Context Navigation

← Previous Change
Next Change →

functions.php

Timestamp:

07/05/2018 02:54:32 PM (8 years ago)

Author:

johnbillion

Message:

Media: Limit thumbnail file deletions to the same directory as the original file.

Merges [43393] into the 4.5 branch.

File:

: 1 edited

branches/4.5/src/wp-includes/functions.php (modified) (3 diffs)

Legend:

: Unmodified
: Added
: Removed

branches/4.5/src/wp-includes/functions.php

-              r42283
+              r43397
  * @since 4.4.0 Ensures upper-case drive letters on Windows systems.
  * @since 4.5.0 Allows for Windows network shares.
+ * @since 4.9.7 Allows for PHP file wrappers.
+ *
  * @param string $path Path to normalize.
 …
  */
 function wp_normalize_path( $path ) {
+        $wrapper = '';
+        if ( wp_is_stream( $path ) ) {
+                list( $wrapper, $path ) = explode( '://', $path, 2 );
+                $wrapper .= '://';
+        }
+        // Standardise all paths to use /
         $path = str_replace( '\\', '/', $path );
+        // Replace multiple slashes down to a singular, allowing for network shares having two slashes.
         $path = preg_replace( '|(?<=.)/+|', '/', $path );
+        // Windows paths should uppercase the drive letter
         if ( ':' === substr( $path, 1, 1 ) ) {
                 $path = ucfirst( $path );
+        }
+        return $path;
+        return $wrapper . $path;
+}
 …
 /**
+ * Deletes a file if its path is within the given directory.
+ *
+ * @since 4.9.7
+ *
+ * @param string $file      Absolute path to the file to delete.
+ * @param string $directory Absolute path to a directory.
+ * @return bool True on success, false on failure.
+ */
+function wp_delete_file_from_directory( $file, $directory ) {
+        $real_file = realpath( wp_normalize_path( $file ) );
+        $real_directory = realpath( wp_normalize_path( $directory ) );
+        if ( false === $real_file || false === $real_directory || strpos( wp_normalize_path( $real_file ), trailingslashit( wp_normalize_path( $real_directory ) ) ) !== 0 ) {
+                return false;
+        }
+        wp_delete_file( $file );
+        return true;
+}
+/**
  * Outputs a small JS snippet on preview tabs/windows to remove `window.name` on unload.
+ *

Note: See TracChangeset for help on using the changeset viewer.

Make WordPress Core

Context Navigation

Changeset 43397 for branches/4.5/src/wp-includes/functions.php

Legend:

branches/4.5/src/wp-includes/functions.php

Download in other formats: