Cavemanon/piratepoet
8
Fork 0
Code Pull Requests Actions Releases 16 Activity

Improve TemplateImageLoader robustness

Browse Source 
[MAILPOET-3923]
This commit is contained in:
alex-mpoet
2024-07-11 19:27:35 +03:00
committed by Aschepikov
parent d82d6b89e9
commit 19b21fb2bf
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
mailpoet/lib/NewsletterTemplates/TemplateImageLoader.php
View File

@@ -29,6 +29,7 @@ class TemplateImageLoader {
// Failed to load the image // Failed to load the image
return false; return false;
} }
$mime = $this->wp->wpGetImageMime($image);
if (!$this->isTypeAllowed($image, $mime)) { if (!$this->isTypeAllowed($image, $mime)) {
// Wrong file type // Wrong file type
@unlink($image); @unlink($image);
@@ -46,11 +47,11 @@ class TemplateImageLoader {
} }
private function isUrlAllowed($url) { private function isUrlAllowed($url) {
$urlParts = parse_url($url); $urlParts = $this->wp->wpParseUrl($url);
$allowedExtensions = ['gif', 'png', 'jpg', 'jpeg']; $allowedExtensions = ['gif', 'png', 'jpg', 'jpeg'];
if ( if (
!isset($urlParts['path']) !isset($urlParts['path'])
|| !preg_match('/(' . join('|', $allowedExtensions) . ')$/', $urlParts['path']) || !preg_match('/\.(' . join('|', $allowedExtensions) . ')$/i', $urlParts['path'])
) { ) {
return false; return false;
} }
@@ -59,10 +60,12 @@ class TemplateImageLoader {
'https://ps.w.org/mailpoet/assets/newsletter-templates/', 'https://ps.w.org/mailpoet/assets/newsletter-templates/',
]); ]);
foreach ($allowedUrls as $allowedUrl) { foreach ($allowedUrls as $allowedUrl) {
$allowedUrlParts = parse_url($allowedUrl); $allowedUrlParts = $this->wp->wpParseUrl($allowedUrl);
if ( if (
isset($urlParts['host'], $allowedUrlParts['host'], $allowedUrlParts['path']) isset($urlParts['host'], $urlParts['scheme'])
&& isset($allowedUrlParts['host'], $allowedUrlParts['scheme'], $allowedUrlParts['path'])
&& $urlParts['host'] === $allowedUrlParts['host'] && $urlParts['host'] === $allowedUrlParts['host']
&& $urlParts['scheme'] === $allowedUrlParts['scheme']
&& strpos($urlParts['path'], $allowedUrlParts['path']) === 0 && strpos($urlParts['path'], $allowedUrlParts['path']) === 0
) { ) {
return true; return true;
@@ -71,13 +74,12 @@ class TemplateImageLoader {
return false; return false;
} }
private function isTypeAllowed($image, &$mime = null) { private function isTypeAllowed($image, $mime) {
$allowedMimeTypes = [ $allowedMimeTypes = [
'image/gif', 'image/gif',
'image/jpeg', 'image/jpeg',
'image/png', 'image/png',
]; ];
$mime = $this->wp->wpGetImageMime($image);
return $mime && in_array($mime, $allowedMimeTypes); return $mime && in_array($mime, $allowedMimeTypes);
} }
} }