unauth-file-upload.php — Jetpack – WP Security, Backup, Speed, & Growth 14.6.1

jetpack / unauth-file-upload.php

jetpack Last commit date

unauth-file-upload.php

164 lines

1	<?php
2	/**
3	* Unauthenticated File Upload Helper Functions.
4	*
5	* @package automattic/jetpack
6	*/
7
8	namespace Automattic\Jetpack\UnauthFileUpload;
9
10	add_action( 'wp_ajax_jetpack_unauth_file_download', __NAMESPACE__ . '\handle_file_download' );
11	add_filter( 'jetpack_unauth_file_upload_get_file', __NAMESPACE__ . '\get_file_content', 10, 2 );
12	add_filter( 'jetpack_unauth_file_download_url', __NAMESPACE__ . '\filter_get_download_url', 10, 2 );
13
14	/**
15	* Get the file download URL filter callback.
16	*
17	* @param string $url The file download URL.
18	* @param int $file_id The file ID.
19	*
20	* @return string The file download URL.
21	*/
22	function filter_get_download_url( $url, $file_id ) {
23	$nonce = wp_create_nonce( 'jetpack_unauth_file_download_nonce_' . $file_id );
24	return add_query_arg(
25	array(
26	'action' => 'jetpack_unauth_file_download',
27	'file_id' => $file_id,
28	'_wpnonce' => $nonce,
29	),
30	admin_url( 'admin-ajax.php' )
31	);
32	}
33
34	/**
35	* Handle file download requests from the admin page.
36	*
37	* @return never This method never returns as it exits directly
38	*/
39	function handle_file_download() {
40	/**
41	* Check if the file is availabe for download.
42	*
43	* @since 14.6
44	*
45	* @param array $data The script data.
46	*/
47	$blocks_variation = apply_filters( 'jetpack_blocks_variation', \Automattic\Jetpack\Constants::get_constant( 'JETPACK_BLOCKS_VARIATION' ) );
48
49	if ( apply_filters( 'jetpack_unauth_file_download_available', $blocks_variation !== 'beta' ) ) {
50	wp_die( esc_html__( 'File download is not available.', 'jetpack' ) );
51	}
52
53	if ( ! current_user_can( 'edit_pages' ) ) {
54	wp_die( esc_html__( 'Sorry, you are not allowed to access this page.', 'jetpack' ) );
55	}
56
57	$file_id = isset( $_GET['file_id'] ) ? absint( wp_unslash( $_GET['file_id'] ) ) : 0;
58
59	if ( ! $file_id ) {
60	wp_die( esc_html__( 'Invalid file request.', 'jetpack' ) );
61	}
62
63	if (
64	! isset( $_GET['_wpnonce'] ) \|\|
65	! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'jetpack_unauth_file_download_nonce_' . $file_id ) ) {
66	wp_die( esc_html__( 'Invalid nonce.', 'jetpack' ) );
67	}
68
69	/**
70	* Get the file content that we send to the user to download.
71	*
72	* @since 14.6
73	*
74	* @param array $file_content The file content.
75	* @param string $file_id The file ID.
76	*
77	* @return array\|\WP_Error The file array, containing the content, name and type.
78	*/
79	$file = apply_filters( 'jetpack_unauth_file_upload_get_file', array(), $file_id );
80
81	if ( is_wp_error( $file ) \|\| empty( $file ) ) {
82	wp_die( esc_html__( 'Error retrieving file content.', 'jetpack' ) );
83	}
84
85	// Clean output buffer
86	if ( ob_get_length() ) {
87	ob_clean();
88	}
89	// Set headers for download
90	header( 'Content-Type: ' . $file['type'] );
91	// Forcing the file to be downloaded is important to prevent XSS attacks.
92	header( 'Content-Disposition: attachment; filename="' . sanitize_file_name( $file['name'] ) . '"' );
93	header( 'Content-Length: ' . strlen( $file['content'] ) );
94	header( 'Content-Transfer-Encoding: binary' );
95	header( 'Cache-Control: no-cache, must-revalidate, max-age=0' );
96	header( 'Pragma: no-cache' );
97	header( 'Expires: 0' );
98
99	// Output file content and exit
100	echo $file['content']; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Binary file data
101	exit;
102	}
103
104	/**
105	* Get the file content.
106	*
107	* @param array $file_content The file content, name and type.
108	* @param integer $file_id The file ID.
109	* @return array\|\WP_Error The file content, name and type
110	*/
111	function get_file_content( $file_content, $file_id ) {
112	if ( ( new \Automattic\Jetpack\Status\Host() )->is_wpcom_simple() ) {
113	return $file_content;
114	}
115
116	$blog_id = \Jetpack_Options::get_option( 'id' );
117	$request_url = sprintf( '/sites/%d/unauth-file-upload/%s', $blog_id, $file_id );
118
119	$response = \Automattic\Jetpack\Connection\Client::wpcom_json_api_request_as_blog(
120	$request_url,
121	'v2',
122	array(
123	'method' => 'GET',
124	),
125	null,
126	'wpcom'
127	);
128
129	$file_content = wp_remote_retrieve_body( $response );
130
131	if ( is_wp_error( $response ) \|\| empty( $file_content ) ) {
132	return new \WP_Error( 'jetpack_unauth_file_upload_error', esc_html__( 'Error retrieving file content.', 'jetpack' ) );
133	}
134
135	try {
136	$content = json_decode( $file_content, true, 3, defined( 'JSON_THROW_ON_ERROR' ) ? \JSON_THROW_ON_ERROR : 0 ); // phpcs:ignore PHPCompatibility.Constants.NewConstants.json_throw_on_errorFound
137	if ( isset( $content['message'] ) ) {
138	return new \WP_Error( 'jetpack_unauth_file_upload_error', esc_html__( 'Error retrieving file content.', 'jetpack' ) );
139	}
140	} catch ( \Exception $e ) { // phpcs:ignore Generic.CodeAnalysis.EmptyStatement.DetectedCatch
141	// If the file is not JSON, we assume it's a binary file.
142	}
143
144	$content_disposition = wp_remote_retrieve_header( $response, 'content-disposition' );
145	$filename = '';
146	if ( $content_disposition ) {
147	// Match the filename using a regular expression
148	if ( preg_match( '/filename="([^"]+)"/', $content_disposition, $matches ) ) {
149	$filename = $matches[1]; // Extract the filename
150	}
151	}
152
153	$type = wp_remote_retrieve_header( $response, 'content-type' );
154	if ( empty( $type ) ) {
155	$type = 'application/octet-stream'; // Default to binary if no content type is found
156	}
157
158	return array(
159	'content' => $file_content,
160	'type' => $type,
161	'name' => $filename,
162	);
163	}
164