Tuxedo Big File Uploads - Version 2.1.1

Version Description

Download this release

Release Info

Developer uglyrobot
Plugin Icon 128x128 Tuxedo Big File Uploads
Version 2.1.1
Comparing to
See all releases

Code changes from version 2.1 to 2.1.1

Files changed (2) hide show
  1. readme.txt +6 -1
  2. tuxedo_big_file_uploads.php +32 -10
readme.txt CHANGED
@@ -3,7 +3,7 @@ Contributors: uglyrobot, jdailey, andtrev
3
  Tags: increase file size limit, increase upload limit, max upload file size, post max size, upload limit, file upload, files uploader, ftp, video uploader, AJAX
4
  Requires at least: 5.3
5
  Tested up to: 6.0
6
- Stable tag: 2.1
7
  Requires PHP: 5.6
8
  License: GPLv2
9
  License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -106,6 +106,11 @@ No. [Infinite Uploads](https://wordpress.org/plugins/infinite-uploads/) is an op
106
 
107
  == Changelog ==
108
 
 
 
 
 
 
109
  2.1 - 2022-8-14
110
  ----------------------------------------------------------------------
111
  - Can now handle files of any size, limited only by your disk space, not system temp directory size.
3
  Tags: increase file size limit, increase upload limit, max upload file size, post max size, upload limit, file upload, files uploader, ftp, video uploader, AJAX
4
  Requires at least: 5.3
5
  Tested up to: 6.0
6
+ Stable tag: 2.1.1
7
  Requires PHP: 5.6
8
  License: GPLv2
9
  License URI: https://www.gnu.org/licenses/gpl-2.0.html
106
 
107
  == Changelog ==
108
 
109
+ 2.1.1 - 2022-8-17
110
+ ----------------------------------------------------------------------
111
+ - Compatibility with Easy Digital Downloads plugin.
112
+ - Protect the temp directory from direct access.
113
+
114
  2.1 - 2022-8-14
115
  ----------------------------------------------------------------------
116
  - Can now handle files of any size, limited only by your disk space, not system temp directory size.
tuxedo_big_file_uploads.php CHANGED
@@ -2,7 +2,7 @@
2
  /**
3
  * Plugin Name: Big File Uploads
4
  * Description: Enable large file uploads in the built-in WordPress media uploader via multipart uploads, and set maximum upload file size to any value based on user role. Uploads can be as large as available disk space allows.
5
- * Version: 2.1
6
  * Author: Infinite Uploads
7
  * Author URI: https://infiniteuploads.com/?utm_source=bfu_plugin&utm_medium=plugin&utm_campaign=bfu_plugin&utm_content=meta
8
  * Network: true
@@ -34,7 +34,7 @@ if ( ! defined( 'ABSPATH' ) ) {
34
  die();
35
  }
36
 
37
- define( 'BIG_FILE_UPLOADS_VERSION', '2.1' );
38
 
39
  /**
40
  * Big File Uploads manager class.
@@ -451,14 +451,27 @@ class BigFileUploads {
451
  /** Get file name and path + name. */
452
  $fileName = isset( $_REQUEST['name'] ) ? $_REQUEST['name'] : $_FILES['async-upload']['name'];
453
 
454
- // Create temp directory if it doesn't exist
455
  $bfu_temp_dir = apply_filters( 'bfu_temp_dir', WP_CONTENT_DIR . '/bfu-temp' );
456
- if ( ! @is_dir( $bfu_temp_dir ) ) {
457
- wp_mkdir_p( $bfu_temp_dir );
458
- }
459
 
460
- //scan temp dir for files older than 24 hours and delete them when starting a new upload
461
  if ( $chunk === 0 ) {
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
462
  $files = glob( $bfu_temp_dir . '/*.part' );
463
  if ( is_array( $files ) ) {
464
  foreach ( $files as $file ) {
@@ -469,7 +482,7 @@ class BigFileUploads {
469
  }
470
  }
471
 
472
- $filePath = sprintf( '%s/%d-%s.part', $bfu_temp_dir, get_current_blog_id(), md5( $fileName ) );
473
 
474
  //debugging
475
  if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
@@ -620,17 +633,26 @@ class BigFileUploads {
620
  }
621
 
622
  /** Recreate upload in $_FILES global and pass off to WordPress. */
623
- //rename( $filePath, $_FILES['async-upload']['tmp_name'] );
624
  $_FILES['async-upload']['tmp_name'] = $filePath;
625
  $_FILES['async-upload']['name'] = $fileName;
626
  $_FILES['async-upload']['size'] = filesize( $_FILES['async-upload']['tmp_name'] );
627
  $wp_filetype = wp_check_filetype_and_ext( $_FILES['async-upload']['tmp_name'], $_FILES['async-upload']['name'] );
628
  $_FILES['async-upload']['type'] = $wp_filetype['type'];
629
- header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) );
 
630
 
631
  if ( ! isset( $_REQUEST['short'] ) || ! isset( $_REQUEST['type'] ) ) { //ajax like media uploader in modal
 
 
 
 
 
 
 
 
632
  send_nosniff_header();
633
  nocache_headers();
 
634
  $this->wp_ajax_upload_attachment();
635
  die( '0' );
636
 
2
  /**
3
  * Plugin Name: Big File Uploads
4
  * Description: Enable large file uploads in the built-in WordPress media uploader via multipart uploads, and set maximum upload file size to any value based on user role. Uploads can be as large as available disk space allows.
5
+ * Version: 2.1.1
6
  * Author: Infinite Uploads
7
  * Author URI: https://infiniteuploads.com/?utm_source=bfu_plugin&utm_medium=plugin&utm_campaign=bfu_plugin&utm_content=meta
8
  * Network: true
34
  die();
35
  }
36
 
37
+ define( 'BIG_FILE_UPLOADS_VERSION', '2.1.1' );
38
 
39
  /**
40
  * Big File Uploads manager class.
451
  /** Get file name and path + name. */
452
  $fileName = isset( $_REQUEST['name'] ) ? $_REQUEST['name'] : $_FILES['async-upload']['name'];
453
 
454
+
455
  $bfu_temp_dir = apply_filters( 'bfu_temp_dir', WP_CONTENT_DIR . '/bfu-temp' );
 
 
 
456
 
457
+ //only run on first chunk
458
  if ( $chunk === 0 ) {
459
+ // Create temp directory if it doesn't exist
460
+ if ( ! @is_dir( $bfu_temp_dir ) ) {
461
+ wp_mkdir_p( $bfu_temp_dir );
462
+ }
463
+
464
+ // Protect temp directory from browsing.
465
+ $index_pathname = $bfu_temp_dir . '/index.php';
466
+ if ( ! file_exists( $index_pathname ) ) {
467
+ $file = fopen( $index_pathname, 'w' );
468
+ if ( false !== $file ) {
469
+ fwrite( $file, "<?php\n// Silence is golden.\n" );
470
+ fclose( $file );
471
+ }
472
+ }
473
+
474
+ //scan temp dir for files older than 24 hours and delete them.
475
  $files = glob( $bfu_temp_dir . '/*.part' );
476
  if ( is_array( $files ) ) {
477
  foreach ( $files as $file ) {
482
  }
483
  }
484
 
485
+ $filePath = sprintf( '%s/%d-%s.part', $bfu_temp_dir, get_current_blog_id(), sha1( $fileName ) );
486
 
487
  //debugging
488
  if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
633
  }
634
 
635
  /** Recreate upload in $_FILES global and pass off to WordPress. */
 
636
  $_FILES['async-upload']['tmp_name'] = $filePath;
637
  $_FILES['async-upload']['name'] = $fileName;
638
  $_FILES['async-upload']['size'] = filesize( $_FILES['async-upload']['tmp_name'] );
639
  $wp_filetype = wp_check_filetype_and_ext( $_FILES['async-upload']['tmp_name'], $_FILES['async-upload']['name'] );
640
  $_FILES['async-upload']['type'] = $wp_filetype['type'];
641
+
642
+ header( 'Content-Type: text/plain; charset=' . get_option( 'blog_charset' ) );
643
 
644
  if ( ! isset( $_REQUEST['short'] ) || ! isset( $_REQUEST['type'] ) ) { //ajax like media uploader in modal
645
+
646
+ // Compatibility with Easy Digital Downloads plugin.
647
+ if ( function_exists( 'edd_change_downloads_upload_dir' ) ) {
648
+ global $pagenow;
649
+ $pagenow = 'async-upload.php';
650
+ edd_change_downloads_upload_dir();
651
+ }
652
+
653
  send_nosniff_header();
654
  nocache_headers();
655
+
656
  $this->wp_ajax_upload_attachment();
657
  die( '0' );
658