Changeset 22521

Timestamp:

11/10/2012 05:36:37 AM (14 years ago)

Author:

nacin

Message:

Don't allow non-image uploads for custom headers and backgrounds. props kovshenin. fixes #22149.

Location:

trunk/wp-admin

Files:

• custom-background.php (modified) (1 diff)
• custom-header.php (modified) (1 diff)
• includes/ajax-actions.php (modified) (1 diff)

trunk/wp-admin/custom-background.php

@@ -356 +356 @@
                 check_admin_referer('custom-background-upload', '_wpnonce-custom-background-upload');
                 $overrides = array('test_form' => false);
-                $file = wp_handle_upload($_FILES['import'], $overrides);
+
+                $uploaded_file = $_FILES['import'];
+                $wp_filetype = wp_check_filetype_and_ext( $uploaded_file['tmp_name'], $uploaded_file['name'], false );
+                if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) )
+                        wp_die( __( 'The uploaded file is not a valid image. Please try again.' ) );
+
+                $file = wp_handle_upload($uploaded_file, $overrides);
 
                 if ( isset($file['error']) )

trunk/wp-admin/custom-header.php

@@ -769 +769 @@
         function step_2_manage_upload() {
                 $overrides = array('test_form' => false);
-                $file = wp_handle_upload($_FILES['import'], $overrides);
+
+                $uploaded_file = $_FILES['import'];
+                $wp_filetype = wp_check_filetype_and_ext( $uploaded_file['tmp_name'], $uploaded_file['name'], false );
+                if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) )
+                        wp_die( __( 'The uploaded file is not a valid image. Please try again.' ) );
+
+                $file = wp_handle_upload($uploaded_file, $overrides);
 
                 if ( isset($file['error']) )

trunk/wp-admin/includes/ajax-actions.php

@@ -1610 +1610 @@
         $post_data = isset( $_REQUEST['post_data'] ) ? $_REQUEST['post_data'] : array();
 
+        // If the context is custom header or background, make sure the uploaded file is an image.
+        if ( isset( $post_data['context'] ) && in_array( $post_data['context'], array( 'custom-header', 'custom-background' ) ) ) {
+                $wp_filetype = wp_check_filetype_and_ext( $_FILES['async-upload']['tmp_name'], $_FILES['async-upload']['name'], false );
+                if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) ) {
+                        wp_send_json_error( array(
+                                'message' => __( 'The uploaded file is not a valid image. Please try again.' ),
+                                'filename' => $_FILES['async-upload']['name'],
+                        ) );
+                }
+        }
+
         $attachment_id = media_handle_upload( 'async-upload', $post_id, $post_data );