From 23b7028239af37391f8a9017d10b3e9ee7d0bc96 Mon Sep 17 00:00:00 2001 From: nazmulhasan103 Date: Thu, 6 Aug 2026 11:34:10 +0600 Subject: [PATCH 1/3] Add Divi Integration to default extensions --- includes/classes/class-extension.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/includes/classes/class-extension.php b/includes/classes/class-extension.php index dfb442759b..8b6e6472c3 100644 --- a/includes/classes/class-extension.php +++ b/includes/classes/class-extension.php @@ -246,6 +246,14 @@ public static function get_default_extensions() { 'active' => true, 'item_id' => 370908, ], + 'directorist-divi-integration' => [ + 'name' => 'Directorist Divi Integration', + 'description' => __( 'Turn your directory into native Divi 5 modules and visually customize listing archives, search, categories, locations, single listings, and author profile pages.', 'directorist' ), + 'link' => 'https://directorist.com/product/directorist-divi-integration/', + 'thumbnail' => 'https://directorist.com/wp-content/uploads/edd/2026/06/Directorist-Divi_620x400.jpg', + 'active' => true, + 'item_id' => 371246, + ], 'directorist-listing-importer' => [ 'name' => 'Directorist Listing Importer', 'description' => __( 'Import Google Maps and feeds into Directorist automatically, effortlessly.', 'directorist' ), From 777b3c065a3752d89ffb49783ec99642d7577323 Mon Sep 17 00:00:00 2001 From: Armanul46 <47377178+Armanul46@users.noreply.github.com> Date: Sun, 9 Aug 2026 11:01:23 +0600 Subject: [PATCH 2/3] fixed security issue --- .../classes/class-submission-controller.php | 85 +++++++++++++++++-- 1 file changed, 80 insertions(+), 5 deletions(-) diff --git a/includes/classes/class-submission-controller.php b/includes/classes/class-submission-controller.php index b86c380c15..e06ffff2ee 100644 --- a/includes/classes/class-submission-controller.php +++ b/includes/classes/class-submission-controller.php @@ -109,6 +109,13 @@ protected static function validate_file_field( $field, &$posted_data ) { } } + $value = self::get_safe_submitted_filename( $value ); + if ( ! $value ) { + $field->add_error( __( 'Invalid file name.', 'directorist' ) ); + + return; + } + try { $upload_dir = wp_get_upload_dir(); $temp_dir = trailingslashit( $upload_dir['basedir'] ) . trailingslashit( directorist_get_temp_upload_dir() . DIRECTORY_SEPARATOR . date( 'nj' ) ); @@ -119,6 +126,12 @@ protected static function validate_file_field( $field, &$posted_data ) { return; } + if ( ! self::is_path_inside_directory( $filepath, $temp_dir ) ) { + $field->add_error( __( 'Invalid file path.', 'directorist' ) ); + + return; + } + $file_type = $field->get_file_types(); if ( in_array( $file_type, array( '', 'all_types', 'all' ), true ) ) { @@ -165,6 +178,37 @@ protected static function validate_file_field( $field, &$posted_data ) { } } + protected static function get_safe_submitted_filename( $filename ) { + if ( ! is_string( $filename ) ) { + return false; + } + + $filename = trim( $filename ); + + if ( '' === $filename || wp_basename( $filename ) !== $filename || preg_match( '#[\\\\/]#', $filename ) ) { + return false; + } + + $sanitized_filename = sanitize_file_name( $filename ); + + if ( '' === $sanitized_filename || $sanitized_filename !== $filename ) { + return false; + } + + return $filename; + } + + protected static function is_path_inside_directory( $path, $directory ) { + $real_path = realpath( $path ); + $real_directory = realpath( $directory ); + + if ( false === $real_path || false === $real_directory ) { + return false; + } + + return 0 === strpos( $real_path, trailingslashit( $real_directory ) ); + } + protected static function get_file_value( $field, &$posted_data ) { $value = $field->get_value( $posted_data ); @@ -184,6 +228,11 @@ protected static function get_file_value( $field, &$posted_data ) { } } + $value = self::get_safe_submitted_filename( $value ); + if ( ! $value ) { + return; + } + try { $upload_dir = wp_get_upload_dir(); $temp_dir = trailingslashit( $upload_dir['basedir'] ) . trailingslashit( directorist_get_temp_upload_dir() . DIRECTORY_SEPARATOR . date( 'nj' ) ); @@ -202,10 +251,18 @@ protected static function get_file_value( $field, &$posted_data ) { return; } + if ( ! self::is_path_inside_directory( $filepath, $temp_dir ) ) { + return; + } + if ( file_exists( $target_dir . $value ) ) { $value = wp_unique_filename( $target_dir, $value ); } + if ( ! self::is_path_inside_directory( $target_dir, $upload_dir['basedir'] ) ) { + return; + } + rename( $filepath, $target_dir . $value ); return trailingslashit( $upload_dir['baseurl'] ) . trailingslashit( 'atbdp_temp' ) . $value; @@ -584,10 +641,11 @@ public static function submit( $posted_data, $from = 'web' ) { static::cache_selected_categories( $directory_id, $posted_data ); - $error = new WP_Error(); - $tax_data = array(); - $meta_data = array(); - $listing_data = array( + $error = new WP_Error(); + $tax_data = array(); + $meta_data = array(); + $api_file_fields = array(); + $listing_data = array( 'post_type' => ATBDP_POST_TYPE ); @@ -667,7 +725,7 @@ public static function submit( $posted_data, $from = 'web' ) { // Exception from the web version. if ( self::$from === 'api' && $field->type === 'file' ) { - $meta_data[ '_' . $field->get_key() ] = self::get_file_value( $field, $posted_data ); + $api_file_fields[] = $field; } } @@ -675,6 +733,10 @@ public static function submit( $posted_data, $from = 'web' ) { return $error; } + foreach ( $api_file_fields as $field ) { + $meta_data[ '_' . $field->get_key() ] = self::get_file_value( $field, $posted_data ); + } + // Terms & conditions and privacy policy have been merged in v8. if ( ! empty( $posted_data['t_c_check'] ) || ! empty( $posted_data['privacy_policy'] ) ) { $meta_data['_t_c_check'] = true; @@ -860,16 +922,29 @@ public static function upload_images( $listing_id, $posted_data ) { continue; } + $image = self::get_safe_submitted_filename( $image ); + if ( ! $image ) { + continue; + } + $filepath = $temp_dir . $image; if ( is_dir( $filepath ) || ! file_exists( $filepath ) ) { continue; } + if ( ! self::is_path_inside_directory( $filepath, $temp_dir ) ) { + continue; + } + if ( file_exists( $target_dir . $image ) ) { $image = wp_unique_filename( $target_dir, $image ); } + if ( ! self::is_path_inside_directory( $target_dir, $upload_dir['basedir'] ) ) { + continue; + } + rename( $filepath, $target_dir . $image ); $mime = wp_check_filetype( $image ); From 8f2ad1ce4496eef889ee17c4f0ee42f812766fc6 Mon Sep 17 00:00:00 2001 From: Armanul46 <47377178+Armanul46@users.noreply.github.com> Date: Sun, 9 Aug 2026 11:16:06 +0600 Subject: [PATCH 3/3] readme update --- config.php | 2 +- directorist-base.php | 2 +- readme.txt | 7 ++++++- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/config.php b/config.php index 066d66da25..ebd94a5c14 100644 --- a/config.php +++ b/config.php @@ -1,7 +1,7 @@