elementor / core / files / uploads-manager.php

uploads-manager.php in Elementor Website Builder – more than just a page builder 3.7.0, at core/files/uploads-manager.php

653 lines 17.1 KB

Raw Download Zip

1	<?php
2	namespace Elementor\Core\Files;
3
4	use Elementor\Core\Base\Base_Object;
5	use Elementor\Core\Common\Modules\Ajax\Module as Ajax;
6	use Elementor\Core\Files\File_Types\Base as File_Type_Base;
7	use Elementor\Core\Files\File_Types\Json;
8	use Elementor\Core\Files\File_Types\Svg;
9	use Elementor\Core\Files\File_Types\Zip;
10	use Elementor\Core\Utils\Exceptions;
11
12	if ( ! defined( 'ABSPATH' ) ) {
13	exit; // Exit if accessed directly.
14	}
15
16	/**
17	* Elementor uploads manager.
18	*
19	* Elementor uploads manager handler class is responsible for handling file uploads that are not done with WP Media.
20	*
21	* @since 3.3.0
22	*/
23	class Uploads_Manager extends Base_Object {
24
25	const UNFILTERED_FILE_UPLOADS_KEY = 'elementor_unfiltered_files_upload';
26	const INVALID_FILE_CONTENT = 'Invalid Content In File';
27
28	/**
29	* @var File_Type_Base[]
30	*/
31	private $file_type_handlers = [];
32
33	private $allowed_file_extensions;
34
35	/**
36	* @var bool
37	*/
38	private $is_elementor_upload = false;
39
40	/**
41	* @var string
42	*/
43	private $temp_dir;
44
45	/**
46	* Register File Types
47	*
48	* To Add a new file type to Elementor, with its own handling logic, you need to add it to the $file_types array here.
49	*
50	* @since 3.3.0
51	* @access public
52	*/
53	public function register_file_types() {
54	// All file types that have handlers should be included here.
55	$file_types = [
56	'json' => new Json(),
57	'zip' => new Zip(),
58	'svg' => new Svg(),
59	];
60
61	foreach ( $file_types as $file_type => $file_handler ) {
62	$this->file_type_handlers[ $file_type ] = $file_handler;
63	}
64	}
65
66	/**
67	* Extract and Validate Zip
68	*
69	* This method accepts a $file array (which minimally should include a 'tmp_name')
70	*
71	* @since 3.3.0
72	* @access public
73	*
74	* @param string $file_path
75	* @param array $allowed_file_types
76	* @return array\|\WP_Error
77	*/
78	public function extract_and_validate_zip( $file_path, $allowed_file_types = null ) {
79	$result = [];
80
81	/** @var Zip $zip_handler - File Type */
82	$zip_handler = $this->file_type_handlers['zip'];
83
84	// Returns an array of file paths.
85	$extracted = $zip_handler->extract( $file_path, $allowed_file_types );
86
87	// If there are no extracted file names, no files passed the extraction validation.
88	if ( empty( $extracted['files'] ) ) {
89	// TODO: Decide what to do if no files passed the extraction validation
90	return new \WP_Error( 'file_error', self::INVALID_FILE_CONTENT );
91	}
92
93	$result['extraction_directory'] = $extracted['extraction_directory'];
94
95	foreach ( $extracted['files'] as $extracted_file_path ) {
96	// Each file is an array with a 'name' (file path) property.
97	if ( ! is_wp_error( $this->validate_file( [ 'tmp_name' => $extracted_file_path ] ) ) ) {
98	$result['files'][] = $extracted_file_path;
99	}
100	}
101
102	return $result;
103	}
104
105	/**
106	* Handle Elementor Upload
107	*
108	* This method receives a $file array. If the received file is a Base64 string, the $file array should include a
109	* 'fileData' property containing the string, which is decoded and has its contents stored in a temporary file.
110	* If the $file parameter passed is a standard $file array, the 'name' and 'tmp_name' properties are used for
111	* validation.
112	*
113	* The file goes through validation; if it passes validation, the file is returned. Otherwise, an error is returned.
114	*
115	* @since 3.3.0
116	* @access public
117	*
118	* @param array $file
119	* @param array $allowed_file_extensions Optional. an array of file types that are allowed to pass validation for each
120	* upload.
121	* @return array\|\WP_Error
122	*/
123	public function handle_elementor_upload( array $file, $allowed_file_extensions = null ) {
124	// If $file['fileData'] is set, it signals that the passed file is a Base64 string that needs to be decoded and
125	// saved to a temporary file.
126	if ( isset( $file['fileData'] ) ) {
127	$file = $this->save_base64_to_tmp_file( $file );
128	}
129
130	$validation_result = $this->validate_file( $file, $allowed_file_extensions );
131
132	if ( is_wp_error( $validation_result ) ) {
133	return $validation_result;
134	}
135
136	return $file;
137	}
138
139	/**
140	* are Unfiltered Uploads Enabled
141	*
142	* @since 3.5.0
143	* @access public
144	*
145	* @return bool
146	*/
147	final public static function are_unfiltered_uploads_enabled() {
148	$enabled = ! ! get_option( self::UNFILTERED_FILE_UPLOADS_KEY ) && Svg::file_sanitizer_can_run();
149
150	/**
151	* Allow Unfiltered Files Upload.
152	*
153	* Determines whether to enable unfiltered file uploads.
154	*
155	* @since 3.0.0
156	*
157	* @param bool $enabled Whether upload is enabled or not.
158	*/
159	$enabled = apply_filters( 'elementor/files/allow_unfiltered_upload', $enabled );
160
161	return $enabled;
162	}
163
164	/**
165	* Handle Elementor WP Media Upload
166	*
167	* Runs on the 'wp_handle_upload_prefilter' filter.
168	*
169	* @since 3.2.0
170	* @access public
171	*
172	* @param $file
173	* @return mixed
174	*/
175	public function handle_elementor_wp_media_upload( $file ) {
176	// If it isn't a file uploaded by Elementor, we do not intervene.
177	if ( ! $this->is_elementor_wp_media_upload() ) {
178	return $file;
179	}
180
181	$result = $this->validate_file( $file );
182
183	if ( is_wp_error( $result ) ) {
184	$file['error'] = $result->get_error_message();
185	}
186
187	return $file;
188	}
189
190	/**
191	* Get File Type Handler
192	*
193	* Initialize the proper file type handler according to the file extension
194	* and assign it to the file type handlers array.
195	*
196	* @since 3.3.0
197	* @access public
198	*
199	* @param string\|null $file_extension - file extension
200	* @return File_Type_Base[]\|File_Type_Base
201	*/
202	public function get_file_type_handlers( $file_extension = null ) {
203	return self::get_items( $this->file_type_handlers, $file_extension );
204	}
205
206	/**
207	* Check filetype and ext
208	*
209	* A workaround for upload validation which relies on a PHP extension (fileinfo)
210	* with inconsistent reporting behaviour.
211	* ref: https://core.trac.wordpress.org/ticket/39550
212	* ref: https://core.trac.wordpress.org/ticket/40175
213	*
214	* @since 3.5.0
215	* @access public
216	*
217	* @param $data
218	* @param $file
219	* @param $filename
220	* @param $mimes
221	*
222	* @return mixed
223	*/
224	public function check_filetype_and_ext( $data, $file, $filename, $mimes ) {
225	if ( ! empty( $data['ext'] ) && ! empty( $data['type'] ) ) {
226	return $data;
227	}
228
229	$wp_file_type = wp_check_filetype( $filename, $mimes );
230
231	$file_type_handlers = $this->get_file_type_handlers();
232
233	if ( isset( $file_type_handlers[ $wp_file_type['ext'] ] ) ) {
234	$file_type_handler = $file_type_handlers[ $wp_file_type['ext'] ];
235
236	$data['ext'] = $file_type_handler->get_file_extension();
237	$data['type'] = $file_type_handler->get_mime_type();
238	}
239
240	return $data;
241	}
242
243	/**
244	* Remove File Or Directory
245	*
246	* Directory is deleted recursively with all of its contents (subdirectories and files).
247	*
248	* @since 3.3.0
249	* @access public
250	*
251	* @param string $path
252	*/
253	public function remove_file_or_dir( $path ) {
254	if ( is_dir( $path ) ) {
255	$this->remove_directory_with_files( $path );
256	} else {
257	unlink( $path );
258	}
259	}
260
261	/**
262	* Create Temp File
263	*
264	* Create a random temporary file.
265	*
266	* @since 3.3.0
267	* @access public
268	*
269	* @param string $file_content
270	* @param string $file_name
271	* @return string\|\WP_Error
272	*/
273	public function create_temp_file( $file_content, $file_name ) {
274	$temp_filename = $this->create_unique_dir() . $file_name;
275
276	/**
277	* Temp File Path
278	*
279	* Allows modifying the full path of the temporary file.
280	*
281	* @since 3.7.0
282	*
283	* @param string full path to file
284	*/
285	$temp_filename = apply_filters( 'elementor/files/temp-file-path', $temp_filename );
286
287	file_put_contents( $temp_filename, $file_content ); // phpcs:ignore
288
289	return $temp_filename;
290	}
291
292	/**
293	* Get Temp Directory
294	*
295	* Get the temporary files directory path. If the directory does not exist, this method creates it.
296	*
297	* @since 3.3.0
298	* @access public
299	*
300	* @return string $temp_dir
301	*/
302	public function get_temp_dir() {
303	if ( ! $this->temp_dir ) {
304	$wp_upload_dir = wp_upload_dir();
305
306	$temp_dir = implode( DIRECTORY_SEPARATOR, [ $wp_upload_dir['basedir'], 'elementor', 'tmp' ] ) . DIRECTORY_SEPARATOR;
307
308	/**
309	* Temp File Path
310	*
311	* Allows modifying the full path of the temporary file.
312	*
313	* @since 3.7.0
314	*
315	* @param string temporary directory
316	*/
317	$this->temp_dir = apply_filters( 'elementor/files/temp-dir', $temp_dir );
318
319	if ( ! is_dir( $this->temp_dir ) ) {
320	wp_mkdir_p( $this->temp_dir );
321	}
322	}
323
324	return $this->temp_dir;
325	}
326
327	/**
328	* Create Unique Temp Dir
329	*
330	* Create a unique temporary directory
331	*
332	* @since 3.3.0
333	* @access public
334	*
335	* @return string the new directory path
336	*/
337	public function create_unique_dir() {
338	$unique_dir_path = $this->get_temp_dir() . uniqid() . DIRECTORY_SEPARATOR;
339
340	wp_mkdir_p( $unique_dir_path );
341
342	return $unique_dir_path;
343	}
344
345	/**
346	* Register Ajax Actions
347	*
348	* Runs on the 'elementor/ajax/register_actions' hook. Receives the AJAX module as a parameter and registers
349	* callbacks for specified action IDs.
350	*
351	* @since 3.5.0
352	* @access public
353	*
354	* @param Ajax $ajax
355	*/
356	public function register_ajax_actions( Ajax $ajax ) {
357	$ajax->register_ajax_action( 'enable_unfiltered_files_upload', [ $this, 'enable_unfiltered_files_upload' ] );
358	}
359
360	/**
361	* Set Unfiltered Files Upload
362	*
363	* @since 3.5.0
364	* @access public
365	*/
366	public function enable_unfiltered_files_upload() {
367	if ( ! current_user_can( 'manage_options' ) ) {
368	return;
369	}
370
371	update_option( self::UNFILTERED_FILE_UPLOADS_KEY, 1 );
372	}
373
374	/**
375	* Support Unfiltered File Uploads
376	*
377	* When uploading a file within Elementor, this method adds the registered
378	* file types to WordPress' allowed mimes list. This will only happen if the user allowed unfiltered file uploads
379	* in Elementor's settings in the admin dashboard.
380	*
381	* @since 3.5.0
382	* @access public
383	*
384	* @param array $allowed_mimes
385	* @return array allowed mime types
386	*/
387	final public function support_unfiltered_elementor_file_uploads( $allowed_mimes ) {
388	if ( $this->is_elementor_upload() && $this->are_unfiltered_uploads_enabled() ) {
389	foreach ( $this->file_type_handlers as $file_type_handler ) {
390	$allowed_mimes[ $file_type_handler->get_file_extension() ] = $file_type_handler->get_mime_type();
391	}
392	}
393
394	return $allowed_mimes;
395	}
396
397	/**
398	* Set Elementor Upload State
399	*
400	* @since 3.5.0
401	* @access public
402	*
403	* @param $state
404	*/
405	public function set_elementor_upload_state( $state ) {
406	$this->is_elementor_upload = $state;
407	}
408
409	/**
410	* Is Elementor Upload
411	*
412	* This method checks if the current session includes a request to upload files made via Elementor.
413	*
414	* @since 3.5.0
415	* @access private
416	*
417	* @return bool
418	*/
419	private function is_elementor_upload() {
420	return $this->is_elementor_upload \|\| $this->is_elementor_media_upload() \|\| $this->is_elementor_wp_media_upload();
421	}
422
423	/**
424	* Is Elementor Media Upload
425	*
426	* Checks whether the current request includes uploading files via Elementor which are not destined for the Media
427	* Library.
428	*
429	* @since 3.5.0
430	* @access public
431	*
432	* @return bool
433	*/
434	public function is_elementor_media_upload() {
435	// Sometimes `uploadTypeCaller` passed as a GET parameter when using the WP Media Library REST API, where the
436	// whole request body is occupied by the uploaded file.
437	return isset( $_REQUEST['uploadTypeCaller'] ) && 'elementor-media-upload' === $_REQUEST['uploadTypeCaller']; // phpcs:ignore
438	}
439
440	/**
441	* Is Elementor WP Media Upload
442	*
443	* Checks whether the current request is a request to upload files into the WP Media Library via Elementor.
444	*
445	* @since 3.3.0
446	* @access private
447	*
448	* @return bool
449	*/
450	private function is_elementor_wp_media_upload() {
451	return isset( $_REQUEST['uploadTypeCaller'] ) && 'elementor-wp-media-upload' === $_REQUEST['uploadTypeCaller']; // phpcs:ignore
452	}
453
454	/**
455	* Add File Extension To Allowed Extensions List
456	*
457	* @since 3.3.0
458	* @access private
459	*
460	* @param string $file_type
461	*/
462	private function add_file_extension_to_allowed_extensions_list( $file_type ) {
463	$file_handler = $this->file_type_handlers[ $file_type ];
464
465	$file_extension = $file_handler->get_file_extension();
466
467	// Only add the file extension to the list if it doesn't already exist in it.
468	if ( ! in_array( $file_extension, $this->allowed_file_extensions, true ) ) {
469	$this->allowed_file_extensions[] = $file_extension;
470	}
471	}
472
473	/**
474	* Save Base64 as File
475	*
476	* Saves a Base64 string as a .tmp file in Elementor's temporary files directory.
477	*
478	* @since 3.3.0
479	* @access private
480	*
481	* @param $file
482	* @return array\|\WP_Error
483	*/
484	private function save_base64_to_tmp_file( $file ) {
485	$file_content = base64_decode( $file['fileData'] ); // phpcs:ignore
486
487	// If the decode fails
488	if ( ! $file_content ) {
489	return new \WP_Error( 'file_error', self::INVALID_FILE_CONTENT );
490	}
491
492	$temp_filename = $this->create_temp_file( $file_content, $file['fileName'] );
493
494	if ( is_wp_error( $temp_filename ) ) {
495	return $temp_filename;
496	}
497
498	return [
499	// the original uploaded file name
500	'name' => $file['fileName'],
501	// The path to the temporary file
502	'tmp_name' => $temp_filename,
503	];
504	}
505
506	/**
507	* Validate File
508	*
509	* @since 3.3.0
510	* @access private
511	*
512	* @param array $file
513	* @param array $file_extensions Optional
514	* @return bool\|\WP_Error
515	*/
516	private function validate_file( array $file, $file_extensions = [] ) {
517	$uploaded_file_name = isset( $file['name'] ) ? $file['name'] : $file['tmp_name'];
518
519	$file_extension = pathinfo( $uploaded_file_name, PATHINFO_EXTENSION );
520
521	if ( ! $this->is_elementor_wp_media_upload() ) {
522	$is_file_type_allowed = $this->is_file_type_allowed( $file_extension, $file_extensions );
523
524	if ( is_wp_error( $is_file_type_allowed ) ) {
525	return $is_file_type_allowed;
526	}
527	}
528
529	$file_type_handler = $this->get_file_type_handlers( $file_extension );
530
531	// If Elementor does not have a handler for this file type, don't block it.
532	if ( ! $file_type_handler ) {
533	return true;
534	}
535
536	// If there is a File Type Handler for the uploaded file, it means it is a non-standard file type. In this case,
537	// we check if unfiltered file uploads are enabled or not before allowing it.
538	if ( ! self::are_unfiltered_uploads_enabled() ) {
539	return new \WP_Error( Exceptions::FORBIDDEN, esc_html__( 'This file is not allowed for security reasons.', 'elementor' ) );
540	}
541
542	// Here is each file type handler's chance to run its own specific validations
543	return $file_type_handler->validate_file( $file );
544	}
545
546	/**
547	* Is File Type Allowed
548	*
549	* Checks whether the passed file extension is allowed for upload.
550	*
551	* @since 3.5.0
552	* @access private
553	*
554	* @param $file_extension
555	* @param $filtered_file_extensions
556	* @return bool\|\WP_Error
557	*/
558	private function is_file_type_allowed( $file_extension, $filtered_file_extensions ) {
559	$allowed_file_extensions = $this->get_allowed_file_extensions();
560
561	if ( $filtered_file_extensions ) {
562	$allowed_file_extensions = array_intersect( $allowed_file_extensions, $filtered_file_extensions );
563	}
564
565	$is_allowed = false;
566
567	// Check if the file type (extension) is in the allowed extensions list. If it is a non-standard file type (not
568	// enabled by default in WordPress) and unfiltered file uploads are not enabled, it will not be in the allowed
569	// file extensions list.
570	foreach ( $allowed_file_extensions as $allowed_extension ) {
571	if ( preg_match( '/' . $allowed_extension . '/', $file_extension ) ) {
572	$is_allowed = true;
573
574	break;
575	}
576	}
577
578	if ( ! $is_allowed ) {
579	$is_allowed = new \WP_Error( Exceptions::FORBIDDEN, 'Uploading this file type is not allowed.' );
580	}
581
582	/**
583	* Elementor File Type Allowed
584	*
585	* Allows setting file types
586	*
587	* @since 3.5.0
588	*
589	* @param bool\|\WP_Error $is_allowed
590	*/
591	return apply_filters( 'elementor/files/allow-file-type/' . $file_extension, $is_allowed );
592	}
593
594	/**
595	* Remove Directory with Files
596	*
597	* @since 3.3.0
598	* @access private
599	*
600	* @param string $dir
601	* @return bool
602	*/
603	private function remove_directory_with_files( $dir ) {
604	$dir_iterator = new \RecursiveDirectoryIterator( $dir, \RecursiveDirectoryIterator::SKIP_DOTS );
605
606	foreach ( new \RecursiveIteratorIterator( $dir_iterator, \RecursiveIteratorIterator::CHILD_FIRST ) as $name => $item ) {
607	if ( is_dir( $name ) ) {
608	rmdir( $name );
609	} else {
610	unlink( $name );
611	}
612	}
613
614	return rmdir( $dir );
615	}
616
617	/**
618	* Get Allowed File Extensions
619	*
620	* Retrieve an array containing the list of file extensions allowed for upload.
621	*
622	* @since 3.3.0
623	* @access private
624	*
625	* @return array file extension/s
626	*/
627	private function get_allowed_file_extensions() {
628	if ( ! $this->allowed_file_extensions ) {
629	$this->allowed_file_extensions = array_keys( get_allowed_mime_types() );
630
631	foreach ( $this->get_file_type_handlers() as $file_type => $handler ) {
632	if ( $handler->is_upload_allowed() ) {
633	// Add the file extension to the allowed extensions list only if unfiltered files upload is enabled.
634	$this->add_file_extension_to_allowed_extensions_list( $file_type );
635	}
636	}
637	}
638
639	return $this->allowed_file_extensions;
640	}
641
642	public function __construct() {
643	$this->register_file_types();
644
645	add_filter( 'upload_mimes', [ $this, 'support_unfiltered_elementor_file_uploads' ] );
646	add_filter( 'wp_handle_upload_prefilter', [ $this, 'handle_elementor_wp_media_upload' ] );
647	add_filter( 'wp_check_filetype_and_ext', [ $this, 'check_filetype_and_ext' ], 10, 4 );
648
649	// Ajax.
650	add_action( 'elementor/ajax/register_actions', [ $this, 'register_ajax_actions' ] );
651	}
652	}
653