← All changes | class/class-mainwp-file-uploader-handle.php +7 -2 5.1 → 6.2.3 View file →

		@@ -10,8 +10,13 @@
10	10	*/
11	11
12	12	namespace MainWP\Dashboard;
13	13
	14	+// Exit if accessed directly.
	15	+if ( ! defined( 'ABSPATH' ) ) {
	16	+ exit;
	17	+}
	18	+
14	19	/**
15	20	* Class MainWP_File_Uploader_Handle
16	21	*
17	22	* @package MainWP\Dashboard
		@@ -30,13 +35,13 @@
30	35	* @uses \MainWP\Dashboard\MainWP_System_Utility::get_base_dir()
31	36	*/
32	37	public function save( $path ) {
33	38	$moved = false;
34		- $tmp_name = isset( $_FILES['qqfile']['tmp_name'] ) ? sanitize_text_field( wp_unslash( $_FILES['qqfile']['tmp_name'] ) ) : ''; //phpcs:ignore WordPress.Security.NonceVerification.Missing -- verify in caller.
	39	+ $tmp_name = isset( $_FILES['qqfile']['tmp_name'] ) && MainWP_Utility::valid_file_check( $_FILES['qqfile']['tmp_name'] ) ? $_FILES['qqfile']['tmp_name'] : ''; //phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- verify in caller.
35	40
36	41	//phpcs:disable WordPress.WP.AlternativeFunctions -- custom process.
37	42	if ( ! is_dir( dirname( $path ) ) ) {
38		- mkdir( dirname( $path ), 0777, true );
	43	+ mkdir( dirname( $path ), 0750, true ); // MWP-1558: tightened from 0777.
39	44	}
40	45
41	46	if ( empty( $_REQUEST['dzchunkbyteoffset'] ) && file_exists( $path ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- verified.
42	47	unlink( $path ); // first chuck, delete file if existed, to create new file.