<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[40124] trunk: Media: Reduce failing uploads following 4.7.1.</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta" style="font-size: 105%">
<dt style="float: left; width: 6em; font-weight: bold">Revision</dt> <dd><a style="font-weight: bold" href="https://core.trac.wordpress.org/changeset/40124">40124</a><script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"Review this Commit","action":{"@type":"ViewAction","url":"https://core.trac.wordpress.org/changeset/40124","name":"Review Commit"}}</script></dd>
<dt style="float: left; width: 6em; font-weight: bold">Author</dt> <dd>joemcgill</dd>
<dt style="float: left; width: 6em; font-weight: bold">Date</dt> <dd>2017-02-25 16:07:25 +0000 (Sat, 25 Feb 2017)</dd>
</dl>
<pre style='padding-left: 1em; margin: 2em 0; border-left: 2px solid #ccc; line-height: 1.25; font-size: 105%; font-family: sans-serif'>Media: Reduce failing uploads following 4.7.1.
<a href="https://core.trac.wordpress.org/changeset/39831">[39831]</a> introduced more strict MIME type checking for uploads, which
resulted in unintetionally blocking several filetypes that were
previously valid. This change uses a more targeted approach to MIME
validation to restore previous behavior for most types.
Props blobfolio, iandunn, ipstenu, markoheijnen, xknown, joemcgill.
Fixes <a href="https://core.trac.wordpress.org/ticket/39550">#39550</a>, <a href="https://core.trac.wordpress.org/ticket/39552">#39552</a>.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunksrcwpincludesfunctionsphp">trunk/src/wp-includes/functions.php</a></li>
<li><a href="#trunktestsphpunittestsfunctionsphp">trunk/tests/phpunit/tests/functions.php</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li>trunk/tests/phpunit/data/uploads/</li>
<li><a href="#trunktestsphpunitdatauploadsdashiconswoff">trunk/tests/phpunit/data/uploads/dashicons.woff</a></li>
<li><a href="#trunktestsphpunitdatauploadspagestoworddocx">trunk/tests/phpunit/data/uploads/pages-to-word.docx</a></li>
<li><a href="#trunktestsphpunitdatauploadsvideoplaysvg">trunk/tests/phpunit/data/uploads/video-play.svg</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunksrcwpincludesfunctionsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/functions.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/functions.php 2017-02-25 05:25:40 UTC (rev 40123)
+++ trunk/src/wp-includes/functions.php 2017-02-25 16:07:25 UTC (rev 40124)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2269,15 +2269,15 @@
</span><span class="cx" style="display: block; padding: 0 10px"> return compact( 'ext', 'type', 'proper_filename' );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $real_mime = false;
+
</ins><span class="cx" style="display: block; padding: 0 10px"> // Validate image types.
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $type && 0 === strpos( $type, 'image/' ) ) {
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Attempt to figure out what type of image it actually is
</span><span class="cx" style="display: block; padding: 0 10px"> $real_mime = wp_get_image_mime( $file );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( ! $real_mime ) {
- $type = $ext = false;
- } elseif ( $real_mime != $type ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( $real_mime && $real_mime != $type ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * Filters the list mapping image mime types to their respective extensions.
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2308,18 +2308,29 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $ext = $wp_filetype['ext'];
</span><span class="cx" style="display: block; padding: 0 10px"> $type = $wp_filetype['type'];
</span><span class="cx" style="display: block; padding: 0 10px"> } else {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $type = $ext = false;
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ // Reset $real_mime and try validating again.
+ $real_mime = false;
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- } elseif ( function_exists( 'finfo_file' ) ) {
- // Use finfo_file if available to validate non-image files.
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ }
+
+ // Validate files that didn't get validated during previous checks.
+ if ( $type && ! $real_mime && extension_loaded( 'fileinfo' ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $finfo = finfo_open( FILEINFO_MIME_TYPE );
</span><span class="cx" style="display: block; padding: 0 10px"> $real_mime = finfo_file( $finfo, $file );
</span><span class="cx" style="display: block; padding: 0 10px"> finfo_close( $finfo );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- // If the extension does not match the file's real type, return false.
- if ( $real_mime !== $type ) {
- $type = $ext = false;
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ /*
+ * If $real_mime doesn't match what we're expecting, we need to do some extra
+ * vetting of application mime types to make sure this type of file is allowed.
+ * Other mime types are assumed to be safe, but should be considered unverified.
+ */
+ if ( $real_mime && ( $real_mime !== $type ) && ( 0 === strpos( $real_mime, 'application' ) ) ) {
+ $allowed = get_allowed_mime_types();
+
+ if ( ! in_array( $real_mime, $allowed ) ) {
+ $type = $ext = false;
+ }
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunktestsphpunitdatauploadsdashiconswoff"></a>
<div class="addfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Added: trunk/tests/phpunit/data/uploads/dashicons.woff</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/tests/phpunit/data/uploads/dashicons.woff (rev 0)
+++ trunk/tests/phpunit/data/uploads/dashicons.woff 2017-02-25 16:07:25 UTC (rev 40124)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -0,0 +1,196 @@
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+wOFF f \xA3 FFTM D rL"\x8BGDEF ` 3 OS/2 \x80 @ `\x96i\xCCcmap \xC0 A \xA2\xEA@\x92gasp \xFF\xFF glyf Y\xEE \x8C\x80\xE1l\x93\x87head \\xFC . 6\xFD\x82hhea ], $\xA2\xAEhmtx ]H \x87@rloca ^P \xFE\x82\xDAvmaxp `` Y \xB5name `\x80 \x9B V/*v\x83post b \xE7
+F\xC0\xFA?\xFEwebf f \xB2\xAFV\xE1 \xCC=\xA2\xCF \xD3\x8E \xD3c-x\xDAc`d``\xE0b `b`d`dd\x92,` \x8D 9 x\xDAc`f?\xC58\x81\x81\x95\x81\x85U\x84e\xC34ʹ\x87\xC1\x88)\xC8Ja\xA1\xDE\xE1~\xAA\xBE\xBA\xB3_ \xF1\x81\xA4\x90bDR\xA2\xC0\xC0 6\xB4
+\xC8x\xDAݐ\xBDKA\xC5璨\xBB7\xC4\xE2 Ł\xA4\xB8\xEE\xFC$\xC1\xE64\xC4$\xA0"\xA6\x90\x88H\xFChb!];[\xC1\xBFE;\xB5\xD1F\xD6j\xA5\xCE\xEE\x8E6\xEAy$`ao\xE3\x83yÃ\xE1\xF7` \xBDɀ;X\xC7q\xB2\xBA9e\xB5\xE3\xBD!\xF4A&\xFBA6
+\x91K#\xE4S@S\x94\xA7\xA9L5ڠ\xB5h_Y\xCAV\xAE\xF2U^\x85jV\xDB\xDAվ\xCE늩\x98S3u\xD30-s`\x8E8\xC56\xBB\xEC\xF3(\xE7\xB8\xC0\xA5(\x88\xE9@i&\x8F\xB21}\x8Cr\xC6\xF4U\xA9N[\xB4Km*\xA9\xD2\xCASA\x97n\xE9\xB4\xF6t\xA0CS6K]\xFA\xA6i\x9A\xB69d\xE0~N\xB3\xC7\x8Fs\xC8\xC5(\xEA\xA6\xF0?\xF1\xDF\xF0_\xF0\x9F\xF0\xF0o\xF1\xAF\xF0qK8\x83\xD38\x89Ξ\xD3tv\x9Cmg]\xD6媬ɪ\\x96\xF3rN\x86\xA2#\xEEĵ\xB8\xE7\xE2L\x9C\x8A\x93\xDE\xC7\xFENV?\xFCTX\x89\xD8\xBF\xE0\xDF\xEB6y\x8Dt \xFF\xFF xڬ\xBD |U\xB68\\xB7\xAA\xAB\xAA;[\xA7\xD3[\xB6\xEEt\xA7\xB7,\x9D\xB57\xB2u\x84=l!\x8A K\xB3/F\x91MnQAPE7D\F\xA3"\xE3\x92a\xDCF\xDBmD&\xEA\xE8C\xC5qduF\x9D\xC7s I_\xFF\xE7\xDC\xEAN:\xC8̛\xF7\xFD\xBEt\xAA\xEE\xAD[U\xB7n\xDD\x
E5\xEC\xE7'r\xF0GN\xF3ݜ\xC0I\x9C\x86K\xE3\xB4W\xA5\xB3\xEB\xBD]o\xD6{*\xD1\xE9\xC9\xE9\xDE\xC7\xE8\xD1\xC7\xE8-d\xFAc\xD1\xC7\xF8\xEEX3\xB9\x99\xFB\x99\xF6\xFCLh\xECC\xEEg\xE2\xA5<\xF73G\xB8\xA4\xBF*\x8E\xE3\xB9\x93_\x94z\xA1\xCE \xC7iH(LLf+1[\x85`HCd\xC9P@L9\x83\x97%\xD8Y\xF90 Ca>\xAC\x86\xF2\xEA\x90x0ְ;g\xFD\xED\xB5eM+\xAD\x9Fݺ\xB26\xF6H\xAC\xE1i\x8Be\x99Œ7j\xB1i\x84\xC3?\xA5R\xBB\xE4\xB2\xCB\xFC\x85\xBE\xF4\xBEe\x9C\x9Af6\xF3\xAF\xED\xCEOw\xB8\xAD[ʳ\xF3\xED\xE9$-\xF6\xFF\xDA\xD3\xEC\xECtK^plf\x95\xC3\xD9eK\xC6ʕ\x93\xFD\x85ͺU#\xF3X\x9D!^.*5\xC9j.\xFA\xC4^m2\xEAR)!:G\xA1;\xA0\xF3\xC9i\xA1\xB3u\xED\xDA\xD6(M\x8BB*\xABƚ[\xD7\xD24rzm+\xDFݺ^[\xE0\xFE u|"}}\x99\xC1\xEA1\xCB\xE2ѐ\x80O$Э\xB8IM{\x96\xC56\xC46,\xE3$;\xA3\xB1\x83|[\xDF\xC1F\xDBU\x9B\xF7,\xE3o`\xE5\xB4=zw\xEC\xD1\xD8\xE3\xFCTKN\xD34\xA87\xCA\xED\x96Wȵ\6\xE7\xE6\xEA\xA1^S\xA6\x96di$A\xBF\xC7]\xA8%\xC4\x84\xBCMÎ%\x99H\xB3)(\x93\xA4%\x92\xCD\xE3\xCEl$abf\xA5\xD5\xD2\xDF7
o\xDE\xD3\xFA\xA7eDjiill|\xA6q"}\xD2R\xD3z\xD7Uda\xFF\xB7\xBC\xA9\xA0\xA0\xB0\xAD \xF6-&\xE5d\x9FOнW)\xB7\xD0\xF9MM\x8D\xCFH\xDDXrWk\x8D\x95\x88[\xA0\x82\xA6\xA6\xFA\xE4\xB2?\xB5\xEE\xD9\xDC7*\xB8\xA8\xC0\xC6[c߰\xF4Mr;\xB1y3Y\xB4n\xB1\xD0y\x8D\xCF45r\x9C
+\xE6G\xDEi\xA7\xE7\xF2\xB8b\x9C#D\xE7w\x97\x8F]vJ\xD0\xFB&\x9F\xBD:\xC8U\x9BR\xA1\xDB/\xDAu,
+\xFA\xAA\xCD:;t\xE8\xC0\xA1h\xA8+~\xE4z\xDA~\xFD#\xC5uu\xC5©\xE2\xBAX\xD3\xD1\xDBn;z\x9Bp\x98\x9C\x86\xE4\xB6%\xE6<\xDA}\xAA\xE4\x85N\xBE\xBB\xB8.\xAD+\x8E5\xC3
+\xFC\xB3X|T\xD5wr \xDE#\x92\xB3T^Jd?0'Q\x87O\xB4\xED:\xDF&\x9C\xEA;$\xD8\xFA\xB3\xA3\xE4\xB4h\xE8\xFD.
+8\xFE\xDFp'\xA5?K\xA785\xBC\x93g\xBD\x87q!"g\x87]\x96
+=n#\xBCiP\xA3\x9C\x91\x89X@\xBB_"\xBB=Y\xFDo\xCC\xAE_W\xFD\xED<\xDA\xD1\xE1\xED\xF0z\xBD
+\x82D\x9As\xF0\.\xED\x96\xF2\x95K\xF5\xF7\xACw\xDA\xFB7N\xAF\x95n\xF2v\x90ι\xA7\xE9~8\x95\xA7r\xE9K\xB0\xFE\xA2\xDCRL\xEA猜\xDA.\xA9<{,D\xDCY\xA1\xA0Ӭ\xE1M.46`5J\x9D\xE8߯\x8C}5\xFE\xD8\xED\xE3\xF9m~\xFF\x829D\xB5\x96~Ar\x89\xB5xX\xEF^\xEBt\x8B\xD5j\x99n\xB5?/\xF0\xFBcW\x8C\xBF\xFD\xD88\xDEz%\xC9Z0g\x98\x97~AO\x92\x825?\xC7
+,\x96\xF8\x85\x9C@\xBC\xC4+\xAB\xA5\xFD\xB0\xFEK\xB91\xCA\xE8:\xEC\x83#K|8\xB4\xA5Ĉ\xD9@8\x9Au\xD81\xB0\xF4G<\xB2$\xAEdC\x90\xD5uŽ\xDF\xE1X\x8B\x86\xE2\xBA\xFE\xECf#\x96\xCB@\x86\x9C>O\xD9NU\xE6\xFB\xA6\xE0\xA0[\xEAZ\xEBv-\xE3n\xC8\xF0n\xCC\xD1\x93\xCBb\x9Fb\x8E\x81Gn'\xF7\xA0<Zn\x83\xE5\xA3[¥g\x96\xA1;UЕ\xC42qu\xA9\x87\xF9\x8E_OzuԄf\xBD\xFF\xD7?\xD2SA\xFAa\xF0\xED 1\xFF\x85\xCDF\xE9\xA5Ǯ?\xEC\x9A0\xEA\x95ɇ\xA4
+\xBE$ep\xC1?Xa\xF3\xAB0\xDF\xDCR7̷l\xAE\x9E]X\xAE\xAA \xEE\xB0y\x92!
+.H-$C\xE5(tV@߄\x89Oe\xBAxjЛ\xA3I*m\^\xBC\xB5<\x83\xA8t٥\x81\xCD$\xF3\x8A?l\xD2\xDE\xFF\xA7\x85\xD2ݑ\xC8\\xA9\xF2\xB9ƍk\xD0\xEBC\xCBL([\xFB\xD8l9g\xCC\xF0)5[yV\xD4z\xAC\xD95\xF9\xF9g\xDB\xAD\xBF#\xB2\xDA\xE2\xE1*\xE0\xCD\x92\xEF,\xC9F{\xC0\xED\x91=!\xB7ǡ\xF3C\x9E\x909
+؍&s\xC8,\x9B\xCC>\xAE:\xE8wJY\xFDin\xE8\xEEcw\xB7-\xA6=\x8B\xDB\xEE\xEE\xB9;\x94\xFD\xE9'\xE6(\xB9`\xF1\xB2\x92\xF3'\xFD\xD5g\xBA\xBA\xCEt \xB6\xE53\xE0\\xF2ivδ-&\xC5gCI0/^2{!ޅײvE\xE5By*\xC0WΔD\xE5D\xC1\xEEQ\xA6vVu0\xC0\xDA 5\xBE<j\xD4\xDCv\xFA\xD6֗臻iOD\xC8S\xB5z.\xE1+VM\x9A\xB4j\x92\\xFE2\xA5\xF4\xE7\xB9\xED\x81&\xFA\\xDD\xC8ͤq\xF5\xDCQ\xB1\x93\x86\x85\xE0
+|)\x92W\xC0\xD6\xE1j&\xD5*\xB3\sS\x92}\xE2f9\xF5\x85NO\xC8
+\xF33rh\x88#CN\xDDMt\xF3\xBF\xB8\xEC\xDEO\xD1\xE9\x83G\xB3_%e\xBF\xBA\x87\xFE0PJ\xE6\x909G\xB36\xFE^ڿ\xB9\xFD\xB5ֹ\xAF\xDFA\xDB\xC9$k_og\xBC\x80\xEC\xA4\xED\x9B?\xBB6\x87p2
+\xA3X\xC9ſ\I\x9CMe\x96T6\xA7'\xA8b\xEFm\xAA&