Skip to content

Commit aadf613

Browse files
Copilotswissspidy
andcommitted
Make PHP extension checks case-insensitive
Convert extension to lowercase before comparison in all PHP extension checks to handle files with uppercase extensions (e.g., .PHP, .Php). This makes the validation more robust and consistent across: - Sanitized filename validation - URL path detection - Gist file filtering Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>
1 parent aa00d38 commit aadf613

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

src/WP_CLI/CommandWithUpgrade.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -384,8 +384,8 @@ protected function install_from_php_file( $url, $assoc_args ) {
384384
// Determine the destination filename and validate extension.
385385
$dest_filename = sanitize_file_name( $filename );
386386

387-
// Ensure the sanitized filename still has a .php extension.
388-
if ( pathinfo( $dest_filename, PATHINFO_EXTENSION ) !== 'php' ) {
387+
// Ensure the sanitized filename still has a .php extension (case-insensitive).
388+
if ( strtolower( pathinfo( $dest_filename, PATHINFO_EXTENSION ) ) !== 'php' ) {
389389
return new WP_Error( 'invalid_filename', 'The sanitized filename does not have a .php extension.' );
390390
}
391391

@@ -472,7 +472,7 @@ protected function is_php_file_url( $slug, $is_remote ) {
472472
}
473473

474474
$url_path = Utils\parse_url( $slug, PHP_URL_PATH );
475-
return is_string( $url_path ) && pathinfo( $url_path, PATHINFO_EXTENSION ) === 'php';
475+
return is_string( $url_path ) && strtolower( pathinfo( $url_path, PATHINFO_EXTENSION ) ) === 'php';
476476
}
477477

478478
/**
@@ -1279,7 +1279,7 @@ protected function get_raw_url_from_gist( $gist_id ) {
12791279
$php_files = [];
12801280
$files = (array) $decoded_body->files;
12811281
foreach ( $files as $filename => $file_data ) {
1282-
if ( is_object( $file_data ) && isset( $file_data->raw_url ) && pathinfo( $filename, PATHINFO_EXTENSION ) === 'php' ) {
1282+
if ( is_object( $file_data ) && isset( $file_data->raw_url ) && strtolower( pathinfo( $filename, PATHINFO_EXTENSION ) ) === 'php' ) {
12831283
$php_files[] = [
12841284
'name' => $filename,
12851285
'raw_url' => $file_data->raw_url,

0 commit comments

Comments
 (0)