Kritieke uploadkwetsbaarheid in Elementor Pro opgelost in versie 4.2.2

public function validation( $field , ClassesForm_Record $record , ClassesAjax_Handler $ajax_handler ) {
    static $upload_errors = false;

    if ( ! $upload_errors ) {
        $upload_errors = [
            UPLOAD_ERR_OK => esc_html__( 'There is no error, the file uploaded with success.' , 'elementor-pro' ),
            /* translators: 1: upload_max_filesize, 2: php.ini */
            UPLOAD_ERR_INI_SIZE => sprintf( esc_html__( 'The uploaded file exceeds the %1$s directive in %2$s.' , 'elementor-pro' ), 'upload_max_filesize' , 'php.ini' ),
            /* translators: %s: MAX_FILE_SIZE */
            UPLOAD_ERR_FORM_SIZE => sprintf( esc_html__( 'The uploaded file exceeds the %s directive that was specified in the HTML form.' , 'elementor-pro' ), 'MAX_FILE_SIZE' ),
            UPLOAD_ERR_PARTIAL => esc_html__( 'The uploaded file was only partially uploaded.' , 'elementor-pro' ),
            UPLOAD_ERR_NO_FILE => esc_html__( 'No file was uploaded.' , 'elementor-pro' ),
            UPLOAD_ERR_NO_TMP_DIR => esc_html__( 'Missing a temporary folder.' , 'elementor-pro' ),
            UPLOAD_ERR_CANT_WRITE => esc_html__( 'Failed to write file to disk.' , 'elementor-pro' ),
            /* translators: %s: phpinfo() */
            UPLOAD_ERR_EXTENSION => sprintf( esc_html__( 'A PHP extension stopped the file upload. PHP does not provide a way to ascertain which extension caused the file upload to stop; examining the list of loaded extensions with %s may help.' , 'elementor-pro' ), 'phpinfo()' ),
        ];
    }

    $this->fix_file_indices();
    $id = $field[ 'id' ];
    $files = Utils::_unstable_get_super_global_value( $_FILES, 'form_fields' );

    if ( ! empty( $field[ 'max_files' ] ) ) {
        if ( count( $files[ $id ] ) > $field[ 'max_files' ] ) {
            $error_message = sprintf(
                /* translators: %d: Maximum number of allowed files. */
                _n( 'You can upload only %d file.', 'You can upload up to %d files.', intval( $field[ 'max_files' ] ), 'elementor-pro' ),
                intval( $field[ 'max_files' ] )
            );
            $ajax_handler->add_error( $id, $error_message );
            return;
        }
    }

    foreach ( $files[ $id ] as $index => $file ) {
        // not uploaded
        if ( ! $field[ 'required' ] && UPLOAD_ERR_NO_FILE === $file[ 'error' ] ) {
            return;
        }

        // is the file required and missing?
        if ( $field[ 'required' ] && UPLOAD_ERR_NO_FILE === $file[ 'error' ] ) {
            $ajax_handler->add_error( $id, $upload_errors[ $file[ 'error' ] ] );
            return;
        }

        // Has any error with upload the file?
        if ( $file[ 'error' ] > UPLOAD_ERR_OK ) {
            $ajax_handler->add_error( $id, $upload_errors[ $file[ 'error' ] ] );
            return;
        }

        // valid file type?
        if ( ! $this->is_file_type_valid( $field, $file ) ) {
            $ajax_handler->add_error( $id, esc_html__( 'This file type is not allowed.', 'elementor-pro' ) );
        }

        // allowed file size?
        if ( ! $this->is_file_size_valid( $field, $file ) ) {
            $ajax_handler->add_error( $id, esc_html__( 'This file exceeds the maximum allowed size.', 'elementor-pro' ) );
        }
    }
}

public function process_field( $field , ClassesForm_Record $record , ClassesAjax_Handler $ajax_handler ) {
    $id = $field[ 'id' ];
    $files = Utils::_unstable_get_super_global_value( $_FILES, 'form_fields' );

    foreach ( $files[ $id ] as $index => $file ) {
        if ( UPLOAD_ERR_NO_FILE === $file[ 'error' ] ) {
            continue;
        }

        $uploads_dir = $this->get_ensure_upload_dir();
        $file_extension = pathinfo( $file[ 'name' ], PATHINFO_EXTENSION );
        $filename = uniqid() . '.' . $file_extension;
        $filename = wp_unique_filename( $uploads_dir, $filename );
        $new_file = trailingslashit( $uploads_dir ) . $filename;

        if ( is_dir( $uploads_dir ) && is_writable( $uploads_dir ) ) {
            $move_new_file = Plugin::instance()->php_api->move_uploaded_file( $file[ 'tmp_name' ], $new_file );

            if ( false !== $move_new_file ) {
                // Set correct file permissions.
                $perms = 0644;
                @chmod( $new_file, $perms );
                $record->add_file( $id, $index, [
                    'path' => $new_file,
                    'url' => $this->get_file_url( $filename ),
                ] );
            } else {
                $ajax_handler->add_error( $id, esc_html__( 'There was an error while trying to upload your file.', 'elementor-pro' ) );
            }
        } else {
            $ajax_handler->add_admin_error_message( esc_html__( 'Upload directory is not writable or does not exist.', 'elementor-pro' ) );
        }
    }
}