sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Upload: Fix upload failures of common text file types.

Browse Source 
This adds some special case handling in 'wp_check_filetype_and_ext()' that prevents some common file types from being blocked based on mismatched MIME checks, which were made more strict in WordPress 5.0.1.

Props Kloon, birgire, tellyworth, joemcgill.
See #45615.


git-svn-id: https://develop.svn.wordpress.org/trunk@44438 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Joe McGill 2019-01-07 20:47:56 +00:00
parent c7fb3b36ea
commit 94c8a5d994
2 changed files with 72 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
src/wp-includes/functions.php
View File

@ -2569,10 +2569,31 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {
* This means that common mismatches are forgiven: application/vnd.apple.numbers is often misidentified as application/zip,
* and some media files are commonly named with the wrong extension (.mov instead of .mp4)
*/
if ( substr( $real_mime, 0, strcspn( $real_mime, '/' ) ) !== substr( $type, 0, strcspn( $type, '/' ) ) ) {
$type = $ext = false;
}
} elseif ( 'text/plain' === $real_mime ) {
// A few common file types are occasionally detected as text/plain; allow those.
if ( ! in_array( $type, array(
'text/plain',
'text/csv',
'text/richtext',
'text/tsv',
'text/vtt',
) )
) {
$type = $ext = false;
}
} elseif( 'text/rtf' === $real_mime ) {
// Special casing for RTF files.
if ( ! in_array( $type, array(
'text/rtf',
'text/plain',
'application/rtf',
) )
) {
$type = $ext = false;
}
} else {
if ( $type !== $real_mime ) {
/*

51
tests/phpunit/tests/functions.php
View File

@ -1230,7 +1230,7 @@ class Tests_Functions extends WP_UnitTestCase {
}
/**
* Data profider for test_wp_get_image_mime();
* Data provider for test_wp_get_image_mime();
*/
public function _wp_get_image_mime() {
$data = array(
@ -1336,6 +1336,55 @@ class Tests_Functions extends WP_UnitTestCase {
'proper_filename' => false,
),
),
// Non-image file not allowed even if it's named like one.
array(
DIR_TESTDATA . '/export/crazy-cdata.xml',
'crazy-cdata.jpg',
array(
'ext' => false,
'type' => false,
'proper_filename' => false,
),
),
// Non-image file not allowed if it's named like something else.
array(
DIR_TESTDATA . '/export/crazy-cdata.xml',
'crazy-cdata.doc',
array(
'ext' => false,
'type' => false,
'proper_filename' => false,
),
),
// Assorted text/* sample files
array(
DIR_TESTDATA . '/uploads/test.vtt',
'test.vtt',
array(
'ext' => 'vtt',
'type' => 'text/vtt',
'proper_filename' => false,
),
),
array(
DIR_TESTDATA . '/uploads/test.csv',
'test.csv',
array(
'ext' => 'csv',
'type' => 'text/csv',
'proper_filename' => false,
),
),
// RTF files.
array(
DIR_TESTDATA . '/uploads/test.rtf',
'test.rtf',
array(
'ext' => 'rtf',
'type' => 'application/rtf',
'proper_filename' => false,
),
),
);
// Test a few additional file types on single sites.