← All changes | importExtensions/BuddyImport.php +13 -5 1.4.3 → 2.1 View file →

		@@ -34,9 +34,9 @@
34	34	function buddy_import_function($data_array, $importas,$uID) {
35	35
36	36	global $wpdb;
37	37	foreach($data_array as $data_key => $data_value) {
38		- $get_buddy_fields = $wpdb->get_results($wpdb->prepare("select type , name from {$wpdb->prefix}bp_xprofile_fields where id= $data_key" ), ARRAY_A);
	38	+ $get_buddy_fields = $wpdb->get_results($wpdb->prepare("select type , name from {$wpdb->prefix}bp_xprofile_fields where id= %d", absint($data_key) ), ARRAY_A);
39	39	foreach($get_buddy_fields as $buddy_fields){
40	40	$field_type = $buddy_fields['type'];
41	41	if($field_type == 'multiselect_custom_post_type')
42	42	{
		@@ -66,14 +66,18 @@
66	66	{
67	67	$image_name = $data_value;
68	68	$upload_path = wp_upload_dir();
69	69	$path = $upload_path['basedir'].'/bpxcftr-profile-uploads/'.$uID.'/image';
70		- $base_name=basename($image_name);
	70	+ $base_name = sanitize_file_name(basename((string) wp_parse_url($image_name, PHP_URL_PATH)));
	71	+ $file_type = wp_check_filetype($base_name);
	72	+ if (empty($file_type['type']) || strpos($file_type['type'], 'image/') !== 0) {
	73	+ continue 2;
	74	+ }
71	75	wp_mkdir_p($path);
72	76	$data = file_get_contents($image_name);
73	77	$new = $path.'/'.$base_name;
74	78	file_put_contents($new, $data);
75		- $image_path = "bpxcftr-profile-uploads/$uID/image/".basename($image_name);
	79	+ $image_path = "bpxcftr-profile-uploads/$uID/image/".$base_name;
76	80	$data_value = $image_path;
77	81	}
78	82	elseif($field_type == 'file')
79	83	{
		@@ -79,14 +83,18 @@
79	83	{
80	84	$file_name = $data_value;
81	85	$upload_path = wp_upload_dir();
82	86	$path = $upload_path['basedir'].'/bpxcftr-profile-uploads/'.$uID.'/file';
83		- $base_name=basename($file_name);
	87	+ $base_name = sanitize_file_name(basename((string) wp_parse_url($file_name, PHP_URL_PATH)));
	88	+ $file_type = wp_check_filetype($base_name);
	89	+ if (empty($file_type['type'])) {
	90	+ continue 2;
	91	+ }
84	92	wp_mkdir_p($path);
85	93	$data = file_get_contents($file_name);
86	94	$new = $path.'/'.$base_name;
87	95	file_put_contents($new, $data);
88		- $file_path = "bpxcftr-profile-uploads/$uID/file/".basename($file_name);
	96	+ $file_path = "bpxcftr-profile-uploads/$uID/file/".$base_name;
89	97	$data_value = $file_path;
90	98	}
91	99	}
92	100	$wpdb->insert("{$wpdb->prefix}bp_xprofile_data", array('field_id' => $data_key,'user_id' => $uID,'value' => $data_value));