Changeset 12508

Timestamp:

03/29/2023 08:36:13 AM (19 months ago)

Author:

dd32

Message:

Plugin Directory: Allow plugin reviewers to generate a one-time-use token to bypass certain upload restrictions (Trademarks and Active Installs).

This allows for plugin authors to submit plugins that would be otherwise rejected by the upload form, without requiring manual work-arounds.

These tokens are user-specific, and one time use only.

See #6864.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory

Files:

• admin/tools/class-upload-token.php (added)
• class-plugin-directory.php (modified) (2 diffs)
• shortcodes/class-upload-handler.php (modified) (7 diffs)
• shortcodes/class-upload.php (modified) (3 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php

@@ -4 +4 @@
 use WordPressdotorg\Plugin_Directory\Admin\Customizations;
 use WordPressdotorg\Plugin_Directory\Tools;
-use WordPressdotorg\Plugin_Directory\Admin\Tools\Author_Cards;
-use WordPressdotorg\Plugin_Directory\Admin\Tools\Stats_Report;
+use WordPressdotorg\Plugin_Directory\Admin\Tools\{ Author_Cards, Stats_Report, Upload_Token };
 
 /**
@@ -107 +106 @@
             Author_Cards::instance();
             Stats_Report::instance();
+            Upload_Token::instance();
 
             add_action( 'wp_insert_post_data', array( __NAMESPACE__ . '\Admin\Status_Transitions', 'can_change_post_status' ), 10, 2 );

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload-handler.php

@@ -5 +5 @@
 use WordPressdotorg\Plugin_Directory\Plugin_Directory;
 use WordPressdotorg\Plugin_Directory\Tools\Filesystem;
+use WordPressdotorg\Plugin_Directory\Admin\Tools\Upload_Token;
 
 /**
@@ -59 +60 @@
      */
     public function process_upload() {
+        $has_upload_token = $this->has_valid_upload_token();
         $zip_file         = $_FILES['zip_file']['tmp_name'];
         $this->plugin_dir = Filesystem::unzip( $zip_file );
@@ -115 +117 @@
 
         // Make sure it doesn't use a TRADEMARK protected slug.
-        if ( false !== $this->has_trademarked_slug() ) {
+        if ( false !== $this->has_trademarked_slug() && ! $has_upload_token ) {
             $error = __( 'Error: The plugin name includes a restricted term.', 'wporg-plugins' );
 
@@ -242 +244 @@
 
         // Prevent uploads using popular Plugin names in the wild.
-        if ( function_exists( 'wporg_stats_get_plugin_name_install_count' ) ) {
+        if ( function_exists( 'wporg_stats_get_plugin_name_install_count' ) && ! $has_upload_token ) {
             $installs = wporg_stats_get_plugin_name_install_count( $this->plugin['Name'] );
 
@@ -300 +302 @@
         }
 
-        if ( function_exists( 'wporg_stats_get_plugin_name_install_count' ) ) {
+        if ( function_exists( 'wporg_stats_get_plugin_name_install_count' ) && ! $has_upload_token ) {
             $installs = wporg_stats_get_plugin_name_install_count( $readme->name );
 
@@ -332 +334 @@
         $result = $this->check_plugin();
 
-        if ( ! $result ) {
+        if ( ! $result && ! $has_upload_token ) {
             $error = __( 'Error: The plugin has failed the automated checks.', 'wporg-plugins' );
 
@@ -799 +801 @@
     }
 
+    /**
+     * Determine if the current user has a valid upload token.
+     *
+     * An upload token can be used to bypass various plugin checks.
+     */
+    public function has_valid_upload_token() {
+        $token = wp_unslash( $_REQUEST['upload_token'] ?? '' );
+
+        return $token && Upload_Token::instance()->is_valid_for_user( get_current_user_id(), $token );
+    }
+
 }

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload.php

@@ -28 +28 @@
         ob_start();
 
+        $uploader = new Upload_Handler();
+
         if ( is_user_logged_in() ) :
             include_once ABSPATH . 'wp-admin/includes/template.php';
@@ -58 +60 @@
             ) :
                 if ( UPLOAD_ERR_OK === $_FILES['zip_file']['error'] ) :
-                    $uploader      = new Upload_Handler();
                     $upload_result = $uploader->process_upload();
 
@@ -181 +182 @@
                     <?php wp_nonce_field( 'wporg-plugins-upload' ); ?>
                     <input type="hidden" name="action" value="upload"/>
+                    <?php
+                    if ( ! empty( $_REQUEST['upload_token'] ) ) {
+                        printf(
+                            '<input type="hidden" name="upload_token" value="%s"/>',
+                            esc_attr( $_REQUEST['upload_token'] )
+                        );
+
+                        if ( ! $uploader->has_valid_upload_token() ) {
+                            printf(
+                                '<div class="notice notice-error notice-alt"><p>%s</p></div>',
+                                esc_html__( 'The token provided is invalid for this user.', 'wporg-plugins')
+                            );
+                        }
+                    }
+                    ?>
                     <?php
                     /*