Skip to content

Commit 36cf974

Browse files
author
Marco Pereirinha
committed
Merge branch 'uat' into fix/insecure-replacements
2 parents 9081e4b + 8c4137e commit 36cf974

File tree

3 files changed

+102
-32
lines changed

3 files changed

+102
-32
lines changed

‎php/class-delivery.php‎

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,13 @@ class Delivery implements Setup {
4848
*/
4949
protected $sync;
5050

51+
/**
52+
* Hold the Post ID.
53+
*
54+
* @var null|int
55+
*/
56+
protected $current_post_id = null;
57+
5158
/**
5259
* The meta data cache key to store URLS.
5360
*
@@ -73,6 +80,8 @@ public function __construct( Plugin $plugin ) {
7380
protected function setup_hooks() {
7481
add_filter( 'cloudinary_filter_out_local', '__return_false' );
7582
add_action( 'update_option_cloudinary_media_display', array( $this, 'clear_cache' ) );
83+
add_filter( 'cloudinary_post_id_taxonomy', array( $this, 'get_current_post_id' ) );
84+
add_filter( 'the_content', array( $this, 'add_post_id' ) );
7685
}
7786

7887
/**
@@ -82,6 +91,36 @@ public function clear_cache() {
8291
delete_post_meta_by_key( self::META_CACHE_KEY );
8392
}
8493

94+
/**
95+
* Add the Post ID to images and videos.
96+
*
97+
* @param string $content The content.
98+
*
99+
* @return string
100+
*/
101+
public function add_post_id( $content ) {
102+
return str_replace(
103+
array(
104+
'wp-image-',
105+
'wp-video-',
106+
),
107+
array(
108+
'wp-post-' . get_the_ID() . ' wp-image-',
109+
'wp-post-' . get_the_ID() . ' wp-video-',
110+
),
111+
$content
112+
);
113+
}
114+
115+
/**
116+
* Get the current post ID.
117+
*
118+
* @return int|null
119+
*/
120+
public function get_current_post_id() {
121+
return $this->current_post_id;
122+
}
123+
85124
/**
86125
* Setup component.
87126
*/
@@ -108,6 +147,8 @@ public function process_featured_image( $html, $post_id, $attachment_id ) {
108147
// Get tag element.
109148
$tag_element = $this->parse_element( $html );
110149
$tag_element['atts']['class'][] = 'wp-image-' . $attachment_id;
150+
$tag_element['atts']['class'][] = 'wp-post-' . $post_id;
151+
111152
if ( true === (bool) $this->media->get_post_meta( $post_id, Global_Transformations::META_FEATURED_IMAGE_KEY, true ) ) {
112153
$tag_element['atts']['class'][] = 'cld-overwrite';
113154
}
@@ -219,13 +260,16 @@ public function convert_tags( $content ) {
219260
$replacements = array();
220261
$attachment_ids = array();
221262
foreach ( $tags as $element ) {
222-
$attachment_id = $this->filter->get_id_from_tag( $element );
263+
$attachment_id = $this->filter->get_id_from_tag( $element );
264+
$this->current_post_id = $this->filter->get_id_from_tag( $element, 'wp-post-' );
265+
223266
if ( empty( $attachment_id ) || ! $this->sync->is_synced( $attachment_id ) ) {
224267
continue;
225268
}
226269
// Register replacement.
227270
$replacements[ $element ] = $this->rebuild_tag( $element, $attachment_id );
228271
$attachment_ids[] = $attachment_id;
272+
$this->current_post_id = null;
229273
}
230274

231275
// Create other image sizes for ID's found.

‎php/media/class-filter.php‎

Lines changed: 19 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,11 @@
88
namespace Cloudinary\Media;
99

1010
use Cloudinary\Connect\Api;
11+
use Cloudinary\Media;
1112
use Cloudinary\Utils;
13+
use WP_Post;
14+
use WP_REST_Request;
15+
use WP_REST_Response;
1216

1317
/**
1418
* Class Filter.
@@ -22,16 +26,16 @@ class Filter {
2226
*
2327
* @since 0.1
2428
*
25-
* @var \Cloudinary\Media Instance of the plugin.
29+
* @var Media Instance of the plugin.
2630
*/
2731
private $media;
2832

2933
/**
3034
* Filter constructor.
3135
*
32-
* @param \Cloudinary\Media $media The plugin.
36+
* @param Media $media The plugin.
3337
*/
34-
public function __construct( \Cloudinary\Media $media ) {
38+
public function __construct( Media $media ) {
3539
$this->media = $media;
3640
$this->setup_hooks();
3741
}
@@ -87,13 +91,13 @@ public function get_video_shortcodes( $html ) {
8791
* Get the attachment ID from the media tag.
8892
*
8993
* @param string $asset The media tag.
90-
*
91-
* @return int|false
94+
* @param string $type The type.
95+
* @return int|null
9296
*/
93-
public function get_id_from_tag( $asset ) {
94-
$attachment_id = false;
97+
public function get_id_from_tag( $asset, $type = 'wp-image-|wp-video-' ) {
98+
$attachment_id = null;
9599
// Get attachment id from class name.
96-
if ( preg_match( '#class=["|\']?[^"\']*(wp-image-|wp-video-)([\d]+)[^"\']*["|\']?#i', $asset, $found ) ) {
100+
if ( preg_match( '#class=["|\']?[^"\']*(' . $type . ')([\d]+)[^"\']*["|\']?#i', $asset, $found ) ) {
97101
$attachment_id = intval( $found[2] );
98102
}
99103

@@ -442,9 +446,9 @@ public function filter_attachment_for_js( $attachment ) {
442446
/**
443447
* Return a Cloudinary URL for an attachment used in a REST REQUEST.
444448
*
445-
* @param \WP_REST_Response $attachment The attachment array to be used in JS.
449+
* @param WP_REST_Response $attachment The attachment array to be used in JS.
446450
*
447-
* @return \WP_REST_Response
451+
* @return WP_REST_Response
448452
* @uses filter:rest_prepare_attachment
449453
*/
450454
public function filter_attachment_for_rest( $attachment ) {
@@ -546,13 +550,13 @@ public function filter_video_embeds( $html, $id, $attachment ) {
546550
}
547551

548552
/**
549-
* Filter out local urls in an 'edit' context rest request ( i.e for Gutenburg ).
553+
* Filter out local urls in an 'edit' context rest request ( i.e for Gutenberg ).
550554
*
551-
* @param \WP_REST_Response $response The post data array to save.
552-
* @param \WP_Post $post The current post.
553-
* @param \WP_REST_Request $request The request object.
555+
* @param WP_REST_Response $response The post data array to save.
556+
* @param WP_Post $post The current post.
557+
* @param WP_REST_Request $request The request object.
554558
*
555-
* @return \WP_REST_Response
559+
* @return WP_REST_Response
556560
*/
557561
public function pre_filter_rest_content( $response, $post, $request ) {
558562
$context = $request->get_param( 'context' );

‎php/media/class-global-transformations.php‎

Lines changed: 38 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
namespace Cloudinary\Media;
99

1010
use Cloudinary\Settings\Setting;
11+
use WP_Post;
1112

1213
/**
1314
* Class Global Transformations.
@@ -241,25 +242,23 @@ public function get_transformations( $type ) {
241242
*
242243
* @param string $type The type to get.
243244
*
244-
* @return array
245+
* @return string
245246
*/
246247
public function get_taxonomy_transformations( $type ) {
247248
$return_transformations = '';
248-
if ( in_the_loop() ) {
249-
$post = get_post();
250-
if ( ! empty( $post ) ) {
251-
$transformations = array();
252-
$terms = $this->get_terms( $post->ID );
253-
if ( ! empty( $terms ) ) {
254-
foreach ( $terms as $item ) {
255-
$transformation = $this->get_term_transformations( $item['term']->term_id, $type );
256-
if ( ! empty( $transformation[ $type . '_freeform' ] ) ) {
257-
$transformations[] = trim( $transformation[ $type . '_freeform' ] );
258-
}
249+
$post = $this->get_current_post();
250+
if ( $post ) {
251+
$transformations = array();
252+
$terms = $this->get_terms( $post->ID );
253+
if ( ! empty( $terms ) ) {
254+
foreach ( $terms as $item ) {
255+
$transformation = $this->get_term_transformations( $item['term']->term_id, $type );
256+
if ( ! empty( $transformation[ $type . '_freeform' ] ) ) {
257+
$transformations[] = trim( $transformation[ $type . '_freeform' ] );
259258
}
260-
// Join the freeform.
261-
$return_transformations = implode( '/', (array) $transformations );
262259
}
260+
// Join the freeform.
261+
$return_transformations = implode( '/', (array) $transformations );
263262
}
264263
}
265264

@@ -273,8 +272,8 @@ public function get_taxonomy_transformations( $type ) {
273272
*/
274273
public function is_taxonomy_overwrite() {
275274
$apply_type = false;
276-
if ( in_the_loop() ) {
277-
$post = get_post();
275+
$post = $this->get_current_post();
276+
if ( $post ) {
278277
$apply_type = get_post_meta( $post->ID, self::META_APPLY_KEY . '_terms', true );
279278
}
280279

@@ -563,6 +562,29 @@ public function save_overwrite_transformations_featured_image( $post_id ) {
563562
}
564563
}
565564

565+
/**
566+
* Get the current post.
567+
*
568+
* @return WP_Post|null
569+
*/
570+
protected function get_current_post() {
571+
/**
572+
* Filter the post ID.
573+
*
574+
* @hook cloudinary_post_id
575+
* @default null
576+
*
577+
* @return {WP_Post|null}
578+
*/
579+
$post_id = apply_filters( 'cloudinary_post_id', null );
580+
581+
if ( is_null( $post_id ) ) {
582+
return null;
583+
}
584+
585+
return get_post( $post_id );
586+
}
587+
566588
/**
567589
* Setup hooks for the filters.
568590
*/

0 commit comments

Comments
 (0)