Changeset 9660

Timestamp:

03/29/2015 06:25:35 PM (11 years ago)

Author:

imath

Message:

Improve the BP_Attachment class

• abstract the BP_Attachment class, so it must be extended,
• avoid using get_class_vars( __CLASS__ ) to get the default values in the constructor,
• sanitize the base_dir if set,
• make sure the action and file_input parameters are sanitized,
• use a is_dir() check instead of a file_exists() one when checking if the upload_path exists,
• use bp_parse_args() in the BP_Attachment->crop() method and include a filter,
• improve code formatting.

Props DJPaul

See #6278

Location:

trunk/src/bp-core/classes

Files:

• class-bp-attachment-avatar.php (modified) (1 diff)
• class-bp-attachment.php (modified) (7 diffs)

trunk/src/bp-core/classes/class-bp-attachment-avatar.php

@@ -86 +86 @@
 
                 // File is of invalid type
-                } else if ( ! bp_core_check_avatar_type( array( 'file' => $file ) ) ) {
+                } elseif ( ! bp_core_check_avatar_type( array( 'file' => $file ) ) ) {
                         $file['error'] = 10;
                 }

trunk/src/bp-core/classes/class-bp-attachment.php

@@ -17 +17 @@
  * @since BuddyPress (2.3.0)
  */
-class BP_Attachment {
+abstract class BP_Attachment {
 
         /** Upload properties *****************************************************/
@@ -29 +29 @@
 
         /**
-         * Maximum file size in kilobytes
-         *
-         * @var int
-         */
-        public $original_max_filesize = 0;
-
-        /**
-         * List of allowed file extensions
-         * Defaults to get_allowed_mime_types()
-         *
-         * @var int
-         */
-        public $allowed_mime_types = array();
-
-        /**
-         * component's upload base directory.
-         *
-         * @var string
-         */
-        public $base_dir = '';
-
-        /**
-         * The upload action.
-         *
-         * @var string
-         */
-        public $action = '';
-
-        /**
-         * The file input name attribute
-         *
-         * @var string
-         */
-        public $file_input = '';
-
-        /**
-         * List of upload errors.
+         * The default args to be merged with the
+         * ones passed by the child class
          *
          * @var array
          */
-        public $upload_error_strings = array();
-
-        /**
-         * List of required core files
-         *
-         * @var array
-         */
-        public $required_wp_files = array( 'file' );
+        protected $default_args = array(
+                'original_max_filesize' => 0,
+                'allowed_mime_types'    => array(),
+                'base_dir'              => '',
+                'action'                => '',
+                'file_input'            => '',
+                'upload_error_strings'  => array(),
+                'required_wp_files'     => array( 'file' ),
+        );
 
         /**
@@ -114 +80 @@
                  * a multisite config, the root site fileupload_maxk option
                  */
-                $this->original_max_filesize = (int) wp_max_upload_size();
-
-                $params = bp_parse_args( $args, get_class_vars( __CLASS__ ), $this->action . '_upload_params' );
+                $this->default_args['original_max_filesize'] = (int) wp_max_upload_size();
+
+                $params = bp_parse_args( $args, $this->default_args, $this->action . '_upload_params' );
 
                 foreach ( $params as $key => $param ) {
                         if ( 'upload_error_strings' === $key ) {
                                 $this->{$key} = $this->set_upload_error_strings( $param );
-                        } else {
+
+                        // Sanitize the base dir
+                        } elseif ( 'base_dir' === $key ) {
+                                $this->{$key} = sanitize_title( $param );
+
+                        // Action & File input are already set and sanitized
+                        } elseif ( 'action' !== $key && 'file_input' !== $key ) {
                                 $this->{$key} = $param;
                         }
@@ -316 +288 @@
                 foreach ( (array) $this->allowed_mime_types as $ext ) {
                         foreach ( $wp_mimes as $ext_pattern => $mime ) {
-                                if ( $ext != '' && strpos( $ext_pattern, $ext ) !== false ) {
+                                if ( $ext !== '' && strpos( $ext_pattern, $ext ) !== false ) {
                                         $valid_mimes[$ext_pattern] = $mime;
                                 }
@@ -396 +368 @@
 
                 // Check if upload path already exists
-                if ( ! file_exists( $this->upload_path ) ) {
+                if ( ! is_dir( $this->upload_path ) ) {
 
                         // If path does not exist, attempt to create it
@@ -430 +402 @@
                 $wp_error = new WP_Error();
 
-                $r = wp_parse_args( $args, array(
+                $r = bp_parse_args( $args, array(
                         'original_file' => '',
                         'crop_x'        => 0,
@@ -440 +412 @@
                         'src_abs'       => false,
                         'dst_file'      => false,
-                ) );
+                ), 'bp_attachment_crop_args' );
 
                 if ( empty( $r['original_file'] ) || ! file_exists( $r['original_file'] ) ) {