FileXXXXXXXXXXX

dvadf

File manager - Edit - /home/centroca/public_html/wp/wp-content/plugins/nextgen-gallery/src/Settings/GalleryPathValidation.php

Back
<?php /** * Shared validation for the gallery storage path (relative to the galleries document root). * * @package Imagely\NGG\Settings / namespace Imagely\NGG\Settings; use Imagely\NGG\Util\Filesystem; use WP_Error; /* * Validates user-provided gallerypath strings for saves and REST updates. / class GalleryPathValidation { /* * @param mixed $gallerypath Raw value (typically string from form or JSON). * @return true\|\WP_Error True if the path is a safe relative path under the galleries root. / public static function validate_relative_under_galleries_root( $gallerypath ) { if ( ! is_string( $gallerypath ) ) { return new WP_Error( 'invalid_gallerypath', __( 'Gallery path must be a string.', 'nggallery' ) ); } $trimmed = trim( $gallerypath ); if ( '' === $trimmed ) { return new WP_Error( 'invalid_gallerypath', __( 'Gallery path must be a non-empty relative path.', 'nggallery' ) ); } $fs = Filesystem::get_instance(); $root = wp_normalize_path( $fs->get_document_root( 'galleries' ) ); $relative = $fs->add_trailing_slash( $trimmed ); $sections = explode( '/', str_replace( '\\', '/', trim( $relative, '/\\' ) ) ); if ( in_array( '..', $sections, true ) ) { return new WP_Error( 'invalid_gallerypath', __( "Gallery paths may not use '..' to access parent directories.", 'nggallery' ) ); } $gallery_abspath = wp_normalize_path( path_join( $root, $relative ) ); $root_normalized = wp_normalize_path( $root ); $root_prefixed = trailingslashit( $root_normalized ); // PHP 7.4: avoid str_starts_with() (PHP 8+). $under_root = ( $gallery_abspath === $root_normalized ) \|\| ( strlen( $gallery_abspath ) >= strlen( $root_prefixed ) && 0 === strpos( $gallery_abspath, $root_prefixed ) ); if ( ! $under_root ) { return new WP_Error( 'invalid_gallerypath', sprintf( / translators: %s: galleries root directory path */ __( 'Gallery path must be located under %s', 'nggallery' ), $root_normalized ) ); } return true; } }

dvadf

dvadf