← All changes | class/class-mainwp-qq2-file-uploader.php +22 -10 6.1.6 → 6.2.2 View file →

		@@ -112,9 +112,9 @@
112	112	* @param bool $replaceOldFile True|False Weather or not to replace the orignal file or not.
113	113	*
114	114	* @return array success'=>true|error'=>'error message'
115	115	*/
116		- public function handle_upload( $uploadDirectory, $replaceOldFile = false ) {
	116	+ public function handle_upload( $uploadDirectory, $replaceOldFile = false ) { // phpcs:ignore --NOSONAR -complex.
117	117
118	118	if ( ! $this->file ) {
119	119	return array( 'error' => 'No files were uploaded!' );
120	120	}
		@@ -152,21 +152,33 @@
152	152	}
153	153	}
154	154
155	155	try {
156		- if ( $this->file->save( $uploadDirectory . $filename . '.' . $ext ) ) {
157		- $tmp_name = isset( $_FILES['qqfile']['tmp_name'] ) ? sanitize_text_field( wp_unslash( $_FILES['qqfile']['tmp_name'] ) ) : ''; //phpcs:ignore WordPress.Security.NonceVerification.Missing -- verify in caller.
	156	+ // phpcs:disable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	157	+ $success = false;
	158	+ $tmp_name = '';
	159	+ if ( isset( $_FILES['qqfile'] ) ) {
	160	+ // Multipart upload: validate before saving.
	161	+ if ( isset( $_FILES['qqfile']['error'] ) && isset( $_FILES['qqfile']['tmp_name'] ) && UPLOAD_ERR_OK === $_FILES['qqfile']['error'] && is_uploaded_file( $_FILES['qqfile']['tmp_name'] ) && $this->file->save( $uploadDirectory . $filename . '.' . $ext ) ) {
	162	+ $success = true;
	163	+ $tmp_name = $_FILES['qqfile']['tmp_name'];
	164	+ }
	165	+ } elseif ( $this->file->save( $uploadDirectory . $filename . '.' . $ext ) ) {
	166	+ $success = true;
	167	+ }
	168	+ // phpcs:enable WordPress.Security.NonceVerification,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	169	+
	170	+ if ( $success ) {
158	171	return array(
159	172	'success' => true,
160		- 'path' => esc_html( $uploadDirectory . $filename . '.' . $ext ),
161		- 'tmp' => esc_html( $tmp_name ),
	173	+ 'path' => $uploadDirectory . $filename . '.' . $ext,
	174	+ 'tmp' => $tmp_name,
162	175	);
163		- } else {
164		- return array(
165		- 'error' => esc_html__( 'Could not save uploaded file!', 'mainwp' ) . ' ' .
166		- esc_html__( 'The upload was cancelled, or server error encountered.', 'mainwp' ),
167		- );
168	176	}
	177	+ return array(
	178	+ 'error' => esc_html__( 'Could not save uploaded file!', 'mainwp' ) . ' ' .
	179	+ esc_html__( 'The upload was cancelled, or server error encountered.', 'mainwp' ),
	180	+ );
169	181	} catch ( \Exception $e ) {
170	182	return array( 'error' => $e->getMessage() );
171	183	}
172	184	}