← All changes | src/Controller/Frontend/RedirectController.php +10 -63 trunk → 2.3.17 View file →

		@@ -9,13 +9,12 @@
9	9	use UserAccessManager\Cache\Cache;
10	10	use UserAccessManager\Config\MainConfig;
11	11	use UserAccessManager\Config\WordpressConfig;
12	12	use UserAccessManager\Controller\Controller;
13		-use UserAccessManager\Controller\Frontend\Authentication\LoginControllerTrait;
14	13	use UserAccessManager\Database\Database;
15	14	use UserAccessManager\File\FileHandler;
16		-use UserAccessManager\File\Delivery\FileObject;
17		-use UserAccessManager\File\Delivery\FileObjectFactory;
	15	+use UserAccessManager\File\FileObject;
	16	+use UserAccessManager\File\FileObjectFactory;
18	17	use UserAccessManager\Object\ObjectHandler;
19	18	use UserAccessManager\UserGroup\UserGroupTypeException;
20	19	use UserAccessManager\Util\Util;
21	20	use UserAccessManager\Wrapper\Php;
		@@ -84,51 +83,12 @@
84	83
85	84	return rtrim($uploadUrl, '/') . '/' . ltrim($cleanObjectUrl, '/');
86	85	}
87	86
88		- private function isRegisteredSize(int $attachmentId, string $fileName): bool
89		- {
90		- $metaData = $this->wordpress->getAttachmentMetadata($attachmentId);
91		- $sizes = is_array($metaData) === true ? (array) ($metaData['sizes'] ?? []) : [];
92		-
93		- return in_array($fileName, array_column($sizes, 'file'), true);
94		- }
95		-
96		- /**
97		- * Returns the file the request asks for and tells through $isImage whether it can be shown as image.
98		- * A requested generated size is only used if it is registered at the attachment and stored inside the
99		- * upload directory, so no arbitrary and no missing file becomes reachable. Generated sizes are always
100		- * images, also for documents like PDFs, where they are the preview images shown in the media library.
101		- */
102		- private function getAttachmentFile(
103		- int $attachmentId,
104		- string $attachedFile,
105		- string $requestedUrl,
106		- string $uploadBaseDir,
107		- ?bool &$isImage
108		- ): string {
109		- $requestedFileName = basename((string) parse_url($requestedUrl, PHP_URL_PATH));
110		- $sizeFile = dirname($attachedFile) . DIRECTORY_SEPARATOR . $requestedFileName;
111		-
112		- if ($requestedFileName !== basename($attachedFile)
113		- && $this->isRegisteredSize($attachmentId, $requestedFileName) === true
114		- && $this->isInsideUploadDirectory($sizeFile, $uploadBaseDir) === true
115		- ) {
116		- $isImage = true;
117		-
118		- return $sizeFile;
119		- }
120		-
121		- $isImage = $this->wordpress->attachmentIsImage($attachmentId);
122		-
123		- return $attachedFile;
124		- }
125		-
126	87	private function getAttachmentFileObject(string $objectUrl): ?FileObject
127	88	{
128	89	$uploadDirs = $this->wordpress->getUploadDir();
129		- $requestedUrl = $this->normalizeAttachmentUrl($uploadDirs, $objectUrl);
130		- $postId = $this->getPostIdByUrl($requestedUrl);
	90	+ $postId = $this->getPostIdByUrl($this->normalizeAttachmentUrl($uploadDirs, $objectUrl));
131	91
132	92	if ($postId < 1) {
133	93	return null;
134	94	}
		@@ -138,32 +98,19 @@
138	98	if (($post->post_type ?? '') !== ObjectHandler::ATTACHMENT_OBJECT_TYPE) {
139	99	return null;
140	100	}
141	101
142		- // Unfiltered, because the plugin denies the path through the get_attached_file filter for
143		- // users without access. Filtered it would hide the file from the access check below, which
144		- // then could not answer the request with the no rights page any more.
145		- $attachedFile = $this->wordpress->getAttachedFile($post->ID, true);
	102	+ $file = $this->wordpress->getAttachedFile($post->ID);
146	103
147		- if ($attachedFile === false
148		- || $this->isInsideUploadDirectory($attachedFile, $uploadDirs['basedir']) === false
149		- ) {
	104	+ if ($file === false || $this->isInsideUploadDirectory($file, $uploadDirs['basedir']) === false) {
150	105	return null;
151	106	}
152	107
153		- $file = $this->getAttachmentFile(
154		- $post->ID,
155		- $attachedFile,
156		- $requestedUrl,
157		- $uploadDirs['basedir'],
158		- $isImage
159		- );
160		-
161	108	return $this->fileObjectFactory->createFileObject(
162	109	$post->ID,
163	110	ObjectHandler::ATTACHMENT_OBJECT_TYPE,
164	111	$file,
165		- $isImage
	112	+ $this->wordpress->attachmentIsImage($post->ID)
166	113	);
167	114	}
168	115
169	116	private function isInsideUploadDirectory(string $file, string $uploadBaseDir): bool
		@@ -281,12 +228,12 @@
281	228	{
282	229	$postableTypes = implode('\',\'', $this->objectHandler->getPostTypes());
283	230
284	231	$query = $this->database->prepare(
285		- "SELECT `ID`
286		- FROM `{$this->database->getPostsTable()}`
287		- WHERE `post_name` = %s
288		- AND `post_type` IN ('$postableTypes')",
	232	+ "SELECT ID
	233	+ FROM {$this->database->getPostsTable()}
	234	+ WHERE post_name = %s
	235	+ AND post_type IN ('$postableTypes')",
289	236	$name
290	237	);
291	238
292	239	return (int) $this->database->getVariable($query);