Enhance file upload handling by sanitizing accepted file types in admin settings and custom fields. Additionally, sanitize Content-Type in post endpoints to prevent HTTP header injection, ensuring improved security and data integrity.

Author: kodinkat

dt-core/admin/admin-settings-endpoints.php

@@ -1299,7 +1299,7 @@ public static function edit_field( WP_REST_Request $request ) {
             if ( isset( $post_fields[$field_key]['type'] ) && $post_fields[$field_key]['type'] === 'file_upload' ) {
                 // Accepted file types
                 if ( isset( $post_submission['visibility']['accepted_file_types'] ) && !empty( $post_submission['visibility']['accepted_file_types'] ) ) {
-                    $types = array_map( 'trim', explode( ',', $post_submission['visibility']['accepted_file_types'] ) );
+                    $types = array_map( 'sanitize_text_field', array_map( 'trim', explode( ',', $post_submission['visibility']['accepted_file_types'] ) ) );
                     $custom_field['accepted_file_types'] = $types;
                 }
 

dt-core/admin/menu/tabs/tab-custom-fields.php

@@ -1070,7 +1070,7 @@ private function process_edit_field( $post_submission ){
             if ( $field['type'] === 'file_upload' ) {
                 // Accepted file types
                 if ( isset( $post_submission['accepted_file_types'] ) && !empty( $post_submission['accepted_file_types'] ) ) {
-                    $types = array_map( 'trim', explode( ',', $post_submission['accepted_file_types'] ) );
+                    $types = array_map( 'sanitize_text_field', array_map( 'trim', explode( ',', $post_submission['accepted_file_types'] ) ) );
                     $custom_field['accepted_file_types'] = $types;
                 }
 

dt-posts/dt-posts-endpoints.php

@@ -1504,6 +1504,12 @@ public function storage_download( WP_REST_Request $request ) {
             }
         }
 
+        // Sanitize Content-Type to prevent HTTP header injection (e.g. newlines from S3 or meta).
+        $content_type = sanitize_mime_type( $content_type );
+        if ( $content_type === '' ) {
+            $content_type = 'application/octet-stream';
+        }
+
         // Set headers for file download
         header( 'Content-Type: ' . $content_type );
         header( 'Content-Disposition: attachment; filename="' . esc_attr( $file_name ) . '"' );