<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[12508] sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory: Plugin Directory: Allow plugin reviewers to generate a one-time-use token to bypass certain upload restrictions (Trademarks and Active Installs).</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { white-space: pre-line; overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta" style="font-size: 105%">
<dt style="float: left; width: 6em; font-weight: bold">Revision</dt> <dd><a style="font-weight: bold" href="http://meta.trac.wordpress.org/changeset/12508">12508</a><script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"Review this Commit","action":{"@type":"ViewAction","url":"http://meta.trac.wordpress.org/changeset/12508","name":"Review Commit"}}</script></dd>
<dt style="float: left; width: 6em; font-weight: bold">Author</dt> <dd>dd32</dd>
<dt style="float: left; width: 6em; font-weight: bold">Date</dt> <dd>2023-03-29 08:36:13 +0000 (Wed, 29 Mar 2023)</dd>
</dl>
<pre style='padding-left: 1em; margin: 2em 0; border-left: 2px solid #ccc; line-height: 1.25; font-size: 105%; font-family: sans-serif'>Plugin Directory: Allow plugin reviewers to generate a one-time-use token to bypass certain upload restrictions (Trademarks and Active Installs).
This allows for plugin authors to submit plugins that would be otherwise rejected by the upload form, without requiring manual work-arounds.
These tokens are user-specific, and one time use only.
See <a href="http://meta.trac.wordpress.org/ticket/6864">#6864</a>.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#sitestrunkwordpressorgpublic_htmlwpcontentpluginsplugindirectoryclassplugindirectoryphp">sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php</a></li>
<li><a href="#sitestrunkwordpressorgpublic_htmlwpcontentpluginsplugindirectoryshortcodesclassuploadhandlerphp">sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload-handler.php</a></li>
<li><a href="#sitestrunkwordpressorgpublic_htmlwpcontentpluginsplugindirectoryshortcodesclassuploadphp">sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload.php</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#sitestrunkwordpressorgpublic_htmlwpcontentpluginsplugindirectoryadmintoolsclassuploadtokenphp">sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/tools/class-upload-token.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="sitestrunkwordpressorgpublic_htmlwpcontentpluginsplugindirectoryadmintoolsclassuploadtokenphp"></a>
<div class="addfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Added: sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/tools/class-upload-token.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/tools/class-upload-token.php (rev 0)
+++ sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/tools/class-upload-token.php 2023-03-29 08:36:13 UTC (rev 12508)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -0,0 +1,180 @@
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+<?php
+namespace WordPressdotorg\Plugin_Directory\Admin\Tools;
+
+/**
+ * All functionality related to the Upload Token Tool.
+ *
+ * @package WordPressdotorg\Plugin_Directory\Admin\Tools
+ */
+class Upload_Token {
+
+ const UPLOAD_PAGE_URL = '/developers/add/';
+ const META_KEY = '_plugin_upload_token';
+
+ /**
+ * Fetch the instance of the Stats_Report class.
+ */
+ public static function instance() {
+ static $instance = null;
+
+ return $instance ?: $instance = new self();
+ }
+
+ /**
+ * Constructor.
+ */
+ private function __construct() {
+ add_action( 'admin_menu', array( $this, 'add_to_menu' ) );
+ }
+
+ /**
+ * Plugin Submission handler, delete any upload token for that user if used.
+ */
+ public function plugin_upload( $plugin, $plugin_post ) {
+ $this->delete_token( $plugin_post->post_author );
+ }
+
+ /**
+ * Adds the "Stats Report" link to the admin menu under "Tools".
+ */
+ public function add_to_menu() {
+ add_submenu_page(
+ 'plugin-tools',
+ __( 'Upload Token', 'wporg-plugins' ),
+ __( 'Upload Token', 'wporg-plugins' ),
+ 'plugin_review',
+ 'upload-token',
+ array( $this, 'render' )
+ );
+ }
+
+ /**
+ * Create a one-time-use upload token.
+ *
+ * @param int $user_id User ID.
+ * @param int $expiration Optional. Expiration time in seconds. Default 1 week.
+ * @return string Token.
+ */
+ public function create_token( $user_id, $expiration = 0 ) {
+ $token = wp_generate_password( 64, false, false );
+ $hash = wp_hash_password( $token );
+ $expiration = $expiration ?: time() + WEEK_IN_SECONDS;
+
+ update_user_meta( $user_id, self::META_KEY, compact( 'hash', 'expiration' ) );
+
+ return $token;
+ }
+
+ /**
+ * Validates a token is valid.
+ *
+ * @param int $user_id User ID.
+ * @param string $token Token.
+ * @return bool True if valid, false otherwise.
+ */
+ public function is_valid_for_user( $user_id, $token ) {
+ $user_token = get_user_meta( $user_id, self::META_KEY, true );
+
+ if ( ! $user_id || ! $token || ! $user_token || $user_token['expiration'] < time() ) {
+ return false;
+ }
+
+ if ( ! wp_check_password( $token, $user_token['hash'] ) ) {
+ return false;
+ }
+
+ add_action( 'plugin_upload', array( $this, 'plugin_upload' ), 10, 2 );
+
+ return true;
+ }
+
+ /**
+ * Deletes a token.
+ *
+ * @param int $user_id User ID.
+ * @return bool
+ */
+ public function delete_token( $user_id ) {
+ return delete_user_meta( $user_id, self::META_KEY );
+ }
+
+ /**
+ * Renders the create-new-upload-token tool.
+ */
+ public function render() {
+ if ( ! current_user_can( 'plugin_review' ) ) {
+ return;
+ }
+
+ $username = wp_unslash( $_REQUEST['user'] ?? '' );
+ $expiration = wp_unslash( $_REQUEST['expiration'] ?? '' );
+ if ( ! $expiration ) {
+ $expiration = gmdate( 'Y-m-d H:i:s', time() + WEEK_IN_SECONDS );
+ }
+
+ echo '<div class="wrap author-cards">';
+ echo '<h1>' . __( 'Upload Token', 'wporg-plugins' ) . '</h1>';
+ echo '<p>' . __( 'This tool allows the generation of a one-time-use token to allow a plugin author to upload a plugin bypassing certain checks.', 'wporg-plugins' ) . '</p>';
+ echo '<ol>';
+ echo '<li>' . __( 'Trademarked terms', 'wporg-plugins' ) . '</li>';
+ echo '<li>' . __( 'Active Installs', 'wporg-plugins' ) . '</li>';
+ echo '<li>' . __( 'Plugin Check', 'wporg-plugins' ) . '</li>';
+ echo '</ol>';
+
+ echo '<form method="post">';
+ echo '<table class="form-table"><tbody>';
+ echo '<tr><th scope="row"><label for="users">' . __( 'User', 'wporg-plugins' ) . '</label></th><td>';
+ echo '<input name="user" type="text" id="user" value="' . esc_attr( $username ) . '" class="regular-text">';
+ echo '</td></tr>';
+ echo '<tr><th scope="row"><label for="expiration">' . __( 'Expiration', 'wporg-plugins' ) . '</label></th><td>';
+ echo '<input name="expiration" type="datetime-local" id="expiration" value="' . esc_attr( $expiration ) . '" class="regular-text">';
+ echo '</td></tr>';
+ echo '</tbody></table>';
+ echo '<p class="submit"><input type="submit" name="submit" id="submit" class="button button-primary" value="' . esc_attr__( 'Submit', 'wporg-plugins' ) . '"></p>';
+ echo '</form>';
+
+ if ( ! $username ) {
+ return;
+ }
+
+ $user = get_user_by( 'login', $username );
+ if ( ! $user ) {
+ $user = get_user_by( 'email', $username );
+ }
+ if ( ! $user ) {
+ $user = get_user_by( 'slug', $username );
+ }
+
+ if ( ! $user ) {
+ printf(
+ '<div class="notice inline notice-error"><p>%s</p></div>',
+ __( 'User not found.', 'wporg-plugins' )
+ );
+ return;
+ }
+
+ $user_token = get_user_meta( $user->ID, '_plugin_upload_token', true );
+ if ( $user_token && $user_token['expiration'] > time() ) {
+ printf(
+ '<div class="notice inline notice-error"><p>%s</p></div>',
+ __( 'User already had a valid token, replacing it.', 'wporg-plugins' )
+ );
+ }
+
+ $token = $this->create_token( $user->ID, strtotime( $expiration ) );
+
+ printf(
+ '<div class="notice inline notice-success"><p>%s</p></div>',
+ sprintf(
+ __( 'Token created. Please provide the author with the following URL: <a href="%1$s">%1$s</a>', 'wporg-plugins' ),
+ esc_url(
+ add_query_arg(
+ 'upload_token',
+ urlencode( $token ),
+ home_url( self::UPLOAD_PAGE_URL )
+ )
+ )
+ )
+ );
+ }
+}
</ins><span class="cx" style="display: block; padding: 0 10px">Property changes on: sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/tools/class-upload-token.php
</span><span class="cx" style="display: block; padding: 0 10px">___________________________________________________________________
</span></span></pre></div>
<a id="svneolstyle"></a>
<div class="addfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Added: svn:eol-style</h4></div>
<ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+native
</ins><span class="cx" style="display: block; padding: 0 10px">\ No newline at end of property
</span><a id="sitestrunkwordpressorgpublic_htmlwpcontentpluginsplugindirectoryclassplugindirectoryphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php 2023-03-29 08:31:18 UTC (rev 12507)
+++ sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php 2023-03-29 08:36:13 UTC (rev 12508)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -3,8 +3,7 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> use WordPressdotorg\Plugin_Directory\Admin\Customizations;
</span><span class="cx" style="display: block; padding: 0 10px"> use WordPressdotorg\Plugin_Directory\Tools;
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-use WordPressdotorg\Plugin_Directory\Admin\Tools\Author_Cards;
-use WordPressdotorg\Plugin_Directory\Admin\Tools\Stats_Report;
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+use WordPressdotorg\Plugin_Directory\Admin\Tools\{ Author_Cards, Stats_Report, Upload_Token };
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * The main Plugin Directory class, it handles most of the bootstrap and basic operations of the plugin.
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -106,6 +105,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> Customizations::instance();
</span><span class="cx" style="display: block; padding: 0 10px"> Author_Cards::instance();
</span><span class="cx" style="display: block; padding: 0 10px"> Stats_Report::instance();
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ Upload_Token::instance();
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> add_action( 'wp_insert_post_data', array( __NAMESPACE__ . '\Admin\Status_Transitions', 'can_change_post_status' ), 10, 2 );
</span><span class="cx" style="display: block; padding: 0 10px"> add_action( 'transition_post_status', array( __NAMESPACE__ . '\Admin\Status_Transitions', 'instance' ) );
</span></span></pre></div>
<a id="sitestrunkwordpressorgpublic_htmlwpcontentpluginsplugindirectoryshortcodesclassuploadhandlerphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload-handler.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload-handler.php 2023-03-29 08:31:18 UTC (rev 12507)
+++ sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload-handler.php 2023-03-29 08:36:13 UTC (rev 12508)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -4,6 +4,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> use WordPressdotorg\Plugin_Directory\Readme\Parser;
</span><span class="cx" style="display: block; padding: 0 10px"> use WordPressdotorg\Plugin_Directory\Plugin_Directory;
</span><span class="cx" style="display: block; padding: 0 10px"> use WordPressdotorg\Plugin_Directory\Tools\Filesystem;
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+use WordPressdotorg\Plugin_Directory\Admin\Tools\Upload_Token;
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * The [wporg-plugin-upload] shortcode handler to display a plugin uploader.
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -58,6 +59,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @return string|WP_Error Confirmation message on success, WP_Error object on failure.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="cx" style="display: block; padding: 0 10px"> public function process_upload() {
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $has_upload_token = $this->has_valid_upload_token();
</ins><span class="cx" style="display: block; padding: 0 10px"> $zip_file = $_FILES['zip_file']['tmp_name'];
</span><span class="cx" style="display: block; padding: 0 10px"> $this->plugin_dir = Filesystem::unzip( $zip_file );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -114,7 +116,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Make sure it doesn't use a TRADEMARK protected slug.
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( false !== $this->has_trademarked_slug() ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( false !== $this->has_trademarked_slug() && ! $has_upload_token ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $error = __( 'Error: The plugin name includes a restricted term.', 'wporg-plugins' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $this->has_trademarked_slug() === trim( $this->has_trademarked_slug(), '-' ) ) {
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -241,7 +243,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Prevent uploads using popular Plugin names in the wild.
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( function_exists( 'wporg_stats_get_plugin_name_install_count' ) ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( function_exists( 'wporg_stats_get_plugin_name_install_count' ) && ! $has_upload_token ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $installs = wporg_stats_get_plugin_name_install_count( $this->plugin['Name'] );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $installs && $installs->count >= 100 ) {
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -299,7 +301,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> ) );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( function_exists( 'wporg_stats_get_plugin_name_install_count' ) ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( function_exists( 'wporg_stats_get_plugin_name_install_count' ) && ! $has_upload_token ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $installs = wporg_stats_get_plugin_name_install_count( $readme->name );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $installs && $installs->count >= 100 ) {
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -331,7 +333,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> // We're not actually using this right now.
</span><span class="cx" style="display: block; padding: 0 10px"> $result = $this->check_plugin();
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( ! $result ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( ! $result && ! $has_upload_token ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $error = __( 'Error: The plugin has failed the automated checks.', 'wporg-plugins' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> return new \WP_Error( 'failed_checks', $error . ' ' . sprintf(
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -798,4 +800,15 @@
</span><span class="cx" style="display: block; padding: 0 10px"> return 'zip';
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ /**
+ * Determine if the current user has a valid upload token.
+ *
+ * An upload token can be used to bypass various plugin checks.
+ */
+ public function has_valid_upload_token() {
+ $token = wp_unslash( $_REQUEST['upload_token'] ?? '' );
+
+ return $token && Upload_Token::instance()->is_valid_for_user( get_current_user_id(), $token );
+ }
+
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="sitestrunkwordpressorgpublic_htmlwpcontentpluginsplugindirectoryshortcodesclassuploadphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload.php 2023-03-29 08:31:18 UTC (rev 12507)
+++ sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload.php 2023-03-29 08:36:13 UTC (rev 12508)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -27,6 +27,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> public static function display() {
</span><span class="cx" style="display: block; padding: 0 10px"> ob_start();
</span><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $uploader = new Upload_Handler();
+
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( is_user_logged_in() ) :
</span><span class="cx" style="display: block; padding: 0 10px"> include_once ABSPATH . 'wp-admin/includes/template.php';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -57,7 +59,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> && ! $submitted_counts->total
</span><span class="cx" style="display: block; padding: 0 10px"> ) :
</span><span class="cx" style="display: block; padding: 0 10px"> if ( UPLOAD_ERR_OK === $_FILES['zip_file']['error'] ) :
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $uploader = new Upload_Handler();
</del><span class="cx" style="display: block; padding: 0 10px"> $upload_result = $uploader->process_upload();
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( is_wp_error( $upload_result ) ) {
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -181,6 +182,21 @@
</span><span class="cx" style="display: block; padding: 0 10px"> <?php wp_nonce_field( 'wporg-plugins-upload' ); ?>
</span><span class="cx" style="display: block; padding: 0 10px"> <input type="hidden" name="action" value="upload"/>
</span><span class="cx" style="display: block; padding: 0 10px"> <?php
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( ! empty( $_REQUEST['upload_token'] ) ) {
+ printf(
+ '<input type="hidden" name="upload_token" value="%s"/>',
+ esc_attr( $_REQUEST['upload_token'] )
+ );
+
+ if ( ! $uploader->has_valid_upload_token() ) {
+ printf(
+ '<div class="notice notice-error notice-alt"><p>%s</p></div>',
+ esc_html__( 'The token provided is invalid for this user.', 'wporg-plugins')
+ );
+ }
+ }
+ ?>
+ <?php
</ins><span class="cx" style="display: block; padding: 0 10px"> /*
</span><span class="cx" style="display: block; padding: 0 10px"> <fieldset>
</span><span class="cx" style="display: block; padding: 0 10px"> <legend><?php _e( 'Select categories (up to 3)', 'wporg-plugins' ); ?></legend>
</span></span></pre>
</div>
</div>
</body>
</html>