| @@ -30,8 +30,27 @@ | ||
| 30 | 30 | return $uploadDir['basedir'] . '/' . $folderName; |
| 31 | 31 | } |
| 32 | 32 | |
| 33 | 33 | /** |
| 34 | + * Whether a URL points at a file this application uploaded (renamed by _renameFileName) | |
| 35 | + * @return bool | |
| 36 | + */ | |
| 37 | + public function _isUploadedFileUrl($url) | |
| 38 | + { | |
| 39 | + $name = is_string($url) ? basename((string) wp_parse_url($url, PHP_URL_PATH)) : ''; | |
| 40 | + | |
| 41 | + // The prefix also rules out the folder's own .htaccess and index.php. | |
| 42 | + if (!preg_match('/^fluentbooking-[a-f0-9]{32}-fluentbooking-/', $name)) { | |
| 43 | + return false; | |
| 44 | + } | |
| 45 | + | |
| 46 | + $folderName = apply_filters('fluent_booking/upload_folder_name', 'fluent-booking'); | |
| 47 | + $expected = wp_upload_dir()['baseurl'] . '/' . $folderName . '/' . $name; | |
| 48 | + | |
| 49 | + return set_url_scheme($url) === set_url_scheme($expected) && file_exists($this->_getDir() . '/' . $name); | |
| 50 | + } | |
| 51 | + | |
| 52 | + /** | |
| 34 | 53 | * Get absolute path of file using custom upload dir name of this application |
| 35 | 54 | * @return string [file path] |
| 36 | 55 | */ |
| 37 | 56 | public function _getAbsolutePathOfFile($file) |
| @@ -119,9 +138,9 @@ | ||
| 119 | 138 | |
| 120 | 139 | $param['path'] = $param['basedir'] .'/'. $folderName; |
| 121 | 140 | |
| 122 | 141 | if (!is_dir($param['path'])) { |
| 123 | - mkdir($param['path'], 0755); | |
| 142 | + mkdir($param['path'], 0755); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_mkdir | |
| 124 | 143 | file_put_contents( |
| 125 | 144 | $param['basedir'].'/'.$folderName.'/.htaccess', |
| 126 | 145 | file_get_contents(__DIR__.'/Stubs/htaccess.stub') |
| 127 | 146 | ); |
