| @@ -9,13 +9,12 @@ | ||
| 9 | 9 | use UserAccessManager\Cache\Cache; |
| 10 | 10 | use UserAccessManager\Config\MainConfig; |
| 11 | 11 | use UserAccessManager\Config\WordpressConfig; |
| 12 | 12 | use UserAccessManager\Controller\Controller; |
| 13 | -use UserAccessManager\Controller\Frontend\Authentication\LoginControllerTrait; | |
| 14 | 13 | use UserAccessManager\Database\Database; |
| 15 | 14 | use UserAccessManager\File\FileHandler; |
| 16 | -use UserAccessManager\File\Delivery\FileObject; | |
| 17 | -use UserAccessManager\File\Delivery\FileObjectFactory; | |
| 15 | +use UserAccessManager\File\FileObject; | |
| 16 | +use UserAccessManager\File\FileObjectFactory; | |
| 18 | 17 | use UserAccessManager\Object\ObjectHandler; |
| 19 | 18 | use UserAccessManager\UserGroup\UserGroupTypeException; |
| 20 | 19 | use UserAccessManager\Util\Util; |
| 21 | 20 | use UserAccessManager\Wrapper\Php; |
| @@ -25,9 +24,8 @@ | ||
| 25 | 24 | { |
| 26 | 25 | use LoginControllerTrait; |
| 27 | 26 | |
| 28 | 27 | public const POST_URL_CACHE_KEY = 'PostUrls'; |
| 29 | - public const REDIRECT_TO_PARAMETER = 'redirect_to'; | |
| 30 | 28 | |
| 31 | 29 | public function __construct( |
| 32 | 30 | Php $php, |
| 33 | 31 | Wordpress $wordpress, |
| @@ -74,126 +72,48 @@ | ||
| 74 | 72 | |
| 75 | 73 | return $postUrls[$url]; |
| 76 | 74 | } |
| 77 | 75 | |
| 78 | - private function normalizeAttachmentUrl(array $uploadDirs, string $objectUrl): string | |
| 76 | + private function getFileSettingsByType(string $objectType, string $objectUrl): ?FileObject | |
| 79 | 77 | { |
| 80 | - $uploadDir = str_replace(ABSPATH, '/', $uploadDirs['basedir']); | |
| 81 | - $regex = '/.*' . str_replace('/', '\/', $uploadDir) . '\//i'; | |
| 82 | - $cleanObjectUrl = preg_replace($regex, '', $objectUrl); | |
| 83 | - $uploadUrl = str_replace('/files', $uploadDir, $uploadDirs['baseurl']); | |
| 78 | + $fileObject = null; | |
| 84 | 79 | |
| 85 | - return rtrim($uploadUrl, '/') . '/' . ltrim($cleanObjectUrl, '/'); | |
| 86 | - } | |
| 80 | + if ($objectType === ObjectHandler::ATTACHMENT_OBJECT_TYPE) { | |
| 81 | + $uploadDirs = $this->wordpress->getUploadDir(); | |
| 82 | + $uploadDir = str_replace(ABSPATH, '/', $uploadDirs['basedir']); | |
| 83 | + $regex = '/.*' . str_replace('/', '\/', $uploadDir) . '\//i'; | |
| 84 | + $cleanObjectUrl = preg_replace($regex, '', $objectUrl); | |
| 85 | + $uploadUrl = str_replace('/files', $uploadDir, $uploadDirs['baseurl']); | |
| 86 | + $objectUrl = rtrim($uploadUrl, '/') . '/' . ltrim($cleanObjectUrl, '/'); | |
| 87 | 87 | |
| 88 | - private function isRegisteredSize(int $attachmentId, string $fileName): bool | |
| 89 | - { | |
| 90 | - $metaData = $this->wordpress->getAttachmentMetadata($attachmentId); | |
| 91 | - $sizes = is_array($metaData) === true ? (array) ($metaData['sizes'] ?? []) : []; | |
| 88 | + $post = $this->objectHandler->getPost($this->getPostIdByUrl($objectUrl)); | |
| 89 | + $postType = $post->post_type ?? ''; | |
| 92 | 90 | |
| 93 | - return in_array($fileName, array_column($sizes, 'file'), true); | |
| 94 | - } | |
| 91 | + if ($postType === ObjectHandler::ATTACHMENT_OBJECT_TYPE) { | |
| 92 | + $multiPath = str_replace('/files', $uploadDir, $uploadDirs['baseurl']); | |
| 95 | 93 | |
| 96 | - /** | |
| 97 | - * Returns the file the request asks for and tells through $isImage whether it can be shown as image. | |
| 98 | - * A requested generated size is only used if it is registered at the attachment and stored inside the | |
| 99 | - * upload directory, so no arbitrary and no missing file becomes reachable. Generated sizes are always | |
| 100 | - * images, also for documents like PDFs, where they are the preview images shown in the media library. | |
| 101 | - */ | |
| 102 | - private function getAttachmentFile( | |
| 103 | - int $attachmentId, | |
| 104 | - string $attachedFile, | |
| 105 | - string $requestedUrl, | |
| 106 | - string $uploadBaseDir, | |
| 107 | - ?bool &$isImage | |
| 108 | - ): string { | |
| 109 | - $requestedFileName = basename((string) parse_url($requestedUrl, PHP_URL_PATH)); | |
| 110 | - $sizeFile = dirname($attachedFile) . DIRECTORY_SEPARATOR . $requestedFileName; | |
| 94 | + $fileObject = $this->fileObjectFactory->createFileObject( | |
| 95 | + $post->ID, | |
| 96 | + $objectType, | |
| 97 | + $uploadDirs['basedir'] . str_replace($multiPath, '', $objectUrl), | |
| 98 | + $this->wordpress->attachmentIsImage($post->ID) | |
| 99 | + ); | |
| 100 | + } | |
| 101 | + } else { | |
| 102 | + $extraParameter = $this->getRequestParameter('uamextra'); | |
| 111 | 103 | |
| 112 | - if ($requestedFileName !== basename($attachedFile) | |
| 113 | - && $this->isRegisteredSize($attachmentId, $requestedFileName) === true | |
| 114 | - && $this->isInsideUploadDirectory($sizeFile, $uploadBaseDir) === true | |
| 115 | - ) { | |
| 116 | - $isImage = true; | |
| 117 | - | |
| 118 | - return $sizeFile; | |
| 104 | + $fileObject = $this->wordpress->applyFilters( | |
| 105 | + 'uam_get_file_settings_by_type', | |
| 106 | + $fileObject, | |
| 107 | + $objectType, | |
| 108 | + $objectUrl, | |
| 109 | + $extraParameter | |
| 110 | + ); | |
| 119 | 111 | } |
| 120 | 112 | |
| 121 | - $isImage = $this->wordpress->attachmentIsImage($attachmentId); | |
| 122 | - | |
| 123 | - return $attachedFile; | |
| 113 | + return $fileObject; | |
| 124 | 114 | } |
| 125 | 115 | |
| 126 | - private function getAttachmentFileObject(string $objectUrl): ?FileObject | |
| 127 | - { | |
| 128 | - $uploadDirs = $this->wordpress->getUploadDir(); | |
| 129 | - $requestedUrl = $this->normalizeAttachmentUrl($uploadDirs, $objectUrl); | |
| 130 | - $postId = $this->getPostIdByUrl($requestedUrl); | |
| 131 | - | |
| 132 | - if ($postId < 1) { | |
| 133 | - return null; | |
| 134 | - } | |
| 135 | - | |
| 136 | - $post = $this->objectHandler->getPost($postId); | |
| 137 | - | |
| 138 | - if (($post->post_type ?? '') !== ObjectHandler::ATTACHMENT_OBJECT_TYPE) { | |
| 139 | - return null; | |
| 140 | - } | |
| 141 | - | |
| 142 | - // Unfiltered, because the plugin denies the path through the get_attached_file filter for | |
| 143 | - // users without access. Filtered it would hide the file from the access check below, which | |
| 144 | - // then could not answer the request with the no rights page any more. | |
| 145 | - $attachedFile = $this->wordpress->getAttachedFile($post->ID, true); | |
| 146 | - | |
| 147 | - if ($attachedFile === false | |
| 148 | - || $this->isInsideUploadDirectory($attachedFile, $uploadDirs['basedir']) === false | |
| 149 | - ) { | |
| 150 | - return null; | |
| 151 | - } | |
| 152 | - | |
| 153 | - $file = $this->getAttachmentFile( | |
| 154 | - $post->ID, | |
| 155 | - $attachedFile, | |
| 156 | - $requestedUrl, | |
| 157 | - $uploadDirs['basedir'], | |
| 158 | - $isImage | |
| 159 | - ); | |
| 160 | - | |
| 161 | - return $this->fileObjectFactory->createFileObject( | |
| 162 | - $post->ID, | |
| 163 | - ObjectHandler::ATTACHMENT_OBJECT_TYPE, | |
| 164 | - $file, | |
| 165 | - $isImage | |
| 166 | - ); | |
| 167 | - } | |
| 168 | - | |
| 169 | - private function isInsideUploadDirectory(string $file, string $uploadBaseDir): bool | |
| 170 | - { | |
| 171 | - $realFile = $this->php->realpath($file); | |
| 172 | - $realUploadBaseDir = $this->php->realpath($uploadBaseDir); | |
| 173 | - | |
| 174 | - return $realFile !== false | |
| 175 | - && $realUploadBaseDir !== false | |
| 176 | - && str_starts_with($realFile, $realUploadBaseDir . DIRECTORY_SEPARATOR); | |
| 177 | - } | |
| 178 | - | |
| 179 | - private function getFileSettingsByType(string $objectType, string $objectUrl): ?FileObject | |
| 180 | - { | |
| 181 | - if ($objectType === ObjectHandler::ATTACHMENT_OBJECT_TYPE) { | |
| 182 | - return $this->getAttachmentFileObject($objectUrl); | |
| 183 | - } | |
| 184 | - | |
| 185 | - $extraParameter = $this->getRequestParameter('uamextra'); | |
| 186 | - | |
| 187 | - return $this->wordpress->applyFilters( | |
| 188 | - 'uam_get_file_settings_by_type', | |
| 189 | - null, | |
| 190 | - $objectType, | |
| 191 | - $objectUrl, | |
| 192 | - $extraParameter | |
| 193 | - ); | |
| 194 | - } | |
| 195 | - | |
| 196 | 116 | /** |
| 197 | 117 | * @throws UserGroupTypeException |
| 198 | 118 | */ |
| 199 | 119 | public function getFile(string $objectType, string $objectUrl): void |
| @@ -238,11 +158,8 @@ | ||
| 238 | 158 | } elseif ($redirect === 'custom_url') { |
| 239 | 159 | $url = $this->mainConfig->getRedirectCustomUrl(); |
| 240 | 160 | } elseif ($redirect === 'login') { |
| 241 | 161 | $url = $this->getLoginUrl(); |
| 242 | - } elseif ($redirect === 'origin') { | |
| 243 | - $referer = $this->wordpress->getReferer(); | |
| 244 | - $url = $referer !== false ? $referer : $this->wordpress->getHomeUrl('/'); | |
| 245 | 162 | } else { |
| 246 | 163 | $url = $this->wordpress->getHomeUrl('/'); |
| 247 | 164 | } |
| 248 | 165 | |
| @@ -267,12 +184,8 @@ | ||
| 267 | 184 | $url = $this->getRedirectUrlAndPermalink($permalink); |
| 268 | 185 | $currentUrl = $this->util->getCurrentUrl(); |
| 269 | 186 | |
| 270 | 187 | if ($url !== null && $url !== $currentUrl && $permalink !== $currentUrl) { |
| 271 | - if ($this->mainConfig->appendRedirectToParameter() === true) { | |
| 272 | - $url = $this->wordpress->addQueryArg([self::REDIRECT_TO_PARAMETER => $currentUrl], $url); | |
| 273 | - } | |
| 274 | - | |
| 275 | 188 | $this->wordpress->wpRedirect($url); |
| 276 | 189 | $this->php->callExit(); |
| 277 | 190 | } |
| 278 | 191 | } |
| @@ -281,12 +194,12 @@ | ||
| 281 | 194 | { |
| 282 | 195 | $postableTypes = implode('\',\'', $this->objectHandler->getPostTypes()); |
| 283 | 196 | |
| 284 | 197 | $query = $this->database->prepare( |
| 285 | - "SELECT `ID` | |
| 286 | - FROM `{$this->database->getPostsTable()}` | |
| 287 | - WHERE `post_name` = %s | |
| 288 | - AND `post_type` IN ('$postableTypes')", | |
| 198 | + "SELECT ID | |
| 199 | + FROM {$this->database->getPostsTable()} | |
| 200 | + WHERE post_name = %s | |
| 201 | + AND post_type IN ('$postableTypes')", | |
| 289 | 202 | $name |
| 290 | 203 | ); |
| 291 | 204 | |
| 292 | 205 | return (int) $this->database->getVariable($query); |
