← All changes | class/class-mainwp-file-uploader-handle.php +6 -1 5.2 → 6.2.1 View file →

		@@ -10,8 +10,13 @@
10	10	*/
11	11
12	12	namespace MainWP\Dashboard;
13	13
	14	+// Exit if accessed directly.
	15	+if ( ! defined( 'ABSPATH' ) ) {
	16	+ exit;
	17	+}
	18	+
14	19	/**
15	20	* Class MainWP_File_Uploader_Handle
16	21	*
17	22	* @package MainWP\Dashboard
		@@ -34,9 +39,9 @@
34	39	$tmp_name = isset( $_FILES['qqfile']['tmp_name'] ) && MainWP_Utility::valid_file_check( $_FILES['qqfile']['tmp_name'] ) ? $_FILES['qqfile']['tmp_name'] : ''; //phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- verify in caller.
35	40
36	41	//phpcs:disable WordPress.WP.AlternativeFunctions -- custom process.
37	42	if ( ! is_dir( dirname( $path ) ) ) {
38		- mkdir( dirname( $path ), 0777, true );
	43	+ mkdir( dirname( $path ), 0750, true ); // MWP-1558: tightened from 0777.
39	44	}
40	45
41	46	if ( empty( $_REQUEST['dzchunkbyteoffset'] ) && file_exists( $path ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- verified.
42	47	unlink( $path ); // first chuck, delete file if existed, to create new file.