Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: media upload whitelist per extension, no stray files, IPv4-only import

Browse Source 
Empty effective whitelist is rejected instead of falling back to all types; the
whitelist is matched per extension against core's keys (mp3|m4a|m4b); a file moved
into uploads is deleted when the attachment cannot be created; the import request
resolves IPv4 only; empty temp name guard for URL imports.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
janniclas.loosen
2026-09-26 02:42:45 +02:00
co-authored by Claude Opus 5.5
parent 2e29a6cd4d
commit 56f561c436
2 changed files with 204 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Integrations/Media/MediaImporter.php
+87 -18
View File
@@ -61,6 +61,10 @@ class MediaImporter
AdminIncludes::load();
$tmp = (string) wp_tempnam('lit-mcp-import');
if ($tmp === '') {
return Errors::writeFailed('Die temporäre Datei konnte nicht angelegt werden.');
}
try {
$response = $this->download($url, $tmp);
if ($response instanceof WP_Error) {
@@ -112,12 +116,26 @@ class MediaImporter
/** @return array<string, mixed>|WP_Error The response (body streamed into $tmp). */
private function download(string $url, string $tmp): array|WP_Error
{
$response = wp_safe_remote_get($url, [
'timeout' => self::TIMEOUT,
'stream' => true,
'filename' => $tmp,
'limit_response_size' => $this->limits->uploadBytes() + 1,
]);
// IPv4 only, for this request only: wp_http_validate_url() checks the IPv4 address
// (gethostbyname), so an AAAA record must not lead cURL to an unchecked IPv6 target.
$ipv4 = static function ($handle): void {
if (defined('CURLOPT_IPRESOLVE') && defined('CURL_IPRESOLVE_V4')) {
// phpcs:ignore WordPress.WP.AlternativeFunctions.curl_curl_setopt -- http_api_curl hands us the handle.
curl_setopt($handle, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);
}
};
add_action('http_api_curl', $ipv4);
try {
$response = wp_safe_remote_get($url, [
'timeout' => self::TIMEOUT,
'stream' => true,
'filename' => $tmp,
'limit_response_size' => $this->limits->uploadBytes() + 1,
]);
} finally {
remove_action('http_api_curl', $ipv4);
}
if ($response instanceof WP_Error) {
return $this->downloadFailed($response->get_error_message());
}
@@ -145,12 +163,21 @@ class MediaImporter
}
$mimes = $this->allowedMimes();
if ($mimes === []) {
// An empty list would make wp_check_filetype() fall back to every type WordPress allows.
return Errors::invalidInput(
'Auf dieser Website sind keine Dateitypen zum Hochladen freigegeben.',
['filename' => 'kein Dateityp erlaubt'],
'Administrator fragen (Filter lit_mcp_upload_mimes bzw. erlaubte Dateitypen von WordPress).'
);
}
$name = sanitize_file_name($filename !== '' ? $filename : 'datei');
$check = wp_check_filetype_and_ext($tmp, $name, $mimes);
if (empty($check['type']) || empty($check['ext'])) {
return Errors::invalidInput(
'Dateityp nicht erlaubt oder Inhalt passt nicht zur Endung.',
['filename' => 'erlaubt: ' . str_replace('|', ', ', implode(', ', array_keys($mimes)))],
['filename' => 'erlaubt: ' . implode(', ', array_keys($mimes))],
'Nur erlaubte Dateitypen hochladen (Bilder, PDF, MP4, MP3) und die passende Endung verwenden.'
);
}
@@ -160,18 +187,13 @@ class MediaImporter
}
$title = isset($meta['title']) ? sanitize_text_field((string) $meta['title']) : null;
$attachmentId = media_handle_sideload(
['name' => $name, 'tmp_name' => $tmp],
(int) ($meta['post_id'] ?? 0),
$title
);
$attachmentId = $this->sideload($name, $tmp, (int) ($meta['post_id'] ?? 0), $title);
if ($attachmentId instanceof WP_Error) {
$reason = 'WordPress hat die Datei nicht übernommen: ' . $attachmentId->get_error_message();
return Errors::writeFailed($reason);
}
$attachmentId = (int) $attachmentId;
if (isset($meta['alt']) && $meta['alt'] !== '') {
$this->saveAlt($attachmentId, sanitize_text_field((string) $meta['alt']));
}
@@ -179,6 +201,35 @@ class MediaImporter
return $attachmentId;
}
/**
* media_handle_sideload() moves the file into uploads before it creates the attachment;
* if that fails, WordPress leaves the file behind. The moved file is recorded (one-shot
* wp_handle_upload filter) and removed on error, so "nothing was saved" holds.
*/
private function sideload(string $name, string $tmp, int $postId, ?string $title): int|WP_Error
{
$moved = null;
$record = static function ($upload, $context = '') use (&$moved) {
if ($context === 'sideload' && is_array($upload) && isset($upload['file'])) {
$moved = (string) $upload['file'];
}
return $upload;
};
add_filter('wp_handle_upload', $record, 10, 2);
try {
$result = media_handle_sideload(['name' => $name, 'tmp_name' => $tmp], $postId, $title);
} finally {
remove_filter('wp_handle_upload', $record, 10);
}
if ($result instanceof WP_Error && is_string($moved) && $moved !== '' && file_exists($moved)) {
wp_delete_file($moved);
}
return $result instanceof WP_Error ? $result : (int) $result;
}
/** @throws WriteFailed When the alt text cannot be saved (attachment deleted again if possible). */
private function saveAlt(int $attachmentId, string $alt): void
{
@@ -217,17 +268,35 @@ class MediaImporter
}
/**
* Whitelist (filterable) restricted to what WordPress allows the current user.
* Whitelist (filterable) restricted to what WordPress allows the current user, per
* extension: core groups extensions differently (e.g. 'mp3|m4a|m4b'), so each of our
* extensions is kept only if WordPress maps it to the same MIME type.
*
* @return array<string, string>
* @return array<string, string> Single extension => MIME type.
*/
private function allowedMimes(): array
{
$mimes = apply_filters('lit_mcp_upload_mimes', self::MIMES);
$mimes = is_array($mimes) ? $mimes : self::MIMES;
$allowed = get_allowed_mime_types();
$allowed = is_array($allowed) ? $allowed : [];
return array_intersect_key($mimes, is_array($allowed) ? $allowed : []);
$effective = [];
foreach ($mimes as $extensions => $mime) {
foreach (explode('|', (string) $extensions) as $extension) {
$extension = strtolower(trim($extension));
if ($extension === '' || $allowed === []) {
continue;
}
$core = wp_check_filetype('x.' . $extension, $allowed);
if (($core['type'] ?? false) === $mime) {
$effective[$extension] = (string) $mime;
}
}
}
return $effective;
}
/**
@@ -243,9 +312,9 @@ class MediaImporter
}
$type = strtolower(trim(explode(';', (string) wp_remote_retrieve_header($response, 'content-type'))[0]));
foreach ($this->allowedMimes() as $extensions => $mime) {
foreach ($this->allowedMimes() as $extension => $mime) {
if ($mime === $type) {
return ($name !== '' ? $name : 'datei') . '.' . explode('|', $extensions)[0];
return ($name !== '' ? $name : 'datei') . '.' . $extension;
}
}