Context Navigation

Changeset 3170401

Timestamp:

10/17/2024 01:31:12 AM (18 months ago)

Author:

suiteplugins

Message:

Committing 1.1.0 to trunk

Location:

gallery-for-ultimate-member/trunk

Files:

-                      r3116428
+                      r3170401
  * Plugin URI: https://suiteplugins.com/
  * Description: Allow your user to upload photos from their Ultimate Member profile
  * Version: 1.0.9
+ * Version: 1.1.0
  * Requires at least: 5.2
  * Requires PHP:      5.4
 …
 define( 'UM_GALLERY_LITE_PATH', plugin_dir_path( __FILE__ ) );
 define( 'UM_GALLERY_LITE_PLUGIN', plugin_basename( __FILE__ ) );
 define( 'UM_GALLERY_LITE_VERSION', '1.0.9' );
+define( 'UM_GALLERY_LITE_VERSION', '1.1.0' );
 require_once ABSPATH . 'wp-admin/includes/plugin.php';

-                      r3111398
+                      r3170401
                     // $file = um_gallery_fix_image_orientation( $_FILES );
+                    $file       = $_FILES['file'];
+                    $album_id   = (int) $_POST['album_id'];
+                    // Allowed file types includeing images and videos.
+                    $allowed_file_types = array( 'image/jpeg', 'image/png', 'image/gif', 'video/mp4', 'video/avi', 'video/mov' );
+                    if ( isset( $_FILES['file'] ) && ! empty( $_FILES['file']['name'] ) ) {
+                        $file = $_FILES['file'];
+                    } else {
+                        wp_send_json_error( array( 'message' => 'No file uploaded.' ) );
+                    }
+                    // Check if the file type is allowed
+                    if ( ! in_array( $file['type'], $allowed_file_types ) ) {
+                        wp_send_json_error( array( 'message' => 'File type not allowed.' ) );
+                    }
+                    $album_id   = isset( $_POST['album_id'] ) ? absint( $_POST['album_id'] ) : 0;
                     $tmp_file   = $file['tmp_name'];
                     $name       = sanitize_text_field( $file['name'] );

-                      r3116428
+                      r3170401
 Requires at least: 4.6
 Requires PHP: 5.4
 Tested up to: 6.6
 Stable tag: 1.0.9
+Tested up to: 6.6.2
+Stable tag: 1.1.0
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 …
 == Changelog ==
+= 1.1.0 =
+Fixed: Reported Security issue with file uploads
 = 1.0.9 =
 Fixed: Activation error caused by settings

Note: See TracChangeset for help on using the changeset viewer.