Skip to content

Apply the style package allowlist to nested entries #137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erseco merged 4 commits into from
Sep 26, 2026
Merged

Apply the style package allowlist to nested entries #137

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4f4de92
Apply the style package allowlist to nested entries
erseco Sep 26, 2026
76e07dc
Regenerate translation catalogs
erseco Sep 26, 2026
6ee495b
Check the root folder before skipping directory entries
erseco Sep 26, 2026
f44aa80
Regenerate translation catalogs
erseco Sep 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 7 additions & 8 deletions includes/class-style-package.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,7 @@ private static function scan_entries( $zip ) {
sprintf(
/* translators: %s: offending entry name. */
__( 'Rejected unsafe archive entry: %s', 'exelearning' ),
$name
esc_html( $name )
)
);
}
Expand Down Expand Up @@ -192,24 +192,23 @@ private static function scan_entries( $zip ) {
*/
private static function verify_entries( array $entries, $prefix ) {
foreach ( $entries as $entry ) {
if ( '' === $prefix ) {
// Subdirectories at the root are allowed when config.xml is at the root.
if ( false !== strpos( $entry['name'], '/' ) ) {
continue;
}
} elseif ( 0 !== strpos( $entry['name'], $prefix ) ) {
if ( '' !== $prefix && 0 !== strpos( $entry['name'], $prefix ) ) {
return new WP_Error(
'zip_mixed_roots',
__( 'The archive must contain a single root folder or place all files at the root.', 'exelearning' )
);
}
// Directory entries carry no file type; every file below is still checked.
if ( '/' === substr( $entry['name'], -1 ) ) {
continue;
}
if ( ! self::is_allowed_filename( $entry['name'] ) ) {
return new WP_Error(
'zip_bad_extension',
sprintf(
/* translators: %s: offending filename. */
__( 'File type not allowed in style package: %s', 'exelearning' ),
$entry['name']
esc_html( $entry['name'] )
)
);
}
Expand Down
22 changes: 11 additions & 11 deletions languages/exelearning-ca.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -635,46 +635,46 @@ msgstr "L'arxiu conté més d'un config.xml."
msgid "The style package is missing config.xml."
msgstr "Al paquet d'estil li falta config.xml."

#: includes/class-style-package.php:203
#: includes/class-style-package.php:198
msgid "The archive must contain a single root folder or place all files at the root."
msgstr "L'arxiu ha de contenir una única carpeta arrel o situar tots els fitxers a l'arrel."

#. translators: %s: offending filename.
#: includes/class-style-package.php:211
#: includes/class-style-package.php:210
#, php-format
msgid "File type not allowed in style package: %s"
msgstr "Tipus de fitxer no permès al paquet d'estil: %s"

#: includes/class-style-package.php:232
#: includes/class-style-package.php:231
msgid "Failed to reopen ZIP archive."
msgstr "No s'ha pogut tornar a obrir l'arxiu ZIP."

#: includes/class-style-package.php:243
#: includes/class-style-package.php:242
msgid "Refused unsafe archive entry during extraction."
msgstr "S'ha rebutjat una entrada d'arxiu insegura durant l'extracció."

#: includes/class-style-package.php:290
#: includes/class-style-package.php:289
msgid "Refused path traversal during extraction."
msgstr "S'ha rebutjat un salt de ruta durant l'extracció."

#: includes/class-style-package.php:297
#: includes/class-style-package.php:301
#: includes/class-style-package.php:296
#: includes/class-style-package.php:300
msgid "Failed to create a directory from the archive."
msgstr "No s'ha pogut crear un directori de l'arxiu."

#: includes/class-style-package.php:306
#: includes/class-style-package.php:305
msgid "Failed to read a file from the archive."
msgstr "No s'ha pogut llegir un fitxer de l'arxiu."

#: includes/class-style-package.php:310
#: includes/class-style-package.php:309
msgid "Failed to write an extracted file."
msgstr "No s'ha pogut escriure un fitxer extret."

#: includes/class-style-package.php:396
#: includes/class-style-package.php:395
msgid "config.xml is not valid XML."
msgstr "config.xml no és XML vàlid."

#: includes/class-style-package.php:401
#: includes/class-style-package.php:400
msgid "config.xml must declare a <name> element."
msgstr "config.xml ha de declarar un element <name>."

Expand Down
22 changes: 11 additions & 11 deletions languages/exelearning-ca_valencia.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -635,46 +635,46 @@ msgstr "L'arxiu conté més d'un config.xml."
msgid "The style package is missing config.xml."
msgstr "Al paquet d'estil li falta config.xml."

#: includes/class-style-package.php:203
#: includes/class-style-package.php:198
msgid "The archive must contain a single root folder or place all files at the root."
msgstr "L'arxiu ha de contenir una única carpeta arrel o situar tots els fitxers a l'arrel."

#. translators: %s: offending filename.
#: includes/class-style-package.php:211
#: includes/class-style-package.php:210
#, php-format
msgid "File type not allowed in style package: %s"
msgstr "Tipus de fitxer no permès al paquet d'estil: %s"

#: includes/class-style-package.php:232
#: includes/class-style-package.php:231
msgid "Failed to reopen ZIP archive."
msgstr "No s'ha pogut tornar a obrir l'arxiu ZIP."

#: includes/class-style-package.php:243
#: includes/class-style-package.php:242
msgid "Refused unsafe archive entry during extraction."
msgstr "S'ha rebutjat una entrada d'arxiu insegura durant l'extracció."

#: includes/class-style-package.php:290
#: includes/class-style-package.php:289
msgid "Refused path traversal during extraction."
msgstr "S'ha rebutjat un salt de ruta durant l'extracció."

#: includes/class-style-package.php:297
#: includes/class-style-package.php:301
#: includes/class-style-package.php:296
#: includes/class-style-package.php:300
msgid "Failed to create a directory from the archive."
msgstr "No s'ha pogut crear un directori de l'arxiu."

#: includes/class-style-package.php:306
#: includes/class-style-package.php:305
msgid "Failed to read a file from the archive."
msgstr "No s'ha pogut llegir un fitxer de l'arxiu."

#: includes/class-style-package.php:310
#: includes/class-style-package.php:309
msgid "Failed to write an extracted file."
msgstr "No s'ha pogut escriure un fitxer extret."

#: includes/class-style-package.php:396
#: includes/class-style-package.php:395
msgid "config.xml is not valid XML."
msgstr "config.xml no és XML vàlid."

#: includes/class-style-package.php:401
#: includes/class-style-package.php:400
msgid "config.xml must declare a <name> element."
msgstr "config.xml ha de declarar un element <name>."

Expand Down
22 changes: 11 additions & 11 deletions languages/exelearning-de_DE.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -635,46 +635,46 @@ msgstr "Das Archiv enthält mehr als eine config.xml."
msgid "The style package is missing config.xml."
msgstr "Im Stilpaket fehlt die config.xml."

#: includes/class-style-package.php:203
#: includes/class-style-package.php:198
msgid "The archive must contain a single root folder or place all files at the root."
msgstr "Das Archiv muss einen einzigen Stammordner enthalten oder alle Dateien im Stammverzeichnis ablegen."

#. translators: %s: offending filename.
#: includes/class-style-package.php:211
#: includes/class-style-package.php:210
#, php-format
msgid "File type not allowed in style package: %s"
msgstr "Dateityp im Stilpaket nicht zulässig: %s"

#: includes/class-style-package.php:232
#: includes/class-style-package.php:231
msgid "Failed to reopen ZIP archive."
msgstr "ZIP-Archiv konnte nicht erneut geöffnet werden."

#: includes/class-style-package.php:243
#: includes/class-style-package.php:242
msgid "Refused unsafe archive entry during extraction."
msgstr "Unsicherer Archiveintrag bei der Extraktion abgelehnt."

#: includes/class-style-package.php:290
#: includes/class-style-package.php:289
msgid "Refused path traversal during extraction."
msgstr "Pfad-Traversal bei der Extraktion abgelehnt."

#: includes/class-style-package.php:297
#: includes/class-style-package.php:301
#: includes/class-style-package.php:296
#: includes/class-style-package.php:300
msgid "Failed to create a directory from the archive."
msgstr "Verzeichnis konnte nicht aus dem Archiv erstellt werden."

#: includes/class-style-package.php:306
#: includes/class-style-package.php:305
msgid "Failed to read a file from the archive."
msgstr "Datei konnte nicht aus dem Archiv gelesen werden."

#: includes/class-style-package.php:310
#: includes/class-style-package.php:309
msgid "Failed to write an extracted file."
msgstr "Eine extrahierte Datei konnte nicht geschrieben werden."

#: includes/class-style-package.php:396
#: includes/class-style-package.php:395
msgid "config.xml is not valid XML."
msgstr "config.xml ist kein gültiges XML."

#: includes/class-style-package.php:401
#: includes/class-style-package.php:400
msgid "config.xml must declare a <name> element."
msgstr "config.xml muss ein <name>-Element deklarieren."

Expand Down
22 changes: 11 additions & 11 deletions languages/exelearning-eo.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -635,46 +635,46 @@ msgstr "La arkivo enhavas pli ol unu config.xml."
msgid "The style package is missing config.xml."
msgstr "En la stilpakaĵo mankas config.xml."

#: includes/class-style-package.php:203
#: includes/class-style-package.php:198
msgid "The archive must contain a single root folder or place all files at the root."
msgstr "La arkivo devas enhavi ununuran radikan dosierujon aŭ meti ĉiujn dosierojn en la radikon."

#. translators: %s: offending filename.
#: includes/class-style-package.php:211
#: includes/class-style-package.php:210
#, php-format
msgid "File type not allowed in style package: %s"
msgstr "Dosiertipo ne permesata en la stilpakaĵo: %s"

#: includes/class-style-package.php:232
#: includes/class-style-package.php:231
msgid "Failed to reopen ZIP archive."
msgstr "Ne eblis remalfermi la ZIP-arkivon."

#: includes/class-style-package.php:243
#: includes/class-style-package.php:242
msgid "Refused unsafe archive entry during extraction."
msgstr "Malsekura arkiverero malakceptita dum la malpakado."

#: includes/class-style-package.php:290
#: includes/class-style-package.php:289
msgid "Refused path traversal during extraction."
msgstr "Vojtravado malakceptita dum la malpakado."

#: includes/class-style-package.php:297
#: includes/class-style-package.php:301
#: includes/class-style-package.php:296
#: includes/class-style-package.php:300
msgid "Failed to create a directory from the archive."
msgstr "Ne eblis krei dosierujon el la arkivo."

#: includes/class-style-package.php:306
#: includes/class-style-package.php:305
msgid "Failed to read a file from the archive."
msgstr "Ne eblis legi dosieron el la arkivo."

#: includes/class-style-package.php:310
#: includes/class-style-package.php:309
msgid "Failed to write an extracted file."
msgstr "Ne eblis skribi malpakitan dosieron."

#: includes/class-style-package.php:396
#: includes/class-style-package.php:395
msgid "config.xml is not valid XML."
msgstr "config.xml ne estas valida XML."

#: includes/class-style-package.php:401
#: includes/class-style-package.php:400
msgid "config.xml must declare a <name> element."
msgstr "config.xml devas deklari elementon <name>."

Expand Down
22 changes: 11 additions & 11 deletions languages/exelearning-es_ES.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -635,46 +635,46 @@ msgstr "El archivo contiene más de un config.xml."
msgid "The style package is missing config.xml."
msgstr "Al paquete de estilo le falta config.xml."

#: includes/class-style-package.php:203
#: includes/class-style-package.php:198
msgid "The archive must contain a single root folder or place all files at the root."
msgstr "El archivo debe contener una única carpeta raíz o tener todos los ficheros en la raíz."

#. translators: %s: offending filename.
#: includes/class-style-package.php:211
#: includes/class-style-package.php:210
#, php-format
msgid "File type not allowed in style package: %s"
msgstr "Tipo de archivo no permitido en el paquete de estilo: %s"

#: includes/class-style-package.php:232
#: includes/class-style-package.php:231
msgid "Failed to reopen ZIP archive."
msgstr "No se pudo reabrir el archivo ZIP."

#: includes/class-style-package.php:243
#: includes/class-style-package.php:242
msgid "Refused unsafe archive entry during extraction."
msgstr "Se rechazó una entrada no segura del archivo durante la extracción."

#: includes/class-style-package.php:290
#: includes/class-style-package.php:289
msgid "Refused path traversal during extraction."
msgstr "Se rechazó un intento de escape de ruta durante la extracción."

#: includes/class-style-package.php:297
#: includes/class-style-package.php:301
#: includes/class-style-package.php:296
#: includes/class-style-package.php:300
msgid "Failed to create a directory from the archive."
msgstr "No se pudo crear un directorio del archivo."

#: includes/class-style-package.php:306
#: includes/class-style-package.php:305
msgid "Failed to read a file from the archive."
msgstr "No se pudo leer un archivo del archivo comprimido."

#: includes/class-style-package.php:310
#: includes/class-style-package.php:309
msgid "Failed to write an extracted file."
msgstr "No se pudo escribir un archivo extraído."

#: includes/class-style-package.php:396
#: includes/class-style-package.php:395
msgid "config.xml is not valid XML."
msgstr "config.xml no es XML válido."

#: includes/class-style-package.php:401
#: includes/class-style-package.php:400
msgid "config.xml must declare a <name> element."
msgstr "config.xml debe declarar un elemento <name>."

Expand Down
22 changes: 11 additions & 11 deletions languages/exelearning-eu.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -635,46 +635,46 @@ msgstr "Artxiboak config.xml bat baino gehiago ditu."
msgid "The style package is missing config.xml."
msgstr "Estilo-paketeari config.xml falta zaio."

#: includes/class-style-package.php:203
#: includes/class-style-package.php:198
msgid "The archive must contain a single root folder or place all files at the root."
msgstr "Artxiboak erro-karpeta bakar bat izan behar du edo fitxategi guztiak erroan jarri."

#. translators: %s: offending filename.
#: includes/class-style-package.php:211
#: includes/class-style-package.php:210
#, php-format
msgid "File type not allowed in style package: %s"
msgstr "Estilo-paketean onartzen ez den fitxategi mota: %s"

#: includes/class-style-package.php:232
#: includes/class-style-package.php:231
msgid "Failed to reopen ZIP archive."
msgstr "Ezin izan da ZIP artxiboa berriro ireki."

#: includes/class-style-package.php:243
#: includes/class-style-package.php:242
msgid "Refused unsafe archive entry during extraction."
msgstr "Erauzketa garaian artxibo-sarrera ez segurua baztertu da."

#: includes/class-style-package.php:290
#: includes/class-style-package.php:289
msgid "Refused path traversal during extraction."
msgstr "Erauzketa garaian bide-zeharkatzea baztertu da."

#: includes/class-style-package.php:297
#: includes/class-style-package.php:301
#: includes/class-style-package.php:296
#: includes/class-style-package.php:300
msgid "Failed to create a directory from the archive."
msgstr "Ezin izan da artxibotik direktorio bat sortu."

#: includes/class-style-package.php:306
#: includes/class-style-package.php:305
msgid "Failed to read a file from the archive."
msgstr "Ezin izan da artxibotik fitxategi bat irakurri."

#: includes/class-style-package.php:310
#: includes/class-style-package.php:309
msgid "Failed to write an extracted file."
msgstr "Ezin izan da erauzitako fitxategi bat idatzi."

#: includes/class-style-package.php:396
#: includes/class-style-package.php:395
msgid "config.xml is not valid XML."
msgstr "config.xml ez da baliozko XML."

#: includes/class-style-package.php:401
#: includes/class-style-package.php:400
msgid "config.xml must declare a <name> element."
msgstr "config.xml-ek <name> elementu bat deklaratu behar du."

Expand Down
Loading
Loading