BrandStyles.php
3 years ago
NewsletterTemplatesRepository.php
2 months ago
TemplateImageLoader.php
2 years ago
ThumbnailSaver.php
2 months ago
index.php
3 years ago
TemplateImageLoader.php
89 lines
| 1 | <?php // phpcs:ignore SlevomatCodingStandard.TypeHints.DeclareStrictTypes.DeclareStrictTypesMissing |
| 2 | |
| 3 | namespace MailPoet\NewsletterTemplates; |
| 4 | |
| 5 | if (!defined('ABSPATH')) exit; |
| 6 | |
| 7 | |
| 8 | use MailPoet\WP\Functions as WPFunctions; |
| 9 | |
| 10 | class TemplateImageLoader { |
| 11 | const TIMEOUT = 30; // seconds |
| 12 | |
| 13 | /** @var WPFunctions */ |
| 14 | private $wp; |
| 15 | |
| 16 | public function __construct( |
| 17 | WPFunctions $wp |
| 18 | ) { |
| 19 | $this->wp = $wp; |
| 20 | } |
| 21 | |
| 22 | /** |
| 23 | * Acts as a proxy for html2canvas |
| 24 | */ |
| 25 | public function loadExternalImage(string $url) { |
| 26 | if (!$this->isUrlAllowed($url)) { |
| 27 | // URL not allowed |
| 28 | return false; |
| 29 | } |
| 30 | $image = $this->downloadUrl($url); |
| 31 | if ($this->wp->isWpError($image)) { |
| 32 | // Failed to load the image |
| 33 | return false; |
| 34 | } |
| 35 | $mime = $this->wp->wpGetImageMime($image); |
| 36 | if (!$this->isTypeAllowed($image, $mime)) { |
| 37 | // Wrong file type |
| 38 | @unlink($image); |
| 39 | return false; |
| 40 | } |
| 41 | header('Content-Type: ' . $mime); |
| 42 | readfile($image); |
| 43 | @unlink($image); |
| 44 | return true; |
| 45 | } |
| 46 | |
| 47 | protected function downloadUrl($url) { |
| 48 | require_once ABSPATH . '/wp-admin/includes/file.php'; |
| 49 | return download_url($url, self::TIMEOUT); |
| 50 | } |
| 51 | |
| 52 | private function isUrlAllowed($url) { |
| 53 | $urlParts = $this->wp->wpParseUrl($url); |
| 54 | $allowedExtensions = ['gif', 'png', 'jpg', 'jpeg']; |
| 55 | if ( |
| 56 | !isset($urlParts['path']) |
| 57 | || !preg_match('/\.(' . join('|', $allowedExtensions) . ')$/i', $urlParts['path']) |
| 58 | ) { |
| 59 | return false; |
| 60 | } |
| 61 | /** @var string[] */ |
| 62 | $allowedUrls = (array)$this->wp->applyFilters('mailpoet_template_image_allowed_urls', [ |
| 63 | 'https://ps.w.org/mailpoet/assets/newsletter-templates/', |
| 64 | ]); |
| 65 | foreach ($allowedUrls as $allowedUrl) { |
| 66 | $allowedUrlParts = $this->wp->wpParseUrl($allowedUrl); |
| 67 | if ( |
| 68 | isset($urlParts['host'], $urlParts['scheme']) |
| 69 | && isset($allowedUrlParts['host'], $allowedUrlParts['scheme'], $allowedUrlParts['path']) |
| 70 | && $urlParts['host'] === $allowedUrlParts['host'] |
| 71 | && $urlParts['scheme'] === $allowedUrlParts['scheme'] |
| 72 | && strpos($urlParts['path'], $allowedUrlParts['path']) === 0 |
| 73 | ) { |
| 74 | return true; |
| 75 | } |
| 76 | } |
| 77 | return false; |
| 78 | } |
| 79 | |
| 80 | private function isTypeAllowed($image, $mime) { |
| 81 | $allowedMimeTypes = [ |
| 82 | 'image/gif', |
| 83 | 'image/jpeg', |
| 84 | 'image/png', |
| 85 | ]; |
| 86 | return $mime && in_array($mime, $allowedMimeTypes); |
| 87 | } |
| 88 | } |
| 89 |