Changeset 22521 for trunk/wp-admin/custom-background.php

Timestamp:

11/10/2012 05:36:37 AM (13 years ago)

Author:

nacin

Message:

Don't allow non-image uploads for custom headers and backgrounds. props kovshenin. fixes #22149.

File:

• trunk/wp-admin/custom-background.php (modified) (1 diff)

trunk/wp-admin/custom-background.php

@@ -356 +356 @@
         check_admin_referer('custom-background-upload', '_wpnonce-custom-background-upload');
         $overrides = array('test_form' => false);
-        $file = wp_handle_upload($_FILES['import'], $overrides);
+
+        $uploaded_file = $_FILES['import'];
+        $wp_filetype = wp_check_filetype_and_ext( $uploaded_file['tmp_name'], $uploaded_file['name'], false );
+        if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) )
+            wp_die( __( 'The uploaded file is not a valid image. Please try again.' ) );
+
+        $file = wp_handle_upload($uploaded_file, $overrides);
 
         if ( isset($file['error']) )