elementor / core / files / assets / files-upload-handler.php

files-upload-handler.php in Elementor Website Builder – more than just a page builder 3.4.8, at core/files/assets/files-upload-handler.php

138 lines 3.6 KB

Raw Download Zip

1	<?php
2
3	namespace Elementor\Core\Files\Assets;
4
5	if ( ! defined( 'ABSPATH' ) ) {
6	exit; // Exit if accessed directly.
7	}
8
9	abstract class Files_Upload_Handler {
10	const OPTION_KEY = 'elementor_unfiltered_files_upload';
11
12	public function __construct() {
13	add_filter( 'upload_mimes', [ $this, 'support_unfiltered_files_upload' ] );
14	add_filter( 'wp_handle_upload_prefilter', [ $this, 'handle_upload_prefilter' ] );
15	add_filter( 'wp_check_filetype_and_ext', [ $this, 'check_filetype_and_ext' ], 10, 4 );
16	}
17
18	abstract public function get_mime_type();
19
20	abstract public function get_file_type();
21
22	/**
23	* is_elementor_media_upload
24	* @return bool
25	*/
26	private function is_elementor_media_upload() {
27	return isset( $_POST['uploadTypeCaller'] ) && 'elementor-wp-media-upload' === $_POST['uploadTypeCaller']; // phpcs:ignore
28	}
29
30	/**
31	* @return bool
32	*/
33	final public static function is_enabled() {
34	$enabled = ! ! get_option( self::OPTION_KEY ) && self::file_sanitizer_can_run();
35
36	/**
37	* @deprecated 3.0.0 Use `elementor/document/urls/edit` filter instead.
38	*/
39	$enabled = apply_filters( 'elementor/files/svg/enabled', $enabled );
40
41	/**
42	* Allow Unfiltered Files Upload.
43	*
44	* Determines whether to enable unfiltered file uploads.
45	*
46	* @since 3.0.0
47	*
48	* @param bool $enabled Whether upload is enabled or not.
49	*/
50	$enabled = apply_filters( 'elementor/files/allow_unfiltered_upload', $enabled );
51
52	return $enabled;
53	}
54
55	final public function support_unfiltered_files_upload( $existing_mimes ) {
56	if ( $this->is_elementor_media_upload() && $this->is_enabled() ) {
57	$existing_mimes[ $this->get_file_type() ] = $this->get_mime_type();
58	}
59
60	return $existing_mimes;
61	}
62
63	/**
64	* handle_upload_prefilter
65	* @param $file
66	*
67	* @return mixed
68	*/
69	public function handle_upload_prefilter( $file ) {
70	if ( ! $this->is_file_should_handled( $file ) ) {
71	return $file;
72	}
73
74	$ext = pathinfo( $file['name'], PATHINFO_EXTENSION );
75	$file_type = $this->get_file_type();
76	$display_type = strtoupper( $file_type );
77
78	if ( $file_type !== $ext ) {
79	/* translators: 1: File extension, 2: File type. */
80	$file['error'] = sprintf( esc_html__( 'The uploaded %1$s file is not supported. Please upload a valid %2$s file', 'elementor' ), $ext, $display_type );
81	return $file;
82	}
83
84	if ( ! self::is_enabled() ) {
85	/* translators: %s: File type. */
86	$file['error'] = sprintf( esc_html__( '%1$s file is not allowed for security reasons', 'elementor' ), $display_type );
87	return $file;
88	}
89
90	return $file;
91	}
92
93	protected function is_file_should_handled( $file ) {
94	$ext = pathinfo( $file['name'], PATHINFO_EXTENSION );
95
96	return $this->is_elementor_media_upload() && $this->get_file_type() === $ext;
97	}
98
99	/**
100	* file_sanitizer_can_run
101	* @return bool
102	*/
103	public static function file_sanitizer_can_run() {
104	return class_exists( 'DOMDocument' ) && class_exists( 'SimpleXMLElement' );
105	}
106
107	/**
108	* Check filetype and ext
109	*
110	* A workaround for upload validation which relies on a PHP extension (fileinfo)
111	* with inconsistent reporting behaviour.
112	* ref: https://core.trac.wordpress.org/ticket/39550
113	* ref: https://core.trac.wordpress.org/ticket/40175
114	*
115	* @param $data
116	* @param $file
117	* @param $filename
118	* @param $mimes
119	*
120	* @return mixed
121	*/
122	public function check_filetype_and_ext( $data, $file, $filename, $mimes ) {
123	if ( ! empty( $data['ext'] ) && ! empty( $data['type'] ) ) {
124	return $data;
125	}
126
127	$wp_file_type = wp_check_filetype( $filename, $mimes );
128	$file_type = strtolower( $this->get_file_type() );
129
130	if ( $file_type === $wp_file_type['ext'] ) {
131	$data['ext'] = $file_type;
132	$data['type'] = $this->get_mime_type();
133	}
134
135	return $data;
136	}
137	}
138