Fix. FileUpload. Displaying a blocking message when downloading a malware media file

js/src/spbc-table.js

@@ -415,7 +415,7 @@ function spbcScannerRestoreBulk(current, allItems = false, currentAccordionName
                 .show();
         },
         success: function(result) {
-            if (isQuarantineLog) { 
+            if (isQuarantineLog) {
                 if (result.success === false) {
                     spbcModal.open().putError(result.data);
                 }

js/src/spbc-upload.js

@@ -3,6 +3,25 @@ let spbcErrorMsgCount = 0;
 jQuery(document).ready(function() {
     // Count error messages each 100ms
     setTimeout(spbcCheckNewFiles, 1000);
+
+    // Start checking for new blocked files
+    function spbcBindPluploadDebug() {
+        if (window.uploader && typeof window.uploader.bind === 'function') {
+            window.uploader.bind('Error', function(up, err) {
+                let responseJson = spbcParseJsonResponse(err && err.response ? err.response : '');
+                if (responseJson && responseJson.blocked) {
+                    spbcShowCustomUploadError(responseJson);
+                }
+            });
+            return true;
+        }
+        return false;
+    }
+    if (!spbcBindPluploadDebug()) {
+        let spbcPluInt = setInterval(function() {
+            if (spbcBindPluploadDebug()) clearInterval(spbcPluInt);
+        }, 500);
+    }
 });
 
 /**
@@ -62,3 +81,97 @@ function spbcCheckFileBlockCallback(result, data, params, obj) {
         obj.html(result.warning + '<br>' + result.pattern_title + ' ' + pattern);
     }
 }
+
+/**
+ * Show custom error block in media uploader
+ * @param {obj} dataObj
+ */
+function spbcShowCustomUploadError(dataObj) {
+    // Remove any existing error blocks
+    jQuery('.spbc-custom-upload-error').remove();
+
+    let html = '<div class="notice notice-error spbc-custom-upload-error">';
+    if (dataObj.data && dataObj.data['{TITLE}']) {
+        html +=
+            '<div style="font-weight:bold;font-size:1.1em;margin-bottom:6px;">' +
+            spbcEscapeHTML(dataObj.data['{TITLE}']) +
+            '</div>';
+    }
+    if (dataObj.data && dataObj.data['{REASON}']) {
+        html +=
+            '<div style="margin-bottom:6px;">' +
+            spbcEscapeHTML(dataObj.data['{REASON}']) +
+            '</div>';
+    } else if (dataObj.reason) {
+        html +=
+            '<div style="margin-bottom:6px;">' +
+            spbcEscapeHTML(dataObj.reason) +
+            '</div>';
+    }
+    if (dataObj.data && dataObj.data['{FALSE_POSITIVE_WARNING}']) {
+        html +=
+            '<div style="color:#b00;margin-bottom:6px;">' +
+            spbcEscapeHTML(dataObj.data['{FALSE_POSITIVE_WARNING}']) +
+            '</div>';
+    }
+    if (dataObj.data && dataObj.data['{CLEANTALK_URL}']) {
+        let companyName = dataObj.data['{COMPANY_NAME}'] ?
+            spbcEscapeHTML(dataObj.data['{COMPANY_NAME}']) :
+            'CleanTalk';
+        html +=
+            '<div style="margin-top:8px;"><a href="' +
+            spbcEscapeHTML(dataObj.data['{CLEANTALK_URL}']) +
+            '" target="_blank">' + companyName + '</a></div>';
+    }
+    html += '</div>';
+
+    // Try to insert into media modal or fallback to body
+    let $modal = jQuery('.media-modal-content, #media-upload-error, .upload-php .wrap');
+    if ($modal.length) {
+        $modal.first().prepend(html);
+    } else {
+        jQuery('body').prepend(html);
+    }
+}
+
+/**
+ * Try to extract JSON object from a string, fallback to plain text
+ * @param {string|obj} text
+ * @return {obj}
+ */
+function spbcParseJsonResponse(text) {
+    if (typeof text === 'string') {
+        let jsonStart = text.indexOf('{');
+        let jsonEnd = text.lastIndexOf('}');
+        if (jsonStart !== -1 && jsonEnd !== -1 && jsonEnd > jsonStart) {
+            let possibleJson = text.substring(jsonStart, jsonEnd + 1);
+            try {
+                return JSON.parse(possibleJson);
+            } catch (e) {
+                return {reason: text};
+            }
+        } else {
+            return {reason: text};
+        }
+    } else {
+        return text;
+    }
+}
+
+/**
+ * Simple HTML escape
+ * @param {string} str
+ * @return {string}
+ */
+function spbcEscapeHTML(str) {
+    if (typeof str !== 'string') return str;
+    return str.replace(/[&<>"']/g, function(c) {
+        return {
+            '&': '&amp;',
+            '<': '&lt;',
+            '>': '&gt;',
+            '"': '&quot;',
+            '\'': '&#39;',
+        }[c];
+    });
+}