Changeset 44438 for trunk

Timestamp:

01/07/2019 08:47:56 PM (8 years ago)

Author:

joemcgill

Message:

Upload: Fix upload failures of common text file types.

This adds some special case handling in 'wp_check_filetype_and_ext()' that prevents some common file types from being blocked based on mismatched MIME checks, which were made more strict in WordPress 5.0.1.

Props Kloon, birgire, tellyworth, joemcgill.
See #45615.

Location:

trunk

Files:

• src/wp-includes/functions.php (modified) (1 diff)
• tests/phpunit/tests/functions.php (modified) (2 diffs)

trunk/src/wp-includes/functions.php

@@ -2570 +2570 @@
                          * and some media files are commonly named with the wrong extension (.mov instead of .mp4)
                          */
-
                         if ( substr( $real_mime, 0, strcspn( $real_mime, '/' ) ) !== substr( $type, 0, strcspn( $type, '/' ) ) ) {
+                                $type = $ext = false;
+                        }
+                } elseif ( 'text/plain' === $real_mime ) {
+                        // A few common file types are occasionally detected as text/plain; allow those.
+                        if ( ! in_array( $type, array(
+                                        'text/plain',
+                                        'text/csv',
+                                        'text/richtext',
+                                        'text/tsv',
+                                        'text/vtt',
+                                ) )
+                        ) {
+                                $type = $ext = false;
+                        }
+                } elseif( 'text/rtf' === $real_mime ) {
+                        // Special casing for RTF files.
+                        if ( ! in_array( $type, array(
+                                        'text/rtf',
+                                        'text/plain',
+                                        'application/rtf',
+                                ) )
+                        ) {
                                 $type = $ext = false;
                         }

trunk/tests/phpunit/tests/functions.php

@@ -1231 +1231 @@
 
         /**
-         * Data profider for test_wp_get_image_mime();
+         * Data provider for test_wp_get_image_mime();
          */
         public function _wp_get_image_mime() {
@@ -1334 +1334 @@
                                         'ext'             => false,
                                         'type'            => false,
+                                        'proper_filename' => false,
+                                ),
+                        ),
+                        // Non-image file not allowed even if it's named like one.
+                        array(
+                                DIR_TESTDATA . '/export/crazy-cdata.xml',
+                                'crazy-cdata.jpg',
+                                array(
+                                        'ext' => false,
+                                        'type' => false,
+                                        'proper_filename' => false,
+                                ),
+                        ),
+                        // Non-image file not allowed if it's named like something else.
+                        array(
+                                DIR_TESTDATA . '/export/crazy-cdata.xml',
+                                'crazy-cdata.doc',
+                                array(
+                                        'ext' => false,
+                                        'type' => false,
+                                        'proper_filename' => false,
+                                ),
+                        ),
+                        // Assorted text/* sample files
+                        array(
+                                DIR_TESTDATA . '/uploads/test.vtt',
+                                'test.vtt',
+                                array(
+                                        'ext' => 'vtt',
+                                        'type' => 'text/vtt',
+                                        'proper_filename' => false,
+                                ),
+                        ),
+                        array(
+                                DIR_TESTDATA . '/uploads/test.csv',
+                                'test.csv',
+                                array(
+                                        'ext' => 'csv',
+                                        'type' => 'text/csv',
+                                        'proper_filename' => false,
+                                ),
+                        ),
+                        // RTF files.
+                        array(
+                                DIR_TESTDATA . '/uploads/test.rtf',
+                                'test.rtf',
+                                array(
+                                        'ext' => 'rtf',
+                                        'type' => 'application/rtf',
                                         'proper_filename' => false,
                                 ),