Changeset 43392

Timestamp:

07/05/2018 02:31:24 PM (8 years ago)

Author:

johnbillion

Message:

Media: Limit thumbnail file deletions to the same directory as the original file.

Location:

trunk/src/wp-includes

Files:

• functions.php (modified) (1 diff)
• post.php (modified) (3 diffs)

trunk/src/wp-includes/functions.php

@@ -5849 +5849 @@
 
 /**
+ * Deletes a file if its path is within the given directory.
+ *
+ * @since 4.9.7
+ *
+ * @param string $file      Absolute path to the file to delete.
+ * @param string $directory Absolute path to a directory.
+ * @return bool True on success, false on failure.
+ */
+function wp_delete_file_from_directory( $file, $directory ) {
+        $real_file = realpath( wp_normalize_path( $file ) );
+        $real_directory = realpath( wp_normalize_path( $directory ) );
+
+        if ( false === $real_file || false === $real_directory || strpos( wp_normalize_path( $real_file ), trailingslashit( wp_normalize_path( $real_directory ) ) ) !== 0 ) {
+                return false;
+        }
+
+        wp_delete_file( $file );
+
+        return true;
+}
+
+/**
  * Outputs a small JS snippet on preview tabs/windows to remove `window.name` on unload.
  *

trunk/src/wp-includes/post.php

@@ -5312 +5312 @@
         do_action( 'deleted_post', $post_id );
 
+        wp_delete_attachment_files( $post_id, $meta, $backup_sizes, $file );
+
+        clean_post_cache( $post );
+
+        return $post;
+}
+
+/**
+ * Deletes all files that belong to the given attachment.
+ *
+ * @since 4.9.7
+ *
+ * @param int    $post_id      Attachment ID.
+ * @param array  $meta         The attachment's meta data.
+ * @param array  $backup_sizes The meta data for the attachment's backup images.
+ * @param string $file         Absolute path to the attachment's file.
+ * @return bool True on success, false on failure.
+ */
+function wp_delete_attachment_files( $post_id, $meta, $backup_sizes, $file ) {
+        global $wpdb;
+
         $uploadpath = wp_get_upload_dir();
+        $deleted    = true;
 
         if ( ! empty( $meta['thumb'] ) ) {
@@ -5318 +5340 @@
                 if ( ! $wpdb->get_row( $wpdb->prepare( "SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE %s AND post_id <> %d", '%' . $wpdb->esc_like( $meta['thumb'] ) . '%', $post_id ) ) ) {
                         $thumbfile = str_replace( basename( $file ), $meta['thumb'], $file );
-                        /** This filter is documented in wp-includes/functions.php */
-                        $thumbfile = apply_filters( 'wp_delete_file', $thumbfile );
-                        @ unlink( path_join( $uploadpath['basedir'], $thumbfile ) );
+                        if ( ! empty( $thumbfile ) ) {
+                                $thumbfile = path_join( $uploadpath['basedir'], $thumbfile );
+                                $thumbdir  = path_join( $uploadpath['basedir'], dirname( $file ) );
+
+                                if ( ! wp_delete_file_from_directory( $thumbfile, $thumbdir ) ) {
+                                        $deleted = false;
+                                }
+                        }
                 }
         }
@@ -5326 +5353 @@
         // Remove intermediate and backup images if there are any.
         if ( isset( $meta['sizes'] ) && is_array( $meta['sizes'] ) ) {
+                $intermediate_dir = path_join( $uploadpath['basedir'], dirname( $file ) );
                 foreach ( $meta['sizes'] as $size => $sizeinfo ) {
                         $intermediate_file = str_replace( basename( $file ), $sizeinfo['file'], $file );
-                        /** This filter is documented in wp-includes/functions.php */
-                        $intermediate_file = apply_filters( 'wp_delete_file', $intermediate_file );
-                        @ unlink( path_join( $uploadpath['basedir'], $intermediate_file ) );
+                        if ( ! empty( $intermediate_file ) ) {
+                                $intermediate_file = path_join( $uploadpath['basedir'], $intermediate_file );
+
+                                if ( ! wp_delete_file_from_directory( $intermediate_file, $intermediate_dir ) ) {
+                                        $deleted = false;
+                                }
+                        }
                 }
         }
 
         if ( is_array( $backup_sizes ) ) {
+                $del_dir = path_join( $uploadpath['basedir'], dirname( $meta['file'] ) );
                 foreach ( $backup_sizes as $size ) {
                         $del_file = path_join( dirname( $meta['file'] ), $size['file'] );
-                        /** This filter is documented in wp-includes/functions.php */
-                        $del_file = apply_filters( 'wp_delete_file', $del_file );
-                        @ unlink( path_join( $uploadpath['basedir'], $del_file ) );
-                }
-        }
-
-        wp_delete_file( $file );
-
-        clean_post_cache( $post );
-
-        return $post;
+                        if ( ! empty( $del_file ) ) {
+                                $del_file = path_join( $uploadpath['basedir'], $del_file );
+
+                                if ( ! wp_delete_file_from_directory( $del_file, $del_dir ) ) {
+                                        $deleted = false;
+                                }
+                        }
+                }
+        }
+
+        if ( ! wp_delete_file_from_directory( $file, $uploadpath['basedir'] ) ) {
+                $deleted = false;
+        }
+
+        return $deleted;
 }