From f055694b32861c66b90dc4b5f7d5b0868abe878d Mon Sep 17 00:00:00 2001 From: Joe McGill Date: Mon, 27 Feb 2017 19:27:58 +0000 Subject: [PATCH] Media: Reduce failing uploads following 4.7.1. [39831] introduced more strict MIME type checking for uploads, which resulted in unintetionally blocking several filetypes that were previously valid. This change uses a more targeted approach to MIME validation to restore previous behavior for most types. Props blobfolio, iandunn, ipstenu, markoheijnen, xknown, joemcgill. Merges [40124] and [40125] to the 4.7 branch. Fixes #39550, #39552. git-svn-id: https://develop.svn.wordpress.org/branches/4.7@40134 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/functions.php | 29 +++- tests/phpunit/data/uploads/dashicons.woff | Bin 0 -> 26124 bytes tests/phpunit/data/uploads/pages-to-word.docx | Bin 0 -> 8686 bytes tests/phpunit/data/uploads/video-play.svg | 5 + tests/phpunit/tests/functions.php | 161 ++++++++++++++++++ 5 files changed, 186 insertions(+), 9 deletions(-) create mode 100644 tests/phpunit/data/uploads/dashicons.woff create mode 100644 tests/phpunit/data/uploads/pages-to-word.docx create mode 100644 tests/phpunit/data/uploads/video-play.svg diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php index 828c96615f..6b6a044bff 100644 --- a/src/wp-includes/functions.php +++ b/src/wp-includes/functions.php @@ -2268,15 +2268,15 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) { return compact( 'ext', 'type', 'proper_filename' ); } + $real_mime = false; + // Validate image types. if ( $type && 0 === strpos( $type, 'image/' ) ) { // Attempt to figure out what type of image it actually is $real_mime = wp_get_image_mime( $file ); - if ( ! $real_mime ) { - $type = $ext = false; - } elseif ( $real_mime != $type ) { + if ( $real_mime && $real_mime != $type ) { /** * Filters the list mapping image mime types to their respective extensions. * @@ -2307,18 +2307,29 @@ function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) { $ext = $wp_filetype['ext']; $type = $wp_filetype['type']; } else { - $type = $ext = false; + // Reset $real_mime and try validating again. + $real_mime = false; } } - } elseif ( function_exists( 'finfo_file' ) ) { - // Use finfo_file if available to validate non-image files. + } + + // Validate files that didn't get validated during previous checks. + if ( $type && ! $real_mime && extension_loaded( 'fileinfo' ) ) { $finfo = finfo_open( FILEINFO_MIME_TYPE ); $real_mime = finfo_file( $finfo, $file ); finfo_close( $finfo ); - // If the extension does not match the file's real type, return false. - if ( $real_mime !== $type ) { - $type = $ext = false; + /* + * If $real_mime doesn't match what we're expecting, we need to do some extra + * vetting of application mime types to make sure this type of file is allowed. + * Other mime types are assumed to be safe, but should be considered unverified. + */ + if ( $real_mime && ( $real_mime !== $type ) && ( 0 === strpos( $real_mime, 'application' ) ) ) { + $allowed = get_allowed_mime_types(); + + if ( ! in_array( $real_mime, $allowed ) ) { + $type = $ext = false; + } } } diff --git a/tests/phpunit/data/uploads/dashicons.woff b/tests/phpunit/data/uploads/dashicons.woff new file mode 100644 index 0000000000000000000000000000000000000000..a13f9cf6499823856009da13ee24f41933bed3d4 GIT binary patch literal 26124 zcmY&Ym!W_DoIn zc2f`+2LcBA6;n7Mg#YOxp#Ss#XaD~qF0LZ?J1F|g;{6YfvLsOwqGIB|oc^y*_zNOn zRv<8iKa4EDod2&c_zV41aEmD;8w2}auJ0E@KtLdc=Yp7tW(H2b94Odt4AlSd^8*BG zX6<46%fSHwXXMf>krCxw}t7#ITqX@CC4F#Li8?h7r@{Fej*(xLnHaehIDSO{5b zZsY9!%Sry`fc(vY5hmyeYi(!r8>g%I>;J9}1mQby-POjx{Wq_^{_nj1t63AM#n!;a zkPT|OIjldN8e|Mo+5oa(d(RgRq0+CXqe&0wE}$49-cVGzu&)ma zh@%;1%zb?;zFP)V2x<5vu^g|H6JlteXgHww-}NV1|1sMTSw2Z=e7NMNxgk0(u?`L_ zuU3Dr7;nqGI2zotWy#ESEXTPAnZAMDL6FB_(B6wa5D|3uxIa3t#;8MM2e(PfK{o{P zqY%Z15C?pM4C&z?!9U4mAm|mc?CbduE#`Wf6Kb{hs=6VTY8&fIJu?@P73t`ISX~yG z=$-UqxrRA9FCVB*{`HkmfrOt4THsK`H8T4|JEDy|qNrBLYcyd|)^gQ&X& z!E^wY;R;&hia?#oU37NMwlULLKB}x9uhdR`aFh=%B)uML`GgeND)m8nNw6-yolr=(O^@2!$y?i{8VJv!5GU$JZIF2 zNJ{VLWb<5}XKX6#<*UcJ^14P#was?x=<)=O((zV8{$VS-Pbxc9=Aao*y`<>^tXs!! z8QF_w{%rhgd-N1_e)N>y_}yrJ^z~YUwLRk_g;nBTaW75mK|2&? zl3ucB!3@x-g(Q`%tSK$CR*1f&i1E0hpezJ;P#XEF<{J|N#&9C1WrIcVAfQBu`UA* z`?w_o?E8?e4a+&4GBq)eL;-L91LU|xL6ghX`ZASVlrT-zO6y3b*2)5#qo)n+&Q=G8 zuGa21w2L>1513Cz|2gv{&i;J7zXI7@%|9tQuhe0VAr86&KQi8;h9GaP9khP&4b`j{ zx&u4?qh@|jx6Ap}gHLc38Tm!Fa?XjXRQ0hIZH|-U^8(#JrK!e9h!$i*y`wtiP1IDVNyX%e(+4xwWCn(&B})rCoOaub?`0;UmKGM)*50KKBt8qui=Hd0 z#s)uaT^0HH^)*D#^b|+NdFTpr-RjhBb8m8TF|(3e8jk8#F)87wTKR#cr5NvrjewTx zwM|Y`nt$beBU(l~^^bCnguD$NteVZ(wheP0F|%y!j@dBB5@6dF;AJQG{|vK9MNiz) zP~vo4(WK`-DDt{_##FQ5lnXW(*Inq~-z%qic%4uC3e3xCeGfg?eZNSDU0j9-D)u`x z7Uwr?c|Ei2)3ZYlTgi|4)JV55j*oX?UwFxj8~_lO{H)=t>hB zL*fCLD8aCl5W*Ciaj$p?cPO&YdC6Aan~Dyb%}>7=P|)GIzIW^?O8_!uTR(rU>+^e8x1Qbj z@PVS4PPf_&SE=_YGEW3A)o$w_obq)9z?dnv_pb3X?PX`aTq)pXj%PCU--VmF%ChGt z(b@Rx3>AD}UUZ_Hng#ib)q8R%3~U^J`s~s zE$$jOx);t-OO_e7El>c)+Ycl4=-#hYu5C~9@xM%F>1n<~3Wwv;dV ze1C0&kdL6?inInw%u)+@Rp(NMP+7noTq@wg-eUC>JYD_^Htqgd0WACxdN;Ve0%HDw z3YkU~KP!Pm9IXXhuEb?Bou`b4`4#)Y_u!M6*!Kf83?8bOcHlN)l{u%{tZVUdbu?-# ziLUE+t3o{ziD4Kd>B&TnsGQXVcY-4nOgh{x=dy}W!K7$xw9$0CTKIy>o!3eNrpX>6 z0oDr;1lvDlA&3iG31jGl+7dG+?2mC_ZFpK9YX5mw zud%Y4{v$Tl46ObNgKiGPofXbKCCJCQ;5967|a7JmZNz% zsR)w%mYnkgA!6^p%WXnfg?Y%cAc-bDa+BVUux}En2Ai6#z$Z{79Y_OF)Z_PQOR zjq#ZvGAlhhvo8P3;;Sq`ryoa{JqyfDRdo@b#`tirwp6y9NvaA*8D+WQjZGy5PzlJb zk(CLp7VU*WO|T^Go!zG7PKm;T8>j6dp>C(&)%q8cTX(lsgnB)(#$eP(lL2G&hTA0l zhdyrrW=#x!v?$43t}_G7g(vtFEWMyDYqSvXRJ?LJDRFJARd9;H9-q}#ZPP`8RL^Uw z|2eUF8SD%^cj!Z9v5^OOS5Q*-;N5Fb~r4_g0DECMwl|xGgrtibpL?ADu@hl zdB`6J%YbJ=@ztFTT&Yjet2sXsAzrA~<(4l6iX3sif&O&D5VP^QN$_xqM+E*kWOnalsM+HH8})SWH;V%$IDLmqcV%yv*dWDp_Q$UpnN@Io^7 zch~ig7!KA8sFD~d<+EslZZkC1Kv+3t^%1ffSv;~wY^mT`Jm=|UVucmv&VoWtQllaA z3FJ&siQw|x2EYOsItSndm08e{x6hwt=7RIQZ1TOjIIeNbU!s9De9Q3+$(aHoZ zx7ifotYLi4Bvz7o4M>U)Jur#F2wfeP0el8sChkfNf3w?5zD2EQf7}YypuNWwl*x68 z0+5sziyFMY!MV#?p3XBzzi;)Nv+T8YD!>mz?ea=)hFp_1xS0ja)cc|n+f`Z(xwWIf zh@Ru8X=`t`DlN|dz-;gvudS;>9>W=|`<@!8{6V;VL$G7=n#rvGwNxSNpSg~G5t_sb zp%c;ZOlZzujgslit?%jwj=n#AA`f{RZH+vvFIA)0*_?Xr=iVis5-Yl!r!$*Ep$cD4 z!>J-SIo#3Kl^yS; zQZ+*2vI^PBx?RK?WR8@g4de$ehdXrf`4@TZ*zd@h(0bXtQTQGrM@!{0s zG9EToC4n1}l*{k<+=;~#c+1VjK6jFOm0cvhS%g(wA1n-z1!=?r>qRp*IgN(T*$L!u zj2I7F+sv5SOe4n9w7PsAT*+9dPUI7}g}F+RC(S#M?y*hatXmw^fB57#x9wNGo^>`+ zITa^(&uog1vg}R^?21e4+w6oiot!exb?vy;Kejk0puI!EW>@+9Sh@AT-hfUVfp}}W zh=U+kHD^8sz16ZI{^TT4)K{Y^gz!0XR`^_4_Wqo=o#Hwp`-qHB;@jBZ+j!eLq9keD zYlUhZqLZov-uLr#y`7)NL@AEVjWEf+Mr%!^yzsX{KcD0sGxugyLXxCEi@(B2kugEg zSjZfsZ&Y6yj|f<|kD!P?z~MBAjGeLYfhGDNAA_3-G1UFSD!~;wh_1rTfw~CJTwrpP zT=8N^>|#H|n+Z>;z%d4(z%N%3fd7Dhy8r{iu$xizYbYe&oZNszJC@&EZbl}R?m}@gL zE>WWa?4~FFctOft01m>a`)?RQk;&aY|`$ZbE)k+69R?SK?$5I8gEq%+zsT zCkx#Ab=LLgU1oX|y6MTrl$YdzzWSh$vvGqQT_dz0V z-Bk|xq*O>U)=;c($e)rHm9Ln^zTp{Ml9FgUYbah8uvgo{;jd}jUyO;I9AEi;(Evxk zv&qK?BYb{i>UPTKLTA(Z@&hdDt{;)c zM~xjAA-TGJtQ$g;uB_BM$&&>&zWBt(&~)}-WGXR29hW7E$2h^&sV%iC@?Q8Ey|sDI(QWS(i|lni@lR{_KJHzr(~>*KoV z!TdY%h^JMo6=|Mk3+m&L_mQjp(9JxpXjVrzWW9NU%Zm$tJ2){uj&X?sNLsW}Vh79` zD1p((&M9?!V#L>xXZ6G}Z*6+35jG-@tPvu)IwhHj1;I^7!2&T#`>jJAOuizzZebWi z_CVz_q8o?Cu_)fTdM((}m6-H}ZR692R@(5m8;7s|LU28aO&464>A7u1tsKph#$Ggm ztvxrVu&Gbb`pPH}DluMsNb~t#@HhONce%Toom}dpYd?CXT9Rr93dZq?g3v493@y{K9c#d@q5pO}J+5cR4?^+uqYRX$_`(<834MiwU8Zx2-V_mXi-3Q3F!zh~I zVD0>2>0^n$qd*8Kbj!*>mTf{tD=Z^qZX%UZCAuJc-j0Ffg~b(~hB5&&I48qm7x-yU zcZxX3XH=LgQ*wCgr4Wg-i^R#;`RoIUh@sf!Q6N(!DZu98Tc*jGx{NmFR9E~u>wPSS ze=S6A+$vLhL=M?Re1=A<=v(!thxWf?4QgyriA5!68@916Es@PD znu_DQV{MA&X2Sv_5=ickH|?VV-LHT8#hW>kqr}w5v7iWQ@3@_g`ejA^hmN>S&dyAe zkDzh&?3X4(P}Tpkt9>HPhhh^{u$OcXV-kfpERlD`tI(9FCx()8LNajqjTx2G32NJ|fKnMrBqU!^Y1X5)n(yFAu))wHehZJ4KvDlFF1{j9*8x29g3s zT4c-LQivF}+jNTleqw#6{jS=sVUyzmcUG*%UPbJy{@M4yaVI-rQp=M3yn3WVj_0fL zieW=O!+syE=yZL=FtX906@fwa#`!|ec*bTX+z>hZMgYr^6gL1ox{O7&6zo=&?_0s7mekKkI$^G zOEMb$*}n-k3SmoD_QSgYt%0iBn}fyyhJd*?VploHVWKHB?`#I#2@b)&G7*6}DLIBY z@`Nq`kBYV%Il?sWOgS?)!V>k2#sI<)M#^!9Q5Iy9C>QO7iGMylvUu7Ks(L^6_i8wy z^Li!Iy8e|qebBGiW&#+I0?oRmbxR24a@`lzO0GHcZC$#q^`U$Ps+$y3Zy_bcoXt>3 zwS8WP-4b}#x7V2cdH`sJJF*x8VUV)fveM@1p%I*D>70IxEp65}+7Be{QS+E{UxITW zcr(VVt3=~GXt}2oN{zOx73oalI#jiOj~$XOPcCsJ)iL2$MxU?%b|_pOQ0xHybQwN9jx>G14{XG;rtCeId{o+s642B{E^uE^tGUkz1_V< zIsLqQ{{~#0jcD~d8o*BMyilx=PeKY$#)$DxPH;00k*S~DdC)K+~p3-R|(^L4eIF}aF-M%U~dTwSE1L6yL zeD_X9@L%B0e<&)l0+s4SBs+2SmaL0Y+f2|gzYG*zXa00u4UG|GIA}ne zK`5)qAsMYJL^dCp5FnY)8}f%Y{C1&)$#yHPN7U$1f$e#r^{Op~Oz~YG@3cnGsQ)8nd zp(DzfnP&39!Jn}B0+PXSn#{DE~iqkV_Np4g@y56GYx7Wo6Ss8-{LDN zX5%cYq#E^(SpYUZG0dYSuL}NlV?+5^GFL6p%d_G**)T{7Zf0{*%*#y7Os!cmJzuCI zX{i%Cr99$p7kkny)YgsXC!wDgKohJ}=Em>vsOo$T@4#s>>CSvxmpH4jfQ#hzHoO4f*pQNGGzN zv+r!XnOk2J#8F1~9ydk^ZM27M_WGBdm`mBWP#$_YykXbo23!FuKq;=FRig^6`X7H} z@E3fEqCZD?pkYzA(z8!{eCB z1a$EL{50$rlVLOI!BamWc&^6tHH%cO#!|uMLO8U9+@YrhX=|YxEtTCW|8g!JIL27? z9LD;zFaBXW&(!}|cz?(GlYmDwJA{zxrFDTH%a$^-cQ5D2GmAH8mXeAK7xj$5_;7M; z&6+jov$ocN88F-^77r@&PG$Q*(x}VHvaYz?X{^IM?;*0MOSk03lTao!aD3TrVn?EXxu91~<1xO^d<;t^ge|I)zg!;GqL^ww4lW zqt|hjU^9CS{3t}E!%BdydT_sVtAU2wr#2(EIl^Gy(|B?NttPDBE~ddVh>o@3_7 z+v5K*nYfOPIp6L}JS|d16mVwh-BA#8Sl4S7FWpNC#-{WGoemOYQ$^p;N>097p18h_ zQj*{or4zOYnu*rdpVXm`;GQlQ7=mR?g06OZ4Y7}iELvp#tRaL1fo!V&mwvmUvVgd? z`Fs3bhInvC^LLL1J$kdEPmQB1Ax~X3ozfAI3uPWyQ1;? zGTfd9MaT+IGT@Y8HLp%qO@gF*MiQ*$71?ytG1H_FwDTdQfSzuUunNmm4agA!*O)iZ zR^R`!5BLlYsP0ZI0M;a5m&?W2z&P3G2ulDffXhS|yo2j4X{_OA=T8jtI2(Un;M}aOu7gVQsX2X_%6)t;ewhU7yqIZHP*0MUl1@&RmS#c{W*YWwSTP{dv^FDaNM~#s z0tfpTt$D2+sU?=H1CeVAAx^|K7!Q~TbE=2SCZAkDj7rTWb&DWm%3lgnmM6i7Als8* z+~kqG1E`WYk|0cpn4|cxQ zDiKC0df9(V{AA`&=;ZHoo}owsgluN&MeSzUjH-`lZ$LUQ?L_K>ORQZn7(0oV7Ki9T zcKt=GUJn8)HSLmPbfZ^Y(|?Djc*!h**w5HSjUjeSVh9B?>tAfw0A2ZbSKVG4imrGj zJQk);PK6eqa*^#X(>t*purb}ZAx%^af&(Zahkj95JYgU_w|Q;C>u{w!p9 z>SvK?-{@}c^NlR@!JDiR&MSj7d9`zY@Oo4N96z(hq`d>@{4_=0KL~dC$Ks@D@aLah z8x}#(c2lxrpQJCl$?FXERa ze2C*BxvQXn09Y_l#L2+7G+ETBF##%^BBQ=9eXWx!1R@E;DIVR!jy|Q6%Eq_l3>(ja zm*j~*&l``kc9Z9jr*4Q_j;=lWvyPh5(F!wJFU1W*`xA|@53}3%NX*)S>fLhpkcSux z652TSVdgd!3JZu7$?8KTs5*r+#V>9eu0C6zf;>EdRR+3EzefV=$HwJI# zuS(SmLLICXj+Z$CmF)74$vz zv)SWLV%n=4UbGmRNX)(*V@lTYNY%j)A_mY7vKSNecJ|r>3ezC7AWc+ESXLg4Qrv`D zWHi{;4#P|}?Uh~PvZyzm=(-BpYe4@dm-VpAeiPL@V}%$T0)9{_wmXe0((}}ae|D-m zkR8&AZI~KDHAa7~C?WnZKmu98m3GjE%aZLHCX&=)cN`V z_nYCJ>$?>lIU>5M>B)Rr$p>R@{>4|KU*C}sc<0QVM$KN`T`Xc-iMg^%H>nEdaIUKS zxDh?IilVavEOG?V+AOq}IY}Sr%3|8S_JzZwAQuk|y=D ze6@TJZ@G`pJ?U)PK~N5xObRw%QPp7`W(+BZ9}DM|+!+$OnY3em&t?}>x`Pb~uD`q7 zNb(a!A>Nd0N``|gI%Eb!T}f(O3^NS_v;Fc}_)lwWafvda)I1cqYR~(~o{{*D$H^)4 zAnt{a>Lb&GL1ao_w>k#R3lFWCuJYNC7p$XWi#?-9-1pGrT~-#ww#Ug3g=^El>0X28 zHN9OrwqxUSlOWxslnkRr%=H{GK0A8iZCTZS6Y46NW^!$73pE}kVm+0s2FLnO=|2g|OpMJ(B~g@RTKp4U?6|5;krzWf<i0=9M5FHRJn~x56Zs7tlk}*5Kq!vxu9Rwf`OulB`S` zp8&6UYzbk3wF!N?&)wG$mb)q0^OdN8>^>bG8;jk5swObSQa5oP!}?JdAB=c9i*n}f zSQMsW?cI3r!iv5D4({iR=q*EF2$r^$C(Om@a9X)2$$)(2o9i?XFkwA`0$HCXbxHia zbTin=CwSuH7`-Vvu%m~`EA$C@w&FY}(J6I&Z<03rz20i^XQeduRN|1qk=UWj3!C3{ zy6sV}3|IR7s9IIK1Ejo!L; zi{#Z2F!c-Lx#8W@gz&b@QLr@K|b_wXCkBpWaKjZETf9sP$JQ#7b;i9bxtmBztwecsDR#V2OAo$PEU^|Tq=~2ivKy#Ka8p;?c z!5xfqMr~ZxCK0^3@A)(ch$k>m1S2QqAgXGEX8J56EymimtmZ5PQ`gtPz;k4C@&ra^ zS6?H>(RuuzTvnuwvT41b&1|6{UH9u%yt3*l>j%XrHZP|yOMo)$i; zCGhkSlH=BFfAOGJefiYwsOl>9w|;$XrK=e_9umE-?~?yJV?8+y#y`PEwM;xEF@MCS z#cq0*b@jNXRSJ2cq<2Y}YO(x;5oNilXO6k{@khR8H0@?3OxX&&;R@sZmA+<$F0!VW z9Agr~8C1Zbs{Sl7na`=hBHh>c9SnGPM#nhax$_ZBePD?t#wQd=pSv1{7}>TJgJAh?gG0@zR$Z!D&1nYDd(*MqpjWKvpSWUJ699d6mykzlELG=k)7>%(M(4mig}UO z^mt!YUHiS*<+^&g9Yks}$M5cun}zWzsb)B(ppU7Eq0@6eJpsFPYD$W9l%TBP`;XBG zr^&3Z;Zyil+jY-grKFXVr?rFA-}O~&SXkK54Z6i+*(nw0U}MOl8buUled6l2qJr?8 zOO&zDItdouf5h4tO6Cyh`}=~i zU^y{lLAQ|)=lbmzeCg%;A%x^4;cyl#KZenys7m#|7HO499cGZPnPC7*+e z(;KvZZ?+VmuVke)v^p7c7vi)PVsMroVY)|`RfUXj@QUAwi}-kL%X zBKRU-MF17-xItm?XVXvzOcu_6X?2>rH5XZ3d{c4TE19vak4KP=$t7H;x=ej9fZLQC z_UwW8wQ>$j)e$vHP=vq`4ER2xQ9y|)J)epQ7$QIuKystN^|ag_j>p)62hGPO>DiIM z61*L6fFk-mOq1d(@VgwJF_38cu(j5--Q>s-KHFTN@9@95Kx)6MjjmAgZo_~VH6+^+ z1Vj-E+}a#g$VG>0yA+Z<4>)YUmM}hN9pFvX82dQD;9USkQjq1?`s?dHf-e=l;aai? z(>Zwf3vhTDo3g3Fkrz73LwSfc$;(_Si9JHVg}88D36Zcy`V{yH5&?3jUhJHvAMUb#ZjzU6xs14V$FHdn1CgS4(kB1Xg*BLK^NaV%vqdk6| zCtZR+Nt!J)j(rE;E%<|mvg!$FcSgrOp5@2+BQHkahBBy}!iXU)Vhp=PUu4MCiYT8e zUdL43D`iGVL!y15=Z$ zfP!mR6K-8M8c6r9mH~;j9@c#A8TQZj)hNA1?KHc!Y|Sa^08|3rn@}lo3(>+WZ(Y^F z@Q%v=&~m(j?QMiY*#D?S{B8Nm5qc4tQsN#=qqY)D{Pf}(`zaV&5^B5FIZBziNv@{E zX=%B^B+^kk0I*eI|2mDp)+*)1*oc}U?`e2CyqW-KWgy^R;v`|@-EcGbsxKYD4SRoB zMOB&1NA%pZ)*R=BnS_?5grCK{^D|hc07c1Ph>_s5=A!8u+?@JPF`uiJvb_-VVUZK> z>+JORL`#KiG^;b*O&Zk*WnY-NS3y^-m-E}N%q)tIF#&utX-bklI8S2U8@eLJNO&tY193ZkxaW0sQvwtsx?GJvpG!Fr4J(unr`S^Uy{&R zl!3S6=nh7ZS+pJMs@iRVbXj?68#DVHhqn%g{^H`)>CJ@21C%1PnDem2&%AnhgrGc= zsy$NpJjhUq;46kQ&X(QlkMhVIGq+gf$AU{G;+eZ{Qr5wLzBW{Bmf&~pAyt4dz+H3G zZMla^flC!l5z~rF&Z65DSe=Bq!#_8REex9xdXMAP&ylE*qs!)bL#d-gpMBN7?p>ON z_~60LN^l{KYRxB_q#~kIVI=gl^n5(NJ=iR8m0j@7Ve=*!tH>bs;X83qo`Ltuoa~FP z*t$x;lV_SxaDbCnN>g~&;+qH)-sLyl+o{hZTXzUU(Z<=C&(zCPf!o*-SxiwX+O zrpFt*pQf87!2Hc>vnPO4sWs z?FKt$v#Ez8EsIr2d#A*su6F}dWVtGhfVRW}nGn&FL1AfJ+D3H~g`K7E(SJX4GPS!m z;Vso*P#{e1;(&j#-I(bvCAa2cRZ)B<> zz#R9Z9znqa1uq5f8uP@r|0i_;Vak6?De;LYa6I>QaX?X2+$CtYQ7mR8vJ582jsdng zQ`0J4iYEOGuZp4Zmo2+! zRq5SQXQ#Tuec!%{4x|V?i)sGFaP;64*BLOx-hm+^xPP?n_3UN-Sd70Bxphe+!RLY`B3s24rd26JGTqdwCniwJY2A%e(u!N-rd~`< z<6GhA>hSXo9<-K~b~uLF;C@e>#^4u$5!}t!Y|6JQ*-EcAnTJayMwFij3!%QV+!2t7 zj~5&6pSz9zb%TmiKo(phO07Pb#WYFM6?upF~9tlh{Y0d6r5Ua-taqniBa30=X zARZn)d$PM6l+0keV?EDY=yNb5=GhlNQ$o>{svk)+nBs3HNvB11zPY~wjD2EFRn*nsUO0(bR8(uG3+BR=O{^Tj;#frL3H?+E<@ zQj{PUD+6yxD;3_MXo>xxYeWygyYV8PeGtI;#Lli&ih{v^EKEAD1=a)_4q|zE_-y6+ zH={V~wAm{vzpBD&n=lg>;nZ-&zusqf?=AlNj{f#FNE^5C*s0_{f^}zqUmZ?6J$a^Z z@D)7F{Jh(->{~qMp8;wnGMi6_T~k`CtC<1I)hg&K-MOjHdA&FDww8j6j`BN{-HUJA zr#n4^Kg)mBel#7`J~ckm--7NyzxDS=oe48~bFPbCwuFxx@G}@=!w!5lP)8qZ3tkdD zU>M8C&cX9ztAIQUbzOD&I0UsN*PyEP{TuomlEhxo$z<57uybwp|Az#1s0G)aYN)Um9^czh+Q^fhcXqhA1kT}?ueO@Vq%VZ{+xlH2BR4xWAt%Ra z`hY@BOACIPlWHoJtTb)G`u76J}w<(YZsoPF7ihrkP4E^?`%B8F4b@xS*r-7nx3Dz18J}Zg zVh>q_-}>j;4&4H1SZbPAk66<#Pm7G{H3|+JIU!7Q?G)YH=HqU>I=S9nmjSS~+*J#= zJo)9#78Vwk-8`IPd7iG5|1AN_T$8RW=AzSvzr0I)!dDX_fc9oW)-T7}$2V0pMniz% zV1sS5UKgCYc}=JS`=t_?0wq%Z0~Up76ib(_jIcM8(&?U0KTw21k%;B7bMEWx%&}`q zIS!^NJo?U7&g$BimwtKWRhOVs`)D*I=TW<3@v1a?YQ+8Yg4)5&;AU0SBY;!+kMb`1 zgPZ+f)lhy=RE@L=MJfHpRTY*M{uBa3IRd-idUS;qR}x$x;vypkS(lMOf+J058a^OJ zv3IgSM3Ewim|a|Hb9UtyFmC!hj5m=+RTxNYzjjq*1Mw@=enBKuh1!|rBFr>j zY5xh)2C$i+LcMR~n5pv}^$eOT7I%(>t$Z{$^KSC77h5cy)IlQ^JL^q3b@H?sbCLN- z1;G_}!k~xjR?Szp!r&8>qtYd`FAz7UCjt2d4nZe8FK~65F)XKI& zud~VETXylRnpw(KdNww2Pc#+iEi&JV>DYzI#2ut@X|>T|Q&f zX6o!)Z?t%aGK>97R72>U@3uk5(AxbL)y$PeU@IXYY$G4L%o*4H=^6 z21m*Qw}Kb%dY3)Uvrinln(CSJ-<#kF_SRdCh}OL;d|k%=4|T7-a_6L#$+W(&EW?dc zysikoS2mTyBT!xMzY1&Tl3KR5{eb`o#=kDa)loiz66!L3`=$1n4iD{hr2WX|sbd%zc^Mr1OLoE9VjG2~N)kZuPWMRz1azMe@AM-V3~O4+>#^Y`@! zM*orpB9)2c4oX*K`)w)+^Y{mGzffkQW3~bF)Q)})A<<3YQs^h_VPLSaR@*8@+gjPg zg9+~1?mX6Fz{S4GRONJC@%O)slI_3kLkoVLywRjG9JGU88nY)Cr0?FkbxY#SqD3pF z3%Rm2+lFMiMIi#=UQr3peZC@KP5)50`yt;Yw3%y4swWQP|4W&vz`U}2Fj^Gn5cp9Q z+wG{+dax>K`B+gq;9r^`Kqv{#UaqTyRq=lE{=TJi6!TGH4)Tu7%sY2{^6>C1qHbA% zJJo>P9AANnLP5O4Xag4VEsMn+KWwJLV1n@JaDSAFBKfc)N+d;YWXZ+wjCPR9FSL*i z4+hhEe4{n38LC&P;d=2=y@ODFV-nO-mq@M)A6*32Zg>yDW;I95+(pWal{s6aJ0`+a zeb&sQX$+B+z%(Qo)(?0iA~)Wm&PFB@MCVM>WO#+d6VnOOG+jgCv=-`2JtTc(i0PFe zZr(=r({im^n@|r^Vj6A`h3c0IUINZR$9D>zkyPS$O(Xq@pR)@=>amR|Pa62T1 z5NIm?4K`U{gLAi2hdeN7?_~fC20oo)KYYbMDvY%%-E(^(NXeLK?a0LhUR3)Cu^SUu z?ccPKCsbKp2ORU0^cS;`=1zg{Nc8p-!2GERN}W>WD(?=TCa#Sn;#|}d)vW|}z813{ ze5^3O-hcmc8^6y|BUGFG}T>oPt#cVdET^;!7siUeN z6^__0=BH#36ry}EGUnNh3LKvP3-0w%=|CI_lmhpM?b8@VAOVJsrc2cv5L`&CUMcvp zORv8z7hOKf5T!kZmd=EwT+ck;&J>!ZEBWc#4GN{$D2C0Vyu}&xnXGBCqxV#^!`g7^ zu&NgNxh#Ca&7mb^Gko#9EWS67-$!Rq{7ONwmqeUBVS@}fE-78qR>;L?d zljFDDdNrGqQ+99EORm0g!k*pTTAQE{S(g}lhsK3L4<=b!4+K_O?FOCe-kh_6==(I& z6tKIN25+=|fiW|eHJ-TuFnPJ5@mrK%o(mHD zlY76oE(3E){jN&g9yN0?6VX)kWs;rahiP=O1HRI)p(9-OU$LbD8u5C{wXx8{-@?eP zt&l0e)`-U)T|V)Q(&-`SH`8o%Gk)YeAq?+jZ84M1C#ZK%sPFBfuBYj2H9x;q&%dAC zHO@;OPv@27su54J^%_sJACZq209p2Z+ILcq2dC0bQ>oc(^;Re2<(iK~oZmUw$;Ag@ zAndadZfShO{nCP({OBcqm8zy`^jPJP=@VGa`+(#20Z}PklSssjWvYtsPo3mi)tbco z=C{gT+zW#j^XIE~Vdv-i4Wiu?NWAjP%6fp|dr-3r;n#-{8-LfqQ+rKai`})4$MaX7 z4F#{nLZ0|Yl>U_pYF@K~=dL%46fr}Rwp4S-(E5*9^$E;(^l0Pb$0}snJ-IWvUJu`M zKy$?RZo1yw&l|co_l~+T`e|0f3*!+eGeEDM#8su?3Y5VR{2@Yhe*)OvKuy>e-XN8P zsco|lJZtKZr=hyD^96BBnD!^1d0HPY3Dt}A*>nc0h-kDZLF&K&k-+n-2%6Unwy zp0>1X&cs-zR_I`P4w}$Ml2ULaUZ!=Zh2LYe)!S;hDNRd$v!bwvNVMt5;{cX!{o zyHniV-QA_QdpGV{thmd@T}yE&P^7rS<$q3cPHyg}J8vel=9iU~NhT{RS()b<<|hV` z=^S%h7F-+yzGY?Nds^1hZSQ$3fv2f=#-fg39AE7vy_TG+WBb4|jl5hZ>4GQ7-l<`S zm7aKK5p9X;EDP;ywE6RSeYrsdZI7HOaUl997!6bCxz(<>f0?Z=3jf8T>Goj&>U) z@5UuUi=UBH|27Mu@Y-Ee{0|lhRZz6goM#s``5p;b<@00UsXUple^803MMROtc~kDO zQZC68DvhXe0^rj|Xk0k!ITl$<7@O!wy~2*J!`m_I@wdT~{bEk}?BTHQtn5)PXJO821YFCin{-rXG;5pq#5-~T5PlQlaL{Db* z8*-pVHYdMuQlyfaIFV$A$wRC;<|qkXqi4!Jst@CLR%Q06M&4#00R$8419~NMn)&L$ z7;g%?kD=t)5ZL>Im+#?xyP^OK@M*gg@&<*R(tNLk5A$BqJIY45-noxr`|zEaxLX|* zL>Op{juaSUhHC{yk|eM;L!|u3)ADNdPLIdwLY65B+;>xZj8?W0wLi(8L1yKThpY-y#2?jb+OY z{85d#2CX25j?{y#F>f->8hVC?rwTS4tUKUw(Vyw^3)6*fH?c^NI`pyvph{w)F(UXO za8TL=qSZ}v#L#24aM*KEN|d{4#e9e3|Hf)VeFnqt<;wKRP#qq)Y^J_N6;Cq_|BHS@ zNyMtAjv#3C=SrP_T#!PrN?)M;?~IWF>H}@wdlJ3gSJlgeJ`ui?wh+^|T6>YnR)gLu zhZJl0f?VOVt6C4kOnO=k>N2SKhK}-pB3cT#suOD78FGS7or&p5v;~dvLH;enUMIgw zUF}Lk-R%kO?3MjciLT;a?qRJr6M;^7JhrpAtlUWY3`gP`$J<46Syg%j zb`{>926vKjkWUm6H4CRc_QK>0-#Y|#7?M9g$cLAfW!BZ|t&F@2N#8aMIGR#vTTVBA zZB=w7Iyrv-C%YK$oJn`m%49Ux5!5H2pXQTn@&crvSVLEpRZ5RUi&zhU3im5yY}_Lh zY5y|AIOy`{{pQ&ib=Xp_^w}Mh^{;sp9B#uKVy~w4KpcBpki6U&v%wyNE6tfytY6X+ zOg1IEA$nj`#w?WbXe^kRoV9xs!GsDbOd1Q4X1$2PxPvxEc9t@S?N&qPI&^pvdO~K2 zX0+l@B&ZK{l{oe%q~YUS&(epRFv1#$)1@J&>0}*i=#XU?k>sJ9c=v(5SUiiTL_vWozK3z+_y=r9-L$9gX;bNdW;-;>yFVNG*b3cF=w0Qhp zAbmq@{v2%f6r3n`Fa}O?N^8+`pX@yBs{W~4*ha0YA8VPb*}f=lUsdllcpcm1ipZ#0 zm0CzY_*}kqoxjFH@Ls+l%bp$;;Er7Dl;ak23b?8vA-nC2WB#nhwIVb zkdz;KBP7wg!uWE$??ylUQfV>PLSTjwWb9%UDhaYp?^=z<^qm8a9quH>@nj)SBA5> z84-u_H@lCO?+1AToF9_gZY8ZMf8`-}qVopsUB+XKEI&#{-*t^(AaZ?$RMSzT~Vndj_ zWrM`Xgh~0OHI6Yl;f6rN8Dt|1bxLsbeaiu%7;5HwsNM_|1tTnp1$e|n)>t`)1lu1h z0_PWw&+TP1sTIwZ0?$UwU%*7MZ!<)hrK^65K1VPyP@7{Rva+w9A0`19&LZzG_Z>Fj z7=pc?k4*E@zaCRGTC+D~vwdh}Ps4$4z~Of?YRL-XLt6BY;q?nlW9U*$D_*wY9vZEQ z<5*tssYJFZpI6V;i z%H1d%#>Z!zk+KdF^kpyPv9C2ZJSxa+7hqbSi&n>lfSHu11*{18u|?zl!2W9m~oxRBX2Tp^D>ZZfrw|^X!iQ-cDhLnzxD>zSf+y z(Nn)aP%({T?sI&rxIz7z+(@q7P|_vG{1yTS1Fh-WN6w?mDl|~61sl3Qeci5x5S}KP z*)&C?%y$Q^+vx)edY);(CBheZ2ZuFyE3dNZ$Yx^v66d)1*+;`%14@e=S5iv*gv&K= z=Nf_)f|1uwA+z(We1%<#D06z!FcPLiMY>3=2>a1?gkYm(%=CzFF#sCyr#Jk zuMjJnKSiVw<|(rLtsUU_6#sf!W8YBM)6~SF^V8J5Vwq=9H`R(b^H;WpJ$Ocm9+&sy zZogwSn;Mi9n46K4Q?+>IWMuhMMX%LvnTU4wPem0Ky_6$DyhGyXEB;WXB&*T=QMqYG z&b`e2`;Ur1;*X5GA#jb6d+<1^&k_XRW2kefs2LCS}H%6rjf7sbniA`E8%iCZ5e^pB#Bji2f}< zMi6B2wvRFYp)%$mkX&j_L&&dP9D)wHCMCBbu6%nWJ>(>ZDUh9!tBVHG<8;uOUUD6Z zvIPfcVHq1}xIZn?XIWd_qiT$jiCOR6`w7hLt#c)-an^dCHs($+km<3Mz1(pR?PN|? z{F^g!Uz8RF@fv3H^47|cTI(P(#)o^G3#i|rMp06 zpD5F$I#u)@y!*ltJq3Tu%F_sL<=Lr=<73qxH)~in=aN?vH)Q5W-53D>{ZKH$(idK$60%!r9F_Or$T4tIs*rhS-6JYl;0?C_a)6mE|_G%@r-OSZI z({pVVU5nPgaR#_dFvcYY(m}k(Xv3QpvLUY}rU!Ri;Gw#MTCI1_nJm&7ZRtV5@Ws&> zH_oCe)JH#E-y`uv%+@0^&_qgu0ngM=hiS&_^!M!uk4;m<#Gqsui8F$b=O#DCkUTnn zg3&uM8BpkeM3Og7Q%WS?s4f$dt%UCNaX&|vW?u*Z@)(OZO=)Kytvx%lxTNOhd(IYt zidssAm5&(a)lBV`Pi$_H3D`uW+BO>Mz*T+6c0FE0SojcIoRn z!9XrZ%YC-WVVe2D<=dmQbwHynL%EzHdkt!vB`nG_Yp(OFD{~ruu!L=E;?Rfek9g>K zuq2Dk@VS+IippEuKe~ExtR^@9a<%nqE9g?#5532RbTS3{0OBn)veG=ImHHA$%f9N5 zBg5^Ae)H$6PjEguaE4Oyb3D23Zrj@Y`Kw?j6~RbM zo?1lN8!g2!>8Jifgp^WL(tNraXN`KD)s*$bQygxt+r~S`)2q2~Q6jKulEu%%Yy5^< zI_#I^3S_5obO$TD#U_m(CD*Go_?xAL;pIwE1;pB3mD1S?`Ma=Hzi(f%)ra-w(NkdH z){BbH+zs%iQu(dI!PbxHa#{SZkVLVo(os1iF)*&n;@=CoqBMB8F}7vS>FaPLvg8v% zxzEg%=vTpl`B39V%-Qj{#E>M%E9ZEhoN=&n=B>94r#wf?hKF-!=H(2SX<`aImubVf zw@nxtys0C3BZ-pH?L);)&XTy4<==C7m*TTwza$PjYNWxxWP8dj>X{Q|L@7vKqFn=S z)2;24U3kxLe}=|dek!)4l|fTZOrI`@7ou?Lw;5!@C-{W@Cqvf;jgdxiaJ~do0{YBG zPBO@2G?FFZ)5|gUWSPUlSY=GH>uMQ1Oy-!lzQr*(g)G!>g|r9hm6bF$CXG{$*P7a;}#39sXlV4@W1bnFbv_H`UkA z{ulVp9$x{1_#0;lmK`J-nWf|e+SBQ&YI#dxRZE-;Lga68Kg#GA#bFaP?*?4!pItWw zn-Z;$O8HxJ+)nc=vg&{HDvhgj#DPjHg8+Wxh!G<}JC`4;KFP-oav06HZ69<==)L62 zrbbU3DIA{bfSZTlY08_>Qb=W`_$SgNfG?=D4;mMmh^~cdjM>5sQJ~gNd6w$cRV*0l zh6aZv=wlk~BOkIcETF$%nA^~2%b|2PCrUQJTTNe3!QZb>q88v|LJK@^@DR9OaPZCC z&}}}&T#sXwx2OpitXf#O%4;Ct^$@vW7+JWj4(h|OSMxerw~MVc`nj$%=pTJ#ABVtp z`PF^mCnokb&C(&3+abg>%RzgHkjZnfry-(?h9*JpAK@Fj+&nJS+)XN_g;LwamQp1N zeZA)h9K8tPp%T`%IdRKX*s8MQ*f8wjE@rCkI=%2f`b9?jJ8Ay&o?W8A#`dP2$-e8&Dj^Bl7vmyNd0Z zqSqWWf+R5Q2zC^OHiE6bocQquyc79dkL$;I=5bh09WUh{zD_W|l5;o>Jm*hZ#jHmb z9qkEsT4oBO_AJ=HFpEiz{rZhhlQBj|vN@kzGczB@;8_*4pYbamC(|=e@se0yzu`L0 zudI_kv!jsnW3HH_#Ht(9ZRJk%<23})yH;=(tkV(-na62nUN6iafyp5kT* zMF;vhV18qBv5mC}8GLwHd>G#GKORr`{rYybix(SmZ3Zs{_@@y1htZ;k82zJtgaW-W zIJs(({Q>v_i6>bh*}MG{j+1$p#K0hb*c&nspG4H3NYuZi zXHIPny?z}x@CM+!jpv@2>|R8@WhA_R_lstRlFo|hfa=d&A6K@Z6clvAFMqZzJm4i5 zKYsTq9vY~47w5bsNz6B5NH|#J|_hqEO={)fy>Br5I~e2zLK{PrGR;LOBO>4p~&VdzX}t5xND@zpxFfv>lc_CFI-VT9aXm9=+W$U-0z;Pil-oMb-UKUgQ0q#{H?K z$tHS;wF(~;q#*68T2}c z(Ux=rCyrb?2Hv88*UAn_t5Cz*mf2Rihx&Jn;z0U5=?rKHzbRJ0@gwTtakYi_5E-TR zq^>Ev%GA)aZn3-Kl4d+7%c;YTtvs$pF0BU2?-Strl6 zfM|*!JT&wwG}JZd`n2hX_KNrMhFx|YPV;i@96UnvMtZ%1HeCin9Sx;n(ko$Pzgtk> zs+DHd$n7IY$$fQ=*pb=GU(9r#M!Dv|H&ntaR&J4Pa90I|ceaN4?OPywEYcM{pi)w# zB=;k`x|{&MhFMGvH}VWAQys@;ekNW_S&YC~0NYJE?#|}f=eIHnV`JWw7{K{R?%sfn z5z%1&(8Q?rcVA1OTIA!SzVjKK{&lmq5X<4KThV1o;zn-5i+xe~Uz4+?sCw*w*pCTy z!7rc@Lm35TMjpqi=ciMGWCdId4)J&My35J z-XI|uaolYZ_liCqu6fMbf<6a@$m!p$_T@1VnoG4r-y|QE4*bgUWNW{zwhG`H*0he2 z5Q2yjcQHnprn&j~73`EUHPfh9tS0LXX`5+8qLm_8A)B`|(6n9gPr23|Wn)3D5$^ z?+Jx0a-mb4Lb16EAwbPfrx3H}%ri_L#ufe=3K#bF&3H80ukc9qI25RwrjcJTH{NWz ztBLD>SW3B3*B3l>6U<{Ds{skzJPh#u6#k`oXL$+Y<}2)-Zq9_=)95>tQC zbA#U!85Hw!T~?>Y^UljA++nG+B4`l4SB;!)&0a=u;^iB#j;A92Pj5{t8#o_-L%&$K zdzMISy}NY#$K}|ozh&qPO~}63B!pM5u;HB=`Pf`~1>1k|UQL;G z@qE>I{F5*6xqrMS1T$DyXcs`f!G2+P-ro1|{Um04=dV5=ii$zFF{cUF&K(?)3AhPL z9ZjCN~|9gs|nDIFE8onZ&S0|7-E z*n%A&47Fg2zR0!LCUHP;4q^DK|8sA+57yJjSV$0|Q(ETf(}x^^k6I63x1I$_{#uWJ z0nN(;?cuNyB176O&1sj313OSOKh4(F~_}d|0m5Sk@D&ACaQZp2u{udTg9h4<- zj|Z10>m6;8Xg`AR+7Xx&#kUO04KapMH4LEJ!4e|~)39Uh<5*rcSZItb(!;!#sjC|B zde_a)_I!Sko9Q6qYx;W;F;>)Y(Vz56Lf(Ifs5$D-_3m$P+&&*cj47LG!jia#S8nG( z<5fFtSq;LcvEoR?ucfRyiOc!T9;Erltk-DM7;_SKTJzU<=`fEblFZEOOtVbn?SP;fJ9ixSrrA{-=N6zYjo+g$YDjJW^!{HiYLm%%`2) zXG2Pj-ASAsDG)_sWJ&}=Vobzy2jWbYSoHZz48O-QIv<1?9HE)0*~u0P5*!X7C`$f( zjnm^D!>s0f<}t1=wrCuGcdG^tOutJKmPYRal8b~nW-K99AReW9qQwDWNy ze2i1P@vZ{W?KtNeyk$ard%25Lb+)maRH*%N+&Z+7RZ!1EE#Cx|$~a4|d%SPdLC$gs z_umYhZ=b|-wuz$}4%4nKGw7iEg5Bx_?`3y zEwcYVE^V6s3JXLOL?y%$q%dSMWF_PU6bn=;6c`!>S`RuIdI5$2CKF}~77msT_8))% zU|*#bEoc@X&@3K5DC3J7Ha6%RE4bqfs&jRP$JZ4m7r zIug1px*2*QhA>7HMkU4s#u+9KW+mnUmMWGXRxVZ>HUhRfb|wxIjxtUn&KxcWE*MW7 zuMKYl?;alsUlBhFe}{mEz=$A%ppxK#kb^LWh@Z%gsFUc7n2XqsIG(tXM3}^jWQpXS z)Qz--435l!tch%i?4BHjJdu2Yf{G%WqK(poa*j%iDu!x~>WmtNT9i7Gx|(`}`jsY| zR+M&_4vmh1PLxiM&V??Pu8^*iZjK&~o`!ypL6)J3F^X}IDT*12S&_Mvd4~mwg@DC? zrI2NT6~Jo1n$HHs_LVJ!t(NVWorIl-U56dS;l)wPalwhe8PB=KMZ}fL^~yuSBhRzK zi^40<8_Rpj$HDiNZx9FossrtS>A*dHL4FVZO8z+kfPj_2y&#*QmEf6>j?j#-nQ*Ld zrSPcmrtq~0KqN>cUZhx5RTM1dC3YZABW@wSDS;5r&4q-ho8>oHq&TUCK~mSVCQe=;lmJOz|Vq zgxtI23=}P~kv1`vYb@6s6t$DrY(HA=HC|Cj6Y3JSO$u_xWon}2{`*y-g)t`c~?SxN)#$z z#XJkZ65*9J@iJdWAhZREr6qn7aFb+(BkdUk>as6A*=HFa>dP-+}(EP5?Q3JLe3lG`mzpuJbt*LG;+n~qx^sD;SzGhJdqm7`OzYj;9j|SUZjOqJH zyA-u&`xLoWK*d^o<(lECy!GhWqN9v51nF)qk0RSMC?(YT6>(Hx4JDp&wc(w=l{}<& zyG0tdU$<31#1`7;gi~v@ovf|OTbB|kR}Qxe^4RySaz1hEv~ zvi7bn7#c{?^>!c1ajVv$?H8G7{ z*Y?NO4o}n$R@aW6)(+&>j%?Hpb=HnOJM>36439btmOG3dISgbvjI1D;61G_iv{};$ zG*Sxu;OuH-99m2Gy&f*K9@n!T9k`yfdo~M61QsKjA}5+KC7MAe8doElW+$3-C7OlL z2g~J8(SNS7`7`+WR!7TD7SZQ+# z&S_W6Y2WK&NBLsU>0;ODVn2vvM~r08lw?T0~jdnGS z_C2?Dl(zO9w{{J;_5+1?KFv<%!n+#6`|iCv3cY*wy}SCo`~E>YGC_ORLA%;P``+(6 zD(`#F@1_EQ)qw4%C+v)zIqOVT*{$o@b?Yb7@51%9Ir;i(uO~!MbiOBgTe| z)%)vIfB6ggj*^2!b(L-R|9T*QXE&K~VruX7O||NSj*0`&e|P!cM*2ZV%|U%?m;438 ze;VqUe|l42j6fT%L8XST_fHFqv<7o%I>>C zxI(OcMz`I^zVkQ5f67uyE~U2PdT|3;pN(#Nj{WB!ivRC|?P2S+o^M@u;{Ow6R@T=b q_&2!!P7mDwe*)qDH$rg#od?nj5&0X|P|@y>&%a-2?KagzK>Q!5=a?w~ literal 0 HcmV?d00001 diff --git a/tests/phpunit/data/uploads/pages-to-word.docx b/tests/phpunit/data/uploads/pages-to-word.docx new file mode 100644 index 0000000000000000000000000000000000000000..291052c0afcae9e7ec32f07b831c6ca396b1c46d GIT binary patch literal 8686 zcmaKx1yCH_wzda%cXxLZ+=5$h4eo<`aQEOI+&#EEA%nYXa0m{;f(Cv*IroO#lfS2? zXZLhHyQ<&bwbt6}Rg{H*!~_5Uuz->VHkmNv=J3tuD>-lg00Dpr(04Soc4A@v>kI}! zeZKMXsEF^DfnY-oITaL7@#I>DC!eavLG!?PM`9pl<|@jS8vEAj{s**@b1tTE%*FUf zKNsuaG2Pn(sTQ|r=wvyB@I2GqEraz2Ppz+k^Z}C_J#mN`rJr5ud~)FmD-$P+^XMtC zA@Zd>CR!Kbz>`BTdYATjU=p>y3DeYj5=vDq{gB_yMof7%JBByF*91A6iSaY40s@W~ zb0+x}lXB(qJFgD0_bD*w5Yfj@QN#UWDuX#J2o*joJ>I8G0<{8=;f{k5@*s4di&uaTrujhq>K1nx#TWA2fk`*@K1;v=1^}Qv%VT0^tmtTG@5Ewk z=V;38W@G)|M6!t)wgkOF6uu=Ax(*xT(w!aKg^A(KgdV2v^eE9(Ri~w zx{yALRG<)StgKWLledm*3X?qX`ztfM`V99TlfB`{$n-{Uv2n|Cr9chCOm&I}2BwOk z%gkbN12}i1abc*oA`ro+jE=8NjDs?IJry(j1m&9x<PE=^GbTwVfXoq`l}9x_V$00A#k(kUh^X8G_im2lq#HjSZ zhr$j|iU6GTo3k&VdFOQPp71!J0(`V76!@SU-*n0P$Ax@;cn)M)qu9NCEJgz&m`W%BpdRa=*XwHMXu|URj^Epu+B*N~xmGlF?Up$) zz1ONpFRN*KNi3F3^fEcE(#XVBAm0aof&Bc7DsA#GOV2^k_lK^uGLC8QBbM>4=J>_P z-QC^XPg*nzvIX1du(adfPwhEy9wD(yXr+i8+;X>d@-FiYrCjLX=-|n1S<5kdx;!{@ z&_}{jS&Rd6RtBQ$g0E*wo>z`Am8*bCT;IaTLcHhe<90ioZR8u>3A@{+O6p`pn{Mj4+lnW!Wp~5CHsv|NQ1hV!2peV;dEc3rK-80 zGI54p&idr9od{}_B_buo%F|Ko;sKGyz`%vsQ?nx9(KZd&iZnD|FB=XZ z20cS<&06tfP<;~DF7Md~{>4-k&`(L2Bk(0N47(2xptB>fs*ZR2gwYNPN7om_FuhBw z-CH!Cp^`#K#L*f{4;H1$hr7<8VHu^j+vArfI3|4pk4KOub)`$TMd3IIw(qW88Y*L} zRMPtMw68lkH&-eITv3(z?5g&P9wDQ2dZDP*lL;58O#6>6w-2c9w|MT)yjdT25guyD zfrm3DXrDxz1HEFLqUmjOM?4>_wp`5WU0Jb8wrJEHdn+4yXp$FtDMe6SAA6)9KTJLr zgLmQ6Rqop0>~|av>I$@P^4hnVfj}9#AtXKp!N;6%H9qxS8)m-OhwBBjs4$Xk47nP~ zmoP3Cf$Q0HM=LkAQ2Q`3KSGb*YVCHF=bdELS1}hXx7KeBeJ3f1y7b)DaJ}WF+7_;; z_qv|FShhQDs8MAntP>rC&yO^f_Xr7$9#4(G$l-SC-gr=#>dDy8nFtIxFr{@e!;y$s zPwD4@Rsou9kqJh}Ci~51eYr=wO~T?q>g zxYb-XCd*~r@Wed$U|zBf?hzjw{&_TCojyH4Qa6Zw5aU3FpT6uheOa{Tcc$4iND=bf zFx)zLea--6&dD^T6xow^Q52EA`x%3Ivs|mmVX)%~%}U5`;jyxWO)47rD4J;eOLx@MA5bfGGHbL6`Mv}Vz? zI8jzUmkUiO-m-j`^EtuU%(R`vtM{p!h~4l5dm7#Db#&pe3Yf@7_--|DT4SWq5+v`N zjY~I5#ct#+G&j|W#>lq!jI~$IbdUGgAB+7 zi0*aUvZlCAv9YJ^Ax9+Ujhe|YPgEs2d{=I86)MU}pRFV1^ zPBkGh(!sYGH#?bn7|HkAlSgyrOAFk5U#rpwk7pkG_ZsRimr2U+($}kqql?DlNclu3WLg%R= z_E}2xPLFT%)6)IAr!pBf#SmWB4IkrAmTVzY<5Cw)S(M~gJY&?4GNsOhknCC;kb@Xm zM$qk0IB?3WSi_`SXJh7EBl~jfWe@`Zs!zIjtBFPSuYNT+J za=W(3C?5VxqUZ{_#P-l^k_t0C{t~V2m5dT3+72wR*K49Fkpp`KO{RqsUSzG|(o+~W zIk96GeyNC*)i0#Qph91*j+J@VG)QZ>T2VzNc_)=DUXzajsM3?n3TtfuW!qeM!q|jZ z%yl#QK95=-G*&sRQs1)+o`1yyZP3zGk4oF!q~*|)hlMlGuVqDz%6{Kf`?So{OpMcW zusxZ=eMYB8E3k$o;z|(3_z*@ex+Xu0he4v)5%e}zpXh_T3z!>vMsib1-2(NX9JRA7 zQLjH&1d6$^ssGo4QopbHM2>aRA_MM~+GEBPrEXen95#|sxQ>Nx$`lB-IvlXZNroc_ z&f9%b)f(cJGJ)jbarXI$MF=7&lLp5b;5(KdD_K8nH227wpRDQ02~G}|`xWK~f63#m zjM)1Qr4u0^LQB7t=y7ps`8S|_)d{VcQ(Lv!z*WGh zPdj5W;sDkU6P22k;`Xp&+g}`}F?-6-&YP;w=|cDRyG!i{tZig^j$UhlZ~DEv5X;nt z428F-WJffECKdM?O$sN8oAqI#3vZb8NobjyqCE1-?4BkXf8YcQZ@o1OM3Cp>+S?4B zU`6f}&OJ=T6{KTp-rV%OCeB1h)HhhFq#ov7to3YQ)M)C*dKC-}Uh`_yZCw_=n0gkr_*`4$4%>H$AxFrLykohr#++sVrEWTnqN%ngiJuzLweBWb|@=!-Z(_r^< zo}G_wRm5&Pm3-*clKuqp8hXDVCOooI$Kp?iq)HwVP0hB_obVs>=}SFp1?K!diryI)AfJTPLqO+g({Yq}(diZPoz6>|>XEs)Mkvk+)pTiq#^|4Af zI_17~U~n_rJluJI=7~qW)Ba8@NN&MBbt=#uvl|(bWpG0-ApF>}PVxgXib&W==sR?) zf48hN1gLJ3WdZ5+`VyG{)IR+d(I}Jo$xZ8ZzPS&xb+JP^h+v-Nho?N!XXHcQ51aF0 z8`nz@G80~!>Be8%9`f9HkAEwl%`;-Jp`Uj~Sr7mK`hTLSnVqe(s-cnfAGb#x zaozGDR>Y7~e(^*;*+sBi%N0nGFa$!)Yk=NiC7QHOZ|=Lbtnz#sR1y5;(H~FC+14!T zo>pQpSsX1Qt0U}m6KbkfO$^&bUag%80T9jjh&+tjevBH!;v)o({^AEN8T}%SWX>(h zIt}Ljz?ocGEzwmGsnWGlsm>FAwSkNf?fh@=Ts|?H(-gate?zv;OI#w4(1_fOVkAUT zL&!Q?-|xm`A1=VZ|7`i{t(wr1WbSmXWw8f}9%yb|SXpv`YtN%vn_Z~(+tX;P0`|pq z1GnWj6-A>h=R5lFk5~KsOKT=byA)v&)gQ7n+s<#%9@ z*OBAhqQ+m&6m%g)Ps9x*MR?Qc?Tt<9hGC&Cz5P1%3koMQ%tG&`f%K7#&;6qy)f|%< z|KMKgaVOpac99`Am9vxC)B6to)CFvuFo`e|%vY^C5-F)DA3i zq4$KuBCj^>Y6(^LB3>nvgQ+z-kcXTY%q4QK8n8MlCn{>k07E0kH@V@?+_6uT--@%r zfgs@~GVBsEma)a@O1NPkZ^KTpAsw=UXmB)PM~-B6*5H!2TC8E=+Tdq-^>Fc4n$J;y z=~n@)huCOJFtcFa5hj$1<KB`0}jS_VMt8=)Lujj!1Qf9}8>7dT|L=U6l7HiX>%Qpl)aAX>r{_6;p znA>>Lc~q~hnsDrQf4toK&Yc9_97j?esP5?j2vxTQvLKK;x1WCfmA5_&(|d5*D3v1b~r z&3rlEzDmdEMv=tqMYd)L+9IBj{{6m2)Wy%*Z)n4zI=!&3)%lNsNqpb4YdvJe#+tb$ zy|g2hb$5)T=k7fHS&r>9pt#q{dhItKL$$c?wIjB0LpMJpx59h(Qg(Fo!|-{hRd5Yw zFYMp1Ih$JvKhAR_3+*`(PVZlr+J{|OhF#og96@#G+R{rJSqjgcs*PAO9lg2s`F4Z5-gh`GuMIJ$NyndJ%1wQ9_E=K#b(vuAc<u3aCAXk|u0t*M+O1aDHa?BtYEn@7nkWbYY zKD+g37xCH~GWOn?42#o8nZ28M87I1@eqr<1@=Bc^<>BWpDr$men4j|A9LCES_{*{` zXjNE7affhmmeYrqVutvg$tYv_Ldn`zAGIk{nS(*J9u%5sAh#?QN~d`@#2lU?m%9J6JUOSwW@yVk|y>!^q@F8(M~py0|^Xga(p z<8+nWd}|0vCFdcpyC#&FRhbJ!5umA(9am>PCiQ5f%lnYavxygt8-3}}^NEN3H6a_} z{?NBOa^AOz`cF39A0+N_i3SFfqV9+GyCsHL;}&DF_(tG56|uH(U@P<_z$ zNRR^MGoE%vx(DX)k`x@uF_>1RK1sS*%zA7_{VcVWq+HAEfPCblD)H?-g2=eps2>r$ z>0Zc8UW8exv;E}8hn(6}O^d(QXZ&-wnZF5ut0Cv#In6H~`OCaA*rarq!t)V@W@)< zb$5Uj<($RF>9+{Yc6R={VQg$-EI+wY*XD1{&OybK(kzn<)liGYc+v$}ige4E+gm@~ zuf@M;fvWg_lqX^JgN|@lRCjr}{LJ%-zB?tZ8Q&(9dD> zUQI!JWShod7Jef;xKrm*sI2d{=~f#Ey%Em`P60G|Ajvvns``1FQJVl=7`8f~Bwg0~ za#A8Km%^h+bXekpY7Bz~9Z~`wt3D9QJ{4V*w1x)t8Ex};QNrXWoJSVFhUlhbzLu%9 zr%63jUe|oQnqGC#+1HjyQXFk>Wv$?0lVhamr*9TrT3`h2*A!7Vd51Eii$zkNyovwB1N9w=6N12DKuN zbK?HBcL6O2iqbsSkURS%ZxfUT`ROK36tOgs!9HrxrC?`P-@3?G@CW&nmJo(E17r(% zt$ORczm+cgOKDBg!+({wAW5LsfIg#jlM4M`r9+;TKKM&%Ew1Uv1*19B&s$KeYd@n9r|5BRdZ>6me2FCwZdLL%)3So*oAC!trq4V{3rN_Q8ZfifgAG*(N zfxlY(|Fi^5ot-Ugfq!fYM5)T!ExkeQyw=F6P;Ch9L1BeMr3pY!6rENlKQ25ltbwUB z>aaSlBr7@aJzd~KmWy4==uEX+ts~Z7;ZLq@f-nwNr;8X9or6f)*C`=4T_eT@ek=zP zY4Cj15*|V}SRB2Y^|9{eajq43n{(7WqTJ|Ei4WsH%Bkq+S;?Siu4AR*7+OXb5T9PT534yTe6pK(lI|93p_(=(;LQmyWONr`6rE zRf2{D(12-7eW;P^NQ-uEq#dLBl*~T0b_jMyb7G>9RU+Nf7CzS+h|*ybjOWni^z&Vt zX_QaH(5WBAHGF^Y+)2;mXZhDvS1Vjw8sQ54iruNQievHN$0Ne=o4d}(AmuW`x%T7} z|Egqp4c*L$l#zCqyAws5Hyg$lS9vH4{%K_ovho)h@|8^pOczz7dDRC9byL|v0jXe} z4bu%ID(6Kl+GRCViy&}tF)Nb zLI!%=Ql`#&b0bS5iKUG`FHu^_TIU{#cgFF-K-*NU$0R~q`^cu^OC4gD@g?=fKrhkt zNByp?J4xFKhd_#t&N`0UAw*o(&7-;C6v0cI61qi^|R?x{2X!#|Fb&(G3kEwDgJEOCCFJm$AsW(f#4KxCO!*MI;C1Vf9nWOfExZ2 z>O1tQ`kAJxFpJGMth(m65+nDkBRR*9K-MDy(W6W(MJy`T`l0>RMsUFc&=x|q)Rd(~ zhBz37#KLLgsX1j~^1_v1?Y3dQU-UqiBe7a&U}W%x`LyiT7gD;x2}hP$>Ba#K)0Pdx z6R@VNqY|i~{7S#s{Qf7mwxWHkPM#}{oI*ZW;yBt-tb}4jrg*bn?k!C{`owGjyZr$04#-ax$+k@-Q>weC5Xj>7-|7|$YVi$3pBpB)~3Rd;(+C*42ots0WXZI@XQ z`%XRKMd!)XTc0AZGALwb&|CT-$V5l9Jl-X!9a6WoI`tg`xrgXeNU!URV|nD}Uzb7eA83e5Nk8bK z+F904c0~UaN1lX1Wp@FXJM*+B%#z&Y2gED#hx>H}lj+Kj7~2a@J;2c3$JicomweE3 zM-T9Wm(S-tl$s*p;$NmKsFaR9z4UPsKF9DXbyucX!#64b7073^OVGAyNJ&W01Z^{0Cp{`OAZPf9mL!1eDc50V?=z6JMaeY-p2 zi0qQGf?xZWS)KrjvS8qX&u{p@+uP57zc_v|yMG5?8o$3%B+m=!|JcC4<1hWvUvZk} zRP#UhzwYVp^h;avSNidp{y!$=@A%6m_pkUV?7#T`w!D9bU-oo6hBzcl>3z{uR$5_!s{}@cw+1gj DfO{*E literal 0 HcmV?d00001 diff --git a/tests/phpunit/data/uploads/video-play.svg b/tests/phpunit/data/uploads/video-play.svg new file mode 100644 index 0000000000..b5ea206dde --- /dev/null +++ b/tests/phpunit/data/uploads/video-play.svg @@ -0,0 +1,5 @@ + + + + + diff --git a/tests/phpunit/tests/functions.php b/tests/phpunit/tests/functions.php index 5f4d6fd975..3ad52351f9 100644 --- a/tests/phpunit/tests/functions.php +++ b/tests/phpunit/tests/functions.php @@ -898,4 +898,165 @@ class Tests_Functions extends WP_UnitTestCase { $unique_uuids = array_unique( $uuids ); $this->assertEquals( $uuids, $unique_uuids ); } + + /** + * @ticket 39550 + * @dataProvider _wp_check_filetype_and_ext_data + */ + function test_wp_check_filetype_and_ext( $file, $filename, $expected ) { + if ( ! extension_loaded( 'fileinfo' ) ) { + $this->markTestSkipped( 'The fileinfo PHP extension is not loaded.' ); + } + + $this->assertEquals( $expected, wp_check_filetype_and_ext( $file, $filename ) ); + } + + /** + * @ticket 39550 + */ + function test_wp_check_filetype_and_ext_with_filtered_svg() { + if ( ! extension_loaded( 'fileinfo' ) ) { + $this->markTestSkipped( 'The fileinfo PHP extension is not loaded.' ); + } + + if ( is_multisite() ) { + $this->markTestSkipped( 'Test does not run in multisite' ); + } + + $file = DIR_TESTDATA . '/uploads/video-play.svg'; + $filename = 'video-play.svg'; + + $expected = array( + 'ext' => 'svg', + 'type' => 'image/svg+xml', + 'proper_filename' => false, + ); + + add_filter( 'upload_mimes', array( $this, '_filter_mime_types_svg' ) ); + $this->assertEquals( $expected, wp_check_filetype_and_ext( $file, $filename ) ); + + // Cleanup. + remove_filter( 'upload_mimes', array( $this, '_test_add_mime_types_svg' ) ); + } + + /** + * @ticket 39550 + */ + function test_wp_check_filetype_and_ext_with_filtered_woff() { + if ( ! extension_loaded( 'fileinfo' ) ) { + $this->markTestSkipped( 'The fileinfo PHP extension is not loaded.' ); + } + + if ( is_multisite() ) { + $this->markTestSkipped( 'Test does not run in multisite' ); + } + + $file = DIR_TESTDATA . '/uploads/dashicons.woff'; + $filename = 'dashicons.woff'; + + $expected = array( + 'ext' => 'woff', + 'type' => 'application/font-woff', + 'proper_filename' => false, + ); + + add_filter( 'upload_mimes', array( $this, '_filter_mime_types_woff' ) ); + $this->assertEquals( $expected, wp_check_filetype_and_ext( $file, $filename ) ); + + // Cleanup. + remove_filter( 'upload_mimes', array( $this, '_test_add_mime_types_woff' ) ); + } + + public function _filter_mime_types_svg( $mimes ) { + $mimes['svg'] = 'image/svg+xml'; + return $mimes; + } + + public function _filter_mime_types_woff( $mimes ) { + $mimes['woff'] = 'application/font-woff'; + return $mimes; + } + + public function _wp_check_filetype_and_ext_data() { + $data = array( + // Standard image. + array( + DIR_TESTDATA . '/images/canola.jpg', + 'canola.jpg', + array( + 'ext' => 'jpg', + 'type' => 'image/jpeg', + 'proper_filename' => false, + ), + ), + // Image with wrong extension. + array( + DIR_TESTDATA . '/images/test-image-mime-jpg.png', + 'test-image-mime-jpg.png', + array( + 'ext' => 'jpg', + 'type' => 'image/jpeg', + 'proper_filename' => 'test-image-mime-jpg.jpg', + ), + ), + // Image without extension. + array( + DIR_TESTDATA . '/images/test-image-no-extension', + 'test-image-no-extension', + array( + 'ext' => false, + 'type' => false, + 'proper_filename' => false, + ), + ), + // Valid non-image file with an image extension. + array( + DIR_TESTDATA . '/formatting/big5.txt', + 'big5.jpg', + array( + 'ext' => 'jpg', + 'type' => 'image/jpeg', + 'proper_filename' => false, + ), + ), + // Non-image file not allowed. + array( + DIR_TESTDATA . '/export/crazy-cdata.xml', + 'crazy-cdata.xml', + array( + 'ext' => false, + 'type' => false, + 'proper_filename' => false, + ), + ), + ); + + // Test a few additional file types on single sites. + if ( ! is_multisite() ) { + $data = array_merge( $data, array( + // Standard non-image file. + array( + DIR_TESTDATA . '/formatting/big5.txt', + 'big5.txt', + array( + 'ext' => 'txt', + 'type' => 'text/plain', + 'proper_filename' => false, + ), + ), + // Non-image file with wrong sub-type. + array( + DIR_TESTDATA . '/uploads/pages-to-word.docx', + 'pages-to-word.docx', + array( + 'ext' => 'docx', + 'type' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', + 'proper_filename' => false, + ), + ), + ) ); + } + + return $data; + } }