Changeset 12508 for sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload.php

Timestamp:

03/29/2023 08:36:13 AM (4 years ago)

Author:

dd32

Message:

Plugin Directory: Allow plugin reviewers to generate a one-time-use token to bypass certain upload restrictions (Trademarks and Active Installs).

This allows for plugin authors to submit plugins that would be otherwise rejected by the upload form, without requiring manual work-arounds.

These tokens are user-specific, and one time use only.

See #6864.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload.php (modified) (3 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload.php

@@ -28 +28 @@
                 ob_start();
 
+                $uploader = new Upload_Handler();
+
                 if ( is_user_logged_in() ) :
                         include_once ABSPATH . 'wp-admin/includes/template.php';
@@ -58 +60 @@
                         ) :
                                 if ( UPLOAD_ERR_OK === $_FILES['zip_file']['error'] ) :
-                                        $uploader      = new Upload_Handler();
                                         $upload_result = $uploader->process_upload();
 
@@ -181 +182 @@
                                         <?php wp_nonce_field( 'wporg-plugins-upload' ); ?>
                                         <input type="hidden" name="action" value="upload"/>
+                                        <?php
+                                        if ( ! empty( $_REQUEST['upload_token'] ) ) {
+                                                printf(
+                                                        '<input type="hidden" name="upload_token" value="%s"/>',
+                                                        esc_attr( $_REQUEST['upload_token'] )
+                                                );
+
+                                                if ( ! $uploader->has_valid_upload_token() ) {
+                                                        printf(
+                                                                '<div class="notice notice-error notice-alt"><p>%s</p></div>',
+                                                                esc_html__( 'The token provided is invalid for this user.', 'wporg-plugins')
+                                                        );
+                                                }
+                                        }
+                                        ?>
                                         <?php
                                         /*