king-addons / includes / widgets / Form_Builder / helpers / Upload_Email_File.php

Upload_Email_File.php in King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder 51.1.36, at includes/widgets/Form_Builder/helpers/Upload_Email_File.php

253 lines 8.6 KB

Raw Download Zip

1	<?php
2
3	namespace King_Addons;
4
5	if (!defined('ABSPATH')) {
6	exit;
7	}
8
9	class Upload_Email_File
10	{
11	public function __construct()
12	{
13	add_action('wp_ajax_king_addons_upload_file', [$this, 'handle_file_upload']);
14	add_action('wp_ajax_nopriv_king_addons_upload_file', [$this, 'handle_file_upload']);
15	}
16
17	public function handle_file_upload()
18	{
19	if (!isset($_POST['king_addons_fb_nonce']) \|\| !wp_verify_nonce($_POST['king_addons_fb_nonce'], 'king-addons-js')) {
20	wp_send_json_error(array(
21	'message' => esc_html__('Security check failed.', 'king-addons'),
22	));
23	}
24
25	// Add capability check
26	if (!current_user_can('upload_files')) {
27	wp_send_json_error(array(
28	'message' => esc_html__('Insufficient permissions to upload files.', 'king-addons'),
29	));
30	}
31
32	$max_file_size = isset($_POST['max_file_size']) ? floatval(sanitize_text_field($_POST['max_file_size'])) : 0;
33	if ($max_file_size <= 0) {
34	$max_file_size = wp_max_upload_size() / pow(1024, 2);
35	}
36
37	if (isset($_FILES['uploaded_file'])) {
38	$file = $_FILES['uploaded_file'];
39
40	if ($file['size'] > $max_file_size * 1024 * 1024) {
41	wp_send_json_error(array(
42	'cause' => 'filesize',
43	'sizes' => [
44	$max_file_size * 1024 * 1024,
45	$file['size']
46	],
47	'message' => 'File size exceeds the allowed limit.'
48	));
49	}
50
51	if (!$this->file_validity($file)) {
52	wp_send_json_error(array(
53	'cause' => 'filetype',
54	'message' => esc_html__('File type is not valid.', 'king-addons')
55	));
56	}
57
58	// Additional MIME type validation
59	$allowed_mime_types = [
60	'image/jpeg', 'image/jpg', 'image/png', 'image/gif',
61	'application/pdf', 'application/msword', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
62	'application/vnd.ms-powerpoint', 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
63	'application/vnd.oasis.opendocument.text', 'video/avi', 'audio/ogg', 'video/mp4', 'audio/mp3',
64	'video/mpeg', 'audio/wav', 'video/x-ms-wmv', 'text/plain'
65	];
66
67	if (!in_array($file['type'], $allowed_mime_types)) {
68	wp_send_json_error(array(
69	'cause' => 'mime_type',
70	'message' => esc_html__('File MIME type is not allowed.', 'king-addons')
71	));
72	}
73
74	// Security check: Scan file content for malicious patterns
75	if (!$this->is_file_safe($file['tmp_name'])) {
76	wp_send_json_error(array(
77	'cause' => 'security',
78	'message' => esc_html__('File contains potentially malicious content.', 'king-addons')
79	));
80	}
81
82	if ('click' == $_POST['triggering_event']) {
83	$upload_dir = wp_upload_dir();
84	$upload_path = $upload_dir['basedir'] . '/king-addons/forms';
85
86	wp_mkdir_p($upload_path);
87
88	$filename = wp_unique_filename($upload_path, $file['name']);
89
90	if (move_uploaded_file($file['tmp_name'], $upload_path . '/' . $filename)) {
91	wp_send_json_success(array(
92	'url' => $upload_dir['baseurl'] . '/king-addons/forms/' . $filename
93	));
94	} else {
95	wp_send_json_error(array(
96	'message' => esc_html__('Failed to upload the file.', 'king-addons')
97	));
98	}
99	} else {
100	wp_send_json_success(array(
101	'message' => esc_html__('File validation passed', 'king-addons')
102	));
103	}
104	}
105
106	if ('click' == $_POST['triggering_event']) {
107
108	$upload_dir = wp_upload_dir();
109	$upload_path = $upload_dir['basedir'] . '/king-addons/forms';
110
111	wp_mkdir_p($upload_path);
112
113	wp_send_json_error(array(
114	'message' => esc_html__('No file was uploaded.', 'king-addons'),
115	'files' => $_FILES['uploaded_file']
116	));
117	}
118	}
119
120	private function file_validity($file)
121	{
122	$whitelist = ['jpg', 'jpeg', 'png', 'gif', 'pdf', 'doc', 'docx', 'ppt', 'pptx', 'odt', 'avi', 'ogg', 'm4a', 'mov', 'mp3', 'mp4', 'mpg', 'wav', 'wmv', 'txt'];
123
124	if (empty($_POST['allowed_file_types'])) {
125	$allowed_file_types = 'jpg,jpeg,png,gif,pdf,doc,docx,ppt,pptx,odt,avi,ogg,m4a,mov,mp3,mp4,mpg,wav,wmv,txt';
126	} else {
127	$allowed_file_types = $_POST['allowed_file_types'];
128	}
129
130	if (!wp_check_filetype($file['name'])['ext']) {
131	return 'mailto:bug@kingaddons.com?subject=Bug Report - King Addons&body=Please describe the issue';
132	}
133
134	$f_extension = pathinfo($file['name'], PATHINFO_EXTENSION);
135	$f_extension = strtolower($f_extension);
136
137	$allowed_file_types = explode(',', $allowed_file_types);
138	$allowed_file_types = array_map('trim', $allowed_file_types);
139	$allowed_file_types = array_map('strtolower', $allowed_file_types);
140
141	return (in_array($f_extension, $allowed_file_types) && in_array($f_extension, $whitelist) && !in_array($f_extension, $this->get_exclusion_list()));
142	}
143
144	private function get_exclusion_list()
145	{
146	static $exclusionlist = false;
147	if (!$exclusionlist) {
148	$exclusionlist = [
149	'php',
150	'php3',
151	'php4',
152	'php5',
153	'php6',
154	'phps',
155	'php7',
156	'phtml',
157	'shtml',
158	'pht',
159	'swf',
160	'html',
161	'asp',
162	'aspx',
163	'cmd',
164	'csh',
165	'bat',
166	'htm',
167	'hta',
168	'jar',
169	'exe',
170	'com',
171	'js',
172	'lnk',
173	'htaccess',
174	'htpasswd',
175	'phtml',
176	'ps1',
177	'ps2',
178	'py',
179	'rb',
180	'tmp',
181	'cgi',
182	'svg',
183	'svgz'
184	];
185	}
186
187	return $exclusionlist;
188	}
189
190	/**
191	* Check if uploaded file is safe from malicious content
192	*
193	* @param string $file_path Path to the uploaded file
194	* @return bool True if file is safe, false if potentially malicious
195	*/
196	private function is_file_safe($file_path)
197	{
198	// Only check text-based files for malicious content
199	$text_mime_types = ['text/plain', 'application/json', 'text/html', 'text/css', 'text/javascript'];
200
201	if (!in_array($this->get_file_mime_type($file_path), $text_mime_types)) {
202	return true; // Non-text files are considered safe for this check
203	}
204
205	if (!file_exists($file_path)) {
206	return false;
207	}
208
209	$content = file_get_contents($file_path);
210	if ($content === false) {
211	return false;
212	}
213
214	// Check for common malicious patterns
215	$malicious_patterns = [
216	'/<\?php/i', // PHP opening tag
217	'/eval\s*\(/i', // eval() function
218	'/base64_decode/i', // Base64 decode
219	'/system\s*\(/i', // system() function
220	'/exec\s*\(/i', // exec() function
221	'/shell_exec/i', // shell_exec function
222	'/passthru/i', // passthru function
223	'/<\?=/i', // PHP short tag
224	'/<script/i', // JavaScript tags
225	'/javascript:/i', // JavaScript protocol
226	'/on\w+\s*=/i', // Event handlers
227	];
228
229	foreach ($malicious_patterns as $pattern) {
230	if (preg_match($pattern, $content)) {
231	return false;
232	}
233	}
234
235	return true;
236	}
237
238	/**
239	* Get file MIME type from file path
240	*
241	* @param string $file_path Path to the file
242	* @return string MIME type
243	*/
244	private function get_file_mime_type($file_path)
245	{
246	$finfo = finfo_open(FILEINFO_MIME_TYPE);
247	$mime_type = finfo_file($finfo, $file_path);
248	finfo_close($finfo);
249	return $mime_type;
250	}
251	}
252
253	new Upload_Email_File();