Changeset 46979 for branches/5.3

Timestamp:

12/17/2019 09:10:14 PM (7 years ago)

Author:

azaozz

Message:

Upload:

• Fix PHP warnings in wp_unique_filename() when the destination directory is unreadable.
• Run the final name collision test only for files that are saved to the uploads directory.
• Update the unit tests to match.

Props eden159, audrasjb, azaozz.
Merges [46965] to the 5.3 branch.
Fixes #48960.

Location:

branches/5.3

Files:

• . (modified) (1 prop)
• src/wp-includes/functions.php (modified) (1 diff)
• tests/phpunit/tests/functions.php (modified) (4 diffs)

branches/5.3/src/wp-includes/functions.php

@@ -2473 +2473 @@
                 // Prevent collisions with existing file names that contain dimension-like strings
                 // (whether they are subsizes or originals uploaded prior to #42437).
+                $upload_dir = wp_get_upload_dir();
 
                 // The (resized) image files would have name and extension, and will be in the uploads dir.
-                if ( @is_dir( $dir ) && $name && $ext ) {
-                        // List of all files and directories contained in $dir (with the "dot" files removed).
-                        $files = array_diff( scandir( $dir ), array( '.', '..' ) );
+                if ( $name && $ext && @is_dir( $dir ) && false !== strpos( $dir, $upload_dir['basedir'] ) ) {
+                        // List of all files and directories contained in $dir.
+                        $files = @scandir( $dir );
+
+                        if ( ! empty( $files ) ) {
+                                // Remove "dot" dirs.
+                                $files = array_diff( $files, array( '.', '..' ) );
+                        }
 
                         if ( ! empty( $files ) ) {

branches/5.3/tests/phpunit/tests/functions.php

@@ -202 +202 @@
                 $testdir = DIR_TESTDATA . '/images/';
 
+                add_filter( 'upload_dir', array( $this, 'upload_dir_patch_basedir' ) );
+
                 // Test collision with "dimension-like" original filename.
                 $this->assertEquals( 'one-blue-pixel-100x100-1.png', wp_unique_filename( $testdir, 'one-blue-pixel-100x100.png' ) );
@@ -207 +209 @@
                 // Existing files: one-blue-pixel-100x100.png, one-blue-pixel-1-100x100.png.
                 $this->assertEquals( 'one-blue-pixel-2.png', wp_unique_filename( $testdir, 'one-blue-pixel.png' ) );
+
+                remove_filter( 'upload_dir', array( $this, 'upload_dir_patch_basedir' ) );
+        }
+
+        // Callback to patch "basedir" when used in `wp_unique_filename()`.
+        function upload_dir_patch_basedir( $upload_dir ) {
+                $upload_dir['basedir'] = DIR_TESTDATA . '/images/';
+                return $upload_dir;
         }
 
@@ -229 +239 @@
                         ),
                 );
+
                 foreach ( $cases as $case ) {
                         $this->assertTrue( is_serialized( $case ), "Serialized data: $case" );
@@ -238 +249 @@
                         's:4:test;',
                 );
+
                 foreach ( $not_serialized as $case ) {
                         $this->assertFalse( is_serialized( $case ), "Test data: $case" );