| 1 |
<?php |
| 2 |
/** |
| 3 |
* Unauthenticated File Upload Helper Functions. |
| 4 |
* |
| 5 |
* @package automattic/jetpack |
| 6 |
*/ |
| 7 |
|
| 8 |
namespace Automattic\Jetpack\UnauthFileUpload; |
| 9 |
|
| 10 |
if ( ! defined( 'ABSPATH' ) ) { |
| 11 |
exit( 0 ); |
| 12 |
} |
| 13 |
|
| 14 |
add_action( 'wp_ajax_jetpack_unauth_file_download', __NAMESPACE__ . '\handle_file_download' ); |
| 15 |
add_filter( 'jetpack_unauth_file_upload_get_file', __NAMESPACE__ . '\get_file_content', 10, 2 ); |
| 16 |
add_filter( 'jetpack_unauth_file_download_url', __NAMESPACE__ . '\filter_get_download_url', 10, 2 ); |
| 17 |
|
| 18 |
/** |
| 19 |
* Get the file download URL filter callback. |
| 20 |
* |
| 21 |
* @param string $url The file download URL. |
| 22 |
* @param int $file_id The file ID. |
| 23 |
* |
| 24 |
* @return string The file download URL. |
| 25 |
*/ |
| 26 |
function filter_get_download_url( $url, $file_id ) { |
| 27 |
$nonce = wp_create_nonce( 'jetpack_unauth_file_download_nonce_' . $file_id ); |
| 28 |
return add_query_arg( |
| 29 |
array( |
| 30 |
'action' => 'jetpack_unauth_file_download', |
| 31 |
'file_id' => $file_id, |
| 32 |
'_wpnonce' => $nonce, |
| 33 |
), |
| 34 |
admin_url( 'admin-ajax.php' ) |
| 35 |
); |
| 36 |
} |
| 37 |
|
| 38 |
/** |
| 39 |
* Handle file download requests from the admin page. |
| 40 |
* |
| 41 |
* @return never This method never returns as it exits directly |
| 42 |
*/ |
| 43 |
function handle_file_download() { |
| 44 |
if ( ! current_user_can( 'edit_pages' ) ) { |
| 45 |
wp_die( esc_html__( 'Sorry, you are not allowed to access this page.', 'jetpack' ) ); |
| 46 |
} |
| 47 |
|
| 48 |
$file_id = isset( $_GET['file_id'] ) ? absint( wp_unslash( $_GET['file_id'] ) ) : 0; |
| 49 |
|
| 50 |
if ( ! $file_id ) { |
| 51 |
wp_die( esc_html__( 'Invalid file request.', 'jetpack' ) ); |
| 52 |
} |
| 53 |
|
| 54 |
if ( |
| 55 |
! isset( $_GET['_wpnonce'] ) || |
| 56 |
! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'jetpack_unauth_file_download_nonce_' . $file_id ) ) { |
| 57 |
wp_die( esc_html__( 'Invalid nonce.', 'jetpack' ) ); |
| 58 |
} |
| 59 |
|
| 60 |
/** |
| 61 |
* Get the file content that we send to the user to download. |
| 62 |
* |
| 63 |
* @since 14.6 |
| 64 |
* |
| 65 |
* @param array $file_content The file content. |
| 66 |
* @param string $file_id The file ID. |
| 67 |
* |
| 68 |
* @return array|\WP_Error The file array, containing the content, name and type. |
| 69 |
*/ |
| 70 |
$file = apply_filters( 'jetpack_unauth_file_upload_get_file', array(), $file_id ); |
| 71 |
|
| 72 |
if ( is_wp_error( $file ) || empty( $file ) || ! is_array( $file ) ) { |
| 73 |
wp_die( esc_html__( 'Error retrieving file content.', 'jetpack' ) ); |
| 74 |
} |
| 75 |
|
| 76 |
// Given $file can be manipulated by a filter, make sure everything is as it should be. |
| 77 |
$file['content'] = $file['content'] ?? ''; |
| 78 |
$file['type'] = $file['type'] ?? 'application/octet-stream'; |
| 79 |
$file['name'] = $file['name'] ?? ''; |
| 80 |
|
| 81 |
$is_preview = isset( $_GET['preview'] ) && 'true' === $_GET['preview'] && is_file_type_previewable( $file['type'] ); |
| 82 |
|
| 83 |
// Clean output buffer |
| 84 |
if ( ob_get_length() ) { |
| 85 |
ob_clean(); |
| 86 |
} |
| 87 |
// Set headers for download |
| 88 |
header( 'Content-Type: ' . $file['type'] ); |
| 89 |
|
| 90 |
if ( ! $is_preview ) { |
| 91 |
// Forcing the file to be downloaded is important to prevent XSS attacks. |
| 92 |
header( 'Content-Disposition: attachment; filename="' . sanitize_file_name( $file['name'] ) . '"' ); |
| 93 |
} else { |
| 94 |
// For preview mode, use inline disposition |
| 95 |
header( 'Content-Disposition: inline; filename="' . sanitize_file_name( $file['name'] ) . '"' ); |
| 96 |
} |
| 97 |
header( 'Content-Length: ' . strlen( $file['content'] ) ); |
| 98 |
header( 'Content-Transfer-Encoding: binary' ); |
| 99 |
header( 'Cache-Control: no-cache, must-revalidate, max-age=0' ); |
| 100 |
header( 'Pragma: no-cache' ); |
| 101 |
header( 'Expires: 0' ); |
| 102 |
|
| 103 |
// Output file content and exit |
| 104 |
echo $file['content']; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Binary file data |
| 105 |
exit( 0 ); |
| 106 |
} |
| 107 |
|
| 108 |
/** |
| 109 |
* Get the file content. |
| 110 |
* |
| 111 |
* @param array $file_content The file content, name and type. |
| 112 |
* @param integer $file_id The file ID. |
| 113 |
* @return array|\WP_Error The file content, name and type |
| 114 |
*/ |
| 115 |
function get_file_content( $file_content, $file_id ) { |
| 116 |
if ( ( new \Automattic\Jetpack\Status\Host() )->is_wpcom_simple() ) { |
| 117 |
return $file_content; |
| 118 |
} |
| 119 |
|
| 120 |
$blog_id = \Jetpack_Options::get_option( 'id' ); |
| 121 |
$request_url = sprintf( '/sites/%d/unauth-file-upload/%s', $blog_id, $file_id ); |
| 122 |
|
| 123 |
$response = \Automattic\Jetpack\Connection\Client::wpcom_json_api_request_as_blog( |
| 124 |
$request_url, |
| 125 |
'v2', |
| 126 |
array( |
| 127 |
'method' => 'GET', |
| 128 |
), |
| 129 |
null, |
| 130 |
'wpcom' |
| 131 |
); |
| 132 |
|
| 133 |
$file_content = wp_remote_retrieve_body( $response ); |
| 134 |
|
| 135 |
if ( is_wp_error( $response ) || empty( $file_content ) ) { |
| 136 |
return new \WP_Error( 'jetpack_unauth_file_upload_error', esc_html__( 'Error retrieving file content.', 'jetpack' ) ); |
| 137 |
} |
| 138 |
|
| 139 |
try { |
| 140 |
$content = json_decode( $file_content, true, 3, defined( 'JSON_THROW_ON_ERROR' ) ? \JSON_THROW_ON_ERROR : 0 ); // phpcs:ignore PHPCompatibility.Constants.NewConstants.json_throw_on_errorFound |
| 141 |
if ( isset( $content['message'] ) ) { |
| 142 |
return new \WP_Error( 'jetpack_unauth_file_upload_error', esc_html__( 'Error retrieving file content.', 'jetpack' ) ); |
| 143 |
} |
| 144 |
} catch ( \Exception $e ) { // phpcs:ignore Generic.CodeAnalysis.EmptyStatement.DetectedCatch |
| 145 |
// If the file is not JSON, we assume it's a binary file. |
| 146 |
} |
| 147 |
|
| 148 |
$content_disposition = wp_remote_retrieve_header( $response, 'content-disposition' ); |
| 149 |
$filename = ''; |
| 150 |
if ( $content_disposition ) { |
| 151 |
// Match the filename using a regular expression |
| 152 |
if ( preg_match( '/filename="([^"]+)"/', $content_disposition, $matches ) ) { |
| 153 |
$filename = $matches[1]; // Extract the filename |
| 154 |
} |
| 155 |
} |
| 156 |
|
| 157 |
$type = wp_remote_retrieve_header( $response, 'content-type' ); |
| 158 |
if ( empty( $type ) ) { |
| 159 |
$type = 'application/octet-stream'; // Default to binary if no content type is found |
| 160 |
} |
| 161 |
|
| 162 |
return array( |
| 163 |
'content' => $file_content, |
| 164 |
'type' => $type, |
| 165 |
'name' => $filename, |
| 166 |
); |
| 167 |
} |
| 168 |
|
| 169 |
/** |
| 170 |
* Check which file type is previewable in the browser without downloading them. |
| 171 |
* |
| 172 |
* Allow images with extensions jpg, jpeg, png, gif, webp and pdf files. |
| 173 |
* |
| 174 |
* @param string $file_type The MIME type of the file. |
| 175 |
* @return bool True if the file is previable, false otherwise. |
| 176 |
*/ |
| 177 |
function is_file_type_previewable( $file_type ) { |
| 178 |
$previable_types = array( |
| 179 |
'image/jpeg', |
| 180 |
'image/png', |
| 181 |
'image/gif', |
| 182 |
'image/webp', |
| 183 |
'application/pdf', |
| 184 |
); |
| 185 |
|
| 186 |
return in_array( $file_type, $previable_types, true ); |
| 187 |
} |
| 188 |
|
