | return self::get_items( $this->file_type_handlers, $file_extension ); |
| 236 | 160 | } |
| 237 | 161 | |
| 238 | 162 | /** |
| 239 | - * Check filetype and ext | |
| 240 | - * | |
| 241 | - * A workaround for upload validation which relies on a PHP extension (fileinfo) | |
| 242 | - * with inconsistent reporting behaviour. | |
| 243 | - * ref: https://core.trac.wordpress.org/ticket/39550 | |
| 244 | - * ref: https://core.trac.wordpress.org/ticket/40175 | |
| 245 | - * | |
| 246 | - * @since 3.5.0 | |
| 247 | - * @access public | |
| 248 | - * | |
| 249 | - * @param $data | |
| 250 | - * @param $file | |
| 251 | - * @param $filename | |
| 252 | - * @param $mimes | |
| 253 | - * | |
| 254 | - * @return mixed | |
| 255 | - */ | |
| 256 | - public function check_filetype_and_ext( $data, $file, $filename, $mimes ) { | |
| 257 | - if ( ! empty( $data['ext'] ) && ! empty( $data['type'] ) ) { | |
| 258 | - return $data; | |
| 259 | - } | |
| 260 | - | |
| 261 | - $wp_file_type = wp_check_filetype( $filename, $mimes ); | |
| 262 | - | |
| 263 | - $file_type_handlers = $this->get_file_type_handlers(); | |
| 264 | - | |
| 265 | - if ( isset( $file_type_handlers[ $wp_file_type['ext'] ] ) ) { | |
| 266 | - $file_type_handler = $file_type_handlers[ $wp_file_type['ext'] ]; | |
| 267 | - | |
| 268 | - $data['ext'] = $file_type_handler->get_file_extension(); | |
| 269 | - $data['type'] = $file_type_handler->get_mime_type(); | |
| 270 | - } | |
| 271 | - | |
| 272 | - return $data; | |
| 273 | - } | |
| 274 | - | |
| 275 | - /** | |
| 276 | - * Check if path is within the allowed Elementor uploads directory. | |
| 277 | - * | |
| 278 | - * Prevents path traversal and arbitrary directory deletion by ensuring the path | |
| 279 | - * resolves under wp-content/uploads/elementor/ or under the configured temp dir | |
| 280 | - * (elementor/files/temp-dir filter), so that cleanup works when temp dir is customized. | |
| 281 | - * | |
| 282 | - * @since 3.35.4 | |
| 283 | - * @access private | |
| 284 | - * | |
| 285 | - * @param string $path | |
| 286 | - * @return bool | |
| 287 | - */ | |
| 288 | - private function is_path_in_allowed_dir( $path ) { | |
| 289 | - if ( ! is_string( $path ) || '' === $path ) { | |
| 290 | - return false; | |
| 291 | - } | |
| 292 | - | |
| 293 | - $real_path = realpath( $path ); | |
| 294 | - | |
| 295 | - if ( false === $real_path ) { | |
| 296 | - $real_path = realpath( dirname( $path ) ); | |
| 297 | - if ( false === $real_path ) { | |
| 298 | - return false; | |
| 299 | - } | |
| 300 | - } | |
| 301 | - | |
| 302 | - $wp_upload_dir = wp_upload_dir(); | |
| 303 | - $elementor_base = realpath( $wp_upload_dir['basedir'] . DIRECTORY_SEPARATOR . self::ELEMENTOR_UPLOAD_DIR ); | |
| 304 | - | |
| 305 | - if ( false !== $elementor_base ) { | |
| 306 | - $allowed = $real_path === $elementor_base || 0 === strpos( $real_path, $elementor_base . DIRECTORY_SEPARATOR ); | |
| 307 | - if ( $allowed ) { | |
| 308 | - return true; | |
| 309 | - } | |
| 310 | - } | |
| 311 | - | |
| 312 | - $temp_dir = realpath( $this->get_temp_dir() ); | |
| 313 | - if ( false !== $temp_dir ) { | |
| 314 | - $temp_dir = rtrim( $temp_dir, DIRECTORY_SEPARATOR ) . DIRECTORY_SEPARATOR; | |
| 315 | - return 0 === strpos( $real_path, $temp_dir ); | |
| 316 | - } | |
| 317 | - | |
| 318 | - return false; | |
| 319 | - } | |
| 320 | - | |
| 321 | - /** | |
| 322 | - * Remove File Or Directory | |
| 323 | - * | |
| 324 | - * Directory is deleted recursively with all of its contents (subdirectories and files). | |
| 325 | - * Only paths under wp-content/uploads/elementor/ are allowed (security: prevents arbitrary directory deletion). | |
| 326 | - * | |
| 327 | - * @since 3.3.0 | |
| 328 | - * @access public | |
| 329 | - * | |
| 330 | - * @param string $path | |
| 331 | - */ | |
| 332 | - public function remove_file_or_dir( $path ) { | |
| 333 | - if ( ! $this->is_path_in_allowed_dir( $path ) ) { | |
| 334 | - return; | |
| 335 | - } | |
| 336 | - | |
| 337 | - if ( is_dir( $path ) ) { | |
| 338 | - $this->remove_directory_with_files( $path ); | |
| 339 | - } elseif ( is_file( $path ) ) { | |
| 340 | - unlink( $path ); | |
| 341 | - } | |
| 342 | - } | |
| 343 | - | |
| 344 | - /** | |
| 345 | 163 | * Create Temp File |
| 346 | 164 | * |
| 347 | 165 | * Create a random temporary file. |
| 348 | 166 | * |
| 349 | 167 | * @since 3.3.0 |
| 350 | - * @access public | |
| 351 | 168 | * |
| 352 | 169 | * @param string $file_content |
| 353 | 170 | * @param string $file_name |
| 354 | 171 | * @return string|\WP_Error |
| @@ -353,27 +170,10 @@ | ||
| 353 | 170 | * @param string $file_name |
| 354 | 171 | * @return string|\WP_Error |
| 355 | 172 | */ |
| 356 | 173 | public function create_temp_file( $file_content, $file_name ) { |
| 357 | - $file_name = str_replace( ' ', '', sanitize_file_name( $file_name ) ); | |
| 358 | - | |
| 359 | - if ( empty( $file_name ) ) { | |
| 360 | - return new \WP_Error( 'invalid_file_name', esc_html__( 'Invalid file name.', 'elementor' ) ); | |
| 361 | - } | |
| 362 | - | |
| 363 | 174 | $temp_filename = $this->create_unique_dir() . $file_name; |
| 364 | 175 | |
| 365 | - /** | |
| 366 | - * Temp File Path | |
| 367 | - * | |
| 368 | - * Allows modifying the full path of the temporary file. | |
| 369 | - * | |
| 370 | - * @since 3.7.0 | |
| 371 | - * | |
| 372 | - * @param string full path to file | |
| 373 | - */ | |
| 374 | - $temp_filename = apply_filters( 'elementor/files/temp-file-path', $temp_filename ); | |
| 375 | - | |
| 376 | 176 | file_put_contents( $temp_filename, $file_content ); // phpcs:ignore |
| 377 | 177 | |
| 378 | 178 | return $temp_filename; |
| 379 | 179 | } |
| @@ -383,9 +183,8 @@ | ||
| 383 | 183 | * |
| 384 | 184 | * Get the temporary files directory path. If the directory does not exist, this method creates it. |
| 385 | 185 | * |
| 386 | 186 | * @since 3.3.0 |
| 387 | - * @access public | |
| 388 | 187 | * |
| 389 | 188 | * @return string $temp_dir |
| 390 | 189 | */ |
| 391 | 190 | public function get_temp_dir() { |
| @@ -391,21 +190,10 @@ | ||
| 391 | 190 | public function get_temp_dir() { |
| 392 | 191 | if ( ! $this->temp_dir ) { |
| 393 | 192 | $wp_upload_dir = wp_upload_dir(); |
| 394 | 193 | |
| 395 | - $temp_dir = implode( DIRECTORY_SEPARATOR, [ $wp_upload_dir['basedir'], self::ELEMENTOR_UPLOAD_DIR, 'tmp' ] ) . DIRECTORY_SEPARATOR; | |
| 194 | + $this->temp_dir = implode( DIRECTORY_SEPARATOR, [ $wp_upload_dir['basedir'], 'elementor', 'tmp' ] ) . DIRECTORY_SEPARATOR; | |
| 396 | 195 | |
| 397 | - /** | |
| 398 | - * Temp File Path | |
| 399 | - * | |
| 400 | - * Allows modifying the full path of the temporary file. | |
| 401 | - * | |
| 402 | - * @since 3.7.0 | |
| 403 | - * | |
| 404 | - * @param string temporary directory | |
| 405 | - */ | |
| 406 | - $this->temp_dir = apply_filters( 'elementor/files/temp-dir', $temp_dir ); | |
| 407 | - | |
| 408 | 196 | if ( ! is_dir( $this->temp_dir ) ) { |
| 409 | 197 | wp_mkdir_p( $this->temp_dir ); |
| 410 | 198 | } |
| 411 | 199 | } |
| @@ -418,9 +206,8 @@ | ||
| 418 | 206 | * |
| 419 | 207 | * Create a unique temporary directory |
| 420 | 208 | * |
| 421 | 209 | * @since 3.3.0 |
| 422 | - * @access public | |
| 423 | 210 | * |
| 424 | 211 | * @return string the new directory path |
| 425 | 212 | */ |
| 426 | 213 | public function create_unique_dir() { |
| @@ -431,138 +218,28 @@ | ||
| 431 | 218 | return $unique_dir_path; |
| 432 | 219 | } |
| 433 | 220 | |
| 434 | 221 | /** |
| 435 | - * Register Ajax Actions | |
| 222 | + * Are Unfiltered Uploads Enabled | |
| 436 | 223 | * |
| 437 | - * Runs on the 'elementor/ajax/register_actions' hook. Receives the AJAX module as a parameter and registers | |
| 438 | - * callbacks for specified action IDs. | |
| 224 | + * Checks if the user allowed uploading unfiltered files. | |
| 439 | 225 | * |
| 440 | - * @since 3.5.0 | |
| 441 | - * @access public | |
| 226 | + * @since 3.3.0 | |
| 442 | 227 | * |
| 443 | - * @param Ajax $ajax | |
| 228 | + * @return bool | |
| 444 | 229 | */ |
| 445 | - public function register_ajax_actions( Ajax $ajax ) { | |
| 446 | - $ajax->register_ajax_action( 'enable_unfiltered_files_upload', [ $this, 'enable_unfiltered_files_upload' ] ); | |
| 447 | - $ajax->register_ajax_action( 'enqueue_google_fonts', [ $this, 'ajax_enqueue_google_fonts' ] ); | |
| 448 | - } | |
| 449 | - | |
| 450 | - /** | |
| 451 | - * Set Unfiltered Files Upload | |
| 452 | - * | |
| 453 | - * @since 3.5.0 | |
| 454 | - * @access public | |
| 455 | - */ | |
| 456 | - public function enable_unfiltered_files_upload() { | |
| 457 | - if ( ! current_user_can( 'manage_options' ) ) { | |
| 458 | - return; | |
| 230 | + private function are_unfiltered_uploads_enabled() { | |
| 231 | + if ( ! $this->are_unfiltered_files_enabled ) { | |
| 232 | + $this->are_unfiltered_files_enabled = ! ! get_option( self::UNFILTERED_FILE_UPLOADS_KEY ); | |
| 459 | 233 | } |
| 460 | 234 | |
| 461 | - update_option( self::UNFILTERED_FILE_UPLOADS_KEY, 1 ); | |
| 235 | + return $this->are_unfiltered_files_enabled; | |
| 462 | 236 | } |
| 463 | 237 | |
| 464 | - public function ajax_enqueue_google_fonts( $data ): bool { | |
| 465 | - if ( empty( $data['font_name'] ) ) { | |
| 466 | - return false; | |
| 467 | - } | |
| 468 | - | |
| 469 | - $font_type = Fonts::get_font_type( $data['font_name'] ); | |
| 470 | - | |
| 471 | - if ( Fonts::GOOGLE !== $font_type ) { | |
| 472 | - return false; | |
| 473 | - } | |
| 474 | - | |
| 475 | - Google_Font::enqueue( $data['font_name'] ); | |
| 476 | - | |
| 477 | - return true; | |
| 478 | - } | |
| 479 | - | |
| 480 | 238 | /** |
| 481 | - * Support Unfiltered File Uploads | |
| 482 | - * | |
| 483 | - * When uploading a file within Elementor, this method adds the registered | |
| 484 | - * file types to WordPress' allowed mimes list. This will only happen if the user allowed unfiltered file uploads | |
| 485 | - * in Elementor's settings in the admin dashboard. | |
| 486 | - * | |
| 487 | - * @since 3.5.0 | |
| 488 | - * @access public | |
| 489 | - * | |
| 490 | - * @param array $allowed_mimes | |
| 491 | - * @return array allowed mime types | |
| 492 | - */ | |
| 493 | - final public function support_unfiltered_elementor_file_uploads( $allowed_mimes ) { | |
| 494 | - if ( $this->is_elementor_upload() && $this->are_unfiltered_uploads_enabled() ) { | |
| 495 | - foreach ( $this->file_type_handlers as $file_type_handler ) { | |
| 496 | - $allowed_mimes[ $file_type_handler->get_file_extension() ] = $file_type_handler->get_mime_type(); | |
| 497 | - } | |
| 498 | - } | |
| 499 | - | |
| 500 | - return $allowed_mimes; | |
| 501 | - } | |
| 502 | - | |
| 503 | - /** | |
| 504 | - * Set Elementor Upload State | |
| 505 | - * | |
| 506 | - * @since 3.5.0 | |
| 507 | - * @access public | |
| 508 | - * | |
| 509 | - * @param $state | |
| 510 | - */ | |
| 511 | - public function set_elementor_upload_state( $state ) { | |
| 512 | - $this->is_elementor_upload = $state; | |
| 513 | - } | |
| 514 | - | |
| 515 | - /** | |
| 516 | - * Is Elementor Upload | |
| 517 | - * | |
| 518 | - * This method checks if the current session includes a request to upload files made via Elementor. | |
| 519 | - * | |
| 520 | - * @since 3.5.0 | |
| 521 | - * @access private | |
| 522 | - * | |
| 523 | - * @return bool | |
| 524 | - */ | |
| 525 | - private function is_elementor_upload() { | |
| 526 | - return $this->is_elementor_upload || $this->is_elementor_media_upload() || $this->is_elementor_wp_media_upload(); | |
| 527 | - } | |
| 528 | - | |
| 529 | - /** | |
| 530 | - * Is Elementor Media Upload | |
| 531 | - * | |
| 532 | - * Checks whether the current request includes uploading files via Elementor which are not destined for the Media | |
| 533 | - * Library. | |
| 534 | - * | |
| 535 | - * @since 3.5.0 | |
| 536 | - * @access public | |
| 537 | - * | |
| 538 | - * @return bool | |
| 539 | - */ | |
| 540 | - public function is_elementor_media_upload() { | |
| 541 | - // Sometimes `uploadTypeCaller` passed as a GET parameter when using the WP Media Library REST API, where the | |
| 542 | - // whole request body is occupied by the uploaded file. | |
| 543 | - return isset( $_REQUEST['uploadTypeCaller'] ) && 'elementor-media-upload' === $_REQUEST['uploadTypeCaller']; // phpcs:ignore | |
| 544 | - } | |
| 545 | - | |
| 546 | - /** | |
| 547 | - * Is Elementor WP Media Upload | |
| 548 | - * | |
| 549 | - * Checks whether the current request is a request to upload files into the WP Media Library via Elementor. | |
| 550 | - * | |
| 551 | - * @since 3.3.0 | |
| 552 | - * @access private | |
| 553 | - * | |
| 554 | - * @return bool | |
| 555 | - */ | |
| 556 | - private function is_elementor_wp_media_upload() { | |
| 557 | - return isset( $_REQUEST['uploadTypeCaller'] ) && 'elementor-wp-media-upload' === $_REQUEST['uploadTypeCaller']; // phpcs:ignore | |
| 558 | - } | |
| 559 | - | |
| 560 | - /** | |
| 561 | 239 | * Add File Extension To Allowed Extensions List |
| 562 | 240 | * |
| 563 | 241 | * @since 3.3.0 |
| 564 | - * @access private | |
| 565 | 242 | * |
| 566 | 243 | * @param string $file_type |
| 567 | 244 | */ |
| 568 | 245 | private function add_file_extension_to_allowed_extensions_list( $file_type ) { |
| @@ -581,27 +258,13 @@ | ||
| 581 | 258 | * |
| 582 | 259 | * Saves a Base64 string as a .tmp file in Elementor's temporary files directory. |
| 583 | 260 | * |
| 584 | 261 | * @since 3.3.0 |
| 585 | - * @access private | |
| 586 | 262 | * |
| 587 | 263 | * @param $file |
| 588 | - * @param array|null $allowed_file_extensions | |
| 589 | - * | |
| 590 | 264 | * @return array|\WP_Error |
| 591 | 265 | */ |
| 592 | - private function save_base64_to_tmp_file( $file, $allowed_file_extensions = null ) { | |
| 593 | - if ( empty( $file['fileName'] ) || empty( $file['fileData'] ) ) { | |
| 594 | - return new \WP_Error( 'file_error', self::INVALID_FILE_CONTENT ); | |
| 595 | - } | |
| 596 | - | |
| 597 | - $file_extension = pathinfo( $file['fileName'], PATHINFO_EXTENSION ); | |
| 598 | - $is_file_type_allowed = $this->is_file_type_allowed( $file_extension, $allowed_file_extensions ); | |
| 599 | - | |
| 600 | - if ( is_wp_error( $is_file_type_allowed ) ) { | |
| 601 | - return $is_file_type_allowed; | |
| 602 | - } | |
| 603 | - | |
| 266 | + private function save_base64_to_tmp_file( $file ) { | |
| 604 | 267 | $file_content = base64_decode( $file['fileData'] ); // phpcs:ignore |
| 605 | 268 | |
| 606 | 269 | // If the decode fails |
| 607 | 270 | if ( ! $file_content ) { |
| @@ -613,37 +276,53 @@ | ||
| 613 | 276 | if ( is_wp_error( $temp_filename ) ) { |
| 614 | 277 | return $temp_filename; |
| 615 | 278 | } |
| 616 | 279 | |
| 617 | - return [ | |
| 280 | + $new_file_array = [ | |
| 618 | 281 | // the original uploaded file name |
| 619 | 282 | 'name' => $file['fileName'], |
| 620 | 283 | // The path to the temporary file |
| 621 | 284 | 'tmp_name' => $temp_filename, |
| 622 | 285 | ]; |
| 286 | + | |
| 287 | + return $new_file_array; | |
| 623 | 288 | } |
| 624 | 289 | |
| 625 | 290 | /** |
| 291 | + * is_elementor_wp_media_upload | |
| 292 | + * | |
| 293 | + * @since 3.3.0 | |
| 294 | + * | |
| 295 | + * @return bool | |
| 296 | + */ | |
| 297 | + private function is_elementor_wp_media_upload() { | |
| 298 | + return isset( $_POST['elementor_wp_media_upload'] ); // phpcs:ignore | |
| 299 | + } | |
| 300 | + | |
| 301 | + /** | |
| 626 | 302 | * Validate File |
| 627 | 303 | * |
| 628 | 304 | * @since 3.3.0 |
| 629 | - * @access private | |
| 630 | 305 | * |
| 631 | - * @param array $file | |
| 306 | + * @param string $file_path | |
| 632 | 307 | * @param array $file_extensions Optional |
| 633 | 308 | * @return bool|\WP_Error |
| 309 | + * | |
| 634 | 310 | */ |
| 635 | - private function validate_file( array $file, $file_extensions = [] ) { | |
| 636 | - $uploaded_file_name = isset( $file['name'] ) ? $file['name'] : $file['tmp_name']; | |
| 311 | + private function validate_file( $file_path, $file_extensions = [] ) { | |
| 312 | + $file_extension = pathinfo( $file_path, PATHINFO_EXTENSION ); | |
| 637 | 313 | |
| 638 | - $file_extension = pathinfo( $uploaded_file_name, PATHINFO_EXTENSION ); | |
| 314 | + $allowed_file_extensions = $this->get_allowed_file_extensions(); | |
| 639 | 315 | |
| 640 | - if ( ! $this->is_elementor_wp_media_upload() ) { | |
| 641 | - $is_file_type_allowed = $this->is_file_type_allowed( $file_extension, $file_extensions ); | |
| 316 | + if ( $file_extensions ) { | |
| 317 | + $allowed_file_extensions = array_intersect( $allowed_file_extensions, $file_extensions ); | |
| 318 | + } | |
| 642 | 319 | |
| 643 | - if ( is_wp_error( $is_file_type_allowed ) ) { | |
| 644 | - return $is_file_type_allowed; | |
| 645 | - } | |
| 320 | + // Check if the file type (extension) is in the allowed extensions list. If it is a non-standard file type (not | |
| 321 | + // enabled by default in WordPress) and unfiltered file uploads are not enabled, it will not be in the allowed | |
| 322 | + // file extensions list. | |
| 323 | + if ( ! in_array( $file_extension, $allowed_file_extensions, true ) ) { | |
| 324 | + return new \WP_Error( Exceptions::FORBIDDEN, 'Uploading this file type is not allowed.' ); | |
| 646 | 325 | } |
| 647 | 326 | |
| 648 | 327 | $file_type_handler = $this->get_file_type_handlers( $file_extension ); |
| 649 | 328 | |
| @@ -651,67 +330,27 @@ | ||
| 651 | 330 | if ( ! $file_type_handler ) { |
| 652 | 331 | return true; |
| 653 | 332 | } |
| 654 | 333 | |
| 655 | - // If there is a File Type Handler for the uploaded file, it means it is a non-standard file type. In this case, | |
| 656 | - // we check if unfiltered file uploads are enabled or not before allowing it. | |
| 657 | - if ( ! self::are_unfiltered_uploads_enabled() ) { | |
| 658 | - $error = 'json' === $file_extension | |
| 659 | - ? esc_html__( 'You do not have permission to upload JSON files.', 'elementor' ) | |
| 660 | - : esc_html__( 'This file is not allowed for security reasons.', 'elementor' ); | |
| 661 | - return new \WP_Error( Exceptions::FORBIDDEN, $error ); | |
| 662 | - } | |
| 663 | - | |
| 664 | 334 | // Here is each file type handler's chance to run its own specific validations |
| 665 | - return $file_type_handler->validate_file( $file ); | |
| 335 | + return $file_type_handler->validate_file( $file_path ); | |
| 666 | 336 | } |
| 667 | 337 | |
| 668 | 338 | /** |
| 669 | - * Is File Type Allowed | |
| 339 | + * Remove File Or Directory | |
| 670 | 340 | * |
| 671 | - * Checks whether the passed file extension is allowed for upload. | |
| 341 | + * Directory is deleted recursively with all of its contents (subdirectories and files). | |
| 672 | 342 | * |
| 673 | - * @since 3.5.0 | |
| 674 | - * @access private | |
| 343 | + * @since 3.3.0 | |
| 675 | 344 | * |
| 676 | - * @param $file_extension | |
| 677 | - * @param $filtered_file_extensions | |
| 678 | - * @return bool|\WP_Error | |
| 345 | + * @param string $path | |
| 679 | 346 | */ |
| 680 | - private function is_file_type_allowed( $file_extension, $filtered_file_extensions ) { | |
| 681 | - $allowed_file_extensions = $this->get_allowed_file_extensions(); | |
| 682 | - | |
| 683 | - if ( $filtered_file_extensions ) { | |
| 684 | - $allowed_file_extensions = array_intersect( $allowed_file_extensions, $filtered_file_extensions ); | |
| 347 | + public function remove_file_or_dir( $path ) { | |
| 348 | + if ( is_dir( $path ) ) { | |
| 349 | + $this->remove_directory_with_files( $path ); | |
| 350 | + } else { | |
| 351 | + unlink( $path ); | |
| 685 | 352 | } |
| 686 | - | |
| 687 | - $is_allowed = false; | |
| 688 | - | |
| 689 | - // Check if the file type (extension) is in the allowed extensions list. If it is a non-standard file type (not | |
| 690 | - // enabled by default in WordPress) and unfiltered file uploads are not enabled, it will not be in the allowed | |
| 691 | - // file extensions list. | |
| 692 | - foreach ( $allowed_file_extensions as $allowed_extension ) { | |
| 693 | - if ( preg_match( '/' . $allowed_extension . '/', $file_extension ) ) { | |
| 694 | - $is_allowed = true; | |
| 695 | - | |
| 696 | - break; | |
| 697 | - } | |
| 698 | - } | |
| 699 | - | |
| 700 | - if ( ! $is_allowed ) { | |
| 701 | - $is_allowed = new \WP_Error( Exceptions::FORBIDDEN, 'Uploading this file type is not allowed.' ); | |
| 702 | - } | |
| 703 | - | |
| 704 | - /** | |
| 705 | - * Elementor File Type Allowed | |
| 706 | - * | |
| 707 | - * Allows setting file types | |
| 708 | - * | |
| 709 | - * @since 3.5.0 | |
| 710 | - * | |
| 711 | - * @param bool|\WP_Error $is_allowed | |
| 712 | - */ | |
| 713 | - return apply_filters( 'elementor/files/allow-file-type/' . $file_extension, $is_allowed ); | |
| 714 | 353 | } |
| 715 | 354 | |
| 716 | 355 | /** |
| 717 | 356 | * Remove Directory with Files |
| @@ -716,9 +355,8 @@ | ||
| 716 | 355 | /** |
| 717 | 356 | * Remove Directory with Files |
| 718 | 357 | * |
| 719 | 358 | * @since 3.3.0 |
| 720 | - * @access private | |
| 721 | 359 | * |
| 722 | 360 | * @param string $dir |
| 723 | 361 | * @return bool |
| 724 | 362 | */ |
| @@ -727,9 +365,9 @@ | ||
| 727 | 365 | |
| 728 | 366 | foreach ( new \RecursiveIteratorIterator( $dir_iterator, \RecursiveIteratorIterator::CHILD_FIRST ) as $name => $item ) { |
| 729 | 367 | if ( is_dir( $name ) ) { |
| 730 | 368 | rmdir( $name ); |
| 731 | - } elseif ( is_file( $name ) ) { | |
| 369 | + } else { | |
| 732 | 370 | unlink( $name ); |
| 733 | 371 | } |
| 734 | 372 | } |
| 735 | 373 | |
| @@ -741,9 +379,8 @@ | ||
| 741 | 379 | * |
| 742 | 380 | * Retrieve an array containing the list of file extensions allowed for upload. |
| 743 | 381 | * |
| 744 | 382 | * @since 3.3.0 |
| 745 | - * @access private | |
| 746 | 383 | * |
| 747 | 384 | * @return array file extension/s |
| 748 | 385 | */ |
| 749 | 386 | private function get_allowed_file_extensions() { |
| @@ -763,12 +400,7 @@ | ||
| 763 | 400 | |
| 764 | 401 | public function __construct() { |
| 765 | 402 | $this->register_file_types(); |
| 766 | 403 | |
| 767 | - add_filter( 'upload_mimes', [ $this, 'support_unfiltered_elementor_file_uploads' ] ); | |
| 768 | 404 | add_filter( 'wp_handle_upload_prefilter', [ $this, 'handle_elementor_wp_media_upload' ] ); |
| 769 | - add_filter( 'wp_check_filetype_and_ext', [ $this, 'check_filetype_and_ext' ], 10, 4 ); | |
| 770 | - | |
| 771 | - // Ajax. | |
| 772 | - add_action( 'elementor/ajax/register_actions', [ $this, 'register_ajax_actions' ] ); | |
| 773 | 405 | } |
| 774 | 406 | } |
