file.php 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443
  1. <?php
  2. /**
  3. ** A base module for [file] and [file*]
  4. **/
  5. /* form_tag handler */
  6. add_action( 'wpcf7_init', 'wpcf7_add_form_tag_file', 10, 0 );
  7. function wpcf7_add_form_tag_file() {
  8. wpcf7_add_form_tag( array( 'file', 'file*' ),
  9. 'wpcf7_file_form_tag_handler', array( 'name-attr' => true ) );
  10. }
  11. function wpcf7_file_form_tag_handler( $tag ) {
  12. if ( empty( $tag->name ) ) {
  13. return '';
  14. }
  15. $validation_error = wpcf7_get_validation_error( $tag->name );
  16. $class = wpcf7_form_controls_class( $tag->type );
  17. if ( $validation_error ) {
  18. $class .= ' wpcf7-not-valid';
  19. }
  20. $atts = array();
  21. $atts['size'] = $tag->get_size_option( '40' );
  22. $atts['class'] = $tag->get_class_option( $class );
  23. $atts['id'] = $tag->get_id_option();
  24. $atts['tabindex'] = $tag->get_option( 'tabindex', 'signed_int', true );
  25. $atts['accept'] = wpcf7_acceptable_filetypes(
  26. $tag->get_option( 'filetypes' ), 'attr' );
  27. if ( $tag->is_required() ) {
  28. $atts['aria-required'] = 'true';
  29. }
  30. $atts['aria-invalid'] = $validation_error ? 'true' : 'false';
  31. $atts['type'] = 'file';
  32. $atts['name'] = $tag->name;
  33. $atts = wpcf7_format_atts( $atts );
  34. $html = sprintf(
  35. '<span class="wpcf7-form-control-wrap %1$s"><input %2$s />%3$s</span>',
  36. sanitize_html_class( $tag->name ), $atts, $validation_error );
  37. return $html;
  38. }
  39. /* Encode type filter */
  40. add_filter( 'wpcf7_form_enctype', 'wpcf7_file_form_enctype_filter', 10, 1 );
  41. function wpcf7_file_form_enctype_filter( $enctype ) {
  42. $multipart = (bool) wpcf7_scan_form_tags(
  43. array( 'type' => array( 'file', 'file*' ) ) );
  44. if ( $multipart ) {
  45. $enctype = 'multipart/form-data';
  46. }
  47. return $enctype;
  48. }
  49. /* Validation + upload handling filter */
  50. add_filter( 'wpcf7_validate_file', 'wpcf7_file_validation_filter', 10, 2 );
  51. add_filter( 'wpcf7_validate_file*', 'wpcf7_file_validation_filter', 10, 2 );
  52. function wpcf7_file_validation_filter( $result, $tag ) {
  53. $name = $tag->name;
  54. $id = $tag->get_id_option();
  55. $file = isset( $_FILES[$name] ) ? $_FILES[$name] : null;
  56. if ( $file['error'] and UPLOAD_ERR_NO_FILE != $file['error'] ) {
  57. $result->invalidate( $tag, wpcf7_get_message( 'upload_failed_php_error' ) );
  58. return $result;
  59. }
  60. if ( empty( $file['tmp_name'] ) and $tag->is_required() ) {
  61. $result->invalidate( $tag, wpcf7_get_message( 'invalid_required' ) );
  62. return $result;
  63. }
  64. if ( ! is_uploaded_file( $file['tmp_name'] ) ) {
  65. return $result;
  66. }
  67. /* File type validation */
  68. $file_type_pattern = wpcf7_acceptable_filetypes(
  69. $tag->get_option( 'filetypes' ), 'regex' );
  70. $file_type_pattern = '/\.(' . $file_type_pattern . ')$/i';
  71. if ( ! preg_match( $file_type_pattern, $file['name'] ) ) {
  72. $result->invalidate( $tag,
  73. wpcf7_get_message( 'upload_file_type_invalid' ) );
  74. return $result;
  75. }
  76. /* File size validation */
  77. $allowed_size = $tag->get_limit_option();
  78. if ( $allowed_size < $file['size'] ) {
  79. $result->invalidate( $tag, wpcf7_get_message( 'upload_file_too_large' ) );
  80. return $result;
  81. }
  82. wpcf7_init_uploads(); // Confirm upload dir
  83. $uploads_dir = wpcf7_upload_tmp_dir();
  84. $uploads_dir = wpcf7_maybe_add_random_dir( $uploads_dir );
  85. $filename = $file['name'];
  86. $filename = wpcf7_canonicalize( $filename, 'as-is' );
  87. $filename = wpcf7_antiscript_file_name( $filename );
  88. $filename = apply_filters( 'wpcf7_upload_file_name', $filename,
  89. $file['name'], $tag );
  90. $filename = wp_unique_filename( $uploads_dir, $filename );
  91. $new_file = path_join( $uploads_dir, $filename );
  92. if ( false === @move_uploaded_file( $file['tmp_name'], $new_file ) ) {
  93. $result->invalidate( $tag, wpcf7_get_message( 'upload_failed' ) );
  94. return $result;
  95. }
  96. // Make sure the uploaded file is only readable for the owner process
  97. chmod( $new_file, 0400 );
  98. if ( $submission = WPCF7_Submission::get_instance() ) {
  99. $submission->add_uploaded_file( $name, $new_file );
  100. }
  101. return $result;
  102. }
  103. /* Messages */
  104. add_filter( 'wpcf7_messages', 'wpcf7_file_messages', 10, 1 );
  105. function wpcf7_file_messages( $messages ) {
  106. return array_merge( $messages, array(
  107. 'upload_failed' => array(
  108. 'description' => __( "Uploading a file fails for any reason", 'contact-form-7' ),
  109. 'default' => __( "There was an unknown error uploading the file.", 'contact-form-7' )
  110. ),
  111. 'upload_file_type_invalid' => array(
  112. 'description' => __( "Uploaded file is not allowed for file type", 'contact-form-7' ),
  113. 'default' => __( "You are not allowed to upload files of this type.", 'contact-form-7' )
  114. ),
  115. 'upload_file_too_large' => array(
  116. 'description' => __( "Uploaded file is too large", 'contact-form-7' ),
  117. 'default' => __( "The file is too big.", 'contact-form-7' )
  118. ),
  119. 'upload_failed_php_error' => array(
  120. 'description' => __( "Uploading a file fails for PHP error", 'contact-form-7' ),
  121. 'default' => __( "There was an error uploading the file.", 'contact-form-7' )
  122. )
  123. ) );
  124. }
  125. /* Tag generator */
  126. add_action( 'wpcf7_admin_init', 'wpcf7_add_tag_generator_file', 50, 0 );
  127. function wpcf7_add_tag_generator_file() {
  128. $tag_generator = WPCF7_TagGenerator::get_instance();
  129. $tag_generator->add( 'file', __( 'file', 'contact-form-7' ),
  130. 'wpcf7_tag_generator_file' );
  131. }
  132. function wpcf7_tag_generator_file( $contact_form, $args = '' ) {
  133. $args = wp_parse_args( $args, array() );
  134. $type = 'file';
  135. $description = __( "Generate a form-tag for a file uploading field. For more details, see %s.", 'contact-form-7' );
  136. $desc_link = wpcf7_link( __( 'https://contactform7.com/file-uploading-and-attachment/', 'contact-form-7' ), __( 'File Uploading and Attachment', 'contact-form-7' ) );
  137. ?>
  138. <div class="control-box">
  139. <fieldset>
  140. <legend><?php echo sprintf( esc_html( $description ), $desc_link ); ?></legend>
  141. <table class="form-table">
  142. <tbody>
  143. <tr>
  144. <th scope="row"><?php echo esc_html( __( 'Field type', 'contact-form-7' ) ); ?></th>
  145. <td>
  146. <fieldset>
  147. <legend class="screen-reader-text"><?php echo esc_html( __( 'Field type', 'contact-form-7' ) ); ?></legend>
  148. <label><input type="checkbox" name="required" /> <?php echo esc_html( __( 'Required field', 'contact-form-7' ) ); ?></label>
  149. </fieldset>
  150. </td>
  151. </tr>
  152. <tr>
  153. <th scope="row"><label for="<?php echo esc_attr( $args['content'] . '-name' ); ?>"><?php echo esc_html( __( 'Name', 'contact-form-7' ) ); ?></label></th>
  154. <td><input type="text" name="name" class="tg-name oneline" id="<?php echo esc_attr( $args['content'] . '-name' ); ?>" /></td>
  155. </tr>
  156. <tr>
  157. <th scope="row"><label for="<?php echo esc_attr( $args['content'] . '-limit' ); ?>"><?php echo esc_html( __( "File size limit (bytes)", 'contact-form-7' ) ); ?></label></th>
  158. <td><input type="text" name="limit" class="filesize oneline option" id="<?php echo esc_attr( $args['content'] . '-limit' ); ?>" /></td>
  159. </tr>
  160. <tr>
  161. <th scope="row"><label for="<?php echo esc_attr( $args['content'] . '-filetypes' ); ?>"><?php echo esc_html( __( 'Acceptable file types', 'contact-form-7' ) ); ?></label></th>
  162. <td><input type="text" name="filetypes" class="filetype oneline option" id="<?php echo esc_attr( $args['content'] . '-filetypes' ); ?>" /></td>
  163. </tr>
  164. <tr>
  165. <th scope="row"><label for="<?php echo esc_attr( $args['content'] . '-id' ); ?>"><?php echo esc_html( __( 'Id attribute', 'contact-form-7' ) ); ?></label></th>
  166. <td><input type="text" name="id" class="idvalue oneline option" id="<?php echo esc_attr( $args['content'] . '-id' ); ?>" /></td>
  167. </tr>
  168. <tr>
  169. <th scope="row"><label for="<?php echo esc_attr( $args['content'] . '-class' ); ?>"><?php echo esc_html( __( 'Class attribute', 'contact-form-7' ) ); ?></label></th>
  170. <td><input type="text" name="class" class="classvalue oneline option" id="<?php echo esc_attr( $args['content'] . '-class' ); ?>" /></td>
  171. </tr>
  172. </tbody>
  173. </table>
  174. </fieldset>
  175. </div>
  176. <div class="insert-box">
  177. <input type="text" name="<?php echo $type; ?>" class="tag code" readonly="readonly" onfocus="this.select()" />
  178. <div class="submitbox">
  179. <input type="button" class="button button-primary insert-tag" value="<?php echo esc_attr( __( 'Insert Tag', 'contact-form-7' ) ); ?>" />
  180. </div>
  181. <br class="clear" />
  182. <p class="description mail-tag"><label for="<?php echo esc_attr( $args['content'] . '-mailtag' ); ?>"><?php echo sprintf( esc_html( __( "To attach the file uploaded through this field to mail, you need to insert the corresponding mail-tag (%s) into the File Attachments field on the Mail tab.", 'contact-form-7' ) ), '<strong><span class="mail-tag"></span></strong>' ); ?><input type="text" class="mail-tag code hidden" readonly="readonly" id="<?php echo esc_attr( $args['content'] . '-mailtag' ); ?>" /></label></p>
  183. </div>
  184. <?php
  185. }
  186. /* Warning message */
  187. add_action( 'wpcf7_admin_warnings',
  188. 'wpcf7_file_display_warning_message', 10, 3 );
  189. function wpcf7_file_display_warning_message( $page, $action, $object ) {
  190. if ( $object instanceof WPCF7_ContactForm ) {
  191. $contact_form = $object;
  192. } else {
  193. return;
  194. }
  195. $has_tags = (bool) $contact_form->scan_form_tags(
  196. array( 'type' => array( 'file', 'file*' ) ) );
  197. if ( ! $has_tags ) {
  198. return;
  199. }
  200. $uploads_dir = wpcf7_upload_tmp_dir();
  201. wpcf7_init_uploads();
  202. if ( ! is_dir( $uploads_dir )
  203. or ! wp_is_writable( $uploads_dir ) ) {
  204. $message = sprintf( __( 'This contact form contains file uploading fields, but the temporary folder for the files (%s) does not exist or is not writable. You can create the folder or change its permission manually.', 'contact-form-7' ), $uploads_dir );
  205. echo sprintf( '<div class="notice notice-warning"><p>%s</p></div>',
  206. esc_html( $message ) );
  207. }
  208. }
  209. /* File uploading functions */
  210. function wpcf7_acceptable_filetypes( $types = 'default', $format = 'regex' ) {
  211. if ( 'default' === $types
  212. or empty( $types ) ) {
  213. $types = array(
  214. 'jpg',
  215. 'jpeg',
  216. 'png',
  217. 'gif',
  218. 'pdf',
  219. 'doc',
  220. 'docx',
  221. 'ppt',
  222. 'pptx',
  223. 'odt',
  224. 'avi',
  225. 'ogg',
  226. 'm4a',
  227. 'mov',
  228. 'mp3',
  229. 'mp4',
  230. 'mpg',
  231. 'wav',
  232. 'wmv',
  233. );
  234. } else {
  235. $types_tmp = (array) $types;
  236. $types = array();
  237. foreach ( $types_tmp as $val ) {
  238. if ( is_string( $val ) ) {
  239. $val = preg_split( '/[\s|,]+/', $val );
  240. }
  241. $types = array_merge( $types, (array) $val );
  242. }
  243. }
  244. $types = array_unique( array_filter( $types ) );
  245. $output = '';
  246. foreach ( $types as $type ) {
  247. $type = trim( $type, ' ,.|' );
  248. $type = str_replace(
  249. array( '.', '+', '*', '?' ),
  250. array( '\.', '\+', '\*', '\?' ),
  251. $type );
  252. if ( '' === $type ) {
  253. continue;
  254. }
  255. if ( 'attr' === $format
  256. or 'attribute' === $format ) {
  257. $output .= sprintf( '.%s', $type );
  258. $output .= ',';
  259. } else {
  260. $output .= $type;
  261. $output .= '|';
  262. }
  263. }
  264. return trim( $output, ' ,|' );
  265. }
  266. function wpcf7_init_uploads() {
  267. $dir = wpcf7_upload_tmp_dir();
  268. wp_mkdir_p( $dir );
  269. $htaccess_file = path_join( $dir, '.htaccess' );
  270. if ( file_exists( $htaccess_file ) ) {
  271. return;
  272. }
  273. if ( $handle = fopen( $htaccess_file, 'w' ) ) {
  274. fwrite( $handle, "Deny from all\n" );
  275. fclose( $handle );
  276. }
  277. }
  278. function wpcf7_maybe_add_random_dir( $dir ) {
  279. do {
  280. $rand_max = mt_getrandmax();
  281. $rand = zeroise( mt_rand( 0, $rand_max ), strlen( $rand_max ) );
  282. $dir_new = path_join( $dir, $rand );
  283. } while ( file_exists( $dir_new ) );
  284. if ( wp_mkdir_p( $dir_new ) ) {
  285. return $dir_new;
  286. }
  287. return $dir;
  288. }
  289. function wpcf7_upload_tmp_dir() {
  290. if ( defined( 'WPCF7_UPLOADS_TMP_DIR' ) ) {
  291. return WPCF7_UPLOADS_TMP_DIR;
  292. } else {
  293. return path_join( wpcf7_upload_dir( 'dir' ), 'wpcf7_uploads' );
  294. }
  295. }
  296. add_action( 'template_redirect', 'wpcf7_cleanup_upload_files', 20, 0 );
  297. function wpcf7_cleanup_upload_files( $seconds = 60, $max = 100 ) {
  298. if ( is_admin()
  299. or 'GET' != $_SERVER['REQUEST_METHOD']
  300. or is_robots()
  301. or is_feed()
  302. or is_trackback() ) {
  303. return;
  304. }
  305. $dir = trailingslashit( wpcf7_upload_tmp_dir() );
  306. if ( ! is_dir( $dir )
  307. or ! is_readable( $dir )
  308. or ! wp_is_writable( $dir ) ) {
  309. return;
  310. }
  311. $seconds = absint( $seconds );
  312. $max = absint( $max );
  313. $count = 0;
  314. if ( $handle = opendir( $dir ) ) {
  315. while ( false !== ( $file = readdir( $handle ) ) ) {
  316. if ( '.' == $file
  317. or '..' == $file
  318. or '.htaccess' == $file ) {
  319. continue;
  320. }
  321. $mtime = @filemtime( path_join( $dir, $file ) );
  322. if ( $mtime and time() < $mtime + $seconds ) { // less than $seconds old
  323. continue;
  324. }
  325. wpcf7_rmdir_p( path_join( $dir, $file ) );
  326. $count += 1;
  327. if ( $max <= $count ) {
  328. break;
  329. }
  330. }
  331. closedir( $handle );
  332. }
  333. }