Use of `wp_unslash()` breaks file uploads on IIS hosts

[juliolopez78]

Hello,

When using Directorist on Windows IIS hosted WordPress, file uploads are broken due to the use of wp_unslash() on lines 577 and 578 of includes/classes/class-add-listing.php. The result is a broken file path to the temp uploaded file. For example, the file C:\Program Files\PHPv8.1\upload\phpAC39.tmp loses all the slashes and ends up being C:Program FilesPHPv8.1uploadphpAC39.tmp. So when the file gets passed over to wp_handle_upload() it fails the validation because the temp_name is not a valid file path.

directorist/includes/classes/class-add-listing.php

Line 577 in 362c2fa

$files = ! empty( $_FILES['listing_img'] ) ? directorist_clean( wp_unslash( $_FILES['listing_img'] ) ) : array();

directorist/includes/classes/class-add-listing.php

Line 578 in 362c2fa

$files_meta = ! empty( $_POST['files_meta'] ) ? directorist_clean( wp_unslash( $_POST['files_meta'] ) ) : array();

Is it absolutely necessary to unslash the temp_name for the uploaded files? If you're really concerned about validating the values in the $file array ('name', 'tmp_name', 'type', etc.) I suggest writing validation that is specific for the array and then validate the value for each key instead of the brute-force approach of running the whole set of data through wp_unslash().

You can set up a simple validation using array_filter() to remove invalid files. In the example below, isFileUploadValid() is run for every uploaded file. If it returns true, the file is added to the resulting array, otherwise it is not, essentially cleaning out the invalid uploads.

/**
 * Filter callback for use with array_filter(). Receives a file array. Ensures it has all the required keys and 
 * that all the values pass the required validations. Any arrays that fail, will be removed, thus that file will
 * not be uploaded
 */
function isFileUploadValid(array $file): bool
{
    // An array of keys that MUST be in the $file array
    $validKeys = ['name', 'type', 'tmp_name', 'error', 'size',];
    
    // Configure the validations you want to run on each key in $file. The keys in this array 
    // match the names of the keys in $file, the values are the names of callbacks you can
    // set up to validate the key's value. They return true if the value passes, false otherwise
    $validations = [
        'name' => 'fileNameIsValid',
        'type' => 'fileTypeIsValid',
        'tmp_name' => 'fileTmpNameIsValid',
        'error' => 'fileErrorIsValid',
        'size' => 'fileSizeIsValid',
    ];
    
    // Loop through the keys and make sure the $file array has all the ones we want
    foreach ($validKeys as $key) {
        if (!array_key_exists($key, $file)) {
            return false;
        }
    }
    
    // unset $key to avoid any cross-contamination from the previous foreach
    unset($key);
    
    // Loop through the validations and apply them to each value in $file
    foreach($validations as $key => $callback) {
        if (call_user_func($callback, $file[$key]) === false) {
            return false;
        }
    }
    
    // do any other validation you deem necessary
    
    // return true if you get this far
    return true;
}

/*
 * Normalizes the $_FILES array. Necessary when multiple files are uploaded under the same input name, i.e.
 * name="my_input[]". The result is a 2D array where the values for each key are arrays too.
 * [
 *     'my_input' => [
 *         'name' => [
 *             'somefile.jpg',
 *             'somefile2.jpg',
 *         ],
 *         'type' => [
 *             'image/jpg',
 *             'image/jpg',
 *         ],
 *         // etc.
 *     ]
 * ]
 * This function returns a 2D array that looks like this:
 * [
 *     'my_input_0' => [
 *         'name' => 'somefile.jpg',
 *         'type' => 'image/jpg',
 *         // etc.
 *     ],
 *     'my_input_1' => [
 *         'name' => 'somefile2.jpg',
 *         'type' => 'image/jpg',
 *         // etc.
 *     ],
 * ]
 */
function normalizeFiles(array $files): array
{
    $returnArray = [];

    foreach ($files as $file => $fileData) {
        foreach ($fileData as $fileKey => $fileKeyValues) {
            if (is_array($fileKeyValues)) {
                foreach ($fileKeyValues as $index => $value) {
                    $fileName = "{$file}_$index";

                    if (!array_key_exists($fileName, $returnArray)) {
                        $returnArray[$fileName] = [];
                    }

                    $returnArray[$fileName][$fileKey] = $value;
                }
            } elseif (is_scalar($fileKeyValues)) {
                if (!array_key_exists($file, $returnArray)) {
                    $returnArray[$file] = [];
                }
                
                $returnArray[$file][$fileKey] = $fileKeyValues;
            }
        }
    }
    
    return $returnArray;
}

// In the event that you have multiple files uploaded, you'll need to normalize the $_FILES array
$filesToValidate = normalizeFiles($_FILES);

$validUploads = array_filter($filesToValidate, isFileUploadValid);

// continue uploading the file to the DB

[juliolopez78]

For anyone looking for a quick fix to this issue before a proper solution is added via a release, consider adding this to your functions.php:

function fixWpUnslashBug(array $file): array
{
    if (isWindows()) {
        if (array_key_exists('name', $file)) {
            if (array_key_exists('listing_img', $_FILES) && is_array($_FILES['listing_img'])) {
                if (array_key_exists('name', $_FILES['listing_img']) && is_array($_FILES['listing_img']['name'])) {
                    $index = array_search($file['name'], $_FILES['listing_img']['name']);

                    if ($index !== false && array_key_exists($index, $_FILES['listing_img']['tmp_name'])) {
                        $correctTempPath = $_FILES['listing_img']['tmp_name'][$index];
                        $file['tmp_name'] = $correctTempPath;
                    }
                }
            }
        }
    }

    return $file;
}

/**
 * I admit, this function is real dodgy. Not 100% sure how else to check if WordPress is running on windows/IIS,
 * But in my case, this works
 */
function isWindows(): bool
{
    $systemDriveRegEx = '/^[a-z]:$/i';
    $pathStartRegEx = '/^[a-z]:/i';

    if (array_key_exists('SERVER_SOFTWARE', $_SERVER)) {
        $hasMicrosoft = stripos($_SERVER['SERVER_SOFTWARE'], 'microsoft') !== false;
        $hasIis = stripos($_SERVER['SERVER_SOFTWARE'], 'iis') !== false;

        if ($hasMicrosoft || $hasIis) {
            return true;
        }
    }

    if (array_key_exists('DOCUMENT_ROOT', $_SERVER)
        && preg_match($pathStartRegEx, $_SERVER['DOCUMENT_ROOT']) === 1) {
        return true;
    }

    if (array_key_exists('PATH_TRANSLATED', $_SERVER)
        && preg_match($pathStartRegEx, $_SERVER['PATH_TRANSLATED']) === 1) {
        return true;
    }

    if (array_key_exists('OS', $_SERVER) && stripos($_SERVER['OS'], 'windows') !== false) {
        return true;
    }

    if (array_key_exists('SystemDrive', $_SERVER) && preg_match($systemDriveRegEx, $_SERVER['SystemDrive']) === 1) {
        return true;
    }

    if (array_key_exists('windir', $_SERVER) && preg_match($pathStartRegEx, $_SERVER['windir']) === 1) {
        return true;
    }

    return false;
}

add_filter('wp_handle_upload_prefilter', 'fixWpUnslashBug', 10, 1);

[M4hd1BD]

+1
The wp_unslash function also breaks Directory Import on Windows hosts/installation.
CC: @vairafiq, @obiPlabon

[RabbiIslamRony]

@Armanul46

[RabbiIslamRony]

This is partially fixed. The main listing-image upload path no longer applies wp_unslash() to $_FILES, but the asynchronous custom-file upload handler still does so before calling wp_handle_upload(). Therefore IIS paths containing backslashes may still break. Please keep this issue open until every affected upload and import path is corrected.

[RabbiIslamRony]

A focused fix is available in #2948. It removes unslashing only from the two remaining raw upload-array paths: asynchronous custom-file upload and directory JSON import. Recursive cleaning and all existing nonce, capability, size, MIME, and WordPress upload validation remain in place. Windows path preservation and real LocalWP multipart custom-file, directory-import, and listing-image flows were verified.