vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2025-10-16 12:05:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Filesystem API: Use a temp folder for Content-Disposition files.

Browse Source 
#38231 added support for files fetched remotely to have their filename defined by the host using the `Content-Disposition` header. This would then take priority over the existing temporary file name created with `wp_tempnam()` earlier in the process.

The change unintentionally omitted the temporary directory path used during uploads, since the `wp_tempnam()` function would have added it previously, so that files with this header ended up being stored in the WordPress root folder, or wp-admin folder, when triggered by WP_Cron or user interactions respectively.

This change makes sure the file path includes the temporary directory location when the header is used.

Follow-up to [51939].

Props antonynz, azouamauriac.
Fixes #55109.

git-svn-id: https://develop.svn.wordpress.org/trunk@52734 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Marius L. J 2022-02-15 17:47:39 +00:00
parent fac497a8d1
commit d7745c656d
2 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/wp-admin/includes/file.php
View File

@ -1198,6 +1198,8 @@ function download_url( $url, $timeout = 300, $signature_verification = false ) {
if ( $tmpfname_disposition && is_string( $tmpfname_disposition )
&& ( 0 === validate_file( $tmpfname_disposition ) )
) {
$tmpfname_disposition = dirname( $tmpfname ) . '/' . $tmpfname_disposition;
if ( rename( $tmpfname, $tmpfname_disposition ) ) {
$tmpfname = $tmpfname_disposition;
}

29
tests/phpunit/tests/admin/includesFile.php
View File

@ -101,6 +101,24 @@ class Tests_Admin_IncludesFile extends WP_UnitTestCase {
remove_filter( 'pre_http_request', array( $this, $filter ) );
}
/**
* @ticket #55109
* @dataProvider data_save_to_temp_directory_when_getting_filename_from_content_disposition_header
*
* @covers ::download_url
*
* @param $filter A callback containing a fake Content-Disposition header.
*/
public function test_save_to_temp_directory_when_getting_filename_from_content_disposition_header( $filter ) {
add_filter( 'pre_http_request', array( $this, $filter ), 10, 3 );
$filename = download_url( 'url_with_content_disposition_header' );
$this->assertStringContainsString( get_temp_dir(), $filename );
$this->unlink( $filename );
remove_filter( 'pre_http_request', array( $this, $filter ) );
}
/**
* Data provider for test_download_url_should_respect_filename_from_content_disposition_header.
*
@ -114,6 +132,17 @@ class Tests_Admin_IncludesFile extends WP_UnitTestCase {
);
}
/**
* Data provider for test_save_to_temp_directory_when_getting_filename_from_content_disposition_header.
*
* @return array
*/
public function data_save_to_temp_directory_when_getting_filename_from_content_disposition_header() {
return array(
'valid parameters' => array( 'filter_content_disposition_header_with_filename' ),
);
}
/**
* Filter callback for data_download_url_should_respect_filename_from_content_disposition_header.
*