Eine auf WordPress spezialiserte Suchmaschine für Entwickler und Theme-Autoren



validate_file ›

Seit1.2.0
Veraltetn/v
validate_file ( $file, $allowed_files = array() )
Parameter: (2)
  • (string) $file File path.
    Erforderlich: Ja
  • (array) $allowed_files Optional. List of allowed files.
    Erforderlich: Nein
    Standard: array()
Gibt zurück:
  • (int) 0 means nothing is wrong, greater than 0 means something was wrong.
Definiert in:
Codex:

Validates a file name and path against an allowed set of rules.

A return value of 1 means the file path contains directory traversal.

A return value of 2 means the file path contains a Windows drive path.

A return value of 3 means the file is not in the allowed files list.



Quellcode

function validate_file( $file, $allowed_files = array() ) {
	// `../` on its own is not allowed:
	if ( '../' === $file ) {
		return 1;
	}

	// More than one occurence of `../` is not allowed:
	if ( preg_match_all( '#\.\./#', $file, $matches, PREG_SET_ORDER ) && ( count( $matches ) > 1 ) ) {
		return 1;
	}

	// `../` which does not occur at the end of the path is not allowed:
	if ( false !== strpos( $file, '../' ) && '../' !== mb_substr( $file, -3, 3 ) ) {
		return 1;
	}

	// Files not in the allowed file list are not allowed:
	if ( ! empty( $allowed_files ) && ! in_array( $file, $allowed_files ) )
		return 3;

	// Absolute Windows drive paths are not allowed:
	if (':' == substr( $file, 1, 1 ) )
		return 2;

	return 0;
}