Permalink
Browse files

Media: Limit thumbnail file deletions to the same directory as the or…

…iginal file.

Built from https://develop.svn.wordpress.org/trunk@43392


git-svn-id: http://core.svn.wordpress.org/trunk@43220 1a063a9b-81f0-0310-95a4-ce76da25c4cd
  • Loading branch information...
johnbillion committed Jul 5, 2018
1 parent 44b8c2e commit c9dce0606b0d7e6f494d4abe7b193ac046a322cd
Showing with 73 additions and 14 deletions.
  1. +22 −0 wp-includes/functions.php
  2. +50 −13 wp-includes/post.php
  3. +1 −1 wp-includes/version.php
View
@@ -5847,6 +5847,28 @@ function wp_delete_file( $file ) {
}
}
/**
* Deletes a file if its path is within the given directory.
*
* @since 4.9.7
*
* @param string $file Absolute path to the file to delete.
* @param string $directory Absolute path to a directory.
* @return bool True on success, false on failure.
*/
function wp_delete_file_from_directory( $file, $directory ) {
$real_file = realpath( wp_normalize_path( $file ) );
$real_directory = realpath( wp_normalize_path( $directory ) );
if ( false === $real_file || false === $real_directory || strpos( wp_normalize_path( $real_file ), trailingslashit( wp_normalize_path( $real_directory ) ) ) !== 0 ) {
return false;
}
wp_delete_file( $file );
return true;
}
/**
* Outputs a small JS snippet on preview tabs/windows to remove `window.name` on unload.
*
View
@@ -5311,42 +5311,79 @@ function wp_delete_attachment( $post_id, $force_delete = false ) {
/** This action is documented in wp-includes/post.php */
do_action( 'deleted_post', $post_id );
wp_delete_attachment_files( $post_id, $meta, $backup_sizes, $file );
clean_post_cache( $post );
return $post;
}
/**
* Deletes all files that belong to the given attachment.
*
* @since 4.9.7
*
* @param int $post_id Attachment ID.
* @param array $meta The attachment's meta data.
* @param array $backup_sizes The meta data for the attachment's backup images.
* @param string $file Absolute path to the attachment's file.
* @return bool True on success, false on failure.
*/
function wp_delete_attachment_files( $post_id, $meta, $backup_sizes, $file ) {
global $wpdb;
$uploadpath = wp_get_upload_dir();
$deleted = true;
if ( ! empty( $meta['thumb'] ) ) {
// Don't delete the thumb if another attachment uses it.
if ( ! $wpdb->get_row( $wpdb->prepare( "SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE %s AND post_id <> %d", '%' . $wpdb->esc_like( $meta['thumb'] ) . '%', $post_id ) ) ) {
$thumbfile = str_replace( basename( $file ), $meta['thumb'], $file );
/** This filter is documented in wp-includes/functions.php */
$thumbfile = apply_filters( 'wp_delete_file', $thumbfile );
@ unlink( path_join( $uploadpath['basedir'], $thumbfile ) );
if ( ! empty( $thumbfile ) ) {
$thumbfile = path_join( $uploadpath['basedir'], $thumbfile );
$thumbdir = path_join( $uploadpath['basedir'], dirname( $file ) );
if ( ! wp_delete_file_from_directory( $thumbfile, $thumbdir ) ) {
$deleted = false;
}
}
}
}
// Remove intermediate and backup images if there are any.
if ( isset( $meta['sizes'] ) && is_array( $meta['sizes'] ) ) {
$intermediate_dir = path_join( $uploadpath['basedir'], dirname( $file ) );
foreach ( $meta['sizes'] as $size => $sizeinfo ) {
$intermediate_file = str_replace( basename( $file ), $sizeinfo['file'], $file );
/** This filter is documented in wp-includes/functions.php */
$intermediate_file = apply_filters( 'wp_delete_file', $intermediate_file );
@ unlink( path_join( $uploadpath['basedir'], $intermediate_file ) );
if ( ! empty( $intermediate_file ) ) {
$intermediate_file = path_join( $uploadpath['basedir'], $intermediate_file );
if ( ! wp_delete_file_from_directory( $intermediate_file, $intermediate_dir ) ) {
$deleted = false;
}
}
}
}
if ( is_array( $backup_sizes ) ) {
$del_dir = path_join( $uploadpath['basedir'], dirname( $meta['file'] ) );
foreach ( $backup_sizes as $size ) {
$del_file = path_join( dirname( $meta['file'] ), $size['file'] );
/** This filter is documented in wp-includes/functions.php */
$del_file = apply_filters( 'wp_delete_file', $del_file );
@ unlink( path_join( $uploadpath['basedir'], $del_file ) );
if ( ! empty( $del_file ) ) {
$del_file = path_join( $uploadpath['basedir'], $del_file );
if ( ! wp_delete_file_from_directory( $del_file, $del_dir ) ) {
$deleted = false;
}
}
}
}
wp_delete_file( $file );
clean_post_cache( $post );
if ( ! wp_delete_file_from_directory( $file, $uploadpath['basedir'] ) ) {
$deleted = false;
}
return $post;
return $deleted;
}
/**
View
@@ -4,7 +4,7 @@
*
* @global string $wp_version
*/
$wp_version = '5.0-alpha-43391';
$wp_version = '5.0-alpha-43392';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

0 comments on commit c9dce06

Please sign in to comment.