WordPress.org

Make WordPress Core


Ignore:
Timestamp:
05/15/2010 04:47:03 AM (11 years ago)
Author:
nacin
Message:

Introduce wp_check_filetype_and_ext() to handle mime/ext image comparisons and corrections for upload and sideload. props Viper007Bond, see #11946.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-admin/includes/file.php

    r14427 r14649  
    307307    // A correct MIME type will pass this test. Override $mimes or use the upload_mimes filter.
    308308    if ( $test_type ) {
    309         $wp_filetype = wp_check_filetype( $file['name'], $mimes );
     309        $wp_filetype = wp_check_filetype_and_ext( $file['tmp_name'], $file['name'], $mimes );
    310310
    311311        extract( $wp_filetype );
     312
     313        // Check to see if wp_check_filetype_and_ext() determined the filename was incorrect
     314        if ( $proper_filename )
     315            $file['name'] = $proper_filename;
    312316
    313317        if ( ( !$type || !$ext ) && !current_user_can( 'unfiltered_upload' ) )
     
    417421    // A correct MIME type will pass this test. Override $mimes or use the upload_mimes filter.
    418422    if ( $test_type ) {
    419         $wp_filetype = wp_check_filetype( $file['name'], $mimes );
     423        $wp_filetype = wp_check_filetype_and_ext( $file['tmp_name'], $file['name'], $mimes );
    420424
    421425        extract( $wp_filetype );
    422426
    423         // If the file claims to be an image, validate it's extension
    424         if ( function_exists('getimagesize') && !empty( $type ) && 'image/' == substr( $type, 0, 6 ) && is_uploaded_file( $file['tmp_name'] ) ) {
    425             // Attempt to figure out what type of image it really is
    426             $imgstats = @getimagesize( $file['tmp_name'] );
    427 
    428             // If getimagesize() knows what kind of image it really is and if the real MIME doesn't match the claimed MIME
    429             if ( !empty($imgstats['mime']) && $imgstats['mime'] != $type ) {
    430                 // This is a simplified array of MIMEs that getimagesize() can detect and their extensions
    431                 $mime_to_ext = apply_filters( 'getimagesize_mimes_to_exts', array(
    432                     'image/jpeg' => 'jpg',
    433                     'image/png'  => 'png',
    434                     'image/gif'  => 'gif',
    435                     'image/bmp'  => 'bmp',
    436                     'image/tiff' => 'tif',
    437                 ) );
    438 
    439                 // Replace whatever's after the last period in the filename with the correct extension
    440                 if ( !empty($mime_to_ext[$imgstats['mime']]) ) {
    441                     $filename_parts = explode( '.', $file['name'] );
    442                     array_pop( $filename_parts );
    443                     $filename_parts[] = $mime_to_ext[$imgstats['mime']];
    444                     $file['name'] = implode( '.', $filename_parts );
    445 
    446                     // Re-validate the extension / MIME
    447                     $wp_filetype = wp_check_filetype( $file['name'], $mimes );
    448                     extract( $wp_filetype );
    449                 }
    450             }
    451         }
     427        // Check to see if wp_check_filetype_and_ext() determined the filename was incorrect
     428        if ( $proper_filename )
     429            $file['name'] = $proper_filename;
    452430
    453431        if ( ( !$type || !$ext ) && !current_user_can( 'unfiltered_upload' ) )
Note: See TracChangeset for help on using the changeset viewer.