<?php

[0] Fix | Delete

declare( strict_types = 1 );

[1] Fix | Delete

[2] Fix | Delete

namespace Automattic\WooCommerce\Internal\Utilities;

[3] Fix | Delete

[4] Fix | Delete

use Automattic\Jetpack\Constants;

[5] Fix | Delete

use Automattic\WooCommerce\Proxies\LegacyProxy;

[6] Fix | Delete

use Exception;

[7] Fix | Delete

use WP_Filesystem_Base;

[8] Fix | Delete

[9] Fix | Delete

/**

[10] Fix | Delete

* FilesystemUtil class.

[11] Fix | Delete

*/

[12] Fix | Delete

class FilesystemUtil {

[13] Fix | Delete

/**

[14] Fix | Delete

* Wrapper to retrieve the class instance contained in the $wp_filesystem global, after initializing if necessary.

[15] Fix | Delete

*

[16] Fix | Delete

* @return WP_Filesystem_Base

[17] Fix | Delete

* @throws Exception Thrown when the filesystem fails to initialize.

[18] Fix | Delete

*/

[19] Fix | Delete

public static function get_wp_filesystem(): WP_Filesystem_Base {

[20] Fix | Delete

global $wp_filesystem;

[21] Fix | Delete

[22] Fix | Delete

if ( ! $wp_filesystem instanceof WP_Filesystem_Base ) {

[23] Fix | Delete

$initialized = self::initialize_wp_filesystem();

[24] Fix | Delete

[25] Fix | Delete

if ( false === $initialized ) {

[26] Fix | Delete

throw new Exception( 'The WordPress filesystem could not be initialized.' );

[27] Fix | Delete

}

[28] Fix | Delete

}

[29] Fix | Delete

[30] Fix | Delete

return $wp_filesystem;

[31] Fix | Delete

}

[32] Fix | Delete

[33] Fix | Delete

/**

[34] Fix | Delete

* Get the WP filesystem method, with a fallback to 'direct' if no FS_METHOD constant exists and there are not FTP related options/credentials set.

[35] Fix | Delete

*

[36] Fix | Delete

* @return string|false The name of the WP filesystem method to use.

[37] Fix | Delete

*/

[38] Fix | Delete

public static function get_wp_filesystem_method_or_direct() {

[39] Fix | Delete

$proxy = wc_get_container()->get( LegacyProxy::class );

[40] Fix | Delete

if ( ! self::constant_exists( 'FS_METHOD' ) && false === $proxy->call_function( 'get_option', 'ftp_credentials' ) && ! self::constant_exists( 'FTP_HOST' ) ) {

[41] Fix | Delete

return 'direct';

[42] Fix | Delete

}

[43] Fix | Delete

[44] Fix | Delete

$method = $proxy->call_function( 'get_filesystem_method' );

[45] Fix | Delete

if ( $method ) {

[46] Fix | Delete

return $method;

[47] Fix | Delete

}

[48] Fix | Delete

[49] Fix | Delete

return 'direct';

[50] Fix | Delete

}

[51] Fix | Delete

[52] Fix | Delete

/**

[53] Fix | Delete

* Check if a constant exists and is not null.

[54] Fix | Delete

*

[55] Fix | Delete

* @param string $name Constant name.

[56] Fix | Delete

* @return bool True if the constant exists and its value is not null.

[57] Fix | Delete

*/

[58] Fix | Delete

private static function constant_exists( string $name ): bool {

[59] Fix | Delete

return Constants::is_defined( $name ) && ! is_null( Constants::get_constant( $name ) );

[60] Fix | Delete

}

[61] Fix | Delete

[62] Fix | Delete

/**

[63] Fix | Delete

* Recursively creates a directory (if it doesn't exist) and adds an empty index.html and a .htaccess to prevent

[64] Fix | Delete

* directory listing.

[65] Fix | Delete

*

[66] Fix | Delete

* @since 9.3.0

[67] Fix | Delete

*

[68] Fix | Delete

* @param string $path Directory to create.

[69] Fix | Delete

* @throws \Exception In case of error.

[70] Fix | Delete

*/

[71] Fix | Delete

public static function mkdir_p_not_indexable( string $path ): void {

[72] Fix | Delete

$wp_fs = self::get_wp_filesystem();

[73] Fix | Delete

[74] Fix | Delete

if ( $wp_fs->is_dir( $path ) ) {

[75] Fix | Delete

return;

[76] Fix | Delete

}

[77] Fix | Delete

[78] Fix | Delete

if ( ! wp_mkdir_p( $path ) ) {

[79] Fix | Delete

throw new \Exception( esc_html( sprintf( 'Could not create directory: %s.', wp_basename( $path ) ) ) );

[80] Fix | Delete

}

[81] Fix | Delete

[82] Fix | Delete

$files = array(

[83] Fix | Delete

'.htaccess' => 'deny from all',

[84] Fix | Delete

'index.html' => '',

[85] Fix | Delete

);

[86] Fix | Delete

[87] Fix | Delete

foreach ( $files as $name => $content ) {

[88] Fix | Delete

$wp_fs->put_contents( trailingslashit( $path ) . $name, $content );

[89] Fix | Delete

}

[90] Fix | Delete

}

[91] Fix | Delete

[92] Fix | Delete

/**

[93] Fix | Delete

* Wrapper to initialize the WP filesystem with defined credentials if they are available.

[94] Fix | Delete

*

[95] Fix | Delete

* @return bool True if the $wp_filesystem global was successfully initialized.

[96] Fix | Delete

*/

[97] Fix | Delete

protected static function initialize_wp_filesystem(): bool {

[98] Fix | Delete

global $wp_filesystem;

[99] Fix | Delete

[100] Fix | Delete

if ( $wp_filesystem instanceof WP_Filesystem_Base ) {

[101] Fix | Delete

return true;

[102] Fix | Delete

}

[103] Fix | Delete

[104] Fix | Delete

require_once ABSPATH . 'wp-admin/includes/file.php';

[105] Fix | Delete

[106] Fix | Delete

$method = self::get_wp_filesystem_method_or_direct();

[107] Fix | Delete

$initialized = false;

[108] Fix | Delete

[109] Fix | Delete

if ( 'direct' === $method ) {

[110] Fix | Delete

$initialized = WP_Filesystem();

[111] Fix | Delete

} elseif ( false !== $method ) {

[112] Fix | Delete

// See https://core.trac.wordpress.org/changeset/56341.

[113] Fix | Delete

ob_start();

[114] Fix | Delete

$credentials = request_filesystem_credentials( '' );

[115] Fix | Delete

ob_end_clean();

[116] Fix | Delete

[117] Fix | Delete

$initialized = $credentials && WP_Filesystem( $credentials );

[118] Fix | Delete

}

[119] Fix | Delete

[120] Fix | Delete

return is_null( $initialized ) ? false : $initialized;

[121] Fix | Delete

}

[122] Fix | Delete

[123] Fix | Delete

/**

[124] Fix | Delete

* Validate that a file path is a valid upload path.

[125] Fix | Delete

*

[126] Fix | Delete

* @param string $path The path to validate.

[127] Fix | Delete

* @throws \Exception If the file path is not a valid upload path.

[128] Fix | Delete

*/

[129] Fix | Delete

public static function validate_upload_file_path( string $path ): void {

[130] Fix | Delete

$wp_filesystem = self::get_wp_filesystem();

[131] Fix | Delete

[132] Fix | Delete

// File must exist and be readable.

[133] Fix | Delete

$is_valid_file = $wp_filesystem->is_readable( $path );

[134] Fix | Delete

[135] Fix | Delete

// Check that file is within an allowed location.

[136] Fix | Delete

if ( $is_valid_file ) {

[137] Fix | Delete

$is_valid_file = self::file_is_in_directory( $path, $wp_filesystem->abspath() );

[138] Fix | Delete

if ( ! $is_valid_file ) {

[139] Fix | Delete

$upload_dir = wp_get_upload_dir();

[140] Fix | Delete

$is_valid_file = false === $upload_dir['error'] && self::file_is_in_directory( $path, $upload_dir['basedir'] );

[141] Fix | Delete

}

[142] Fix | Delete

}

[143] Fix | Delete

[144] Fix | Delete

if ( ! $is_valid_file ) {

[145] Fix | Delete

throw new \Exception( esc_html__( 'File path is not a valid upload path.', 'woocommerce' ) );

[146] Fix | Delete

}

[147] Fix | Delete

}

[148] Fix | Delete

[149] Fix | Delete

/**

[150] Fix | Delete

* Check if a given file is inside a given directory.

[151] Fix | Delete

*

[152] Fix | Delete

* @param string $file_path The full path of the file to check.

[153] Fix | Delete

* @param string $directory The path of the directory to check.

[154] Fix | Delete

* @return bool True if the file is inside the directory.

[155] Fix | Delete

*/

[156] Fix | Delete

private static function file_is_in_directory( string $file_path, string $directory ): bool {

[157] Fix | Delete

// Extract protocol if it exists.

[158] Fix | Delete

$protocol = '';

[159] Fix | Delete

if ( preg_match( '#^([a-z0-9]+://)#i', $file_path, $matches ) ) {

[160] Fix | Delete

$protocol = $matches[1];

[161] Fix | Delete

$file_path = preg_replace( '#^[a-z0-9]+://#i', '', $file_path );

[162] Fix | Delete

}

[163] Fix | Delete

[164] Fix | Delete

$file_path = (string) new URL( $file_path ); // This resolves '/../' sequences.

[165] Fix | Delete

$file_path = preg_replace( '/^file:\\/\\//', $protocol, $file_path );

[166] Fix | Delete

$file_path = preg_replace( '/^file:\\/\\//', '', $file_path );

[167] Fix | Delete

[168] Fix | Delete

return 0 === stripos( wp_normalize_path( $file_path ), trailingslashit( wp_normalize_path( $directory ) ) );

[169] Fix | Delete

}

[170] Fix | Delete

}

[171] Fix | Delete

[172] Fix | Delete