elementor / core / files / uploads-manager.php

uploads-manager.php in Elementor Website Builder – more than just a page builder 3.5.6, at core/files/uploads-manager.php

622 lines 16.4 KB

Raw Download Zip

1	<?php
2	namespace Elementor\Core\Files;
3
4	use Elementor\Core\Base\Base_Object;
5	use Elementor\Core\Common\Modules\Ajax\Module as Ajax;
6	use Elementor\Core\Files\File_Types\Base as File_Type_Base;
7	use Elementor\Core\Files\File_Types\Json;
8	use Elementor\Core\Files\File_Types\Svg;
9	use Elementor\Core\Files\File_Types\Zip;
10	use Elementor\Core\Utils\Exceptions;
11
12	if ( ! defined( 'ABSPATH' ) ) {
13	exit; // Exit if accessed directly.
14	}
15
16	/**
17	* Elementor uploads manager.
18	*
19	* Elementor uploads manager handler class is responsible for handling file uploads that are not done with WP Media.
20	*
21	* @since 3.3.0
22	*/
23	class Uploads_Manager extends Base_Object {
24
25	const UNFILTERED_FILE_UPLOADS_KEY = 'elementor_unfiltered_files_upload';
26	const INVALID_FILE_CONTENT = 'Invalid Content In File';
27
28	/**
29	* @var File_Type_Base[]
30	*/
31	private $file_type_handlers = [];
32
33	private $allowed_file_extensions;
34
35	/**
36	* @var bool
37	*/
38	private $is_elementor_upload = false;
39
40	/**
41	* @var string
42	*/
43	private $temp_dir;
44
45	/**
46	* Register File Types
47	*
48	* To Add a new file type to Elementor, with its own handling logic, you need to add it to the $file_types array here.
49	*
50	* @since 3.3.0
51	* @access public
52	*/
53	public function register_file_types() {
54	// All file types that have handlers should be included here.
55	$file_types = [
56	'json' => new Json(),
57	'zip' => new Zip(),
58	'svg' => new Svg(),
59	];
60
61	foreach ( $file_types as $file_type => $file_handler ) {
62	$this->file_type_handlers[ $file_type ] = $file_handler;
63	}
64	}
65
66	/**
67	* Extract and Validate Zip
68	*
69	* This method accepts a $file array (which minimally should include a 'tmp_name')
70	*
71	* @since 3.3.0
72	* @access public
73	*
74	* @param string $file_path
75	* @param array $allowed_file_types
76	* @return array\|\WP_Error
77	*/
78	public function extract_and_validate_zip( $file_path, $allowed_file_types = null ) {
79	$result = [];
80
81	/** @var Zip $zip_handler - File Type */
82	$zip_handler = $this->file_type_handlers['zip'];
83
84	// Returns an array of file paths.
85	$extracted = $zip_handler->extract( $file_path, $allowed_file_types );
86
87	// If there are no extracted file names, no files passed the extraction validation.
88	if ( empty( $extracted['files'] ) ) {
89	// TODO: Decide what to do if no files passed the extraction validation
90	return new \WP_Error( 'file_error', self::INVALID_FILE_CONTENT );
91	}
92
93	$result['extraction_directory'] = $extracted['extraction_directory'];
94
95	foreach ( $extracted['files'] as $extracted_file_path ) {
96	// Each file is an array with a 'name' (file path) property.
97	if ( ! is_wp_error( $this->validate_file( [ 'tmp_name' => $extracted_file_path ] ) ) ) {
98	$result['files'][] = $extracted_file_path;
99	}
100	}
101
102	return $result;
103	}
104
105	/**
106	* Handle Elementor Upload
107	*
108	* This method receives a $file array. If the received file is a Base64 string, the $file array should include a
109	* 'fileData' property containing the string, which is decoded and has its contents stored in a temporary file.
110	* If the $file parameter passed is a standard $file array, the 'name' and 'tmp_name' properties are used for
111	* validation.
112	*
113	* The file goes through validation; if it passes validation, the file is returned. Otherwise, an error is returned.
114	*
115	* @since 3.3.0
116	* @access public
117	*
118	* @param array $file
119	* @param array $allowed_file_extensions Optional. an array of file types that are allowed to pass validation for each
120	* upload.
121	* @return array\|\WP_Error
122	*/
123	public function handle_elementor_upload( array $file, $allowed_file_extensions = null ) {
124	// If $file['fileData'] is set, it signals that the passed file is a Base64 string that needs to be decoded and
125	// saved to a temporary file.
126	if ( isset( $file['fileData'] ) ) {
127	$file = $this->save_base64_to_tmp_file( $file );
128	}
129
130	$validation_result = $this->validate_file( $file, $allowed_file_extensions );
131
132	if ( is_wp_error( $validation_result ) ) {
133	return $validation_result;
134	}
135
136	return $file;
137	}
138
139	/**
140	* are Unfiltered Uploads Enabled
141	*
142	* @since 3.5.0
143	* @access public
144	*
145	* @return bool
146	*/
147	final public static function are_unfiltered_uploads_enabled() {
148	$enabled = ! ! get_option( self::UNFILTERED_FILE_UPLOADS_KEY ) && Svg::file_sanitizer_can_run();
149
150	/**
151	* Allow Unfiltered Files Upload.
152	*
153	* Determines whether to enable unfiltered file uploads.
154	*
155	* @since 3.0.0
156	*
157	* @param bool $enabled Whether upload is enabled or not.
158	*/
159	$enabled = apply_filters( 'elementor/files/allow_unfiltered_upload', $enabled );
160
161	return $enabled;
162	}
163
164	/**
165	* Handle Elementor WP Media Upload
166	*
167	* Runs on the 'wp_handle_upload_prefilter' filter.
168	*
169	* @since 3.2.0
170	* @access public
171	*
172	* @param $file
173	* @return mixed
174	*/
175	public function handle_elementor_wp_media_upload( $file ) {
176	// If it isn't a file uploaded by Elementor, we do not intervene.
177	if ( ! $this->is_elementor_wp_media_upload() ) {
178	return $file;
179	}
180
181	$result = $this->validate_file( $file );
182
183	if ( is_wp_error( $result ) ) {
184	$file['error'] = $result->get_error_message();
185	}
186
187	return $file;
188	}
189
190	/**
191	* Get File Type Handler
192	*
193	* Initialize the proper file type handler according to the file extension
194	* and assign it to the file type handlers array.
195	*
196	* @since 3.3.0
197	* @access public
198	*
199	* @param string\|null $file_extension - file extension
200	* @return File_Type_Base[]\|File_Type_Base
201	*/
202	public function get_file_type_handlers( $file_extension = null ) {
203	return self::get_items( $this->file_type_handlers, $file_extension );
204	}
205
206	/**
207	* Check filetype and ext
208	*
209	* A workaround for upload validation which relies on a PHP extension (fileinfo)
210	* with inconsistent reporting behaviour.
211	* ref: https://core.trac.wordpress.org/ticket/39550
212	* ref: https://core.trac.wordpress.org/ticket/40175
213	*
214	* @since 3.5.0
215	* @access public
216	*
217	* @param $data
218	* @param $file
219	* @param $filename
220	* @param $mimes
221	*
222	* @return mixed
223	*/
224	public function check_filetype_and_ext( $data, $file, $filename, $mimes ) {
225	if ( ! empty( $data['ext'] ) && ! empty( $data['type'] ) ) {
226	return $data;
227	}
228
229	$wp_file_type = wp_check_filetype( $filename, $mimes );
230
231	$file_type_handlers = $this->get_file_type_handlers();
232
233	if ( isset( $file_type_handlers[ $wp_file_type['ext'] ] ) ) {
234	$file_type_handler = $file_type_handlers[ $wp_file_type['ext'] ];
235
236	$data['ext'] = $file_type_handler->get_file_extension();
237	$data['type'] = $file_type_handler->get_mime_type();
238	}
239
240	return $data;
241	}
242
243	/**
244	* Remove File Or Directory
245	*
246	* Directory is deleted recursively with all of its contents (subdirectories and files).
247	*
248	* @since 3.3.0
249	* @access public
250	*
251	* @param string $path
252	*/
253	public function remove_file_or_dir( $path ) {
254	if ( is_dir( $path ) ) {
255	$this->remove_directory_with_files( $path );
256	} else {
257	unlink( $path );
258	}
259	}
260
261	/**
262	* Create Temp File
263	*
264	* Create a random temporary file.
265	*
266	* @since 3.3.0
267	* @access public
268	*
269	* @param string $file_content
270	* @param string $file_name
271	* @return string\|\WP_Error
272	*/
273	public function create_temp_file( $file_content, $file_name ) {
274	$temp_filename = $this->create_unique_dir() . $file_name;
275
276	file_put_contents( $temp_filename, $file_content ); // phpcs:ignore
277
278	return $temp_filename;
279	}
280
281	/**
282	* Get Temp Directory
283	*
284	* Get the temporary files directory path. If the directory does not exist, this method creates it.
285	*
286	* @since 3.3.0
287	* @access public
288	*
289	* @return string $temp_dir
290	*/
291	public function get_temp_dir() {
292	if ( ! $this->temp_dir ) {
293	$wp_upload_dir = wp_upload_dir();
294
295	$this->temp_dir = implode( DIRECTORY_SEPARATOR, [ $wp_upload_dir['basedir'], 'elementor', 'tmp' ] ) . DIRECTORY_SEPARATOR;
296
297	if ( ! is_dir( $this->temp_dir ) ) {
298	wp_mkdir_p( $this->temp_dir );
299	}
300	}
301
302	return $this->temp_dir;
303	}
304
305	/**
306	* Create Unique Temp Dir
307	*
308	* Create a unique temporary directory
309	*
310	* @since 3.3.0
311	* @access public
312	*
313	* @return string the new directory path
314	*/
315	public function create_unique_dir() {
316	$unique_dir_path = $this->get_temp_dir() . uniqid() . DIRECTORY_SEPARATOR;
317
318	wp_mkdir_p( $unique_dir_path );
319
320	return $unique_dir_path;
321	}
322
323	/**
324	* Register Ajax Actions
325	*
326	* Runs on the 'elementor/ajax/register_actions' hook. Receives the AJAX module as a parameter and registers
327	* callbacks for specified action IDs.
328	*
329	* @since 3.5.0
330	* @access public
331	*
332	* @param Ajax $ajax
333	*/
334	public function register_ajax_actions( Ajax $ajax ) {
335	$ajax->register_ajax_action( 'enable_unfiltered_files_upload', [ $this, 'enable_unfiltered_files_upload' ] );
336	}
337
338	/**
339	* Set Unfiltered Files Upload
340	*
341	* @since 3.5.0
342	* @access public
343	*/
344	public function enable_unfiltered_files_upload() {
345	if ( ! current_user_can( 'manage_options' ) ) {
346	return;
347	}
348
349	update_option( self::UNFILTERED_FILE_UPLOADS_KEY, 1 );
350	}
351
352	/**
353	* Support Unfiltered File Uploads
354	*
355	* When uploading a file within Elementor, this method adds the registered
356	* file types to WordPress' allowed mimes list. This will only happen if the user allowed unfiltered file uploads
357	* in Elementor's settings in the admin dashboard.
358	*
359	* @since 3.5.0
360	* @access public
361	*
362	* @param array $allowed_mimes
363	* @return array allowed mime types
364	*/
365	final public function support_unfiltered_elementor_file_uploads( $allowed_mimes ) {
366	if ( $this->is_elementor_upload() && $this->are_unfiltered_uploads_enabled() ) {
367	foreach ( $this->file_type_handlers as $file_type_handler ) {
368	$allowed_mimes[ $file_type_handler->get_file_extension() ] = $file_type_handler->get_mime_type();
369	}
370	}
371
372	return $allowed_mimes;
373	}
374
375	/**
376	* Set Elementor Upload State
377	*
378	* @since 3.5.0
379	* @access public
380	*
381	* @param $state
382	*/
383	public function set_elementor_upload_state( $state ) {
384	$this->is_elementor_upload = $state;
385	}
386
387	/**
388	* Is Elementor Upload
389	*
390	* This method checks if the current session includes a request to upload files made via Elementor.
391	*
392	* @since 3.5.0
393	* @access private
394	*
395	* @return bool
396	*/
397	private function is_elementor_upload() {
398	return $this->is_elementor_upload \|\| $this->is_elementor_media_upload() \|\| $this->is_elementor_wp_media_upload();
399	}
400
401	/**
402	* Is Elementor Media Upload
403	*
404	* Checks whether the current request includes uploading files via Elementor which are not destined for the Media
405	* Library.
406	*
407	* @since 3.5.0
408	* @access private
409	*
410	* @return bool
411	*/
412	private function is_elementor_media_upload() {
413	// Sometimes `uploadTypeCaller` passed as a GET parameter when using the WP Media Library REST API, where the
414	// whole request body is occupied by the uploaded file.
415	return isset( $_REQUEST['uploadTypeCaller'] ) && 'elementor-media-upload' === $_REQUEST['uploadTypeCaller']; // phpcs:ignore
416	}
417
418	/**
419	* Is Elementor WP Media Upload
420	*
421	* Checks whether the current request is a request to upload files into the WP Media Library via Elementor.
422	*
423	* @since 3.3.0
424	* @access private
425	*
426	* @return bool
427	*/
428	private function is_elementor_wp_media_upload() {
429	return isset( $_REQUEST['uploadTypeCaller'] ) && 'elementor-wp-media-upload' === $_REQUEST['uploadTypeCaller']; // phpcs:ignore
430	}
431
432	/**
433	* Add File Extension To Allowed Extensions List
434	*
435	* @since 3.3.0
436	* @access private
437	*
438	* @param string $file_type
439	*/
440	private function add_file_extension_to_allowed_extensions_list( $file_type ) {
441	$file_handler = $this->file_type_handlers[ $file_type ];
442
443	$file_extension = $file_handler->get_file_extension();
444
445	// Only add the file extension to the list if it doesn't already exist in it.
446	if ( ! in_array( $file_extension, $this->allowed_file_extensions, true ) ) {
447	$this->allowed_file_extensions[] = $file_extension;
448	}
449	}
450
451	/**
452	* Save Base64 as File
453	*
454	* Saves a Base64 string as a .tmp file in Elementor's temporary files directory.
455	*
456	* @since 3.3.0
457	* @access private
458	*
459	* @param $file
460	* @return array\|\WP_Error
461	*/
462	private function save_base64_to_tmp_file( $file ) {
463	$file_content = base64_decode( $file['fileData'] ); // phpcs:ignore
464
465	// If the decode fails
466	if ( ! $file_content ) {
467	return new \WP_Error( 'file_error', self::INVALID_FILE_CONTENT );
468	}
469
470	$temp_filename = $this->create_temp_file( $file_content, $file['fileName'] );
471
472	if ( is_wp_error( $temp_filename ) ) {
473	return $temp_filename;
474	}
475
476	return [
477	// the original uploaded file name
478	'name' => $file['fileName'],
479	// The path to the temporary file
480	'tmp_name' => $temp_filename,
481	];
482	}
483
484	/**
485	* Validate File
486	*
487	* @since 3.3.0
488	* @access private
489	*
490	* @param array $file
491	* @param array $file_extensions Optional
492	* @return bool\|\WP_Error
493	*/
494	private function validate_file( array $file, $file_extensions = [] ) {
495	$uploaded_file_name = isset( $file['name'] ) ? $file['name'] : $file['tmp_name'];
496
497	$file_extension = pathinfo( $uploaded_file_name, PATHINFO_EXTENSION );
498
499	if ( ! $this->is_elementor_wp_media_upload() ) {
500	$is_file_type_allowed = $this->is_file_type_allowed( $file_extension, $file_extensions );
501
502	if ( is_wp_error( $is_file_type_allowed ) ) {
503	return $is_file_type_allowed;
504	}
505	}
506
507	$file_type_handler = $this->get_file_type_handlers( $file_extension );
508
509	// If Elementor does not have a handler for this file type, don't block it.
510	if ( ! $file_type_handler ) {
511	return true;
512	}
513
514	// If there is a File Type Handler for the uploaded file, it means it is a non-standard file type. In this case,
515	// we check if unfiltered file uploads are enabled or not before allowing it.
516	if ( ! self::are_unfiltered_uploads_enabled() ) {
517	return new \WP_Error( Exceptions::FORBIDDEN, esc_html__( 'This file is not allowed for security reasons.', 'elementor' ) );
518	}
519
520	// Here is each file type handler's chance to run its own specific validations
521	return $file_type_handler->validate_file( $file );
522	}
523
524	/**
525	* Is File Type Allowed
526	*
527	* Checks whether the passed file extension is allowed for upload.
528	*
529	* @since 3.5.0
530	* @access private
531	*
532	* @param $file_extension
533	* @param $filtered_file_extensions
534	* @return bool\|\WP_Error
535	*/
536	private function is_file_type_allowed( $file_extension, $filtered_file_extensions ) {
537	$allowed_file_extensions = $this->get_allowed_file_extensions();
538
539	if ( $filtered_file_extensions ) {
540	$allowed_file_extensions = array_intersect( $allowed_file_extensions, $filtered_file_extensions );
541	}
542
543	$is_allowed = false;
544
545	// Check if the file type (extension) is in the allowed extensions list. If it is a non-standard file type (not
546	// enabled by default in WordPress) and unfiltered file uploads are not enabled, it will not be in the allowed
547	// file extensions list.
548	foreach ( $allowed_file_extensions as $allowed_extension ) {
549	if ( preg_match( '/' . $allowed_extension . '/', $file_extension ) ) {
550	$is_allowed = true;
551
552	break;
553	}
554	}
555
556	if ( ! $is_allowed ) {
557	$is_allowed = new \WP_Error( Exceptions::FORBIDDEN, 'Uploading this file type is not allowed.' );
558	}
559
560	return $is_allowed;
561	}
562
563	/**
564	* Remove Directory with Files
565	*
566	* @since 3.3.0
567	* @access private
568	*
569	* @param string $dir
570	* @return bool
571	*/
572	private function remove_directory_with_files( $dir ) {
573	$dir_iterator = new \RecursiveDirectoryIterator( $dir, \RecursiveDirectoryIterator::SKIP_DOTS );
574
575	foreach ( new \RecursiveIteratorIterator( $dir_iterator, \RecursiveIteratorIterator::CHILD_FIRST ) as $name => $item ) {
576	if ( is_dir( $name ) ) {
577	rmdir( $name );
578	} else {
579	unlink( $name );
580	}
581	}
582
583	return rmdir( $dir );
584	}
585
586	/**
587	* Get Allowed File Extensions
588	*
589	* Retrieve an array containing the list of file extensions allowed for upload.
590	*
591	* @since 3.3.0
592	* @access private
593	*
594	* @return array file extension/s
595	*/
596	private function get_allowed_file_extensions() {
597	if ( ! $this->allowed_file_extensions ) {
598	$this->allowed_file_extensions = array_keys( get_allowed_mime_types() );
599
600	foreach ( $this->get_file_type_handlers() as $file_type => $handler ) {
601	if ( $handler->is_upload_allowed() ) {
602	// Add the file extension to the allowed extensions list only if unfiltered files upload is enabled.
603	$this->add_file_extension_to_allowed_extensions_list( $file_type );
604	}
605	}
606	}
607
608	return $this->allowed_file_extensions;
609	}
610
611	public function __construct() {
612	$this->register_file_types();
613
614	add_filter( 'upload_mimes', [ $this, 'support_unfiltered_elementor_file_uploads' ] );
615	add_filter( 'wp_handle_upload_prefilter', [ $this, 'handle_elementor_wp_media_upload' ] );
616	add_filter( 'wp_check_filetype_and_ext', [ $this, 'check_filetype_and_ext' ], 10, 4 );
617
618	// Ajax.
619	add_action( 'elementor/ajax/register_actions', [ $this, 'register_ajax_actions' ] );
620	}
621	}
622