| @@ -40,8 +40,27 @@ | ||
| 40 | 40 | 'extendify.com', |
| 41 | 41 | ]; |
| 42 | 42 | |
| 43 | 43 | /** |
| 44 | + * Check whether the url points at one of our image domains. | |
| 45 | + * | |
| 46 | + * @param string $url The image url to check. | |
| 47 | + * @return bool | |
| 48 | + */ | |
| 49 | + public static function isAllowedImageHost($url) | |
| 50 | + { | |
| 51 | + $host = strtolower((string) wp_parse_url($url, PHP_URL_HOST)); | |
| 52 | + | |
| 53 | + foreach (self::$imagesDomains as $domain) { | |
| 54 | + if ($host === $domain || str_ends_with($host, '.' . $domain)) { | |
| 55 | + return true; | |
| 56 | + } | |
| 57 | + } | |
| 58 | + | |
| 59 | + return false; | |
| 60 | + } | |
| 61 | + | |
| 62 | + /** | |
| 44 | 63 | * Upload the image and return the attachment information |
| 45 | 64 | * If the attachment is already there, then return the |
| 46 | 65 | * attachment information only. |
| 47 | 66 | * |
| @@ -77,13 +96,13 @@ | ||
| 77 | 96 | if (!array_key_exists($fileMimeType, $this->mimes)) { |
| 78 | 97 | return new \WP_Error(2002, 'File type is not allowed.'); |
| 79 | 98 | } |
| 80 | 99 | |
| 81 | - if (!preg_match('(' . implode('|', array_map('preg_quote', self::$imagesDomains)) . ')i', $image)) { | |
| 100 | + if (!self::isAllowedImageHost($image)) { | |
| 82 | 101 | $imageUrl = esc_url_raw($image); |
| 83 | 102 | } else { |
| 84 | 103 | $parsedUrl = wp_parse_url($image); |
| 85 | - parse_str($parsedUrl['query'], $params); | |
| 104 | + parse_str(($parsedUrl['query'] ?? ''), $params); | |
| 86 | 105 | |
| 87 | 106 | if (!isset($params['w'])) { |
| 88 | 107 | $params['w'] = 1280; |
| 89 | 108 | } |
| @@ -186,8 +205,10 @@ | ||
| 186 | 205 | if (!empty($metadata)) { |
| 187 | 206 | wp_update_attachment_metadata($attachmentId, $metadata); |
| 188 | 207 | } |
| 189 | 208 | |
| 209 | + update_post_meta($attachmentId, '_extendify_source_url', $image); | |
| 210 | + | |
| 190 | 211 | return $attachmentId; |
| 191 | 212 | } |
| 192 | 213 | |
| 193 | 214 | /** |
| @@ -206,9 +227,9 @@ | ||
| 206 | 227 | * } |
| 207 | 228 | */ |
| 208 | 229 | protected function upload($imageUrl, $imageSha, $fileMimeType) |
| 209 | 230 | { |
| 210 | - $response = wp_remote_get($imageUrl); | |
| 231 | + $response = wp_safe_remote_get($imageUrl); | |
| 211 | 232 | $body = trim(wp_remote_retrieve_body($response)); |
| 212 | 233 | return wp_upload_bits($imageSha . $this->mimes[$fileMimeType], null, $body); |
| 213 | 234 | } |
| 214 | 235 | |
