Merge pull request #583 from ColinFrick/sanity-check

fix(delete): sanity check filename when deleting file
rosell-dk · Apr 15, 2023 · 0c50bb7 · 0c50bb7
2 parents 35d0a6f + 25af3be
commit 0c50bb7
Showing 1 changed file with 21 additions and 14 deletions.
diff --git a/lib/classes/HandleDeleteFileHook.php b/lib/classes/HandleDeleteFileHook.php
@@ -3,6 +3,7 @@
 namespace WebPExpress;
 use \WebPExpress\Convert;
 use \WebPExpress\Mime;
+use \WebPExpress\SanityCheck;
 
 class HandleDeleteFileHook
 {
@@ -12,22 +13,28 @@ class HandleDeleteFileHook
      */
     public static function deleteAssociatedWebP($filename)
     {
-        $mimeTypes = [
-            'image/jpeg',
-            'image/png',
-        ];
-        if (!Mime::isOneOfTheseImageMimeTypes($filename, $mimeTypes)) {
-            return $filename;
-        }
+        try {
+            $filename = SanityCheck::absPathExistsAndIsFileInDocRoot($filename);
+
+            $mimeTypes = [
+                'image/jpeg',
+                'image/png',
+            ];
+            if (!Mime::isOneOfTheseImageMimeTypes($filename, $mimeTypes)) {
+                return $filename;
+            }
 
-        $config = Config::loadConfigAndFix();
-        $destination = Convert::getDestination($filename, $config);
-        if (@file_exists($destination)) {
-            if (@unlink($destination)) {
-                Convert::updateBiggerThanOriginalMark($filename, $destination, $config);
-            } else {
-                error_log('WebP Express failed deleting webp:' . $destination);
+            $config = Config::loadConfigAndFix();
+            $destination = Convert::getDestination($filename, $config);
+            if (@file_exists($destination)) {
+                if (@unlink($destination)) {
+                    Convert::updateBiggerThanOriginalMark($filename, $destination, $config);
+                } else {
+                    error_log('WebP Express failed deleting webp:' . $destination);
+                }
             }
+        } catch (SanityException $e) {
+            // fail silently. (maybe we should write to debug log instead?)
         }
 
         return $filename;