nixpanelandClaude Sonnet 5
39af8d650d
The toggle existed in the UI with no implementation behind it, so uploads were rejected regardless of the setting. New SvgUploads class: - Allowlists the SVG mime type and fixes WP's real-mime sniff, which otherwise nulls out the file type for SVGs specifically even after the mime allowlist is updated. - Populates width/height metadata (parsed from the SVG's own viewBox/width/height) — without this, wp_get_missing_image_subsizes() throws undefined-array-key warnings that can corrupt the upload response's JSON on environments with warnings displayed inline. - Basic sanitization on upload (strips <script> tags, inline event handlers, javascript: URIs). Verified live via the REST media endpoint: clean upload with correct dimensions, and a malicious test SVG had its script/handlers stripped while staying valid markup. Co-Authored-By: Claude Sonnet 5 <[email protected]>
65 lines
1.8 KiB
PHP
65 lines
1.8 KiB
PHP
<?php
|
|
namespace AuroraAdmin\App;
|
|
|
|
use AuroraAdmin\Options\Settings;
|
|
use AuroraAdmin\Licensing\License;
|
|
use AuroraAdmin\Shell\Shell;
|
|
use AuroraAdmin\Pages\DashboardTakeover;
|
|
use AuroraAdmin\Pages\SettingsPage;
|
|
use AuroraAdmin\Rest\DashboardData;
|
|
use AuroraAdmin\Analytics\Analytics;
|
|
use AuroraAdmin\Rest\AnalyticsData;
|
|
use AuroraAdmin\Rest\PluginsData;
|
|
use AuroraAdmin\Rest\CommentsData;
|
|
use AuroraAdmin\Posts\ScheduledDayFilter;
|
|
use AuroraAdmin\WhiteLabel\WhiteLabel;
|
|
use AuroraAdmin\Pages\SubApps;
|
|
use AuroraAdmin\MenuCreator\MenuCreator;
|
|
use AuroraAdmin\MenuCreator\MenuCreatorData;
|
|
use AuroraAdmin\Notices\Notices;
|
|
use AuroraAdmin\Notices\NoticesData;
|
|
use AuroraAdmin\Roles\RolesData;
|
|
use AuroraAdmin\ActivityLog\ActivityLog;
|
|
use AuroraAdmin\ActivityLog\ActivityLogData;
|
|
use AuroraAdmin\DatabaseExplorer\DatabaseExplorerData;
|
|
use AuroraAdmin\Login\LoginStyle;
|
|
use AuroraAdmin\Media\SvgUploads;
|
|
|
|
defined("ABSPATH") || exit();
|
|
|
|
/**
|
|
* Plugin bootstrap. Deliberately minimal: each piece of functionality
|
|
* registers its own hooks in its own constructor, instantiated here.
|
|
* No global state, no manifest-parsing gymnastics beyond Assets::enqueue,
|
|
* no body-hider/temporary-style tricks.
|
|
*/
|
|
class AuroraAdmin
|
|
{
|
|
public function __construct()
|
|
{
|
|
new Settings();
|
|
new License();
|
|
new Shell();
|
|
new DashboardTakeover();
|
|
new SettingsPage();
|
|
new DashboardData();
|
|
new Analytics();
|
|
new AnalyticsData();
|
|
new PluginsData();
|
|
new CommentsData();
|
|
new ScheduledDayFilter();
|
|
new WhiteLabel();
|
|
new SubApps();
|
|
new MenuCreator();
|
|
new MenuCreatorData();
|
|
new Notices();
|
|
new NoticesData();
|
|
new RolesData();
|
|
new ActivityLog();
|
|
new ActivityLogData();
|
|
new DatabaseExplorerData();
|
|
new LoginStyle();
|
|
new SvgUploads();
|
|
}
|
|
}
|