Skip to content

Commit d0cfeb4

Browse files
sy-recordssy-records
authored
Improve form validation (#5)
1 parent eba3e4f commit d0cfeb4

File tree

2 files changed

+35
-39
lines changed

2 files changed

+35
-39
lines changed

‎huaweicloud-obs-wordpress.php‎

Lines changed: 31 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Plugin Name: OBS HuaWeiCloud
44
Plugin URI: https://github.com/sy-records/huaweicloud-obs-wordpress
55
Description: 使用华为云对象存储服务 OBS 作为附件存储空间。（This is a plugin that uses HuaWei Cloud Object Storage Service for attachments remote saving.）
6-
Version: 1.4.1
6+
Version: 1.4.2
77
Author: 沈唁
88
Author URI: https://qq52o.me
99
License: Apache 2.0
@@ -14,7 +14,7 @@
1414
use Obs\ObsClient;
1515
use Obs\ObsException;
1616

17-
define('OBS_VERSION', '1.4.1');
17+
define('OBS_VERSION', '1.4.2');
1818
define('OBS_BASEFOLDER', plugin_basename(dirname(__FILE__)));
1919

2020
if (!function_exists('get_home_path')) {
@@ -135,7 +135,7 @@ function obs_delete_obs_file($file)
135135
{
136136
$bucket = obs_get_bucket_name();
137137
$obsClient = obs_get_client();
138-
$obsClient->deleteObject(array('Bucket' => $bucket, 'Key' => $file));
138+
$obsClient->deleteObject(['Bucket' => $bucket, 'Key' => $file]);
139139
}
140140

141141
/**
@@ -152,7 +152,7 @@ function obs_delete_obs_files($files)
152152

153153
$bucket = obs_get_bucket_name();
154154
$obsClient = obs_get_client();
155-
$obsClient->deleteObjects(array('Bucket' => $bucket, 'Objects' => $deleteObjects, 'Quiet' => false));
155+
$obsClient->deleteObjects(['Bucket' => $bucket, 'Objects' => $deleteObjects, 'Quiet' => false]);
156156
}
157157

158158
/**
@@ -307,15 +307,14 @@ function obs_delete_remote_attachment($post_id)
307307
add_action('delete_attachment', 'obs_delete_remote_attachment');
308308

309309
// 当upload_path为根目录时，需要移除URL中出现的“绝对路径”
310-
function obs_modefiy_img_url($url, $post_id)
310+
function obs_modify_img_url($url, $post_id)
311311
{
312312
// 移除 ./ 和 项目根路径
313-
$url = str_replace(['./', get_home_path()], '', $url);
314-
return $url;
313+
return str_replace(['./', get_home_path()], '', $url);
315314
}
316315

317316
if (get_option('upload_path') == '.') {
318-
add_filter('wp_get_attachment_url', 'obs_modefiy_img_url', 30, 2);
317+
add_filter('wp_get_attachment_url', 'obs_modify_img_url', 30, 2);
319318
}
320319

321320
function obs_sanitize_file_name($filename)
@@ -332,20 +331,6 @@ function obs_sanitize_file_name($filename)
332331
}
333332
add_filter('sanitize_file_name', 'obs_sanitize_file_name', 10, 1);
334333

335-
function obs_function_each(&$array)
336-
{
337-
$res = [];
338-
$key = key($array);
339-
if ($key !== null) {
340-
next($array);
341-
$res[1] = $res['value'] = $array[$key];
342-
$res[0] = $res['key'] = $key;
343-
} else {
344-
$res = false;
345-
}
346-
return $res;
347-
}
348-
349334
/**
350335
* @param string $homePath
351336
* @param string $uploadPath
@@ -438,15 +423,20 @@ function obs_setting_page()
438423
if (!current_user_can('manage_options')) {
439424
wp_die('Insufficient privileges!');
440425
}
426+
if (!empty($_POST) && !empty($_POST['type'])) {
427+
$nonce = $_POST["{$_POST['type']}-nonce"] ?? '';
428+
if (empty($nonce) || !wp_verify_nonce($nonce, $_POST['type'])) {
429+
wp_die('Illegal requests!');
430+
}
431+
}
441432
$options = [];
442-
if (!empty($_POST) && $_POST['type'] == 'obs_set') {
433+
if (!empty($_POST) && $_POST['type'] == 'huaweicloud_obs_set') {
443434
$options['bucket'] = isset($_POST['bucket']) ? sanitize_text_field($_POST['bucket']) : '';
444435
$options['regional'] = isset($_POST['regional']) ? sanitize_text_field($_POST['regional']) : '';
445436
$options['key'] = isset($_POST['key']) ? sanitize_text_field($_POST['key']) : '';
446437
$options['secret'] = isset($_POST['secret']) ? sanitize_text_field($_POST['secret']) : '';
447438
$options['nothumb'] = isset($_POST['nothumb']) ? 'true' : 'false';
448439
$options['nolocalsaving'] = isset($_POST['nolocalsaving']) ? 'true' : 'false';
449-
//仅用于插件卸载时比较使用
450440
$options['upload_url_path'] = isset($_POST['upload_url_path']) ? sanitize_text_field(stripslashes($_POST['upload_url_path'])) : '';
451441
$options['update_file_name'] = isset($_POST['update_file_name']) ? sanitize_text_field($_POST['update_file_name']) : 'false';
452442
}
@@ -464,7 +454,7 @@ function obs_setting_page()
464454
$old_url = esc_url_raw($_POST['old_url']);
465455
$new_url = esc_url_raw($_POST['new_url']);
466456

467-
if (!empty($old_url) && !empty($new_url)) {
457+
if (!empty($old_url)) {
468458
global $wpdb;
469459
// 文章内容
470460
$posts_name = $wpdb->prefix . 'posts';
@@ -510,19 +500,19 @@ function obs_setting_page()
510500
$obs_update_file_name = esc_attr($obs_options['update_file_name'] ?? 'false');
511501

512502
$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? 'https://' : 'http://';
513-
?>
503+
?>
514504
<div class="wrap" style="margin: 10px;">
515505
<h1>华为云 OBS 设置 <span style="font-size: 13px;">当前版本：<?php echo OBS_VERSION; ?></span></h1>
516506
<p>如果觉得此插件对你有所帮助，不妨到 <a href="https://github.com/sy-records/huaweicloud-obs-wordpress" target="_blank">GitHub</a> 上点个<code>Star</code>，<code>Watch</code>关注更新；<a href="https://go.qq52o.me/qm/ccs" target="_blank">欢迎加入云存储插件交流群，QQ群号：887595381</a>；</p>
517507
<hr/>
518-
<form name="form1" method="post" action="<?php echo wp_nonce_url('./options-general.php?page=' . OBS_BASEFOLDER . '/huaweicloud-obs-wordpress.php'); ?>">
508+
<form method="post">
519509
<table class="form-table">
520510
<tr>
521511
<th>
522512
<legend>桶名称</legend>
523513
</th>
524514
<td>
525-
<input type="text" name="bucket" value="<?php echo $obs_bucket; ?>" size="50" placeholder="请填写桶名称"/>
515+
<input type="text" name="bucket" required value="<?php echo $obs_bucket; ?>" size="50" placeholder="请填写桶名称"/>
526516

527517
<p>请先访问 <a href="https://storage.huaweicloud.com/obs/?region=cn-east-3#/obs/create" target="_blank">华为云控制台</a> 创建<code>桶</code>，再填写以上内容。</p>
528518
</td>
@@ -540,14 +530,14 @@ function obs_setting_page()
540530
<th>
541531
<legend>key</legend>
542532
</th>
543-
<td><input type="text" name="key" value="<?php echo $obs_key; ?>" size="50" placeholder="key"/></td>
533+
<td><input type="text" name="key" required value="<?php echo $obs_key; ?>" size="50" placeholder="key"/></td>
544534
</tr>
545535
<tr>
546536
<th>
547537
<legend>secret</legend>
548538
</th>
549539
<td>
550-
<input type="text" name="secret" value="<?php echo $obs_secret; ?>" size="50" placeholder="secret"/>
540+
<input type="text" name="secret" required value="<?php echo $obs_secret; ?>" size="50" placeholder="secret"/>
551541
</td>
552542
</tr>
553543
<tr>
@@ -585,7 +575,7 @@ function obs_setting_page()
585575
<legend>本地文件夹</legend>
586576
</th>
587577
<td>
588-
<input type="text" name="upload_path" value="<?php echo $upload_path; ?>" size="50" placeholder="请输入上传文件夹"/>
578+
<input type="text" name="upload_path" required value="<?php echo $upload_path; ?>" size="50" placeholder="请输入上传文件夹"/>
589579
<p>附件在服务器上的存储位置，例如： <code>wp-content/uploads</code> （注意不要以“/”开头和结尾），根目录请输入<code>.</code>。</p>
590580
</td>
591581
</tr>
@@ -594,7 +584,7 @@ function obs_setting_page()
594584
<legend>URL前缀</legend>
595585
</th>
596586
<td>
597-
<input type="text" name="upload_url_path" value="<?php echo $upload_url_path; ?>" size="50" placeholder="请输入URL前缀"/>
587+
<input type="text" name="upload_url_path" required value="<?php echo $upload_url_path; ?>" size="50" placeholder="请输入URL前缀"/>
598588

599589
<p><b>注意：</b></p>
600590

@@ -607,27 +597,29 @@ function obs_setting_page()
607597
</tr>
608598
<tr>
609599
<th><legend>保存/更新选项</legend></th>
610-
<td><input type="submit" name="submit" class="button button-primary" value="保存更改"/></td>
600+
<td><input type="submit" class="button button-primary" value="保存更改"/></td>
611601
</tr>
612602
</table>
613-
<input type="hidden" name="type" value="obs_set">
603+
<input type="hidden" name="type" value="huaweicloud_obs_set">
604+
<?php wp_nonce_field('huaweicloud_obs_set', 'huaweicloud_obs_set-nonce'); ?>
614605
</form>
615-
<form name="form2" method="post" action="<?php echo wp_nonce_url('./options-general.php?page=' . OBS_BASEFOLDER . '/huaweicloud-obs-wordpress.php'); ?>">
606+
<form method="post">
616607
<table class="form-table">
617608
<tr>
618609
<th>
619610
<legend>同步历史附件</legend>
620611
</th>
621612
<input type="hidden" name="type" value="huaweicloud_obs_all">
613+
<?php wp_nonce_field('huaweicloud_obs_all', 'huaweicloud_obs_all-nonce'); ?>
622614
<td>
623-
<input type="submit" name="submit" class="button button-secondary" value="开始同步"/>
615+
<input type="submit" class="button button-secondary" value="开始同步"/>
624616
<p><b>注意：如果是首次同步，执行时间将会十分十分长（根据你的历史附件数量），有可能会因执行时间过长，页面显示超时或者报错。<br> 所以，建议那些几千上万附件的大神们，考虑官方的 <a target="_blank" rel="nofollow" href="https://support.huaweicloud.com/utiltg-obs/obs_11_0001.html">同步工具</a></b></p>
625617
</td>
626618
</tr>
627619
</table>
628620
</form>
629621
<hr>
630-
<form name="form3" method="post" action="<?php echo wp_nonce_url('./options-general.php?page=' . OBS_BASEFOLDER . '/huaweicloud-obs-wordpress.php'); ?>">
622+
<form method="post">
631623
<table class="form-table">
632624
<tr>
633625
<th>
@@ -650,8 +642,9 @@ function obs_setting_page()
650642
<legend></legend>
651643
</th>
652644
<input type="hidden" name="type" value="huaweicloud_obs_replace">
645+
<?php wp_nonce_field('huaweicloud_obs_replace', 'huaweicloud_obs_replace-nonce'); ?>
653646
<td>
654-
<input type="submit" name="submit" class="button button-secondary" value="开始替换"/>
647+
<input type="submit" class="button button-secondary" value="开始替换"/>
655648
<p><b>注意：如果是首次替换，请注意备份！此功能会替换文章以及设置的特色图片（题图）等使用的资源链接</b></p>
656649
</td>
657650
</tr>

‎readme.txt‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Tags: OBS, 华为云, 对象存储, HuaWei
55
Requires at least: 4.6
66
Tested up to: 6.8
77
Requires PHP: 7.2
8-
Stable tag: 1.4.1
8+
Stable tag: 1.4.2
99
License: Apache 2.0
1010
License URI: http://www.apache.org/licenses/LICENSE-2.0.html
1111

@@ -61,6 +61,9 @@ QQ交流群：887595381
6161

6262
== Changelog ==
6363

64+
= 1.4.2 =
65+
* Improve form validation
66+
6467
= 1.4.1 =
6568
* 支持上传文件自动重命名
6669

0 commit comments

Comments
 (0)