Changeset 3788934

Timestamp:

11/07/2026 02:13:32 AM (less than one hour ago)

Author:

addonsorg

Message:

Release new version

Location:

drag-and-drop-file-upload-for-elementor-forms

Files:

• tags/1.6.3 (added)
• tags/1.6.3/assets (added)
• tags/1.6.3/assets/css (added)
• tags/1.6.3/assets/css/drap_drop_file_upload.css (added)
• tags/1.6.3/assets/images (added)
• tags/1.6.3/assets/images/generic.png (added)
• tags/1.6.3/assets/images/remove.png (added)
• tags/1.6.3/assets/images/trash.png (added)
• tags/1.6.3/assets/js (added)
• tags/1.6.3/assets/js/admin-upload.js (added)
• tags/1.6.3/assets/js/drap_drop_file_upload.js (added)
• tags/1.6.3/drag-and-drop-file-upload-for-elementor-forms.php (added)
• tags/1.6.3/fields (added)
• tags/1.6.3/fields/dropbox.php (added)
• tags/1.6.3/fields/file_upload.php (added)
• tags/1.6.3/languages (added)
• tags/1.6.3/readme.txt (added)
• tags/1.6.3/yeekit (added)
• tags/1.6.3/yeekit/document.php (added)
• tags/1.6.3/yeekit/yeekit.css (added)
• tags/1.6.3/yeekit/yeekit.js (added)
• trunk/drag-and-drop-file-upload-for-elementor-forms.php (modified) (1 diff)
• trunk/fields/file_upload.php (modified) (3 diffs)
• trunk/readme.txt (modified) (2 diffs)

drag-and-drop-file-upload-for-elementor-forms/trunk/drag-and-drop-file-upload-for-elementor-forms.php

@@ -7 +7 @@
  * Author: add-ons.org
  * Author URI: https://add-ons.org/
- * Version: 1.6.2
+ * Version: 1.6.3
  * Requires PHP: 5.2
  * Elementor tested up to: 4.2

drag-and-drop-file-upload-for-elementor-forms/trunk/fields/file_upload.php

@@ -723 +723 @@
                 }
                 if ($field["raw_value"] != "") {
-                        $temp_dir = $this->get_temp_dir();
-                        $dir_upload = $this->get_ensure_upload_dir();
+                        $temp_dir = trailingslashit($this->get_temp_dir());
+                        $dir_upload = trailingslashit($this->get_ensure_upload_dir());
                         $files = explode("|", $field["raw_value"]);
                         $new_files = array();
                         $index = 0;
+                        global $wp_filesystem;
+                        if (empty($wp_filesystem)) {
+                                require_once ABSPATH . 'wp-admin/includes/file.php';
+                                WP_Filesystem();
+                        }
                         foreach ($files as $file) {
-                                $file_datas = explode("/", $file);
-                                $filename = end($file_datas);
+                                // Only accept a plain file name that was really uploaded to the temp folder
+                                $filename = $this->sanitize_submitted_filename($file);
+                                if ($filename === '') {
+                                        continue;
+                                }
                                 $temp_path = $temp_dir . $filename;
                                 $dest_path = $dir_upload . $filename;
-
-                                // Move file from temp to final uploads folder if it exists in temp
-                                global $wp_filesystem;
-                                if (empty($wp_filesystem)) {
-                                        require_once ABSPATH . 'wp-admin/includes/file.php';
-                                        WP_Filesystem();
-                                }
-                                if ($wp_filesystem->exists($temp_path)) {
-                                        $wp_filesystem->move($temp_path, $dest_path, true);
+                                if (!is_file($temp_path) || !$this->is_path_inside_dir($temp_path, $temp_dir)) {
+                                        continue;
+                                }
+                                // Never overwrite a file that is already in the uploads folder
+                                if (file_exists($dest_path)) {
+                                        continue;
+                                }
+                                if (!$wp_filesystem->move($temp_path, $dest_path, false) || !$this->is_path_inside_dir($dest_path, $dir_upload)) {
+                                        continue;
                                 }
 
@@ -773 +781 @@
                         }
 
+                        if (empty($new_files) && !empty($field['required'])) {
+                                $ajax_handler->add_error($id, esc_html__('Please upload the file again.', 'drag-and-drop-file-upload-for-elementor-forms'));
+                                return;
+                        }
                         // Update the field value in the record to use the permanent URLs
                         $new_raw_value = implode("|", $new_files);
@@ -835 +847 @@
         {
                 $attachments_mode_attach = $this->get_file_by_attachment_type_ok($settings['form_fields'], $record, "yes");
+                $upload_dir = $this->get_upload_dir();
                 foreach ($attachments_mode_attach as $file) {
-                        @wp_delete_file($file);
-                }
+                        if (!is_string($file) || $this->is_protected_filename(basename($file))) {
+                                continue;
+                        }
+                        if (is_file($file) && $this->is_path_inside_dir($file, $upload_dir)) {
+                                @wp_delete_file(realpath($file));
+                        }
+                }
+        }
+        /**
+         * Turns a submitted field token (temp URL or file name) into a safe plain file name.
+         * Returns '' when the token cannot be a file uploaded by this field.
+         */
+        private function sanitize_submitted_filename($value)
+        {
+                $value = trim(rawurldecode((string) $value));
+                if ($value === '') {
+                        return '';
+                }
+                // Handle both separators so Windows paths cannot traverse directories
+                $value = str_replace('\\', '/', $value);
+                $value = strtok($value, '?#');
+                $filename = sanitize_file_name(wp_basename((string) $value));
+                if ($filename === '' || $filename[0] === '.' || $this->is_protected_filename($filename)) {
+                        return '';
+                }
+                return $filename;
+        }
+        private function is_protected_filename($filename)
+        {
+                $protected_files = array('.htaccess', 'index.php', 'index.html', 'php.ini', '.user.ini', 'web.config');
+                return in_array(strtolower((string) $filename), $protected_files, true);
+        }
+        /**
+         * True when $path resolves to a location inside $dir.
+         */
+        private function is_path_inside_dir($path, $dir)
+        {
+                $real_path = realpath($path);
+                $real_dir = realpath($dir);
+                if ($real_path === false || $real_dir === false) {
+                        return false;
+                }
+                return strpos($real_path, trailingslashit($real_dir)) === 0;
         }
         private function get_file_by_attachment_type_ok($form_fields, $record, $type)

drag-and-drop-file-upload-for-elementor-forms/trunk/readme.txt

@@ -2 +2 @@
 Contributors: addonsorg
 Tags: Elementor Forms, File field, Elementor Forms upload, uploads, uploads field
-Stable tag: 1.6.2
+Stable tag: 1.6.3
 Tested up to: 7.1
 Requires PHP: 5.2
@@ -60 +60 @@
 
 == Changelog ==
+= 1.6.3 =
+- Security: Form submissions now only accept files that were really uploaded through the field. Submitted file names are sanitized and confined to the upload folder, existing files are never overwritten, and the "files are not saved on the server" cleanup can only delete files inside the upload folder.
+
 = 1.6.0 =
 - Fixed: Create a temporary upload directory and automatically delete its contents daily to prevent unnecessary files from accumulating on the server.