| @@ -6,12 +6,9 @@ | ||
| 6 | 6 | use Elementor\Core\Files\File_Types\Base as File_Type_Base; |
| 7 | 7 | use Elementor\Core\Files\File_Types\Json; |
| 8 | 8 | use Elementor\Core\Files\File_Types\Svg; |
| 9 | 9 | use Elementor\Core\Files\File_Types\Zip; |
| 10 | -use Elementor\Core\Files\Fonts\Google_Font; | |
| 11 | 10 | use Elementor\Core\Utils\Exceptions; |
| 12 | -use Elementor\Fonts; | |
| 13 | -use Elementor\User; | |
| 14 | 11 | |
| 15 | 12 | if ( ! defined( 'ABSPATH' ) ) { |
| 16 | 13 | exit; // Exit if accessed directly. |
| 17 | 14 | } |
| @@ -26,9 +23,8 @@ | ||
| 26 | 23 | class Uploads_Manager extends Base_Object { |
| 27 | 24 | |
| 28 | 25 | const UNFILTERED_FILE_UPLOADS_KEY = 'elementor_unfiltered_files_upload'; |
| 29 | 26 | const INVALID_FILE_CONTENT = 'Invalid Content In File'; |
| 30 | - const ELEMENTOR_UPLOAD_DIR = 'elementor'; | |
| 31 | 27 | |
| 32 | 28 | /** |
| 33 | 29 | * @var File_Type_Base[] |
| 34 | 30 | */ |
| @@ -36,13 +32,8 @@ | ||
| 36 | 32 | |
| 37 | 33 | private $allowed_file_extensions; |
| 38 | 34 | |
| 39 | 35 | /** |
| 40 | - * @var bool | |
| 41 | - */ | |
| 42 | - private $is_elementor_upload = false; | |
| 43 | - | |
| 44 | - /** | |
| 45 | 36 | * @var string |
| 46 | 37 | */ |
| 47 | 38 | private $temp_dir; |
| 48 | 39 | |
| @@ -51,9 +42,8 @@ | ||
| 51 | 42 | * |
| 52 | 43 | * To Add a new file type to Elementor, with its own handling logic, you need to add it to the $file_types array here. |
| 53 | 44 | * |
| 54 | 45 | * @since 3.3.0 |
| 55 | - * @access public | |
| 56 | 46 | */ |
| 57 | 47 | public function register_file_types() { |
| 58 | 48 | // All file types that have handlers should be included here. |
| 59 | 49 | $file_types = [ |
| @@ -71,13 +61,10 @@ | ||
| 71 | 61 | * Extract and Validate Zip |
| 72 | 62 | * |
| 73 | 63 | * This method accepts a $file array (which minimally should include a 'tmp_name') |
| 74 | 64 | * |
| 75 | - * @since 3.3.0 | |
| 76 | - * @access public | |
| 77 | - * | |
| 78 | 65 | * @param string $file_path |
| 79 | - * @param array $allowed_file_types | |
| 66 | + * @param array $allowed_file_types | |
| 80 | 67 | * @return array|\WP_Error |
| 81 | 68 | */ |
| 82 | 69 | public function extract_and_validate_zip( $file_path, $allowed_file_types = null ) { |
| 83 | 70 | $result = []; |
| @@ -87,12 +74,8 @@ | ||
| 87 | 74 | |
| 88 | 75 | // Returns an array of file paths. |
| 89 | 76 | $extracted = $zip_handler->extract( $file_path, $allowed_file_types ); |
| 90 | 77 | |
| 91 | - if ( is_wp_error( $extracted ) ) { | |
| 92 | - return $extracted; | |
| 93 | - } | |
| 94 | - | |
| 95 | 78 | // If there are no extracted file names, no files passed the extraction validation. |
| 96 | 79 | if ( empty( $extracted['files'] ) ) { |
| 97 | 80 | // TODO: Decide what to do if no files passed the extraction validation |
| 98 | 81 | return new \WP_Error( 'file_error', self::INVALID_FILE_CONTENT ); |
| @@ -119,66 +102,38 @@ | ||
| 119 | 102 | * validation. |
| 120 | 103 | * |
| 121 | 104 | * The file goes through validation; if it passes validation, the file is returned. Otherwise, an error is returned. |
| 122 | 105 | * |
| 123 | - * @since 3.3.0 | |
| 124 | - * @access public | |
| 125 | - * | |
| 126 | - * @param array $data | |
| 106 | + * @param array $file | |
| 127 | 107 | * @param array $allowed_file_extensions Optional. an array of file types that are allowed to pass validation for each |
| 128 | 108 | * upload. |
| 129 | 109 | * @return array|\WP_Error |
| 130 | 110 | */ |
| 131 | - public function handle_elementor_upload( array $data, $allowed_file_extensions = null ) { | |
| 111 | + public function handle_elementor_upload( array $file, $allowed_file_extensions = null ) { | |
| 132 | 112 | // If $file['fileData'] is set, it signals that the passed file is a Base64 string that needs to be decoded and |
| 133 | 113 | // saved to a temporary file. |
| 134 | - if ( isset( $data['fileData'] ) ) { | |
| 135 | - $data = $this->save_base64_to_tmp_file( $data, $allowed_file_extensions ); | |
| 114 | + if ( isset( $file['fileData'] ) ) { | |
| 115 | + $file = $this->save_base64_to_tmp_file( $file ); | |
| 136 | 116 | } |
| 137 | 117 | |
| 138 | - if ( is_wp_error( $data ) ) { | |
| 139 | - return $data; | |
| 140 | - } | |
| 118 | + $validation_result = $this->validate_file( $file, $allowed_file_extensions ); | |
| 141 | 119 | |
| 142 | - if ( ! isset( $data['fileData'] ) ) { | |
| 143 | - if ( empty( $data['tmp_name'] ) ) { | |
| 144 | - return new \WP_Error( 'file_error', esc_html__( 'Invalid temporary file path.', 'elementor' ) ); | |
| 145 | - } | |
| 146 | - | |
| 147 | - // Path validation only applies to direct calls (e.g. import_template) where | |
| 148 | - // tmp_name originates from user input. When is_elementor_upload is true, this | |
| 149 | - // method is used as a WordPress filter (wp_handle_sideload_prefilter) and | |
| 150 | - // tmp_name is set by WordPress core. | |
| 151 | - if ( ! $this->is_elementor_upload && ! $this->is_path_in_allowed_dir( $data['tmp_name'] ) ) { | |
| 152 | - return new \WP_Error( 'file_error', esc_html__( 'Invalid temporary file path.', 'elementor' ) ); | |
| 153 | - } | |
| 154 | - } | |
| 155 | - | |
| 156 | - $validation_result = $this->validate_file( $data, $allowed_file_extensions ); | |
| 157 | - | |
| 158 | 120 | if ( is_wp_error( $validation_result ) ) { |
| 159 | - if ( ! empty( $data['tmp_name'] ) ) { | |
| 160 | - $this->remove_file_or_dir( dirname( $data['tmp_name'] ) ); | |
| 161 | - } | |
| 162 | - | |
| 163 | 121 | return $validation_result; |
| 164 | 122 | } |
| 165 | 123 | |
| 166 | - return $data; | |
| 124 | + return $file; | |
| 167 | 125 | } |
| 168 | 126 | |
| 169 | 127 | /** |
| 170 | - * Is Unfiltered Uploads Enabled | |
| 128 | + * are Unfiltered Uploads Enabled | |
| 171 | 129 | * |
| 172 | 130 | * @since 3.5.0 |
| 173 | - * @access public | |
| 174 | 131 | * |
| 175 | 132 | * @return bool |
| 176 | 133 | */ |
| 177 | 134 | final public static function are_unfiltered_uploads_enabled() { |
| 178 | - $enabled = (bool) get_option( self::UNFILTERED_FILE_UPLOADS_KEY ) | |
| 179 | - && Svg::file_sanitizer_can_run() | |
| 180 | - && User::is_current_user_can_upload_json(); | |
| 135 | + $enabled = ! ! get_option( self::UNFILTERED_FILE_UPLOADS_KEY ) && Svg::file_sanitizer_can_run(); | |
| 181 | 136 | |
| 182 | 137 | /** |
| 183 | 138 | * Allow Unfiltered Files Upload. |
| 184 | 139 | * |
| @@ -198,9 +153,8 @@ | ||
| 198 | 153 | * |
| 199 | 154 | * Runs on the 'wp_handle_upload_prefilter' filter. |
| 200 | 155 | * |
| 201 | 156 | * @since 3.2.0 |
| 202 | - * @access public | |
| 203 | 157 | * |
| 204 | 158 | * @param $file |
| 205 | 159 | * @return mixed |
| 206 | 160 | */ |
| @@ -225,9 +179,8 @@ | ||
| 225 | 179 | * Initialize the proper file type handler according to the file extension |
| 226 | 180 | * and assign it to the file type handlers array. |
| 227 | 181 | * |
| 228 | 182 | * @since 3.3.0 |
| 229 | - * @access public | |
| 230 | 183 | * |
| 231 | 184 | * @param string|null $file_extension - file extension |
| 232 | 185 | * @return File_Type_Base[]|File_Type_Base |
| 233 | 186 | */ |
| @@ -243,9 +196,8 @@ | ||
| 243 | 196 | * ref: https://core.trac.wordpress.org/ticket/39550 |
| 244 | 197 | * ref: https://core.trac.wordpress.org/ticket/40175 |
| 245 | 198 | * |
| 246 | 199 | * @since 3.5.0 |
| 247 | - * @access public | |
| 248 | 200 | * |
| 249 | 201 | * @param $data |
| 250 | 202 | * @param $file |
| 251 | 203 | * @param $filename |
| @@ -272,72 +224,20 @@ | ||
| 272 | 224 | return $data; |
| 273 | 225 | } |
| 274 | 226 | |
| 275 | 227 | /** |
| 276 | - * Check if path is within the allowed Elementor uploads directory. | |
| 277 | - * | |
| 278 | - * Prevents path traversal and arbitrary directory deletion by ensuring the path | |
| 279 | - * resolves under wp-content/uploads/elementor/ or under the configured temp dir | |
| 280 | - * (elementor/files/temp-dir filter), so that cleanup works when temp dir is customized. | |
| 281 | - * | |
| 282 | - * @since 3.35.4 | |
| 283 | - * @access private | |
| 284 | - * | |
| 285 | - * @param string $path | |
| 286 | - * @return bool | |
| 287 | - */ | |
| 288 | - private function is_path_in_allowed_dir( $path ) { | |
| 289 | - if ( ! is_string( $path ) || '' === $path ) { | |
| 290 | - return false; | |
| 291 | - } | |
| 292 | - | |
| 293 | - $real_path = realpath( $path ); | |
| 294 | - | |
| 295 | - if ( false === $real_path ) { | |
| 296 | - $real_path = realpath( dirname( $path ) ); | |
| 297 | - if ( false === $real_path ) { | |
| 298 | - return false; | |
| 299 | - } | |
| 300 | - } | |
| 301 | - | |
| 302 | - $wp_upload_dir = wp_upload_dir(); | |
| 303 | - $elementor_base = realpath( $wp_upload_dir['basedir'] . DIRECTORY_SEPARATOR . self::ELEMENTOR_UPLOAD_DIR ); | |
| 304 | - | |
| 305 | - if ( false !== $elementor_base ) { | |
| 306 | - $allowed = $real_path === $elementor_base || 0 === strpos( $real_path, $elementor_base . DIRECTORY_SEPARATOR ); | |
| 307 | - if ( $allowed ) { | |
| 308 | - return true; | |
| 309 | - } | |
| 310 | - } | |
| 311 | - | |
| 312 | - $temp_dir = realpath( $this->get_temp_dir() ); | |
| 313 | - if ( false !== $temp_dir ) { | |
| 314 | - $temp_dir = rtrim( $temp_dir, DIRECTORY_SEPARATOR ) . DIRECTORY_SEPARATOR; | |
| 315 | - return 0 === strpos( $real_path, $temp_dir ); | |
| 316 | - } | |
| 317 | - | |
| 318 | - return false; | |
| 319 | - } | |
| 320 | - | |
| 321 | - /** | |
| 322 | 228 | * Remove File Or Directory |
| 323 | 229 | * |
| 324 | 230 | * Directory is deleted recursively with all of its contents (subdirectories and files). |
| 325 | - * Only paths under wp-content/uploads/elementor/ are allowed (security: prevents arbitrary directory deletion). | |
| 326 | 231 | * |
| 327 | 232 | * @since 3.3.0 |
| 328 | - * @access public | |
| 329 | 233 | * |
| 330 | 234 | * @param string $path |
| 331 | 235 | */ |
| 332 | 236 | public function remove_file_or_dir( $path ) { |
| 333 | - if ( ! $this->is_path_in_allowed_dir( $path ) ) { | |
| 334 | - return; | |
| 335 | - } | |
| 336 | - | |
| 337 | 237 | if ( is_dir( $path ) ) { |
| 338 | 238 | $this->remove_directory_with_files( $path ); |
| 339 | - } elseif ( is_file( $path ) ) { | |
| 239 | + } else { | |
| 340 | 240 | unlink( $path ); |
| 341 | 241 | } |
| 342 | 242 | } |
| 343 | 243 | |
| @@ -346,9 +246,8 @@ | ||
| 346 | 246 | * |
| 347 | 247 | * Create a random temporary file. |
| 348 | 248 | * |
| 349 | 249 | * @since 3.3.0 |
| 350 | - * @access public | |
| 351 | 250 | * |
| 352 | 251 | * @param string $file_content |
| 353 | 252 | * @param string $file_name |
| 354 | 253 | * @return string|\WP_Error |
| @@ -353,27 +252,10 @@ | ||
| 353 | 252 | * @param string $file_name |
| 354 | 253 | * @return string|\WP_Error |
| 355 | 254 | */ |
| 356 | 255 | public function create_temp_file( $file_content, $file_name ) { |
| 357 | - $file_name = str_replace( ' ', '', sanitize_file_name( $file_name ) ); | |
| 358 | - | |
| 359 | - if ( empty( $file_name ) ) { | |
| 360 | - return new \WP_Error( 'invalid_file_name', esc_html__( 'Invalid file name.', 'elementor' ) ); | |
| 361 | - } | |
| 362 | - | |
| 363 | 256 | $temp_filename = $this->create_unique_dir() . $file_name; |
| 364 | 257 | |
| 365 | - /** | |
| 366 | - * Temp File Path | |
| 367 | - * | |
| 368 | - * Allows modifying the full path of the temporary file. | |
| 369 | - * | |
| 370 | - * @since 3.7.0 | |
| 371 | - * | |
| 372 | - * @param string full path to file | |
| 373 | - */ | |
| 374 | - $temp_filename = apply_filters( 'elementor/files/temp-file-path', $temp_filename ); | |
| 375 | - | |
| 376 | 258 | file_put_contents( $temp_filename, $file_content ); // phpcs:ignore |
| 377 | 259 | |
| 378 | 260 | return $temp_filename; |
| 379 | 261 | } |
| @@ -383,9 +265,8 @@ | ||
| 383 | 265 | * |
| 384 | 266 | * Get the temporary files directory path. If the directory does not exist, this method creates it. |
| 385 | 267 | * |
| 386 | 268 | * @since 3.3.0 |
| 387 | - * @access public | |
| 388 | 269 | * |
| 389 | 270 | * @return string $temp_dir |
| 390 | 271 | */ |
| 391 | 272 | public function get_temp_dir() { |
| @@ -391,21 +272,10 @@ | ||
| 391 | 272 | public function get_temp_dir() { |
| 392 | 273 | if ( ! $this->temp_dir ) { |
| 393 | 274 | $wp_upload_dir = wp_upload_dir(); |
| 394 | 275 | |
| 395 | - $temp_dir = implode( DIRECTORY_SEPARATOR, [ $wp_upload_dir['basedir'], self::ELEMENTOR_UPLOAD_DIR, 'tmp' ] ) . DIRECTORY_SEPARATOR; | |
| 276 | + $this->temp_dir = implode( DIRECTORY_SEPARATOR, [ $wp_upload_dir['basedir'], 'elementor', 'tmp' ] ) . DIRECTORY_SEPARATOR; | |
| 396 | 277 | |
| 397 | - /** | |
| 398 | - * Temp File Path | |
| 399 | - * | |
| 400 | - * Allows modifying the full path of the temporary file. | |
| 401 | - * | |
| 402 | - * @since 3.7.0 | |
| 403 | - * | |
| 404 | - * @param string temporary directory | |
| 405 | - */ | |
| 406 | - $this->temp_dir = apply_filters( 'elementor/files/temp-dir', $temp_dir ); | |
| 407 | - | |
| 408 | 278 | if ( ! is_dir( $this->temp_dir ) ) { |
| 409 | 279 | wp_mkdir_p( $this->temp_dir ); |
| 410 | 280 | } |
| 411 | 281 | } |
| @@ -418,9 +288,8 @@ | ||
| 418 | 288 | * |
| 419 | 289 | * Create a unique temporary directory |
| 420 | 290 | * |
| 421 | 291 | * @since 3.3.0 |
| 422 | - * @access public | |
| 423 | 292 | * |
| 424 | 293 | * @return string the new directory path |
| 425 | 294 | */ |
| 426 | 295 | public function create_unique_dir() { |
| @@ -443,9 +312,8 @@ | ||
| 443 | 312 | * @param Ajax $ajax |
| 444 | 313 | */ |
| 445 | 314 | public function register_ajax_actions( Ajax $ajax ) { |
| 446 | 315 | $ajax->register_ajax_action( 'enable_unfiltered_files_upload', [ $this, 'enable_unfiltered_files_upload' ] ); |
| 447 | - $ajax->register_ajax_action( 'enqueue_google_fonts', [ $this, 'ajax_enqueue_google_fonts' ] ); | |
| 448 | 316 | } |
| 449 | 317 | |
| 450 | 318 | /** |
| 451 | 319 | * Set Unfiltered Files Upload |
| @@ -460,24 +328,8 @@ | ||
| 460 | 328 | |
| 461 | 329 | update_option( self::UNFILTERED_FILE_UPLOADS_KEY, 1 ); |
| 462 | 330 | } |
| 463 | 331 | |
| 464 | - public function ajax_enqueue_google_fonts( $data ): bool { | |
| 465 | - if ( empty( $data['font_name'] ) ) { | |
| 466 | - return false; | |
| 467 | - } | |
| 468 | - | |
| 469 | - $font_type = Fonts::get_font_type( $data['font_name'] ); | |
| 470 | - | |
| 471 | - if ( Fonts::GOOGLE !== $font_type ) { | |
| 472 | - return false; | |
| 473 | - } | |
| 474 | - | |
| 475 | - Google_Font::enqueue( $data['font_name'] ); | |
| 476 | - | |
| 477 | - return true; | |
| 478 | - } | |
| 479 | - | |
| 480 | 332 | /** |
| 481 | 333 | * Support Unfiltered File Uploads |
| 482 | 334 | * |
| 483 | 335 | * When uploading a file within Elementor, this method adds the registered |
| @@ -484,85 +336,33 @@ | ||
| 484 | 336 | * file types to WordPress' allowed mimes list. This will only happen if the user allowed unfiltered file uploads |
| 485 | 337 | * in Elementor's settings in the admin dashboard. |
| 486 | 338 | * |
| 487 | 339 | * @since 3.5.0 |
| 488 | - * @access public | |
| 489 | 340 | * |
| 490 | - * @param array $allowed_mimes | |
| 491 | - * @return array allowed mime types | |
| 341 | + * @return string the new directory path | |
| 492 | 342 | */ |
| 493 | - final public function support_unfiltered_elementor_file_uploads( $allowed_mimes ) { | |
| 494 | - if ( $this->is_elementor_upload() && $this->are_unfiltered_uploads_enabled() ) { | |
| 343 | + final public function support_unfiltered_elementor_file_uploads( $existing_mimes ) { | |
| 344 | + if ( ( $this->is_elementor_media_upload() || $this->is_elementor_wp_media_upload() ) && $this->are_unfiltered_uploads_enabled() ) { | |
| 495 | 345 | foreach ( $this->file_type_handlers as $file_type_handler ) { |
| 496 | - $allowed_mimes[ $file_type_handler->get_file_extension() ] = $file_type_handler->get_mime_type(); | |
| 346 | + $existing_mimes[ $file_type_handler->get_file_extension() ] = $file_type_handler->get_mime_type(); | |
| 497 | 347 | } |
| 498 | 348 | } |
| 499 | 349 | |
| 500 | - return $allowed_mimes; | |
| 350 | + return $existing_mimes; | |
| 501 | 351 | } |
| 502 | 352 | |
| 503 | 353 | /** |
| 504 | - * Set Elementor Upload State | |
| 505 | - * | |
| 506 | - * @since 3.5.0 | |
| 507 | - * @access public | |
| 508 | - * | |
| 509 | - * @param $state | |
| 510 | - */ | |
| 511 | - public function set_elementor_upload_state( $state ) { | |
| 512 | - $this->is_elementor_upload = $state; | |
| 513 | - } | |
| 514 | - | |
| 515 | - /** | |
| 516 | - * Is Elementor Upload | |
| 517 | - * | |
| 518 | - * This method checks if the current session includes a request to upload files made via Elementor. | |
| 519 | - * | |
| 520 | - * @since 3.5.0 | |
| 521 | - * @access private | |
| 522 | - * | |
| 354 | + * is_elementor_media_upload | |
| 523 | 355 | * @return bool |
| 524 | 356 | */ |
| 525 | - private function is_elementor_upload() { | |
| 526 | - return $this->is_elementor_upload || $this->is_elementor_media_upload() || $this->is_elementor_wp_media_upload(); | |
| 357 | + private function is_elementor_media_upload() { | |
| 358 | + return isset( $_POST['uploadTypeCaller'] ) && 'elementor-media-upload' === $_POST['uploadTypeCaller']; // phpcs:ignore | |
| 527 | 359 | } |
| 528 | 360 | |
| 529 | 361 | /** |
| 530 | - * Is Elementor Media Upload | |
| 531 | - * | |
| 532 | - * Checks whether the current request includes uploading files via Elementor which are not destined for the Media | |
| 533 | - * Library. | |
| 534 | - * | |
| 535 | - * @since 3.5.0 | |
| 536 | - * @access public | |
| 537 | - * | |
| 538 | - * @return bool | |
| 539 | - */ | |
| 540 | - public function is_elementor_media_upload() { | |
| 541 | - // Sometimes `uploadTypeCaller` passed as a GET parameter when using the WP Media Library REST API, where the | |
| 542 | - // whole request body is occupied by the uploaded file. | |
| 543 | - return isset( $_REQUEST['uploadTypeCaller'] ) && 'elementor-media-upload' === $_REQUEST['uploadTypeCaller']; // phpcs:ignore | |
| 544 | - } | |
| 545 | - | |
| 546 | - /** | |
| 547 | - * Is Elementor WP Media Upload | |
| 548 | - * | |
| 549 | - * Checks whether the current request is a request to upload files into the WP Media Library via Elementor. | |
| 550 | - * | |
| 551 | - * @since 3.3.0 | |
| 552 | - * @access private | |
| 553 | - * | |
| 554 | - * @return bool | |
| 555 | - */ | |
| 556 | - private function is_elementor_wp_media_upload() { | |
| 557 | - return isset( $_REQUEST['uploadTypeCaller'] ) && 'elementor-wp-media-upload' === $_REQUEST['uploadTypeCaller']; // phpcs:ignore | |
| 558 | - } | |
| 559 | - | |
| 560 | - /** | |
| 561 | 362 | * Add File Extension To Allowed Extensions List |
| 562 | 363 | * |
| 563 | 364 | * @since 3.3.0 |
| 564 | - * @access private | |
| 565 | 365 | * |
| 566 | 366 | * @param string $file_type |
| 567 | 367 | */ |
| 568 | 368 | private function add_file_extension_to_allowed_extensions_list( $file_type ) { |
| @@ -581,27 +381,13 @@ | ||
| 581 | 381 | * |
| 582 | 382 | * Saves a Base64 string as a .tmp file in Elementor's temporary files directory. |
| 583 | 383 | * |
| 584 | 384 | * @since 3.3.0 |
| 585 | - * @access private | |
| 586 | 385 | * |
| 587 | 386 | * @param $file |
| 588 | - * @param array|null $allowed_file_extensions | |
| 589 | - * | |
| 590 | 387 | * @return array|\WP_Error |
| 591 | 388 | */ |
| 592 | - private function save_base64_to_tmp_file( $file, $allowed_file_extensions = null ) { | |
| 593 | - if ( empty( $file['fileName'] ) || empty( $file['fileData'] ) ) { | |
| 594 | - return new \WP_Error( 'file_error', self::INVALID_FILE_CONTENT ); | |
| 595 | - } | |
| 596 | - | |
| 597 | - $file_extension = pathinfo( $file['fileName'], PATHINFO_EXTENSION ); | |
| 598 | - $is_file_type_allowed = $this->is_file_type_allowed( $file_extension, $allowed_file_extensions ); | |
| 599 | - | |
| 600 | - if ( is_wp_error( $is_file_type_allowed ) ) { | |
| 601 | - return $is_file_type_allowed; | |
| 602 | - } | |
| 603 | - | |
| 389 | + private function save_base64_to_tmp_file( $file ) { | |
| 604 | 390 | $file_content = base64_decode( $file['fileData'] ); // phpcs:ignore |
| 605 | 391 | |
| 606 | 392 | // If the decode fails |
| 607 | 393 | if ( ! $file_content ) { |
| @@ -622,14 +408,25 @@ | ||
| 622 | 408 | ]; |
| 623 | 409 | } |
| 624 | 410 | |
| 625 | 411 | /** |
| 412 | + * is_elementor_wp_media_upload | |
| 413 | + * | |
| 414 | + * @since 3.3.0 | |
| 415 | + * | |
| 416 | + * @return bool | |
| 417 | + */ | |
| 418 | + private function is_elementor_wp_media_upload() { | |
| 419 | + return isset( $_POST['uploadTypeCaller'] ) && 'elementor-wp-media-upload' === $_POST['uploadTypeCaller']; // phpcs:ignore | |
| 420 | + } | |
| 421 | + | |
| 422 | + /** | |
| 626 | 423 | * Validate File |
| 627 | 424 | * |
| 628 | 425 | * @since 3.3.0 |
| 629 | 426 | * @access private |
| 630 | 427 | * |
| 631 | - * @param array $file | |
| 428 | + * @param array $file_path | |
| 632 | 429 | * @param array $file_extensions Optional |
| 633 | 430 | * @return bool|\WP_Error |
| 634 | 431 | */ |
| 635 | 432 | private function validate_file( array $file, $file_extensions = [] ) { |
| @@ -654,12 +451,9 @@ | ||
| 654 | 451 | |
| 655 | 452 | // If there is a File Type Handler for the uploaded file, it means it is a non-standard file type. In this case, |
| 656 | 453 | // we check if unfiltered file uploads are enabled or not before allowing it. |
| 657 | 454 | if ( ! self::are_unfiltered_uploads_enabled() ) { |
| 658 | - $error = 'json' === $file_extension | |
| 659 | - ? esc_html__( 'You do not have permission to upload JSON files.', 'elementor' ) | |
| 660 | - : esc_html__( 'This file is not allowed for security reasons.', 'elementor' ); | |
| 661 | - return new \WP_Error( Exceptions::FORBIDDEN, $error ); | |
| 455 | + return new \WP_Error( Exceptions::FORBIDDEN, esc_html__( 'This file is not allowed for security reasons.', 'elementor' ) ); | |
| 662 | 456 | } |
| 663 | 457 | |
| 664 | 458 | // Here is each file type handler's chance to run its own specific validations |
| 665 | 459 | return $file_type_handler->validate_file( $file ); |
| @@ -700,18 +494,9 @@ | ||
| 700 | 494 | if ( ! $is_allowed ) { |
| 701 | 495 | $is_allowed = new \WP_Error( Exceptions::FORBIDDEN, 'Uploading this file type is not allowed.' ); |
| 702 | 496 | } |
| 703 | 497 | |
| 704 | - /** | |
| 705 | - * Elementor File Type Allowed | |
| 706 | - * | |
| 707 | - * Allows setting file types | |
| 708 | - * | |
| 709 | - * @since 3.5.0 | |
| 710 | - * | |
| 711 | - * @param bool|\WP_Error $is_allowed | |
| 712 | - */ | |
| 713 | - return apply_filters( 'elementor/files/allow-file-type/' . $file_extension, $is_allowed ); | |
| 498 | + return $is_allowed; | |
| 714 | 499 | } |
| 715 | 500 | |
| 716 | 501 | /** |
| 717 | 502 | * Remove Directory with Files |
| @@ -716,9 +501,8 @@ | ||
| 716 | 501 | /** |
| 717 | 502 | * Remove Directory with Files |
| 718 | 503 | * |
| 719 | 504 | * @since 3.3.0 |
| 720 | - * @access private | |
| 721 | 505 | * |
| 722 | 506 | * @param string $dir |
| 723 | 507 | * @return bool |
| 724 | 508 | */ |
| @@ -727,9 +511,9 @@ | ||
| 727 | 511 | |
| 728 | 512 | foreach ( new \RecursiveIteratorIterator( $dir_iterator, \RecursiveIteratorIterator::CHILD_FIRST ) as $name => $item ) { |
| 729 | 513 | if ( is_dir( $name ) ) { |
| 730 | 514 | rmdir( $name ); |
| 731 | - } elseif ( is_file( $name ) ) { | |
| 515 | + } else { | |
| 732 | 516 | unlink( $name ); |
| 733 | 517 | } |
| 734 | 518 | } |
| 735 | 519 | |
| @@ -741,9 +525,8 @@ | ||
| 741 | 525 | * |
| 742 | 526 | * Retrieve an array containing the list of file extensions allowed for upload. |
| 743 | 527 | * |
| 744 | 528 | * @since 3.3.0 |
| 745 | - * @access private | |
| 746 | 529 | * |
| 747 | 530 | * @return array file extension/s |
| 748 | 531 | */ |
| 749 | 532 | private function get_allowed_file_extensions() { |
