url Optional. URL where users can obtain API credentials. * @type string $setting_name Optional. The setting name for the API key. * @type string $constant_name Optional. PHP constant name for the API key. * @type string $env_var_name Optional. Environment variable name for the API key. * } * @type array $plugin { * Optional. Plugin data for install/activate UI. * * @type string $file The plugin's main file path relative to the plugins * directory (e.g. 'my-plugin/my-plugin.php' or 'hello.php'). * @type callable $is_active Callback to determine whether the plugin is active. Receives no arguments and must return bool. * Defaults to `__return_true`. * } * } * } * @phpstan-return array */ function wp_get_connectors(): array { $registry = WP_Connector_Registry::get_instance(); if ( null === $registry ) { return array(); } return $registry->get_all_registered(); } /** * Resolves an AI provider logo file path to a URL. * * Converts an absolute file path to a plugin URL. The path must reside within * the plugins or must-use plugins directory. * * @since 7.0.0 * @access private * * @param string $path Absolute path to the logo file. * @return non-empty-string|null The URL to the logo file, or null if the path is invalid. */ function _wp_connectors_resolve_ai_provider_logo_url( string $path ): ?string { if ( ! $path ) { return null; } $path = wp_normalize_path( $path ); if ( ! file_exists( $path ) ) { return null; } $mu_plugin_dir = wp_normalize_path( WPMU_PLUGIN_DIR ); if ( str_starts_with( $path, $mu_plugin_dir . '/' ) ) { $logo_url = plugins_url( substr( $path, strlen( $mu_plugin_dir ) ), WPMU_PLUGIN_DIR . '/.' ); return $logo_url ? $logo_url : null; } $plugin_dir = wp_normalize_path( WP_PLUGIN_DIR ); if ( str_starts_with( $path, $plugin_dir . '/' ) ) { $logo_url = plugins_url( substr( $path, strlen( $plugin_dir ) ) ); return $logo_url ? $logo_url : null; } _doing_it_wrong( __FUNCTION__, __( 'Provider logo path must be located within the plugins or must-use plugins directory.' ), '7.0.0' ); return null; } /** * Initializes the connector registry with default connectors and fires the registration action. * * Creates the registry instance, registers built-in connectors (which cannot be unhooked), * and then fires the `wp_connectors_init` action for plugins to register their own connectors. * * @since 7.0.0 * @access private */ function _wp_connectors_init(): void { $registry = new WP_Connector_Registry(); WP_Connector_Registry::set_instance( $registry ); // Only register default AI providers if AI support is enabled. if ( wp_supports_ai() ) { _wp_connectors_register_default_ai_providers( $registry ); } // Non-AI default connectors. $registry->register( 'akismet', array( 'name' => __( 'Akismet Anti-spam' ), 'description' => __( 'Protect your site from spam.' ), 'type' => 'spam_filtering', 'plugin' => array( 'file' => 'akismet/akismet.php', 'is_active' => static function () { return defined( 'AKISMET_VERSION' ); }, ), 'authentication' => array( 'method' => 'api_key', 'credentials_url' => 'https://akismet.com/get/', 'setting_name' => 'wordpress_api_key', 'constant_name' => 'WPCOM_API_KEY', ), ) ); /** * Fires when the connector registry is ready for plugins to register connectors. * * Built-in connectors and any AI providers auto-discovered from the WP AI Client * registry have already been registered at this point and cannot be unhooked. * * AI provider plugins that register with the WP AI Client do not need to use * this action — their connectors are created automatically. This action is * primarily for registering non-AI-provider connectors or overriding metadata * on existing connectors. * * Use `$registry->register()` within this action to add new connectors. * To override an existing connector, unregister it first, then re-register * with updated data. * * Example — overriding metadata on an auto-discovered connector: * * add_action( 'wp_connectors_init', function ( WP_Connector_Registry $registry ) { * if ( $registry->is_registered( 'anthropic' ) ) { * $connector = $registry->unregister( 'anthropic' ); * $connector['description'] = __( 'Custom description for Anthropic.', 'my-plugin' ); * $registry->register( 'anthropic', $connector ); * } * } ); * * @since 7.0.0 * * @param WP_Connector_Registry $registry Connector registry instance. */ do_action( 'wp_connectors_init', $registry ); } /** * Registers connectors for the built-in AI providers. * * @since 7.0.0 * @access private * * @param WP_Connector_Registry $registry The connector registry instance. */ function _wp_connectors_register_default_ai_providers( WP_Connector_Registry $registry ): void { // Built-in connectors. $defaults = array( 'anthropic' => array( 'name' => 'Anthropic', 'description' => __( 'Text generation with Claude.' ), 'type' => 'ai_provider', 'plugin' => array( 'file' => 'ai-provider-for-anthropic/plugin.php', ), 'authentication' => array( 'method' => 'api_key', 'credentials_url' => 'https://platform.claude.com/settings/keys', ), ), 'google' => array( 'name' => 'Google', 'description' => __( 'Text and image generation with Gemini and Imagen.' ), 'type' => 'ai_provider', 'plugin' => array( 'file' => 'ai-provider-for-google/plugin.php', ), 'authentication' => array( 'method' => 'api_key', 'credentials_url' => 'https://aistudio.google.com/api-keys', ), ), 'openai' => array( 'name' => 'OpenAI', 'description' => __( 'Text and image generation with GPT and Dall-E.' ), 'type' => 'ai_provider', 'plugin' => array( 'file' => 'ai-provider-for-openai/plugin.php', ), 'authentication' => array( 'method' => 'api_key', 'credentials_url' => 'https://platform.openai.com/api-keys', ), ), ); // Merge AI Client registry data on top of defaults. // Registry values (from provider plugins) take precedence over hardcoded fallbacks. $ai_registry = AiClient::defaultRegistry(); foreach ( array_filter( $ai_registry->getRegisteredProviderIds() ) as $connector_id ) { $provider_class_name = $ai_registry->getProviderClassName( $connector_id ); $provider_metadata = $provider_class_name::metadata(); $auth_method = $provider_metadata->getAuthenticationMethod(); $is_api_key = null !== $auth_method && $auth_method->isApiKey(); if ( $is_api_key ) { $credentials_url = $provider_metadata->getCredentialsUrl(); $authentication = array( 'method' => 'api_key', ); if ( $credentials_url ) { $authentication['credentials_url'] = $credentials_url; } } else { $authentication = array( 'method' => 'none' ); } $name = $provider_metadata->getName(); $description = $provider_metadata->getDescription(); $logo_url = $provider_metadata->getLogoPath() ? _wp_connectors_resolve_ai_provider_logo_url( $provider_metadata->getLogoPath() ) : null; if ( isset( $defaults[ $connector_id ] ) ) { // Override fields with non-empty registry values. if ( $name ) { $defaults[ $connector_id ]['name'] = $name; } if ( $description ) { $defaults[ $connector_id ]['description'] = $description; } if ( $logo_url ) { $defaults[ $connector_id ]['logo_url'] = $logo_url; } // Always update auth method; keep existing credentials_url as fallback. $defaults[ $connector_id ]['authentication']['method'] = $authentication['method']; if ( ! empty( $authentication['credentials_url'] ) ) { $defaults[ $connector_id ]['authentication']['credentials_url'] = $authentication['credentials_url']; } } else { $defaults[ $connector_id ] = array( 'name' => $name ? $name : ucwords( $connector_id ), 'description' => $description ? $description : '', 'type' => 'ai_provider', 'authentication' => $authentication, ); if ( $logo_url ) { $defaults[ $connector_id ]['logo_url'] = $logo_url; } } } // Register all default connectors directly on the registry. foreach ( $defaults as $id => $args ) { if ( 'api_key' === $args['authentication']['method'] ) { $sanitized_id = str_replace( '-', '_', $id ); $args['authentication']['setting_name'] = "connectors_ai_{$sanitized_id}_api_key"; // All AI providers use the {CONSTANT_CASE_ID}_API_KEY naming convention. $constant_case_key = strtoupper( (string) preg_replace( '/([a-z])([A-Z])/', '$1_$2', $sanitized_id ) ) . '_API_KEY'; $args['authentication']['constant_name'] = $constant_case_key; $args['authentication']['env_var_name'] = $constant_case_key; } $args['plugin']['is_active'] = static function () use ( $ai_registry, $id ): bool { try { return $ai_registry->hasProvider( $id ); } catch ( Exception $e ) { return false; } }; $registry->register( $id, $args ); } } /** * Masks an API key, showing only the last 4 characters. * * @since 7.0.0 * @access private * * @param string $key The API key to mask. * @return string The masked key, e.g. "************fj39". */ function _wp_connectors_mask_api_key( string $key ): string { if ( strlen( $key ) <= 4 ) { return $key; } return str_repeat( "\u{2022}", min( strlen( $key ) - 4, 16 ) ) . substr( $key, -4 ); } /** * Determines the source of an API key for a given connector. * * Checks in order: environment variable, PHP constant, database. * Environment variable and constant are only checked when their * respective names are provided. * * @since 7.0.0 * @access private * * @param string $setting_name The option name for the API key (e.g., 'connectors_spam_filtering_my_plugin_api_key'). * @param string $env_var_name Optional. Environment variable name to check (e.g., 'MY_PLUGIN_API_KEY'). * @param string $constant_name Optional. PHP constant name to check (e.g., 'MY_PLUGIN_API_KEY'). * @return string The key source: 'env', 'constant', 'database', or 'none'. */ function _wp_connectors_get_api_key_source( string $setting_name, string $env_var_name = '', string $constant_name = '' ): string { // Check environment variable first. if ( '' !== $env_var_name ) { $env_value = getenv( $env_var_name ); if ( false !== $env_value && '' !== $env_value ) { return 'env'; } } // Check PHP constant. if ( '' !== $constant_name && defined( $constant_name ) ) { $const_value = constant( $constant_name ); if ( is_string( $const_value ) && '' !== $const_value ) { return 'constant'; } } // Check database. $db_value = get_option( $setting_name, '' ); if ( '' !== $db_value ) { return 'database'; } return 'none'; } /** * Checks whether an API key is valid for a given provider. * * @since 7.0.0 * @access private * * @param string $key The API key to check. * @param string $provider_id The WP AI client provider ID. * @return bool|null True if valid, false if invalid, null if unable to determine. */ function _wp_connectors_is_ai_api_key_valid( string $key, string $provider_id ): ?bool { try { $registry = AiClient::defaultRegistry(); if ( ! $registry->hasProvider( $provider_id ) ) { _doing_it_wrong( __FUNCTION__, sprintf( /* translators: %s: AI provider ID. */ __( 'The provider "%s" is not registered in the AI client registry.' ), $provider_id ), '7.0.0' ); return null; } $registry->setProviderRequestAuthentication( $provider_id, new ApiKeyRequestAuthentication( $key ) ); return $registry->isProviderConfigured( $provider_id ); } catch ( Exception $e ) { wp_trigger_error( __FUNCTION__, $e->getMessage() ); return null; } } /** * Masks and validates connector API keys in REST responses. * * On every `/wp/v2/settings` response, masks connector API key values so raw * keys are never exposed via the REST API. * * On POST or PUT requests, validates each updated key against the provider * before masking. If validation fails, the key is reverted to an empty string. * * @since 7.0.0 * @access private * * @param WP_REST_Response $response The response object. * @param WP_REST_Server $server The server instance. * @param WP_REST_Request $request The request object. * @return WP_REST_Response The modified response with masked/validated keys. */ function _wp_connectors_rest_settings_dispatch( WP_REST_Response $response, WP_REST_Server $server, WP_REST_Request $request ): WP_REST_Response { if ( '/wp/v2/settings' !== $request->get_route() ) { return $response; } $data = $response->get_data(); if ( ! is_array( $data ) ) { return $response; } $is_update = 'POST' === $request->get_method() || 'PUT' === $request->get_method(); foreach ( wp_get_connectors() as $connector_id => $connector_data ) { $auth = $connector_data['authentication']; if ( 'api_key' !== $auth['method'] || empty( $auth['setting_name'] ) ) { continue; } $setting_name = $auth['setting_name']; if ( ! array_key_exists( $setting_name, $data ) ) { continue; } $value = $data[ $setting_name ]; // On update, validate AI provider keys before masking. // Non-AI connectors accept keys as-is; the service plugin handles its own validation. if ( $is_update && is_string( $value ) && '' !== $value && 'ai_provider' === $connector_data['type'] ) { if ( true !== _wp_connectors_is_ai_api_key_valid( $value, $connector_id ) ) { update_option( $setting_name, '' ); $data[ $setting_name ] = ''; continue; } } // Mask the key in the response. if ( is_string( $value ) && '' !== $value ) { $data[ $setting_name ] = _wp_connectors_mask_api_key( $value ); } } $response->set_data( $data ); return $response; } add_filter( 'rest_post_dispatch', '_wp_connectors_rest_settings_dispatch', 10, 3 ); /** * Registers default connector settings. * * @since 7.0.0 * @access private */ function _wp_register_default_connector_settings(): void { $registered_settings = get_registered_settings(); foreach ( wp_get_connectors() as $connector_data ) { $auth = $connector_data['authentication']; if ( 'api_key' !== $auth['method'] || empty( $auth['setting_name'] ) ) { continue; } // Skip if the setting is already registered (e.g. by an owning plugin). if ( isset( $registered_settings[ $auth['setting_name'] ] ) ) { continue; } if ( ! isset( $connector_data['plugin']['is_active'] ) || ! is_callable( $connector_data['plugin']['is_active'] ) ) { continue; } if ( ! call_user_func( $connector_data['plugin']['is_active'] ) ) { continue; } register_setting( 'connectors', $auth['setting_name'], array( 'type' => 'string', 'label' => sprintf( /* translators: %s: Connector name. */ __( '%s API Key' ), $connector_data['name'] ), 'description' => sprintf( /* translators: %s: Connector name. */ __( 'API key for the %s connector.' ), $connector_data['name'] ), 'default' => '', 'show_in_rest' => true, 'sanitize_callback' => 'sanitize_text_field', ) ); } } add_action( 'init', '_wp_register_default_connector_settings', 20 ); /** * Passes stored connector API keys to the WP AI client. * * @since 7.0.0 * @access private */ function _wp_connectors_pass_default_keys_to_ai_client(): void { try { $ai_registry = AiClient::defaultRegistry(); foreach ( wp_get_connectors() as $connector_id => $connector_data ) { if ( 'ai_provider' !== $connector_data['type'] ) { continue; } $auth = $connector_data['authentication']; if ( 'api_key' !== $auth['method'] || empty( $auth['setting_name'] ) ) { continue; } if ( ! $ai_registry->hasProvider( $connector_id ) ) { continue; } // Skip if the key is already provided via env var or constant. $key_source = _wp_connectors_get_api_key_source( $auth['setting_name'], $auth['env_var_name'] ?? '', $auth['constant_name'] ?? '' ); if ( 'env' === $key_source || 'constant' === $key_source ) { continue; } $api_key = get_option( $auth['setting_name'], '' ); if ( ! is_string( $api_key ) || '' === $api_key ) { continue; } $ai_registry->setProviderRequestAuthentication( $connector_id, new ApiKeyRequestAuthentication( $api_key ) ); } } catch ( Exception $e ) { wp_trigger_error( __FUNCTION__, $e->getMessage() ); } } add_action( 'init', '_wp_connectors_pass_default_keys_to_ai_client', 20 ); /** * Exposes connector settings to the connectors-wp-admin script module. * * @since 7.0.0 * @access private * * @param array $data Existing script module data. * @return array Script module data with connectors added. */ function _wp_connectors_get_connector_script_module_data( array $data ): array { $registry = AiClient::defaultRegistry(); if ( ! function_exists( 'validate_plugin' ) ) { require_once ABSPATH . 'wp-admin/includes/plugin.php'; } $connectors = array(); foreach ( wp_get_connectors() as $connector_id => $connector_data ) { $auth = $connector_data['authentication']; $auth_out = array( 'method' => $auth['method'] ); if ( 'api_key' === $auth['method'] ) { $auth_out['settingName'] = $auth['setting_name'] ?? ''; $auth_out['credentialsUrl'] = $auth['credentials_url'] ?? null; $key_source = _wp_connectors_get_api_key_source( $auth['setting_name'] ?? '', $auth['env_var_name'] ?? '', $auth['constant_name'] ?? '' ); $auth_out['keySource'] = $key_source; if ( 'ai_provider' === $connector_data['type'] ) { try { $auth_out['isConnected'] = $registry->hasProvider( $connector_id ) && $registry->isProviderConfigured( $connector_id ); } catch ( Exception $e ) { $auth_out['isConnected'] = false; } } else { $auth_out['isConnected'] = 'none' !== $key_source; } } $connector_out = array( 'name' => $connector_data['name'], 'description' => $connector_data['description'], 'logoUrl' => ! empty( $connector_data['logo_url'] ) ? $connector_data['logo_url'] : null, 'type' => $connector_data['type'], 'authentication' => $auth_out, ); if ( ! empty( $connector_data['plugin']['file'] ) ) { $file = $connector_data['plugin']['file']; $is_activated = (bool) call_user_func( $connector_data['plugin']['is_active'] ); $is_installed = $is_activated || 0 === validate_plugin( $file ); $connector_out['plugin'] = array( 'file' => $file, 'isInstalled' => $is_installed, 'isActivated' => $is_activated, ); } $connectors[ $connector_id ] = $connector_out; } ksort( $connectors ); $data['connectors'] = $connectors; $data['isFileModDisabled'] = ! wp_is_file_mod_allowed( 'install_plugins' ); return $data; } add_filter( 'script_module_data_options-connectors-wp-admin', '_wp_connectors_get_connector_script_module_data' ); ! isset( $data['fileData'] ) ) { if ( empty( $data['tmp_name'] ) ) { return new \WP_Error( 'file_error', esc_html__( 'Invalid temporary file path.', 'elementor' ) ); } // Path validation only applies to direct calls (e.g. import_template) where // tmp_name originates from user input. When is_elementor_upload is true, this // method is used as a WordPress filter (wp_handle_sideload_prefilter) and // tmp_name is set by WordPress core. if ( ! $this->is_elementor_upload && ! $this->is_path_in_allowed_dir( $data['tmp_name'] ) ) { return new \WP_Error( 'file_error', esc_html__( 'Invalid temporary file path.', 'elementor' ) ); } } $validation_result = $this->validate_file( $data, $allowed_file_extensions ); if ( is_wp_error( $validation_result ) ) { if ( ! empty( $data['tmp_name'] ) ) { $this->remove_file_or_dir( dirname( $data['tmp_name'] ) ); } return $validation_result; } return $data; } /** * Is Unfiltered Uploads Enabled * * @since 3.5.0 * @access public * * @return bool */ final public static function are_unfiltered_uploads_enabled() { $enabled = (bool) get_option( self::UNFILTERED_FILE_UPLOADS_KEY ) && Svg::file_sanitizer_can_run() && User::is_current_user_can_upload_json(); /** * Allow Unfiltered Files Upload. * * Determines whether to enable unfiltered file uploads. * * @since 3.0.0 * * @param bool $enabled Whether upload is enabled or not. */ $enabled = apply_filters( 'elementor/files/allow_unfiltered_upload', $enabled ); return $enabled; } /** * Handle Elementor WP Media Upload * * Runs on the 'wp_handle_upload_prefilter' filter. * * @since 3.2.0 * @access public * * @param $file * @return mixed */ public function handle_elementor_wp_media_upload( $file ) { // If it isn't a file uploaded by Elementor, we do not intervene. if ( ! $this->is_elementor_wp_media_upload() ) { return $file; } $result = $this->validate_file( $file ); if ( is_wp_error( $result ) ) { $file['error'] = $result->get_error_message(); } return $file; } /** * Get File Type Handler * * Initialize the proper file type handler according to the file extension * and assign it to the file type handlers array. * * @since 3.3.0 * @access public * * @param string|null $file_extension - file extension * @return File_Type_Base[]|File_Type_Base */ public function get_file_type_handlers( $file_extension = null ) { return self::get_items( $this->file_type_handlers, $file_extension ); } /** * Check filetype and ext * * A workaround for upload validation which relies on a PHP extension (fileinfo) * with inconsistent reporting behaviour. * ref: https://core.trac.wordpress.org/ticket/39550 * ref: https://core.trac.wordpress.org/ticket/40175 * * @since 3.5.0 * @access public * * @param $data * @param $file * @param $filename * @param $mimes * * @return mixed */ public function check_filetype_and_ext( $data, $file, $filename, $mimes ) { if ( ! empty( $data['ext'] ) && ! empty( $data['type'] ) ) { return $data; } $wp_file_type = wp_check_filetype( $filename, $mimes ); $file_type_handlers = $this->get_file_type_handlers(); if ( isset( $file_type_handlers[ $wp_file_type['ext'] ] ) ) { $file_type_handler = $file_type_handlers[ $wp_file_type['ext'] ]; $data['ext'] = $file_type_handler->get_file_extension(); $data['type'] = $file_type_handler->get_mime_type(); } return $data; } /** * Check if path is within the allowed Elementor uploads directory. * * Prevents path traversal and arbitrary directory deletion by ensuring the path * resolves under wp-content/uploads/elementor/ or under the configured temp dir * (elementor/files/temp-dir filter), so that cleanup works when temp dir is customized. * * @since 3.35.4 * @access private * * @param string $path * @return bool */ private function is_path_in_allowed_dir( $path ) { if ( ! is_string( $path ) || '' === $path ) { return false; } $real_path = realpath( $path ); if ( false === $real_path ) { $real_path = realpath( dirname( $path ) ); if ( false === $real_path ) { return false; } } $wp_upload_dir = wp_upload_dir(); $elementor_base = realpath( $wp_upload_dir['basedir'] . DIRECTORY_SEPARATOR . self::ELEMENTOR_UPLOAD_DIR ); if ( false !== $elementor_base ) { $allowed = $real_path === $elementor_base || 0 === strpos( $real_path, $elementor_base . DIRECTORY_SEPARATOR ); if ( $allowed ) { return true; } } $temp_dir = realpath( $this->get_temp_dir() ); if ( false !== $temp_dir ) { $temp_dir = rtrim( $temp_dir, DIRECTORY_SEPARATOR ) . DIRECTORY_SEPARATOR; return 0 === strpos( $real_path, $temp_dir ); } return false; } /** * Remove File Or Directory * * Directory is deleted recursively with all of its contents (subdirectories and files). * Only paths under wp-content/uploads/elementor/ are allowed (security: prevents arbitrary directory deletion). * * @since 3.3.0 * @access public * * @param string $path */ public function remove_file_or_dir( $path ) { if ( ! $this->is_path_in_allowed_dir( $path ) ) { return; } if ( is_dir( $path ) ) { $this->remove_directory_with_files( $path ); } elseif ( is_file( $path ) ) { unlink( $path ); } } /** * Create Temp File * * Create a random temporary file. * * @since 3.3.0 * @access public * * @param string $file_content * @param string $file_name * @return string|\WP_Error */ public function create_temp_file( $file_content, $file_name ) { $file_name = str_replace( ' ', '', sanitize_file_name( $file_name ) ); if ( empty( $file_name ) ) { return new \WP_Error( 'invalid_file_name', esc_html__( 'Invalid file name.', 'elementor' ) ); } $temp_filename = $this->create_unique_dir() . $file_name; /** * Temp File Path * * Allows modifying the full path of the temporary file. * * @since 3.7.0 * * @param string full path to file */ $temp_filename = apply_filters( 'elementor/files/temp-file-path', $temp_filename ); file_put_contents( $temp_filename, $file_content ); // phpcs:ignore return $temp_filename; } /** * Get Temp Directory * * Get the temporary files directory path. If the directory does not exist, this method creates it. * * @since 3.3.0 * @access public * * @return string $temp_dir */ public function get_temp_dir() { if ( ! $this->temp_dir ) { $wp_upload_dir = wp_upload_dir(); $temp_dir = implode( DIRECTORY_SEPARATOR, [ $wp_upload_dir['basedir'], self::ELEMENTOR_UPLOAD_DIR, 'tmp' ] ) . DIRECTORY_SEPARATOR; /** * Temp File Path * * Allows modifying the full path of the temporary file. * * @since 3.7.0 * * @param string temporary directory */ $this->temp_dir = apply_filters( 'elementor/files/temp-dir', $temp_dir ); if ( ! is_dir( $this->temp_dir ) ) { wp_mkdir_p( $this->temp_dir ); } } return $this->temp_dir; } /** * Create Unique Temp Dir * * Create a unique temporary directory * * @since 3.3.0 * @access public * * @return string the new directory path */ public function create_unique_dir() { $unique_dir_path = $this->get_temp_dir() . uniqid() . DIRECTORY_SEPARATOR; wp_mkdir_p( $unique_dir_path ); return $unique_dir_path; } /** * Register Ajax Actions * * Runs on the 'elementor/ajax/register_actions' hook. Receives the AJAX module as a parameter and registers * callbacks for specified action IDs. * * @since 3.5.0 * @access public * * @param Ajax $ajax */ public function register_ajax_actions( Ajax $ajax ) { $ajax->register_ajax_action( 'enable_unfiltered_files_upload', [ $this, 'enable_unfiltered_files_upload' ] ); $ajax->register_ajax_action( 'enqueue_google_fonts', [ $this, 'ajax_enqueue_google_fonts' ] ); } /** * Set Unfiltered Files Upload * * @since 3.5.0 * @access public */ public function enable_unfiltered_files_upload() { if ( ! current_user_can( 'manage_options' ) ) { return; } update_option( self::UNFILTERED_FILE_UPLOADS_KEY, 1 ); } public function ajax_enqueue_google_fonts( $data ): bool { if ( empty( $data['font_name'] ) ) { return false; } $font_type = Fonts::get_font_type( $data['font_name'] ); if ( Fonts::GOOGLE !== $font_type ) { return false; } Google_Font::enqueue( $data['font_name'] ); return true; } /** * Support Unfiltered File Uploads * * When uploading a file within Elementor, this method adds the registered * file types to WordPress' allowed mimes list. This will only happen if the user allowed unfiltered file uploads * in Elementor's settings in the admin dashboard. * * @since 3.5.0 * @access public * * @param array $allowed_mimes * @return array allowed mime types */ final public function support_unfiltered_elementor_file_uploads( $allowed_mimes ) { if ( $this->is_elementor_upload() && $this->are_unfiltered_uploads_enabled() ) { foreach ( $this->file_type_handlers as $file_type_handler ) { $allowed_mimes[ $file_type_handler->get_file_extension() ] = $file_type_handler->get_mime_type(); } } return $allowed_mimes; } /** * Set Elementor Upload State * * @since 3.5.0 * @access public * * @param $state */ public function set_elementor_upload_state( $state ) { $this->is_elementor_upload = $state; } /** * Is Elementor Upload * * This method checks if the current session includes a request to upload files made via Elementor. * * @since 3.5.0 * @access private * * @return bool */ private function is_elementor_upload() { return $this->is_elementor_upload || $this->is_elementor_media_upload() || $this->is_elementor_wp_media_upload(); } /** * Is Elementor Media Upload * * Checks whether the current request includes uploading files via Elementor which are not destined for the Media * Library. * * @since 3.5.0 * @access public * * @return bool */ public function is_elementor_media_upload() { // Sometimes `uploadTypeCaller` passed as a GET parameter when using the WP Media Library REST API, where the // whole request body is occupied by the uploaded file. return isset( $_REQUEST['uploadTypeCaller'] ) && 'elementor-media-upload' === $_REQUEST['uploadTypeCaller']; // phpcs:ignore } /** * Is Elementor WP Media Upload * * Checks whether the current request is a request to upload files into the WP Media Library via Elementor. * * @since 3.3.0 * @access private * * @return bool */ private function is_elementor_wp_media_upload() { return isset( $_REQUEST['uploadTypeCaller'] ) && 'elementor-wp-media-upload' === $_REQUEST['uploadTypeCaller']; // phpcs:ignore } /** * Add File Extension To Allowed Extensions List * * @since 3.3.0 * @access private * * @param string $file_type */ private function add_file_extension_to_allowed_extensions_list( $file_type ) { $file_handler = $this->file_type_handlers[ $file_type ]; $file_extension = $file_handler->get_file_extension(); // Only add the file extension to the list if it doesn't already exist in it. if ( ! in_array( $file_extension, $this->allowed_file_extensions, true ) ) { $this->allowed_file_extensions[] = $file_extension; } } /** * Save Base64 as File * * Saves a Base64 string as a .tmp file in Elementor's temporary files directory. * * @since 3.3.0 * @access private * * @param $file * @param array|null $allowed_file_extensions * * @return array|\WP_Error */ private function save_base64_to_tmp_file( $file, $allowed_file_extensions = null ) { if ( empty( $file['fileName'] ) || empty( $file['fileData'] ) ) { return new \WP_Error( 'file_error', self::INVALID_FILE_CONTENT ); } $file_extension = pathinfo( $file['fileName'], PATHINFO_EXTENSION ); $is_file_type_allowed = $this->is_file_type_allowed( $file_extension, $allowed_file_extensions ); if ( is_wp_error( $is_file_type_allowed ) ) { return $is_file_type_allowed; } $file_content = base64_decode( $file['fileData'] ); // phpcs:ignore // If the decode fails if ( ! $file_content ) { return new \WP_Error( 'file_error', self::INVALID_FILE_CONTENT ); } $temp_filename = $this->create_temp_file( $file_content, $file['fileName'] ); if ( is_wp_error( $temp_filename ) ) { return $temp_filename; } return [ // the original uploaded file name 'name' => $file['fileName'], // The path to the temporary file 'tmp_name' => $temp_filename, ]; } /** * Validate File * * @since 3.3.0 * @access private * * @param array $file * @param array $file_extensions Optional * @return bool|\WP_Error */ private function validate_file( array $file, $file_extensions = [] ) { $uploaded_file_name = isset( $file['name'] ) ? $file['name'] : $file['tmp_name']; $file_extension = pathinfo( $uploaded_file_name, PATHINFO_EXTENSION ); if ( ! $this->is_elementor_wp_media_upload() ) { $is_file_type_allowed = $this->is_file_type_allowed( $file_extension, $file_extensions ); if ( is_wp_error( $is_file_type_allowed ) ) { return $is_file_type_allowed; } } $file_type_handler = $this->get_file_type_handlers( $file_extension ); // If Elementor does not have a handler for this file type, don't block it. if ( ! $file_type_handler ) { return true; } // If there is a File Type Handler for the uploaded file, it means it is a non-standard file type. In this case, // we check if unfiltered file uploads are enabled or not before allowing it. if ( ! self::are_unfiltered_uploads_enabled() ) { $error = 'json' === $file_extension ? esc_html__( 'You do not have permission to upload JSON files.', 'elementor' ) : esc_html__( 'This file is not allowed for security reasons.', 'elementor' ); return new \WP_Error( Exceptions::FORBIDDEN, $error ); } // Here is each file type handler's chance to run its own specific validations return $file_type_handler->validate_file( $file ); } /** * Is File Type Allowed * * Checks whether the passed file extension is allowed for upload. * * @since 3.5.0 * @access private * * @param $file_extension * @param $filtered_file_extensions * @return bool|\WP_Error */ private function is_file_type_allowed( $file_extension, $filtered_file_extensions ) { $allowed_file_extensions = $this->get_allowed_file_extensions(); if ( $filtered_file_extensions ) { $allowed_file_extensions = array_intersect( $allowed_file_extensions, $filtered_file_extensions ); } $is_allowed = false; // Check if the file type (extension) is in the allowed extensions list. If it is a non-standard file type (not // enabled by default in WordPress) and unfiltered file uploads are not enabled, it will not be in the allowed // file extensions list. foreach ( $allowed_file_extensions as $allowed_extension ) { if ( preg_match( '/' . $allowed_extension . '/', $file_extension ) ) { $is_allowed = true; break; } } if ( ! $is_allowed ) { $is_allowed = new \WP_Error( Exceptions::FORBIDDEN, 'Uploading this file type is not allowed.' ); } /** * Elementor File Type Allowed * * Allows setting file types * * @since 3.5.0 * * @param bool|\WP_Error $is_allowed */ return apply_filters( 'elementor/files/allow-file-type/' . $file_extension, $is_allowed ); } /** * Remove Directory with Files * * @since 3.3.0 * @access private * * @param string $dir * @return bool */ private function remove_directory_with_files( $dir ) { $dir_iterator = new \RecursiveDirectoryIterator( $dir, \RecursiveDirectoryIterator::SKIP_DOTS ); foreach ( new \RecursiveIteratorIterator( $dir_iterator, \RecursiveIteratorIterator::CHILD_FIRST ) as $name => $item ) { if ( is_dir( $name ) ) { rmdir( $name ); } elseif ( is_file( $name ) ) { unlink( $name ); } } return rmdir( $dir ); } /** * Get Allowed File Extensions * * Retrieve an array containing the list of file extensions allowed for upload. * * @since 3.3.0 * @access private * * @return array file extension/s */ private function get_allowed_file_extensions() { if ( ! $this->allowed_file_extensions ) { $this->allowed_file_extensions = array_keys( get_allowed_mime_types() ); foreach ( $this->get_file_type_handlers() as $file_type => $handler ) { if ( $handler->is_upload_allowed() ) { // Add the file extension to the allowed extensions list only if unfiltered files upload is enabled. $this->add_file_extension_to_allowed_extensions_list( $file_type ); } } } return $this->allowed_file_extensions; } public function __construct() { $this->register_file_types(); add_filter( 'upload_mimes', [ $this, 'support_unfiltered_elementor_file_uploads' ] ); add_filter( 'wp_handle_upload_prefilter', [ $this, 'handle_elementor_wp_media_upload' ] ); add_filter( 'wp_check_filetype_and_ext', [ $this, 'check_filetype_and_ext' ], 10, 4 ); // Ajax. add_action( 'elementor/ajax/register_actions', [ $this, 'register_ajax_actions' ] ); } }
Fatal error: Uncaught Error: Class "Elementor\Core\Files\Uploads_Manager" not found in /htdocs/wp-content/plugins/elementor/includes/plugin.php:720 Stack trace: #0 /htdocs/wp-content/plugins/elementor/includes/plugin.php(630): Elementor\Plugin->init_components() #1 /htdocs/wp-includes/class-wp-hook.php(341): Elementor\Plugin->init('') #2 /htdocs/wp-includes/class-wp-hook.php(365): WP_Hook->apply_filters(NULL, Array) #3 /htdocs/wp-includes/plugin.php(522): WP_Hook->do_action(Array) #4 /htdocs/wp-settings.php(771): do_action('init') #5 /htdocs/wp-config.php(131): require_once('/htdocs/wp-sett...') #6 /htdocs/wp-load.php(50): require_once('/htdocs/wp-conf...') #7 /htdocs/wp-blog-header.php(13): require_once('/htdocs/wp-load...') #8 /htdocs/index.php(17): require('/htdocs/wp-blog...') #9 {main} thrown in /htdocs/wp-content/plugins/elementor/includes/plugin.php on line 720