fix: add CSRF protection and input validation

Author: girishpanchal30

assets/js/single-attachment.js

@@ -125,6 +125,7 @@ jQuery(document).ready(function($) {
   function uploadFile() {
     var formData = new FormData();
     formData.append("action", "optml_replace_file");
+    formData.append("optml_replace_nonce", OMAttachmentEdit.nonce);
     formData.append("attachment_id", OMAttachmentEdit.attachmentId);
     formData.append("file", $("#optml-replace-file-field")[0].files[0]);
 

inc/media_rename/attachment_edit.php

@@ -92,6 +92,7 @@ public function enqueue_scripts( $hook ) {
 					'maxFileSize'  => $max_file_size,
 					'attachmentId' => $id,
 					'mimeType'     => $mime_type,
+					'nonce'        => wp_create_nonce( 'optml_replace_media_nonce' ),
 					'i18n'         => [
 						'maxFileSizeError' => $max_file_size_error,
 						'replaceFileError' => __( 'Error replacing file', 'optimole-wp' ),
@@ -329,7 +330,17 @@ public function save_attachment_filename( $post_id ) {
 	 * Replace the file
 	 */
 	public function replace_file() {
-		$id = (int) sanitize_text_field( $_POST['attachment_id'] );
+		check_ajax_referer( 'optml_replace_media_nonce', 'optml_replace_nonce' );
+
+		$id = absint( $_POST['attachment_id'] ?? 0 );
+
+		if ( ! $id ) {
+			wp_send_json_error( __( 'Invalid attachment ID', 'optimole-wp' ) );
+		}
+
+		if ( get_post_type( $id ) !== 'attachment' ) {
+			wp_send_json_error( __( 'Invalid attachment ID', 'optimole-wp' ) );
+		}
 
 		if ( ! current_user_can( 'edit_post', $id ) ) {
 			wp_send_json_error( __( 'You are not allowed to replace this file', 'optimole-wp' ) );
@@ -339,6 +350,17 @@ public function replace_file() {
 			wp_send_json_error( __( 'No file uploaded', 'optimole-wp' ) );
 		}
 
+		$file_info = wp_check_filetype_and_ext( $_FILES['file']['tmp_name'], $_FILES['file']['name'] );
+
+		if ( empty( $file_info['type'] ) ) {
+			wp_send_json_error( __( 'Could not determine uploaded file type', 'optimole-wp' ) );
+		}
+
+		$original_mime = get_post_mime_type( $id );
+		if ( $file_info['type'] !== $original_mime ) {
+			wp_send_json_error( __( 'Uploaded file type does not match the original attachment', 'optimole-wp' ) );
+		}
+
 		$replacer = new Optml_Attachment_Replace( $id, $_FILES['file'] );
 
 		$replaced = $replacer->replace();