WordPress.org

Make WordPress Core


Ignore:
Timestamp:
01/11/2017 01:17:52 PM (3 years ago)
Author:
joemcgill
Message:

Media: Improve image filetype checking.

This adds a new function wp_get_image_mime() which is used by
wp_check_filetype_and_ext() to validate image files using
exif_imagetype() if available instead of getimagesize().

getimagesize() is less performant than exif_imagetype() and is
dependent on GD. If exif_imagetype() is not available, it falls back to
getimagesize() as before.

If wp_check_filetype_and_ext() can't validate the filetype, we now return
false for ext/MIME values.

Merges [39831] to the 4.1 branch.

Location:
branches/4.1
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.1

  • branches/4.1/src/wp-includes/functions.php

    r32172 r39838  
    20692069 * then the "proper_filename" value will be set with a proper filename and extension.
    20702070 *
    2071  * Currently this function only supports validating images known to getimagesize().
     2071 * Currently this function only supports renaming images validated via wp_get_image_mime().
    20722072 *
    20732073 * @since 3.0.0
     
    20942094    }
    20952095
    2096     // We're able to validate images using GD
    2097     if ( $type && 0 === strpos( $type, 'image/' ) && function_exists('getimagesize') ) {
     2096    // Validate image types.
     2097    if ( $type && 0 === strpos( $type, 'image/' ) ) {
    20982098
    20992099        // Attempt to figure out what type of image it actually is
    2100         $imgstats = @getimagesize( $file );
    2101 
    2102         // If getimagesize() knows what kind of image it really is and if the real MIME doesn't match the claimed MIME
    2103         if ( !empty($imgstats['mime']) && $imgstats['mime'] != $type ) {
     2100        $real_mime = wp_get_image_mime( $file );
     2101
     2102        if ( ! $real_mime ) {
     2103            $type = $ext = false;
     2104        } elseif ( $real_mime != $type ) {
    21042105            /**
    21052106             * Filter the list mapping image mime types to their respective extensions.
     
    21182119
    21192120            // Replace whatever is after the last period in the filename with the correct extension
    2120             if ( ! empty( $mime_to_ext[ $imgstats['mime'] ] ) ) {
     2121            if ( ! empty( $mime_to_ext[ $real_mime ] ) ) {
    21212122                $filename_parts = explode( '.', $filename );
    21222123                array_pop( $filename_parts );
    2123                 $filename_parts[] = $mime_to_ext[ $imgstats['mime'] ];
     2124                $filename_parts[] = $mime_to_ext[ $real_mime ];
    21242125                $new_filename = implode( '.', $filename_parts );
    21252126
     
    21312132                $ext = $wp_filetype['ext'];
    21322133                $type = $wp_filetype['type'];
     2134            } else {
     2135                $type = $ext = false;
    21332136            }
     2137        }
     2138    } elseif ( function_exists( 'finfo_file' ) ) {
     2139        // Use finfo_file if available to validate non-image files.
     2140        $finfo = finfo_open( FILEINFO_MIME_TYPE );
     2141        $real_mime = finfo_file( $finfo, $file );
     2142        finfo_close( $finfo );
     2143
     2144        // If the extension does not match the file's real type, return false.
     2145        if ( $real_mime !== $type ) {
     2146            $type = $ext = false;
    21342147        }
    21352148    }
     
    21482161     */
    21492162    return apply_filters( 'wp_check_filetype_and_ext', compact( 'ext', 'type', 'proper_filename' ), $file, $filename, $mimes );
     2163}
     2164
     2165/**
     2166 * Returns the real mime type of an image file.
     2167 *
     2168 * This depends on exif_imagetype() or getimagesize() to determine real mime types.
     2169 *
     2170 * @since 4.7.1
     2171 *
     2172 * @param string $file Full path to the file.
     2173 * @return string|false The actual mime type or false if the type cannot be determined.
     2174 */
     2175function wp_get_image_mime( $file ) {
     2176    /*
     2177     * Use exif_imagetype() to check the mimetype if available or fall back to
     2178     * getimagesize() if exif isn't avaialbe. If either function throws an Exception
     2179     * we assume the file could not be validated.
     2180     */
     2181    try {
     2182        if ( ! is_callable( 'exif_imagetype' ) ) {
     2183            $mime = image_type_to_mime_type( exif_imagetype( $file ) );
     2184        } elseif ( function_exists( 'getimagesize' ) ) {
     2185            $imagesize = getimagesize( $file );
     2186            $mime = ( isset( $imagesize['mime'] ) ) ? $imagesize['mime'] : false;
     2187        } else {
     2188            $mime = false;
     2189        }
     2190    } catch ( Exception $e ) {
     2191        $mime = false;
     2192    }
     2193
     2194    return $mime;
    21502195}
    21512196
Note: See TracChangeset for help on using the changeset viewer.