Ticket #6336: 6336.04.patch

src/bp-core/bp-core-avatars.php

@@ -962 +962 @@
 }
 
 /**
+ * Get allowed avatar types
+ *
+ * @since  BuddyPress (2.3.0)
+ */
+function bp_core_get_allowed_avatar_types() {
+        $allowed_types = array( 'jpeg', 'gif', 'png' );
+
+        /**
+         * Use this filter to restrict image types
+         *
+         * @since BuddyPress (2.3.0)
+         *
+         * @param array list of image types
+         */
+        $avatar_types = (array) apply_filters( 'bp_core_get_allowed_avatar_types', $allowed_types );
+
+        if ( empty( $avatar_types ) ) {
+                $avatar_types = $allowed_types;
+        } else {
+                $avatar_types = array_intersect( $allowed_types, $avatar_types );
+        }
+
+        return array_values( $avatar_types );
+}
+
+/**
+ * Get allowed avatar mime types
+ *
+ * @since  BuddyPress (2.3.0)
+ */
+function bp_core_get_allowed_avatar_mimes() {
+        $allowed_types  = bp_core_get_allowed_avatar_types();
+        $validate_mimes = wp_match_mime_types( join( ',', $allowed_types ), wp_get_mime_types() );
+        $allowed_mimes  = array_map( 'implode', $validate_mimes );
+
+        /**
+         * Include jpg type if needed so that bp_core_check_avatar_type()
+         * will check for jpeg and jpg extensions.
+         */
+        if ( isset( $allowed_mimes['jpeg'] ) ) {
+                $allowed_mimes['jpg'] = $allowed_mimes['jpeg'];
+        }
+
+        return $allowed_mimes;
+}
+
+/**
  * Does the current avatar upload have an allowed file type?
  *
  * Permitted file types are JPG, GIF and PNG.
@@ -969 +1016 @@
  * @param array $file The $_FILES array.
  * @return bool True if the file extension is permitted, otherwise false.
  */
-function bp_core_check_avatar_type($file) {
-        if ( ( !empty( $file['file']['type'] ) && !preg_match('/(jpe?g|gif|png)$/i', $file['file']['type'] ) ) || !preg_match( '/(jpe?g|gif|png)$/i', $file['file']['name'] ) )
-                return false;
+function bp_core_check_avatar_type( $file ) {
+        $avatar_filetype = wp_check_filetype_and_ext( $file['file']['tmp_name'], $file['file']['name'], bp_core_get_allowed_avatar_mimes() );
 
-        return true;
+        if ( ! empty( $avatar_filetype['ext'] ) && ! empty( $avatar_filetype['type'] ) ) {
+                return true;
+        }
+
+        return false;
 }
 
 /**

tests/phpunit/testcases/core/avatars.php

@@ -204 +204 @@
                 $classes = explode( ' ', $matches[1] );
                 $this->assertSame( $expected, array_intersect_key( $expected, $classes ) );
         }
+
+        /**
+         * @group bp_core_check_avatar_type
+         */
+        public function test_bp_core_check_avatar_type() {
+                $plugin_dir = trailingslashit( buddypress()->plugin_dir );
+
+                $file = array(
+                        'file' => array(
+                                'name' => 'humans.txt',
+                                'type' => 'text/plain',
+                                'tmp_name' => $plugin_dir . 'humans.txt',
+                        )
+                );
+
+                $this->assertFalse( bp_core_check_avatar_type( $file ) );
+
+                $file = array(
+                        'file' => array(
+                                'name' => 'mystery-man.jpg',
+                                'type' => 'image/jpeg',
+                                'tmp_name' => $plugin_dir . 'bp-core/images/mystery-man.jpg',
+                        )
+                );
+
+                $this->assertTrue( bp_core_check_avatar_type( $file ) );
+
+                $file = array(
+                        'file' => array(
+                                'name' => 'mystery-man.jpg',
+                                'type' => 'application/octet-stream',
+                                'tmp_name' => $plugin_dir . 'bp-core/images/mystery-man.jpg',
+                        )
+                );
+
+                $this->assertTrue( bp_core_check_avatar_type( $file ), 'flash is using application/octet-stream for image uploads' );
+        }
+
+        /**
+         * @group bp_core_check_avatar_type
+         * @group bp_core_get_allowed_avatar_types
+         */
+        public function test_bp_core_get_allowed_avatar_types_filter() {
+                add_filter( 'bp_core_get_allowed_avatar_types', array( $this, 'avatar_types_filter_add_type' ) );
+
+                $this->assertEquals( array( 'jpeg', 'gif', 'png' ), bp_core_get_allowed_avatar_types() );
+
+                remove_filter( 'bp_core_get_allowed_avatar_types', array( $this, 'avatar_types_filter_add_type' ) );
+
+                add_filter( 'bp_core_get_allowed_avatar_types', array( $this, 'avatar_types_filter_remove_type' ) );
+
+                $this->assertEquals( array( 'gif', 'png' ), bp_core_get_allowed_avatar_types() );
+
+                remove_filter( 'bp_core_get_allowed_avatar_types', array( $this, 'avatar_types_filter_remove_type' ) );
+
+                add_filter( 'bp_core_get_allowed_avatar_types', '__return_empty_array' );
+
+                $this->assertEquals( array( 'jpeg', 'gif', 'png' ), bp_core_get_allowed_avatar_types() );
+
+                remove_filter( 'bp_core_get_allowed_avatar_types', '__return_empty_array' );
+        }
+
+        /**
+         * @group bp_core_check_avatar_type
+         * @group bp_core_get_allowed_avatar_mimes
+         */
+        public function test_bp_core_get_allowed_avatar_mimes() {
+                $mimes = bp_core_get_allowed_avatar_mimes();
+
+                $this->assertEquals( array( 'jpeg', 'gif', 'png', 'jpg' ), array_keys( $mimes ) );
+                $this->assertEquals( array( 'image/jpeg', 'image/gif', 'image/png', 'image/jpeg' ), array_values( $mimes ) );
+
+                add_filter( 'bp_core_get_allowed_avatar_types', array( $this, 'avatar_types_filter_add_type' ) );
+
+                $this->assertEquals( array( 'image/jpeg', 'image/gif', 'image/png', 'image/jpeg' ), array_values( bp_core_get_allowed_avatar_mimes() ) );
+
+                remove_filter( 'bp_core_get_allowed_avatar_types', array( $this, 'avatar_types_filter_add_type' ) );
+
+                add_filter( 'bp_core_get_allowed_avatar_types', array( $this, 'avatar_types_filter_remove_type' ) );
+
+                $this->assertEquals( array( 'image/gif', 'image/png' ), array_values( bp_core_get_allowed_avatar_mimes() ) );
+
+                remove_filter( 'bp_core_get_allowed_avatar_types', array( $this, 'avatar_types_filter_remove_type' ) );
+
+                add_filter( 'bp_core_get_allowed_avatar_types', '__return_empty_array' );
+
+                $this->assertEquals( array( 'image/jpeg', 'image/gif', 'image/png', 'image/jpeg' ), array_values( bp_core_get_allowed_avatar_mimes() ) );
+
+                remove_filter( 'bp_core_get_allowed_avatar_types', '__return_empty_array' );
+        }
+
+        public function avatar_types_filter_add_type( $types ) {
+                $types[] = 'bmp';
+
+                return $types;
+        }
+
+        public function avatar_types_filter_remove_type( $types ) {
+                $jpeg = array_shift( $types );
+
+                return $types;
+        }
 }