Changeset 25317 for trunk/src

Timestamp:

09/10/2013 06:03:26 PM (11 years ago)

Author:

nacin

Message:

Tighten allowed upload file types.

File:

• trunk/src/wp-includes/functions.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -2024 +2024 @@
  * @uses wp_get_upload_mime_types() to fetch the list of mime types
  *
+ * @param int|WP_User $user Optional. User to check. Defaults to current user.
  * @return array Array of mime types keyed by the file extension regex corresponding to those types.
  */
-function get_allowed_mime_types() {
-    return apply_filters( 'upload_mimes', wp_get_mime_types() );
+function get_allowed_mime_types( $user = null ) {
+    $t = wp_get_mime_types();
+
+    unset( $t['swf'], $t['exe'] );
+    $unfiltered = $user ? user_can( $user, 'unfiltered_html' ) : current_user_can( 'unfiltered_html' );
+    if ( ! $unfiltered )
+        unset( $t['htm|html'] );
+
+    return apply_filters( 'upload_mimes', $t, $user );
 }