IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't allow non-image uploads for custom headers and backgrounds. props kovshenin. fixes #22149.

Browse Source 
git-svn-id: http://core.svn.wordpress.org/trunk@22521 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Andrew Nacin
2012-11-10 05:36:37 +00:00
parent 2d13e264a4
commit e14ff50cfb
3 changed files with 25 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
wp-admin/custom-background.php
View File

@@ -355,7 +355,13 @@ if ( current_theme_supports( 'custom-background', 'default-color' ) )
check_admin_referer('custom-background-upload', '_wpnonce-custom-background-upload');
$overrides = array('test_form' => false);
$file = wp_handle_upload($_FILES['import'], $overrides);
$uploaded_file = $_FILES['import'];
$wp_filetype = wp_check_filetype_and_ext( $uploaded_file['tmp_name'], $uploaded_file['name'], false );
if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) )
wp_die( __( 'The uploaded file is not a valid image. Please try again.' ) );
$file = wp_handle_upload($uploaded_file, $overrides);
if ( isset($file['error']) )
wp_die( $file['error'] );