<?php

[0] Fix | Delete

[1] Fix | Delete

/**

[2] Fix | Delete

* Validates uploaded files and moves them to the temporary directory.

[3] Fix | Delete

*

[4] Fix | Delete

* @param array $file An item of `$_FILES`.

[5] Fix | Delete

* @param string|array $options Optional. Options to control behavior.

[6] Fix | Delete

* @return array|WP_Error Array of file paths, or WP_Error if validation fails.

[7] Fix | Delete

*/

[8] Fix | Delete

function wpcf7_unship_uploaded_file( $file, $options = '' ) {

[9] Fix | Delete

$options = wp_parse_args( $options, array(

[10] Fix | Delete

'required' => false,

[11] Fix | Delete

'filetypes' => '',

[12] Fix | Delete

'limit' => MB_IN_BYTES,

[13] Fix | Delete

) );

[14] Fix | Delete

[15] Fix | Delete

foreach ( array( 'name', 'size', 'tmp_name', 'error' ) as $key ) {

[16] Fix | Delete

if ( ! isset( $file[$key] ) ) {

[17] Fix | Delete

$file[$key] = array();

[18] Fix | Delete

}

[19] Fix | Delete

}

[20] Fix | Delete

[21] Fix | Delete

$names = wpcf7_array_flatten( $file['name'] );

[22] Fix | Delete

$sizes = wpcf7_array_flatten( $file['size'] );

[23] Fix | Delete

$tmp_names = wpcf7_array_flatten( $file['tmp_name'] );

[24] Fix | Delete

$errors = wpcf7_array_flatten( $file['error'] );

[25] Fix | Delete

[26] Fix | Delete

foreach ( $errors as $error ) {

[27] Fix | Delete

if ( ! empty( $error ) and UPLOAD_ERR_NO_FILE !== $error ) {

[28] Fix | Delete

return new WP_Error( 'wpcf7_upload_failed_php_error',

[29] Fix | Delete

wpcf7_get_message( 'upload_failed_php_error' )

[30] Fix | Delete

);

[31] Fix | Delete

}

[32] Fix | Delete

}

[33] Fix | Delete

[34] Fix | Delete

if ( isset( $options['schema'] ) and isset( $options['name'] ) ) {

[35] Fix | Delete

$context = array(

[36] Fix | Delete

'file' => true,

[37] Fix | Delete

'field' => $options['name'],

[38] Fix | Delete

);

[39] Fix | Delete

[40] Fix | Delete

foreach ( $options['schema']->validate( $context ) as $result ) {

[41] Fix | Delete

if ( is_wp_error( $result ) ) {

[42] Fix | Delete

return $result;

[43] Fix | Delete

}

[44] Fix | Delete

}

[45] Fix | Delete

}

[46] Fix | Delete

[47] Fix | Delete

// Move uploaded file to tmp dir

[48] Fix | Delete

$uploads_dir = wpcf7_upload_tmp_dir();

[49] Fix | Delete

$uploads_dir = wpcf7_maybe_add_random_dir( $uploads_dir );

[50] Fix | Delete

[51] Fix | Delete

$uploaded_files = array();

[52] Fix | Delete

[53] Fix | Delete

foreach ( $names as $key => $name ) {

[54] Fix | Delete

$tmp_name = $tmp_names[$key];

[55] Fix | Delete

[56] Fix | Delete

if ( empty( $tmp_name ) or ! is_uploaded_file( $tmp_name ) ) {

[57] Fix | Delete

continue;

[58] Fix | Delete

}

[59] Fix | Delete

[60] Fix | Delete

$filename = $name;

[61] Fix | Delete

$filename = wpcf7_canonicalize( $filename, array( 'strto' => 'as-is' ) );

[62] Fix | Delete

$filename = wpcf7_antiscript_file_name( $filename );

[63] Fix | Delete

[64] Fix | Delete

$filename = apply_filters( 'wpcf7_upload_file_name',

[65] Fix | Delete

$filename, $name, $options

[66] Fix | Delete

);

[67] Fix | Delete

[68] Fix | Delete

$filename = wp_unique_filename( $uploads_dir, $filename );

[69] Fix | Delete

$new_file = path_join( $uploads_dir, $filename );

[70] Fix | Delete

[71] Fix | Delete

if ( false === @move_uploaded_file( $tmp_name, $new_file ) ) {

[72] Fix | Delete

return new WP_Error( 'wpcf7_upload_failed',

[73] Fix | Delete

wpcf7_get_message( 'upload_failed' )

[74] Fix | Delete

);

[75] Fix | Delete

}

[76] Fix | Delete

[77] Fix | Delete

// Make sure the uploaded file is only readable for the owner process

[78] Fix | Delete

chmod( $new_file, 0400 );

[79] Fix | Delete

[80] Fix | Delete

$uploaded_files[] = $new_file;

[81] Fix | Delete

}

[82] Fix | Delete

[83] Fix | Delete

return $uploaded_files;

[84] Fix | Delete

}

[85] Fix | Delete

[86] Fix | Delete

[87] Fix | Delete

add_filter(

[88] Fix | Delete

'wpcf7_messages',

[89] Fix | Delete

'wpcf7_file_messages',

[90] Fix | Delete

10, 1

[91] Fix | Delete

);

[92] Fix | Delete

[93] Fix | Delete

/**

[94] Fix | Delete

* A wpcf7_messages filter callback that adds messages for

[95] Fix | Delete

* file-uploading fields.

[96] Fix | Delete

*/

[97] Fix | Delete

function wpcf7_file_messages( $messages ) {

[98] Fix | Delete

return array_merge( $messages, array(

[99] Fix | Delete

'upload_failed' => array(

[100] Fix | Delete

'description' => __( "Uploading a file fails for any reason", 'contact-form-7' ),

[101] Fix | Delete

'default' => __( "There was an unknown error uploading the file.", 'contact-form-7' ),

[102] Fix | Delete

),

[103] Fix | Delete

[104] Fix | Delete

'upload_file_type_invalid' => array(

[105] Fix | Delete

'description' => __( "Uploaded file is not allowed for file type", 'contact-form-7' ),

[106] Fix | Delete

'default' => __( "You are not allowed to upload files of this type.", 'contact-form-7' ),

[107] Fix | Delete

),

[108] Fix | Delete

[109] Fix | Delete

'upload_file_too_large' => array(

[110] Fix | Delete

'description' => __( "Uploaded file is too large", 'contact-form-7' ),

[111] Fix | Delete

'default' => __( "The uploaded file is too large.", 'contact-form-7' ),

[112] Fix | Delete

),

[113] Fix | Delete

[114] Fix | Delete

'upload_failed_php_error' => array(

[115] Fix | Delete

'description' => __( "Uploading a file fails for PHP error", 'contact-form-7' ),

[116] Fix | Delete

'default' => __( "There was an error uploading the file.", 'contact-form-7' ),

[117] Fix | Delete

),

[118] Fix | Delete

) );

[119] Fix | Delete

}

[120] Fix | Delete

[121] Fix | Delete

[122] Fix | Delete

add_filter(

[123] Fix | Delete

'wpcf7_form_enctype',

[124] Fix | Delete

'wpcf7_file_form_enctype_filter',

[125] Fix | Delete

10, 1

[126] Fix | Delete

);

[127] Fix | Delete

[128] Fix | Delete

/**

[129] Fix | Delete

* A wpcf7_form_enctype filter callback that sets the enctype attribute

[130] Fix | Delete

* to multipart/form-data if the form has file-uploading fields.

[131] Fix | Delete

*/

[132] Fix | Delete

function wpcf7_file_form_enctype_filter( $enctype ) {

[133] Fix | Delete

$multipart = (bool) wpcf7_scan_form_tags( array(

[134] Fix | Delete

'feature' => 'file-uploading',

[135] Fix | Delete

) );

[136] Fix | Delete

[137] Fix | Delete

if ( $multipart ) {

[138] Fix | Delete

$enctype = 'multipart/form-data';

[139] Fix | Delete

}

[140] Fix | Delete

[141] Fix | Delete

return $enctype;

[142] Fix | Delete

}

[143] Fix | Delete

[144] Fix | Delete

[145] Fix | Delete

/**

[146] Fix | Delete

* Converts a MIME type string to an array of corresponding file extensions.

[147] Fix | Delete

*

[148] Fix | Delete

* @param string $mime MIME type.

[149] Fix | Delete

* Wildcard (*) is available for the subtype part.

[150] Fix | Delete

* @return array Corresponding file extensions.

[151] Fix | Delete

*/

[152] Fix | Delete

function wpcf7_convert_mime_to_ext( $mime ) {

[153] Fix | Delete

static $mime_types = array();

[154] Fix | Delete

[155] Fix | Delete

$mime_types = wp_get_mime_types();

[156] Fix | Delete

[157] Fix | Delete

$results = array();

[158] Fix | Delete

[159] Fix | Delete

if ( preg_match( '%^([a-z]+)/([*]|[a-z0-9.+-]+)$%i', $mime, $matches ) ) {

[160] Fix | Delete

foreach ( $mime_types as $key => $val ) {

[161] Fix | Delete

if ( '*' === $matches[2] and str_starts_with( $val, $matches[1] . '/' )

[162] Fix | Delete

or $val === $matches[0] ) {

[163] Fix | Delete

$results = array_merge( $results, explode( '|', $key ) );

[164] Fix | Delete

}

[165] Fix | Delete

}

[166] Fix | Delete

}

[167] Fix | Delete

[168] Fix | Delete

$results = array_unique( $results );

[169] Fix | Delete

$results = array_filter( $results );

[170] Fix | Delete

$results = array_values( $results );

[171] Fix | Delete

[172] Fix | Delete

return $results;

[173] Fix | Delete

}

[174] Fix | Delete

[175] Fix | Delete

[176] Fix | Delete

/**

[177] Fix | Delete

* Returns a formatted list of acceptable filetypes.

[178] Fix | Delete

*

[179] Fix | Delete

* @param string|array $types Optional. Array of filetypes.

[180] Fix | Delete

* @param string $format Optional. Pre-defined format designator.

[181] Fix | Delete

* @return string Formatted list of acceptable filetypes.

[182] Fix | Delete

*/

[183] Fix | Delete

function wpcf7_acceptable_filetypes( $types = 'default', $format = 'regex' ) {

[184] Fix | Delete

if ( 'default' === $types or empty( $types ) ) {

[185] Fix | Delete

$types = array(

[186] Fix | Delete

'audio/*',

[187] Fix | Delete

'video/*',

[188] Fix | Delete

'image/*',

[189] Fix | Delete

);

[190] Fix | Delete

} else {

[191] Fix | Delete

$types = array_map(

[192] Fix | Delete

static function ( $type ) {

[193] Fix | Delete

if ( is_string( $type ) ) {

[194] Fix | Delete

return preg_split( '/[\s|,]+/', strtolower( $type ) );

[195] Fix | Delete

}

[196] Fix | Delete

},

[197] Fix | Delete

(array) $types

[198] Fix | Delete

);

[199] Fix | Delete

[200] Fix | Delete

$types = wpcf7_array_flatten( $types );

[201] Fix | Delete

$types = array_filter( array_unique( $types ) );

[202] Fix | Delete

}

[203] Fix | Delete

[204] Fix | Delete

if ( 'attr' === $format or 'attribute' === $format ) {

[205] Fix | Delete

$types = array_map(

[206] Fix | Delete

static function ( $type ) {

[207] Fix | Delete

if ( false === strpos( $type, '/' ) ) {

[208] Fix | Delete

return sprintf( '.%s', trim( $type, '.' ) );

[209] Fix | Delete

} elseif ( preg_match( '%^([a-z]+)/[*]$%i', $type, $matches ) ) {

[210] Fix | Delete

if ( in_array( $matches[1], array( 'audio', 'video', 'image' ) ) ) {

[211] Fix | Delete

return $type;

[212] Fix | Delete

} else {

[213] Fix | Delete

return '';

[214] Fix | Delete

}

[215] Fix | Delete

} elseif ( wpcf7_convert_mime_to_ext( $type ) ) {

[216] Fix | Delete

return $type;

[217] Fix | Delete

}

[218] Fix | Delete

},

[219] Fix | Delete

$types

[220] Fix | Delete

);

[221] Fix | Delete

[222] Fix | Delete

$types = array_filter( $types );

[223] Fix | Delete

[224] Fix | Delete

return implode( ',', $types );

[225] Fix | Delete

[226] Fix | Delete

} elseif ( 'regex' === $format ) {

[227] Fix | Delete

$types = array_map(

[228] Fix | Delete

static function ( $type ) {

[229] Fix | Delete

if ( false === strpos( $type, '/' ) ) {

[230] Fix | Delete

return preg_quote( trim( $type, '.' ) );

[231] Fix | Delete

} elseif ( $type = wpcf7_convert_mime_to_ext( $type ) ) {

[232] Fix | Delete

return $type;

[233] Fix | Delete

}

[234] Fix | Delete

},

[235] Fix | Delete

$types

[236] Fix | Delete

);

[237] Fix | Delete

[238] Fix | Delete

$types = wpcf7_array_flatten( $types );

[239] Fix | Delete

$types = array_filter( array_unique( $types ) );

[240] Fix | Delete

[241] Fix | Delete

return implode( '|', $types );

[242] Fix | Delete

}

[243] Fix | Delete

[244] Fix | Delete

return '';

[245] Fix | Delete

}

[246] Fix | Delete

[247] Fix | Delete

[248] Fix | Delete

add_action(

[249] Fix | Delete

'wpcf7_init',

[250] Fix | Delete

'wpcf7_init_uploads',

[251] Fix | Delete

10, 0

[252] Fix | Delete

);

[253] Fix | Delete

[254] Fix | Delete

/**

[255] Fix | Delete

* Initializes the temporary directory for uploaded files.

[256] Fix | Delete

*/

[257] Fix | Delete

function wpcf7_init_uploads() {

[258] Fix | Delete

$dir = wpcf7_upload_tmp_dir();

[259] Fix | Delete

[260] Fix | Delete

if ( is_dir( $dir ) and is_writable( $dir ) ) {

[261] Fix | Delete

$htaccess_file = path_join( $dir, '.htaccess' );

[262] Fix | Delete

[263] Fix | Delete

if ( file_exists( $htaccess_file ) ) {

[264] Fix | Delete

list( $first_line_comment ) = (array) file(

[265] Fix | Delete

$htaccess_file,

[266] Fix | Delete

FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES

[267] Fix | Delete

);

[268] Fix | Delete

[269] Fix | Delete

if ( '# Apache 2.4+' === $first_line_comment ) {

[270] Fix | Delete

return;

[271] Fix | Delete

}

[272] Fix | Delete

}

[273] Fix | Delete

[274] Fix | Delete

if ( $handle = @fopen( $htaccess_file, 'w' ) ) {

[275] Fix | Delete

fwrite( $handle, "# Apache 2.4+\n" );

[276] Fix | Delete

fwrite( $handle, "<IfModule authz_core_module>\n" );

[277] Fix | Delete

fwrite( $handle, " Require all denied\n" );

[278] Fix | Delete

fwrite( $handle, "</IfModule>\n" );

[279] Fix | Delete

fwrite( $handle, "\n" );

[280] Fix | Delete

fwrite( $handle, "# Apache 2.2\n" );

[281] Fix | Delete

fwrite( $handle, "<IfModule !authz_core_module>\n" );

[282] Fix | Delete

fwrite( $handle, " Deny from all\n" );

[283] Fix | Delete

fwrite( $handle, "</IfModule>\n" );

[284] Fix | Delete

[285] Fix | Delete

fclose( $handle );

[286] Fix | Delete

}

[287] Fix | Delete

}

[288] Fix | Delete

}

[289] Fix | Delete

[290] Fix | Delete

[291] Fix | Delete

/**

[292] Fix | Delete

* Creates a child directory with a randomly generated name.

[293] Fix | Delete

*

[294] Fix | Delete

* @param string $dir The parent directory path.

[295] Fix | Delete

* @return string The child directory path if created, otherwise the parent.

[296] Fix | Delete

*/

[297] Fix | Delete

function wpcf7_maybe_add_random_dir( $dir ) {

[298] Fix | Delete

do {

[299] Fix | Delete

$rand_max = mt_getrandmax();

[300] Fix | Delete

$rand = zeroise( mt_rand( 0, $rand_max ), strlen( $rand_max ) );

[301] Fix | Delete

$dir_new = path_join( $dir, $rand );

[302] Fix | Delete

} while ( file_exists( $dir_new ) );

[303] Fix | Delete

[304] Fix | Delete

if ( wp_mkdir_p( $dir_new ) ) {

[305] Fix | Delete

return $dir_new;

[306] Fix | Delete

}

[307] Fix | Delete

[308] Fix | Delete

return $dir;

[309] Fix | Delete

}

[310] Fix | Delete

[311] Fix | Delete

[312] Fix | Delete

/**

[313] Fix | Delete

* Returns the directory path for uploaded files.

[314] Fix | Delete

*

[315] Fix | Delete

* @return string Directory path.

[316] Fix | Delete

*/

[317] Fix | Delete

function wpcf7_upload_tmp_dir() {

[318] Fix | Delete

if ( defined( 'WPCF7_UPLOADS_TMP_DIR' ) ) {

[319] Fix | Delete

$dir = path_join( WP_CONTENT_DIR, WPCF7_UPLOADS_TMP_DIR );

[320] Fix | Delete

wp_mkdir_p( $dir );

[321] Fix | Delete

[322] Fix | Delete

if ( wpcf7_is_file_path_in_content_dir( $dir ) ) {

[323] Fix | Delete

return $dir;

[324] Fix | Delete

}

[325] Fix | Delete

}

[326] Fix | Delete

[327] Fix | Delete

$dir = path_join( wpcf7_upload_dir( 'dir' ), 'wpcf7_uploads' );

[328] Fix | Delete

wp_mkdir_p( $dir );

[329] Fix | Delete

return $dir;

[330] Fix | Delete

}

[331] Fix | Delete

[332] Fix | Delete

[333] Fix | Delete

add_action(

[334] Fix | Delete

'shutdown',

[335] Fix | Delete

'wpcf7_cleanup_upload_files',

[336] Fix | Delete

20, 0

[337] Fix | Delete

);

[338] Fix | Delete

[339] Fix | Delete

/**

[340] Fix | Delete

* Cleans up files in the temporary directory for uploaded files.

[341] Fix | Delete

*

[342] Fix | Delete

* @param int $seconds Files older than this are removed. Default 60.

[343] Fix | Delete

* @param int $max Maximum number of files to be removed in a function call.

[344] Fix | Delete

* Default 100.

[345] Fix | Delete

*/

[346] Fix | Delete

function wpcf7_cleanup_upload_files( $seconds = 60, $max = 100 ) {

[347] Fix | Delete

$dir = trailingslashit( wpcf7_upload_tmp_dir() );

[348] Fix | Delete

[349] Fix | Delete

if ( ! is_dir( $dir )

[350] Fix | Delete

or ! is_readable( $dir )

[351] Fix | Delete

or ! wp_is_writable( $dir ) ) {

[352] Fix | Delete

return;

[353] Fix | Delete

}

[354] Fix | Delete

[355] Fix | Delete

$seconds = absint( $seconds );

[356] Fix | Delete

$max = absint( $max );

[357] Fix | Delete

$count = 0;

[358] Fix | Delete

[359] Fix | Delete

if ( $handle = opendir( $dir ) ) {

[360] Fix | Delete

while ( false !== ( $file = readdir( $handle ) ) ) {

[361] Fix | Delete

if ( '.' == $file

[362] Fix | Delete

or '..' == $file

[363] Fix | Delete

or '.htaccess' == $file ) {

[364] Fix | Delete

continue;

[365] Fix | Delete

}

[366] Fix | Delete

[367] Fix | Delete

$mtime = @filemtime( path_join( $dir, $file ) );

[368] Fix | Delete

[369] Fix | Delete

if ( $mtime and time() < $mtime + $seconds ) { // less than $seconds old

[370] Fix | Delete

continue;

[371] Fix | Delete

}

[372] Fix | Delete

[373] Fix | Delete

wpcf7_rmdir_p( path_join( $dir, $file ) );

[374] Fix | Delete

$count += 1;

[375] Fix | Delete

[376] Fix | Delete

if ( $max <= $count ) {

[377] Fix | Delete

break;

[378] Fix | Delete

}

[379] Fix | Delete

}

[380] Fix | Delete

[381] Fix | Delete

closedir( $handle );

[382] Fix | Delete

}

[383] Fix | Delete

}

[384] Fix | Delete

[385] Fix | Delete

[386] Fix | Delete

add_action(

[387] Fix | Delete

'wpcf7_admin_warnings',

[388] Fix | Delete

'wpcf7_file_display_warning_message',

[389] Fix | Delete

10, 3

[390] Fix | Delete

);

[391] Fix | Delete

[392] Fix | Delete

/**

[393] Fix | Delete

* Displays warning messages about file-uploading fields.

[394] Fix | Delete

*/

[395] Fix | Delete

function wpcf7_file_display_warning_message( $page, $action, $object ) {

[396] Fix | Delete

if ( $object instanceof WPCF7_ContactForm ) {

[397] Fix | Delete

$contact_form = $object;

[398] Fix | Delete

} else {

[399] Fix | Delete

return;

[400] Fix | Delete

}

[401] Fix | Delete

[402] Fix | Delete

$has_tags = (bool) $contact_form->scan_form_tags( array(

[403] Fix | Delete

'feature' => 'file-uploading',

[404] Fix | Delete

) );

[405] Fix | Delete

[406] Fix | Delete

if ( ! $has_tags ) {

[407] Fix | Delete

return;

[408] Fix | Delete

}

[409] Fix | Delete

[410] Fix | Delete

$uploads_dir = wpcf7_upload_tmp_dir();

[411] Fix | Delete

[412] Fix | Delete

if ( ! is_dir( $uploads_dir ) or ! wp_is_writable( $uploads_dir ) ) {

[413] Fix | Delete

$message = sprintf(

[414] Fix | Delete

/* translators: %s: the path of the temporary folder */

[415] Fix | Delete

__( 'This contact form has file uploading fields, but the temporary folder for the files (%s) does not exist or is not writable. You can create the folder or change its permission manually.', 'contact-form-7' ),

[416] Fix | Delete

$uploads_dir

[417] Fix | Delete

);

[418] Fix | Delete

[419] Fix | Delete

echo sprintf(

[420] Fix | Delete

'<div class="notice notice-warning"><p>%s</p></div>',

[421] Fix | Delete

esc_html( $message )

[422] Fix | Delete

);

[423] Fix | Delete

}

[424] Fix | Delete

}

[425] Fix | Delete

[426] Fix | Delete