Ticket #12278: file.php.diff

.php

@@ -220 +224 @@
  * @param array $file Reference to a single element of $_FILES. Call the function once for each uploaded file.
  * @param array $overrides Optional. An associative array of names=>values to override default variables with extract( $overrides, EXTR_OVERWRITE ).
  * @return array On success, returns an associative array of file attributes. On failure, returns $overrides['upload_error_handler'](&$file, $message ) or array( 'error'=>$message ).
+ * @todo I don't think it's correct to define the error handler for prefilter errors before running extract. -tychay
  */
 function wp_handle_upload( &$file, $overrides = false, $time = null ) {
         // The default error handler.
@@ -258 +263 @@
         // All tests are on by default. Most can be turned off by $override[{test_name}] = false;
         $test_form = true;
         $test_size = true;
+        $test_upload = true;
 
         // If you override this, you must provide $ext and $type!!!!
         $test_type = true;
@@ -269 +275 @@
 
         // A correct form post will pass this test.
         if ( $test_form && (!isset( $_POST['action'] ) || ($_POST['action'] != $action ) ) )
-                return $upload_error_handler( $file, __( 'Invalid form submission.' ));
+                return call_user_func($upload_error_handler, $file, __( 'Invalid form submission.' ));
 
         // A successful upload will pass this test. It makes no sense to override this one.
         if ( $file['error'] > 0 )
-                return $upload_error_handler( $file, $upload_error_strings[$file['error']] );
+                return call_user_func($upload_error_handler, $file, $upload_error_strings[$file['error']] );
 
         // A non-empty file will pass this test.
         if ( $test_size && !($file['size'] > 0 ) )
-                return $upload_error_handler( $file, __( 'File is empty. Please upload something more substantial. This error could also be caused by uploads being disabled in your php.ini or by post_max_size being defined as smaller than upload_max_filesize in php.ini.' ));
+                return call_user_func($upload_error_handler, $file, __( 'File is empty. Please upload something more substantial.' ));
 
         // A properly uploaded file will pass this test. There should be no reason to override this one.
-        if (! @ is_uploaded_file( $file['tmp_name'] ) )
-                return $upload_error_handler( $file, __( 'Specified file failed upload test.' ));
+        if ( $test_upload && ! @ is_uploaded_file( $file['tmp_name'] ) )
+                return call_user_func($upload_error_handler, $file, __( 'Specified file failed upload test.' ));
 
         // A correct MIME type will pass this test. Override $mimes or use the upload_mimes filter.
         if ( $test_type ) {
@@ -289 +295 @@
 
                 extract( $wp_filetype );
 
+                /* WPCOM - Limit site admin uploads
                 if ( ( !$type || !$ext ) && !current_user_can( 'unfiltered_upload' ) )
-                        return $upload_error_handler( $file, __( 'File type does not meet security guidelines. Try another.' ));
+                */
+                if ( !$type || !$ext )
+                        return call_user_func($upload_error_handler, $file, __( 'File type does not meet security guidelines. Try another.' ));
 
                 if ( !$ext )
                         $ext = ltrim(strrchr($file['name'], '.'), '.');
@@ -303 +312 @@
 
         // A writable uploads dir will pass this test. Again, there's no point overriding this one.
         if ( ! ( ( $uploads = wp_upload_dir($time) ) && false === $uploads['error'] ) )
-                return $upload_error_handler( $file, $uploads['error'] );
+                return call_user_func($upload_error_handler, $file, $uploads['error'] );
 
         $filename = wp_unique_filename( $uploads['path'], $file['name'], $unique_filename_callback );