← All changes
|
front-end/default-fields/upload/upload_helper_functions.php
+61
-4
4.0.2
→
4.0.3
View file →
| @@ -280,16 +280,16 @@ | ||
| 280 | 280 | $thumbnail = wp_get_attachment_image($value, array(80, 80), true); |
| 281 | 281 | $file_name = get_the_title($value); |
| 282 | 282 | $file_type = get_post_mime_type($value); |
| 283 | 283 | $attachment_url = wp_get_attachment_url($value); |
| 284 | - $upload_button .= '<div id="' . esc_attr($upload_input_id) . '_info_container" class="upload-field-details" data-attachment_id="' . $value . '">'; | |
| 284 | + $upload_button .= '<div id="' . esc_attr($upload_input_id) . '_info_container" class="upload-field-details" data-attachment_id="' . esc_attr( $value ) . '">'; | |
| 285 | 285 | $upload_button .= '<div class="file-thumb">'; |
| 286 | - $upload_button .= "<a href='{$attachment_url}' target='_blank' class='wppb-attachment-link'>" . $thumbnail . "</a>"; | |
| 286 | + $upload_button .= "<a href='" . esc_url( $attachment_url ) . "' target='_blank' class='wppb-attachment-link'>" . $thumbnail . "</a>"; | |
| 287 | 287 | $upload_button .= '</div>'; |
| 288 | 288 | $upload_button .= '<p><span class="file-name">'; |
| 289 | - $upload_button .= $file_name; | |
| 289 | + $upload_button .= esc_html( $file_name ); | |
| 290 | 290 | $upload_button .= '</span><span class="file-type">'; |
| 291 | - $upload_button .= $file_type; | |
| 291 | + $upload_button .= esc_html( $file_type ); | |
| 292 | 292 | $upload_button .= '</span>'; |
| 293 | 293 | $upload_button .= '<span class="wppb-remove-upload" tabindex="0">' . apply_filters( 'wppb_upload_button_remove_label', __( 'Remove', 'profile-builder' ) ) . '</span>'; |
| 294 | 294 | $upload_button .= '</p></div>'; |
| 295 | 295 | } |
| @@ -405,8 +405,65 @@ | ||
| 405 | 405 | return trim($attachment_id); |
| 406 | 406 | } else { |
| 407 | 407 | return ''; |
| 408 | 408 | } |
| 409 | +} | |
| 410 | + | |
| 411 | +/** | |
| 412 | + * Converts a legacy file URL stored in user meta (versions that predate attachment IDs) | |
| 413 | + * into an attachment owned by the user and stores the new ID in its place. | |
| 414 | + * | |
| 415 | + * The URL must resolve to an existing file inside the uploads directory with an allowed | |
| 416 | + * mime type; anything else is discarded. Only call this with a value read from user meta, | |
| 417 | + * never with request data, so that rendering a field cannot persist attacker-controlled input. | |
| 418 | + * | |
| 419 | + * @param string $file_url Legacy file URL read from user meta. | |
| 420 | + * @param array $field Field definition array (must contain 'meta-name'). | |
| 421 | + * @param int $user_id User the attachment and meta belong to. | |
| 422 | + * | |
| 423 | + * @return int|string Attachment ID, or '' when the URL could not be converted. | |
| 424 | + */ | |
| 425 | +function wppb_legacy_file_url_to_attachment( $file_url, $field, $user_id ) { | |
| 426 | + $wp_upload_dir = wp_upload_dir(); | |
| 427 | + $base_dir = realpath( $wp_upload_dir['basedir'] ); | |
| 428 | + $file_path = str_replace( $wp_upload_dir['baseurl'], $wp_upload_dir['basedir'], $file_url ); | |
| 429 | + $file_path = is_file( $file_path ) ? realpath( $file_path ) : false; | |
| 430 | + | |
| 431 | + if ( ! $base_dir || ! $file_path ) { | |
| 432 | + return ''; | |
| 433 | + } | |
| 434 | + | |
| 435 | + $base_dir = trailingslashit( wp_normalize_path( $base_dir ) ); | |
| 436 | + $file_path = wp_normalize_path( $file_path ); | |
| 437 | + | |
| 438 | + if ( strpos( $file_path, $base_dir ) !== 0 ) { | |
| 439 | + return ''; | |
| 440 | + } | |
| 441 | + | |
| 442 | + $file_type = wp_check_filetype( basename( $file_path ), null ); | |
| 443 | + if ( empty( $file_type['type'] ) ) { | |
| 444 | + return ''; | |
| 445 | + } | |
| 446 | + | |
| 447 | + $attachment_id = wp_insert_attachment( array( | |
| 448 | + 'guid' => trailingslashit( $wp_upload_dir['baseurl'] ) . substr( $file_path, strlen( $base_dir ) ), | |
| 449 | + 'post_mime_type' => $file_type['type'], | |
| 450 | + 'post_title' => sanitize_text_field( preg_replace( '/\.[^.]+$/', '', basename( $file_path ) ) ), | |
| 451 | + 'post_content' => '', | |
| 452 | + 'post_status' => 'inherit', | |
| 453 | + 'post_author' => $user_id, | |
| 454 | + ), $file_path ); | |
| 455 | + | |
| 456 | + if ( empty( $attachment_id ) || is_wp_error( $attachment_id ) ) { | |
| 457 | + return ''; | |
| 458 | + } | |
| 459 | + | |
| 460 | + // Make sure that this file is included, as wp_generate_attachment_metadata() depends on it. | |
| 461 | + require_once ABSPATH . 'wp-admin/includes/image.php'; | |
| 462 | + wp_update_attachment_metadata( $attachment_id, wp_generate_attachment_metadata( $attachment_id, $file_path ) ); | |
| 463 | + update_user_meta( $user_id, $field['meta-name'], $attachment_id ); | |
| 464 | + | |
| 465 | + return $attachment_id; | |
| 409 | 466 | } |
| 410 | 467 | |
| 411 | 468 | // Deferred to plugins_loaded so older Profile Builder Pro versions (which declare |
| 412 | 469 | // wppb_verify_attachment_id unconditionally during their own file load) win the |