Make WordPress Core

Changeset 43393


Ignore:
Timestamp:
07/05/2018 02:44:35 PM (6 years ago)
Author:
johnbillion
Message:

Media: Limit thumbnail file deletions to the same directory as the original file.

Location:
branches/4.9/src/wp-includes
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.9/src/wp-includes/functions.php

    r43285 r43393  
    17051705 * @since 4.4.0 Ensures upper-case drive letters on Windows systems.
    17061706 * @since 4.5.0 Allows for Windows network shares.
     1707 * @since 4.9.7 Allows for PHP file wrappers.
    17071708 *
    17081709 * @param string $path Path to normalize.
     
    17101711 */
    17111712function wp_normalize_path( $path ) {
     1713    $wrapper = '';
     1714    if ( wp_is_stream( $path ) ) {
     1715        list( $wrapper, $path ) = explode( '://', $path, 2 );
     1716        $wrapper .= '://';
     1717    }
     1718
     1719    // Standardise all paths to use /
    17121720    $path = str_replace( '\\', '/', $path );
     1721
     1722    // Replace multiple slashes down to a singular, allowing for network shares having two slashes.
    17131723    $path = preg_replace( '|(?<=.)/+|', '/', $path );
     1724
     1725    // Windows paths should uppercase the drive letter
    17141726    if ( ':' === substr( $path, 1, 1 ) ) {
    17151727        $path = ucfirst( $path );
    17161728    }
    1717     return $path;
     1729
     1730    return $wrapper . $path;
    17181731}
    17191732
     
    55055518
    55065519/**
     5520 * Deletes a file if its path is within the given directory.
     5521 *
     5522 * @since 4.9.7
     5523 *
     5524 * @param string $file      Absolute path to the file to delete.
     5525 * @param string $directory Absolute path to a directory.
     5526 * @return bool True on success, false on failure.
     5527 */
     5528function wp_delete_file_from_directory( $file, $directory ) {
     5529    $real_file = realpath( wp_normalize_path( $file ) );
     5530    $real_directory = realpath( wp_normalize_path( $directory ) );
     5531
     5532    if ( false === $real_file || false === $real_directory || strpos( wp_normalize_path( $real_file ), trailingslashit( wp_normalize_path( $real_directory ) ) ) !== 0 ) {
     5533        return false;
     5534    }
     5535
     5536    wp_delete_file( $file );
     5537
     5538    return true;
     5539}
     5540
     5541/**
    55075542 * Outputs a small JS snippet on preview tabs/windows to remove `window.name` on unload.
    55085543 *
  • branches/4.9/src/wp-includes/post.php

    r43084 r43393  
    50575057    do_action( 'deleted_post', $post_id );
    50585058
     5059    wp_delete_attachment_files( $post_id, $meta, $backup_sizes, $file );
     5060
     5061    clean_post_cache( $post );
     5062
     5063    return $post;
     5064}
     5065
     5066/**
     5067 * Deletes all files that belong to the given attachment.
     5068 *
     5069 * @since 4.9.7
     5070 *
     5071 * @param int    $post_id      Attachment ID.
     5072 * @param array  $meta         The attachment's meta data.
     5073 * @param array  $backup_sizes The meta data for the attachment's backup images.
     5074 * @param string $file         Absolute path to the attachment's file.
     5075 * @return bool True on success, false on failure.
     5076 */
     5077function wp_delete_attachment_files( $post_id, $meta, $backup_sizes, $file ) {
     5078    global $wpdb;
     5079
    50595080    $uploadpath = wp_get_upload_dir();
    5060 
    5061     if ( ! empty($meta['thumb']) ) {
     5081    $deleted    = true;
     5082
     5083    if ( ! empty( $meta['thumb'] ) ) {
    50625084        // Don't delete the thumb if another attachment uses it.
    5063         if (! $wpdb->get_row( $wpdb->prepare( "SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE %s AND post_id <> %d", '%' . $wpdb->esc_like( $meta['thumb'] ) . '%', $post_id)) ) {
    5064             $thumbfile = str_replace(basename($file), $meta['thumb'], $file);
    5065             /** This filter is documented in wp-includes/functions.php */
    5066             $thumbfile = apply_filters( 'wp_delete_file', $thumbfile );
    5067             @ unlink( path_join($uploadpath['basedir'], $thumbfile) );
     5085        if ( ! $wpdb->get_row( $wpdb->prepare( "SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE %s AND post_id <> %d", '%' . $wpdb->esc_like( $meta['thumb'] ) . '%', $post_id ) ) ) {
     5086            $thumbfile = str_replace( basename( $file ), $meta['thumb'], $file );
     5087            if ( ! empty( $thumbfile ) ) {
     5088                $thumbfile = path_join( $uploadpath['basedir'], $thumbfile );
     5089                $thumbdir  = path_join( $uploadpath['basedir'], dirname( $file ) );
     5090
     5091                if ( ! wp_delete_file_from_directory( $thumbfile, $thumbdir ) ) {
     5092                    $deleted = false;
     5093                }
     5094            }
    50685095        }
    50695096    }
     
    50715098    // Remove intermediate and backup images if there are any.
    50725099    if ( isset( $meta['sizes'] ) && is_array( $meta['sizes'] ) ) {
     5100        $intermediate_dir = path_join( $uploadpath['basedir'], dirname( $file ) );
    50735101        foreach ( $meta['sizes'] as $size => $sizeinfo ) {
    50745102            $intermediate_file = str_replace( basename( $file ), $sizeinfo['file'], $file );
    5075             /** This filter is documented in wp-includes/functions.php */
    5076             $intermediate_file = apply_filters( 'wp_delete_file', $intermediate_file );
    5077             @ unlink( path_join( $uploadpath['basedir'], $intermediate_file ) );
    5078         }
    5079     }
    5080 
    5081     if ( is_array($backup_sizes) ) {
     5103            if ( ! empty( $intermediate_file ) ) {
     5104                $intermediate_file = path_join( $uploadpath['basedir'], $intermediate_file );
     5105
     5106                if ( ! wp_delete_file_from_directory( $intermediate_file, $intermediate_dir ) ) {
     5107                    $deleted = false;
     5108                }
     5109            }
     5110        }
     5111    }
     5112
     5113    if ( is_array( $backup_sizes ) ) {
     5114        $del_dir = path_join( $uploadpath['basedir'], dirname( $meta['file'] ) );
    50825115        foreach ( $backup_sizes as $size ) {
    5083             $del_file = path_join( dirname($meta['file']), $size['file'] );
    5084             /** This filter is documented in wp-includes/functions.php */
    5085             $del_file = apply_filters( 'wp_delete_file', $del_file );
    5086             @ unlink( path_join($uploadpath['basedir'], $del_file) );
    5087         }
    5088     }
    5089 
    5090     wp_delete_file( $file );
    5091 
    5092     clean_post_cache( $post );
    5093 
    5094     return $post;
     5116            $del_file = path_join( dirname( $meta['file'] ), $size['file'] );
     5117            if ( ! empty( $del_file ) ) {
     5118                $del_file = path_join( $uploadpath['basedir'], $del_file );
     5119
     5120                if ( ! wp_delete_file_from_directory( $del_file, $del_dir ) ) {
     5121                    $deleted = false;
     5122                }
     5123            }
     5124        }
     5125    }
     5126
     5127    if ( ! wp_delete_file_from_directory( $file, $uploadpath['basedir'] ) ) {
     5128        $deleted = false;
     5129    }
     5130
     5131    return $deleted;
    50955132}
    50965133
Note: See TracChangeset for help on using the changeset viewer.