← All changes | app/Services/Libs/FileSystem.php +186 -50 1.95 → 2.2.1 View file →

		@@ -2,8 +2,10 @@
2	2
3	3	namespace FluentBoards\App\Services\Libs;
4	4
5	5	use FluentBoards\Framework\Support\Arr;
	6	+use FluentBoards\App\Services\UploadService;
	7	+use Exception;
6	8
7	9	class FileSystem
8	10	{
9	11	protected $subDir = '';
		@@ -20,11 +22,8 @@
20	22	public function _get($file)
21	23	{
22	24	$arr = explode('/', $file);
23	25	$fileName = end($arr);
24		- if ($this->subDir) {
25		- $fileName = $this->subDir . DIRECTORY_SEPARATOR . $fileName;
26		- }
27	26
28	27	$filePath = $this->getDir() . DIRECTORY_SEPARATOR . $fileName;
29	28
30	29	// Use WordPress Filesystem API
		@@ -54,8 +53,62 @@
54	53	return $uploadDir['basedir'] . DIRECTORY_SEPARATOR . $fbsUploadDir;
55	54	}
56	55
57	56	/**
	57	+ * Legacy Core/Pro entry point: prepare storage, not a verified security boundary.
	58	+ * Rule writes are best effort; $allowProbe is retained for caller compatibility.
	59	+ */
	60	+ public function _installUploadProtectionRules($allowProbe = true)
	61	+ {
	62	+ $directory = (new static())->_getDir();
	63	+ if (!wp_mkdir_p($directory)) {
	64	+ return false;
	65	+ }
	66	+ $path = $directory . '/.htaccess';
	67	+ if (!$this->hasUploadProtectionRules($path)) {
	68	+ if (!function_exists('insert_with_markers')) {
	69	+ require_once ABSPATH . 'wp-admin/includes/misc.php';
	70	+ }
	71	+ insert_with_markers($path, 'Fluent Boards', $this->uploadProtectionRules());
	72	+ }
	73	+ return true;
	74	+ }
	75	+
	76	+ protected function uploadProtectionRules()
	77	+ {
	78	+ return [
	79	+ '<IfModule mod_authz_core.c>',
	80	+ 'Require all denied',
	81	+ '</IfModule>',
	82	+ '<IfModule !mod_authz_core.c>',
	83	+ 'Order deny,allow',
	84	+ 'Deny from all',
	85	+ '</IfModule>',
	86	+ ];
	87	+ }
	88	+
	89	+ protected function hasUploadProtectionRules($path)
	90	+ {
	91	+ if (!is_file($path) || !is_readable($path)) {
	92	+ return false;
	93	+ }
	94	+ $contents = str_replace("\r\n", "\n", file_get_contents($path));
	95	+ if (preg_match_all('/^# BEGIN Fluent Boards\n(.*?)^# END Fluent Boards$/ms', $contents, $blocks) !== 1) {
	96	+ return false;
	97	+ }
	98	+ $rules = array_values(array_filter(array_map('trim', explode("\n", $blocks[1][0])), function ($line) {
	99	+ return $line !== '' && strpos($line, '#') !== 0;
	100	+ }));
	101	+ return $rules === $this->uploadProtectionRules();
	102	+ }
	103	+
	104	+ /** Legacy adapter for older Pro callers; protection is no longer probed over HTTP. */
	105	+ public function _checkUploadProtection($allowProbe = true)
	106	+ {
	107	+ return null;
	108	+ }
	109	+
	110	+ /**
58	111	* Get absolute path of file using custom upload dir name of this application
59	112	* @return string [file path]
60	113	*/
61	114	public function _getAbsolutePathOfFile($file)
		@@ -63,9 +116,79 @@
63	116	return $this->_getDir() . DIRECTORY_SEPARATOR . $file;
64	117	}
65	118
66	119	/**
67		- * Upload files into custom upload dir of this application
	120	+ * Resolve a stored attachment path only when it belongs to Fluent Boards uploads.
	121	+ *
	122	+ * @param string $storedPath
	123	+ * @param int|null $boardId
	124	+ * @return string|null
	125	+ */
	126	+ public function _resolveLocalAttachmentPath($storedPath, $boardId = null)
	127	+ {
	128	+ if (!$storedPath) {
	129	+ return null;
	130	+ }
	131	+
	132	+ $storedFilename = rawurldecode((string) $storedPath);
	133	+ $isBareFilename = $storedFilename !== ''
	134	+ && strpos($storedFilename, '/') === false
	135	+ && strpos($storedFilename, '\\') === false;
	136	+
	137	+ if ($isBareFilename && $boardId === null) {
	138	+ return null;
	139	+ }
	140	+
	141	+ $filePath = $isBareFilename ? null : realpath($storedPath);
	142	+ $allowedDirectory = $this->_getDir();
	143	+ $pluginRoot = realpath($allowedDirectory);
	144	+
	145	+ if (!$pluginRoot) {
	146	+ return null;
	147	+ }
	148	+
	149	+ $pluginRoot = rtrim($pluginRoot, DIRECTORY_SEPARATOR);
	150	+ $allowedRoot = $pluginRoot;
	151	+
	152	+ if ($boardId !== null) {
	153	+ if (!is_int($boardId) && !is_string($boardId)) {
	154	+ return null;
	155	+ }
	156	+
	157	+ $boardId = filter_var($boardId, FILTER_VALIDATE_INT, [
	158	+ 'options' => ['min_range' => 1],
	159	+ ]);
	160	+ if ($boardId === false) {
	161	+ return null;
	162	+ }
	163	+
	164	+ $allowedDirectory .= DIRECTORY_SEPARATOR . 'board_' . $boardId;
	165	+ if (is_link($allowedDirectory)) {
	166	+ return null;
	167	+ }
	168	+
	169	+ $allowedRoot = realpath($allowedDirectory);
	170	+ $expectedBoardRoot = $pluginRoot . DIRECTORY_SEPARATOR . 'board_' . $boardId;
	171	+ if (!$allowedRoot || $allowedRoot !== $expectedBoardRoot) {
	172	+ return null;
	173	+ }
	174	+ }
	175	+
	176	+ if ($isBareFilename) {
	177	+ $filePath = realpath($allowedDirectory . DIRECTORY_SEPARATOR . $storedFilename);
	178	+ }
	179	+
	180	+ if (!$filePath || !$allowedRoot || !is_file($filePath)) {
	181	+ return null;
	182	+ }
	183	+
	184	+ $allowedRoot = rtrim($allowedRoot, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
	185	+
	186	+ return strpos($filePath, $allowedRoot) === 0 ? $filePath : null;
	187	+ }
	188	+
	189	+ /**
	190	+ * Upload request files into the application's custom upload directory.
68	191	* @return array
69	192	*/
70	193	public function _uploadFromRequest()
71	194	{
		@@ -72,42 +195,61 @@
72	195	return $this->_put(FluentBoards('request')->files());
73	196	}
74	197
75	198	/**
76		- * Upload files into custom upload dir of this application
	199	+ * Prepare upload-directory protection before accepting local files.
77	200	* @param array $files
78	201	* @return array
79	202	*/
80	203	public function _put($files)
81	204	{
	205	+ if (!$this->_installUploadProtectionRules()) {
	206	+ throw new Exception(__('Could not create the upload directory. Please check directory permissions.', 'fluent-boards'));
	207	+ }
	208	+
82	209	if (!function_exists('wp_handle_upload')) {
83	210	require_once(ABSPATH . 'wp-admin/includes/file.php');
84	211	}
85	212
86		- $this->overrideUploadDir();
	213	+ $uploadOverrides = [
	214	+ 'test_form' => false,
	215	+ 'mimes' => UploadService::getAllowedMimeMap(),
	216	+ ];
	217	+ $uploadedFiles = [];
	218	+ $files = is_object($files) ? [$files] : (array) $files;
87	219
88		- $uploadOverrides = ['test_form' => false];
89		- $uploadedFiles = []; // Initialize the array
	220	+ $this->_overrideUploadDir();
	221	+ try {
	222	+ foreach ($files as $file) {
	223	+ $filesArray = $file->toArray();
	224	+ $filesArray['tmp_name'] = $file->getRealPath();
	225	+ $extraData = Arr::only($filesArray, ['name', 'size']);
	226	+ if (empty($filesArray['error']) && is_file($filesArray['tmp_name'])) {
	227	+ $filesArray['size'] = filesize($filesArray['tmp_name']);
	228	+ $filesArray['size_in_bytes'] = $filesArray['size'];
	229	+ (new UploadService())->validateFile($filesArray);
	230	+ }
	231	+ $uploadsData = wp_handle_upload($filesArray, $uploadOverrides);
	232	+ if (!empty($uploadsData['error']) || empty($uploadsData['file'])) {
	233	+ throw new Exception($uploadsData['error'] ?? __('File upload failed.', 'fluent-boards'));
	234	+ }
90	235
91		- if(is_object($files)) {
92		- $files = [$files];
	236	+ // Keep WordPress's actual path; callers also expect a legacy bare filename.
	237	+ $uploadsData['full_path'] = $uploadsData['file'];
	238	+ $uploadsData['file'] = basename($uploadsData['file']);
	239	+ $uploadedFiles[] = array_merge($extraData, $uploadsData);
	240	+ }
	241	+ } catch (Exception $exception) {
	242	+ // The batch fails as a whole, so remove files this call already stored.
	243	+ foreach ($uploadedFiles as $uploadedFile) {
	244	+ wp_delete_file($uploadedFile['full_path']);
	245	+ }
	246	+ throw $exception;
	247	+ } finally {
	248	+ remove_filter('wp_handle_upload_prefilter', [$this, '_renameFileName']);
	249	+ remove_filter('upload_dir', [$this, '_setCustomUploadDir']);
93	250	}
94	251
95		- foreach ((array)$files as $file) {
96		-
97		- $filesArray = $file->toArray();
98		-
99		- // tmp_name is the path to the uploaded file which is required for wp_handle_upload, new framework update
100		- // changed the way to get the tmp_name Reference to line # 448 in File.php
101		- $filesArray['tmp_name'] = $file->getRealPath();
102		-
103		- $extraData = Arr::only($filesArray, ['name', 'size']);
104		- $uploadsData = \wp_handle_upload($filesArray, $uploadOverrides);
105		- // Add the full path to the file
106		- $uploadsData['full_path'] = $this->_getAbsolutePathOfFile($uploadsData['file']);
107		- $uploadedFiles[] = array_merge($extraData, $uploadsData);
108		- }
109		-
110	252	return $uploadedFiles;
111	253	}
112	254
113	255	/**
		@@ -133,19 +275,10 @@
133	275	* Register filters for custom upload dir
134	276	*/
135	277	public function _overrideUploadDir()
136	278	{
137		- add_filter('wp_handle_upload_prefilter', function ($file) {
138		- add_filter('upload_dir', [$this, '_setCustomUploadDir']);
139		-
140		- add_filter('wp_handle_upload', function ($fileinfo) {
141		- remove_filter('upload_dir', [$this, '_setCustomUploadDir']);
142		- $fileinfo['file'] = basename($fileinfo['file']);
143		- return $fileinfo;
144		- });
145		-
146		- return $this->_renameFileName($file);
147		- });
	279	+ add_filter('wp_handle_upload_prefilter', [$this, '_renameFileName']);
	280	+ add_filter('upload_dir', [$this, '_setCustomUploadDir']);
148	281	}
149	282
150	283	/**
151	284	* Set plugin's custom upload dir
		@@ -156,19 +289,17 @@
156	289	{
157	290	$fbsUploadDir = apply_filters('fluent_boards/upload_folder_name', FLUENT_BOARDS_UPLOAD_DIR);
158	291
159	292	if ($this->subDir) {
160		- $fbsUploadDir .= DIRECTORY_SEPARATOR . $this->subDir;
161		- if (!is_dir($param['basedir'] . $fbsUploadDir)) {
162		- // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_mkdir -- Creating custom upload subdirectory during upload process, WP_Filesystem not initialized
163		- @mkdir($param['basedir'] . $fbsUploadDir, 0755);
164		- }
	293	+ $fbsUploadDir .= '/' . $this->subDir;
165	294	}
166	295
167		- $param['url'] = $param['baseurl'] . DIRECTORY_SEPARATOR . $fbsUploadDir;
	296	+ $param['url'] = trailingslashit($param['baseurl']) . trim($fbsUploadDir, '/');
	297	+ $param['path'] = trailingslashit($param['basedir']) . trim($fbsUploadDir, '/');
	298	+ if (!wp_mkdir_p($param['path'])) {
	299	+ $param['error'] = __('Could not create the upload directory.', 'fluent-boards');
	300	+ }
168	301
169		- $param['path'] = $param['basedir'] . DIRECTORY_SEPARATOR . $fbsUploadDir;
170		-
171	302	return $param;
172	303	}
173	304
174	305	/**
		@@ -177,10 +308,9 @@
177	308	* @return array $file
178	309	*/
179	310	public function _renameFileName($file)
180	311	{
181		- $currentTimeStamp = (new \DateTimeImmutable())->getTimestamp();
182		- $prefix = $currentTimeStamp . '-';
	312	+ $prefix = wp_generate_uuid4() . '-';
183	313	$prefix = apply_filters('fluent_boards/uploaded_file_name_prefix', $prefix);
184	314	$file['name'] = $prefix . $file['name'];
185	315
186	316	return $file;
		@@ -187,12 +317,18 @@
187	317	}
188	318
189	319	public function _deleteDir($dir)
190	320	{
191		- $dir = $this->getDir() . DIRECTORY_SEPARATOR . $dir;
192		- if (is_dir($dir)) {
193		- $this->deleteContents($dir);
	321	+ $root = realpath($this->_getDir());
	322	+ $path = $root ? $root . DIRECTORY_SEPARATOR . $dir : '';
	323	+ $resolved = $path ? realpath($path) : false;
	324	+ // Never remove the storage root, escape it, or follow a directory symlink.
	325	+ if (!$root || !$resolved || is_link($path)
	326	+ || strpos($resolved, $root . DIRECTORY_SEPARATOR) !== 0) {
	327	+ return false;
194	328	}
	329	+
	330	+ return is_dir($resolved) ? $this->deleteContents($resolved) : false;
195	331	}
196	332
197	333	/**
198	334	* Delete a directory and its content
		@@ -203,9 +339,9 @@
203	339	private function deleteContents($dir)
204	340	{
205	341	$files = array_diff(scandir($dir), ['.', '..']);
206	342	foreach ($files as $file) {
207		- if(is_dir("$dir/$file")) {
	343	+ if (!is_link("$dir/$file") && is_dir("$dir/$file")) {
208	344	// Recursively delete subdirectory
209	345	$this->deleteContents("$dir/$file");
210	346	} else {
211	347	// Delete file