Changeset 14400
- Timestamp:
- 05/03/2010 08:17:01 PM (15 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/wp-admin/includes/file.php
r14377 r14400 421 421 extract( $wp_filetype ); 422 422 423 // If the file claims to be an image, validate it's extension 424 if ( function_exists('getimagesize') && !empty( $type ) && 'image/' == substr( $type, 0, 6 ) && is_uploaded_file( $file['tmp_name'] ) ) { 425 // Attempt to figure out what type of image it really is 426 $imgstats = @getimagesize( $file['tmp_name'] ); 427 428 // If getimagesize() knows what kind of image it really is and if the real MIME doesn't match the claimed MIME 429 if ( !empty($imgstats['mime']) && $imgstats['mime'] != $type ) { 430 // This is a simplified array of MIMEs that getimagesize() can detect and their extensions 431 $mime_to_ext = apply_filters( 'getimagesize_mimes_to_exts', array( 432 'image/jpeg' => 'jpg', 433 'image/png' => 'png', 434 'image/gif' => 'gif', 435 'image/bmp' => 'bmp', 436 'image/tiff' => 'tif', 437 ) ); 438 439 // Replace whatever's after the last period in the filename with the correct extension 440 if ( !empty($mime_to_ext[$imgstats['mime']]) ) { 441 $filename_parts = explode( '.', $file['name'] ); 442 array_pop( $filename_parts ); 443 $filename_parts[] = $mime_to_ext[$imgstats['mime']]; 444 $file['name'] = implode( '.', $filename_parts ); 445 446 // Re-validate the extension / MIME 447 $wp_filetype = wp_check_filetype( $file['name'], $mimes ); 448 extract( $wp_filetype ); 449 } 450 } 451 } 452 423 453 if ( ( !$type || !$ext ) && !current_user_can( 'unfiltered_upload' ) ) 424 454 return $upload_error_handler( $file, __( 'File type does not meet security guidelines. Try another.' ));
Note: See TracChangeset
for help on using the changeset viewer.