plugin_name = $plugin_name; $this->version = $version; // Define default settings $default_settings = array( 'protection_method' => 'index', 'enable_watermark' => false, 'watermark_text' => get_bloginfo('name'), 'watermark_position' => 'bottom-right', 'watermark_opacity' => 50, 'watermark_font_size' => 'medium', // Added default for font size 'enable_right_click_protection' => false, 'enable_password_protection' => false ); // Get stored settings $stored_settings = get_option('protect_uploads_settings'); // Merge stored settings with defaults $this->settings = wp_parse_args( $stored_settings, $default_settings ); // Check if server is running nginx, and if so, force index protection method if ($this->is_nginx() && $this->settings['protection_method'] === 'htaccess') { $this->settings['protection_method'] = 'index'; update_option('protect_uploads_settings', $this->settings); } } public function get_plugin_name() { return $this->plugin_name; } /** * Inject the Pro upgrade-hints (upsell) helper. * * @since 0.7.0 * @param Alti_ProtectUploads_Upsell $upsell The upsell helper instance. * @return void */ public function set_upsell( $upsell ) { $this->upsell = $upsell; } /** * Render an upsell surface if the helper is available. * * Thin wrapper so the settings renderer stays minimal and safe when the * helper is absent (e.g. when Pro is present and no helper was injected). * * @since 0.7.0 * @param string $method The upsell method to call. * @param mixed $arg Optional argument passed to the method. * @return void */ private function render_upsell( $method, $arg = null ) { if ( $this->upsell && method_exists( $this->upsell, $method ) ) { if ( null === $arg ) { $this->upsell->$method(); } else { $this->upsell->$method( $arg ); } } } public function add_submenu_page() { add_submenu_page('upload.php', __( 'Protect Uploads', 'protect-uploads' ), 'Protect Uploads ', 'manage_options', $this->plugin_name . '-settings-page', array($this, 'render_settings_page')); } public function render_settings_page() { // Get active tab - default to directory-protection // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Tab parameter is only used for display, not for data processing $active_tab = isset($_GET['tab']) ? sanitize_key( wp_unslash( $_GET['tab'] ) ) : 'directory-protection'; ?>
display_messages() ); ?>

render_upsell( 'render_settings_banner' ); ?>


is_nginx(); ?>

render_upsell( 'render_inline_hint', 'protection' ); ?>

render_upsell( 'render_inline_hint', 'passwords' ); ?>

render_upsell( 'render_inline_hint', 'watermark' ); ?>

settings['watermark_opacity']); ?>%

render_upsell( 'render_settings_footer_link' ); ?>
id || 'upload' === $screen->id || strpos($screen->id, $this->plugin_name) !== false ) { wp_enqueue_style( $this->plugin_name, plugin_dir_url( __FILE__ ) . 'css/protect-uploads-admin.css', array(), $this->version, 'all' ); // Add inline styles for directory status table, disabled options, and tabs $custom_css = " .directory-status-table-wrapper { max-height: 300px; overflow-y: auto; margin-bottom: 10px; } .directory-status-table th { padding: 8px; } .directory-status-table td { padding: 8px; } label.disabled { opacity: 0.6; cursor: not-allowed; } .nginx-notice { font-weight: bold; } /* Tab styles */ .tab-content { margin-top: 20px; } .tab-content.hidden { display: none; } .nav-tab-wrapper { margin-bottom: 0; } /* Message styles */ .info { border-left-color: #72aee6; background-color: #f0f6fc; } "; wp_add_inline_style( $this->plugin_name, $custom_css ); } } public function add_settings_link($links) { $settings_link = '' . esc_html__('Settings', 'protect-uploads') . ''; array_unshift($links, $settings_link); return $links; } public function get_uploads_dir() { $uploads_dir = wp_upload_dir(); return $uploads_dir['basedir']; } public function get_uploads_url() { $uploads_dir = wp_upload_dir(); return $uploads_dir['baseurl']; } public function get_uploads_subdirectories() { $uploads_dir = self::get_uploads_dir(); $dirs = array($uploads_dir); // Start with the main uploads directory // Get first level directories $first_level = glob($uploads_dir . '/*', GLOB_ONLYDIR); if (!empty($first_level)) { $dirs = array_merge($dirs, $first_level); // Get second level directories foreach ($first_level as $dir) { $second_level = glob($dir . '/*', GLOB_ONLYDIR); if (!empty($second_level)) { $dirs = array_merge($dirs, $second_level); } } } return $dirs; } public function save_form($protection) { if ($protection == 'index') { $this->create_index(); } if ($protection == 'htaccess') { $this->create_htaccess(); } if ($protection == 'remove') { $this->remove_index(); $this->remove_htaccess(); } } // used to check if the current htaccess has been generated by the plugin public function get_htaccess_identifier() { return "[plugin_name=" . $this->plugin_name . "]"; } public function create_index() { $indexContent = " 0) { self::register_message( sprintf( /* translators: 1: number of directories, 2: "directory" or "directories" */ __('Successfully created index.php in %1$d %2$s.', 'protect-uploads'), $successful_count, _n('directory', 'directories', $successful_count, 'protect-uploads') ), 'updated' ); } if ($already_exists_count > 0) { self::register_message( sprintf( /* translators: 1: number of directories, 2: "directory" or "directories" */ __('Skipped %1$d %2$s where index.php already exists.', 'protect-uploads'), $already_exists_count, _n('directory', 'directories', $already_exists_count, 'protect-uploads') ), 'updated' ); } if ($failed_count === 0 && ($successful_count > 0 || $already_exists_count > 0)) { self::register_message( __('All directories have been protected successfully with index.php files.', 'protect-uploads'), 'updated' ); } elseif ($failed_count > 0) { self::register_message( sprintf( /* translators: 1: number of failed directories, 2: total number of directories */ __('Warning: Failed to protect %1$d out of %2$d directories. Check permissions.', 'protect-uploads'), $failed_count, $total_count ), 'error' ); } } public function create_htaccess() { // Check if server is Nginx - abort if it is if ($this->is_nginx()) { self::register_message( __('Cannot create .htaccess file: Your server is running Nginx, which does not support .htaccess files. Please use the index.php protection method instead.', 'protect-uploads'), 'error' ); return; } // Content for htaccess file $date = gmdate('Y-m-d H:i.s'); $phpv = phpversion(); $uploads_dir = self::get_uploads_dir(); $htaccessContent = "\n# BEGIN " . $this->get_plugin_name() . " Plugin\n"; $htaccessContent .= "\tOptions -Indexes\n"; $htaccessContent .= "# [date={$date}] [php={$phpv}] " . self::get_htaccess_identifier() . " [version={$this->version}]\n"; $htaccessContent .= "# END " . $this->get_plugin_name() . " Plugin\n"; $htaccess_path = $uploads_dir . '/.htaccess'; $htaccess_exists = file_exists($htaccess_path); if (!$htaccess_exists) { // Create new .htaccess file if (file_put_contents($htaccess_path, $htaccessContent)) { self::register_message( __('Successfully created .htaccess file in uploads directory.', 'protect-uploads'), 'updated' ); // Check if the .htaccess is actually working by testing the response code if (self::get_uploads_root_response_code() === 403) { self::register_message( __('Directory listing is now blocked (403 Forbidden) as expected.', 'protect-uploads'), 'updated' ); } else { self::register_message( __('Warning: .htaccess file was created but directory listing may not be blocked. Your server might need additional configuration.', 'protect-uploads'), 'warning' ); } } else { self::register_message( __('Failed to create .htaccess file. Please check uploads directory permissions.', 'protect-uploads'), 'error' ); } } else { // Update existing .htaccess file if (self::check_htaccess_is_self_generated()) { // This is our .htaccess, update it self::register_message( __('Existing .htaccess file was previously created by this plugin and has been verified.', 'protect-uploads'), 'updated' ); } else { // This is a different .htaccess, append our content if (file_put_contents($htaccess_path, $htaccessContent, FILE_APPEND | LOCK_EX)) { self::register_message( __('Updated existing .htaccess file with directory protection rules.', 'protect-uploads'), 'updated' ); } else { self::register_message( __('Failed to update existing .htaccess file. Please check file permissions.', 'protect-uploads'), 'error' ); return; } } // Final check to verify protection is working if (self::get_uploads_root_response_code() === 403) { self::register_message( __('Directory listing is now blocked (403 Forbidden) as expected.', 'protect-uploads'), 'updated' ); } else { self::register_message( __('Warning: .htaccess file exists but directory listing may not be blocked. Your server might require additional configuration.', 'protect-uploads'), 'warning' ); } } // Remind users that .htaccess only protects the uploads root directory self::register_message( __('Note: .htaccess protection only applies to the uploads root directory. For complete protection of subdirectories, consider using the index.php method instead.', 'protect-uploads'), 'info' ); } public function remove_index() { $i = 0; foreach (self::get_uploads_subdirectories() as $subDirectory) { if (file_exists($subDirectory . '/index.php')) { wp_delete_file($subDirectory . '/index.php'); $i++; } } if ($i == count(self::get_uploads_subdirectories())) { self::register_message('The index.php file(s) have(has) been deleted.'); } } public function remove_htaccess() { if (file_exists(self::get_uploads_dir() . '/.htaccess')) { $htaccessContent = file_get_contents(self::get_uploads_dir() . '/.htaccess'); $htaccessContent = preg_replace('/(# BEGIN protect-uploads Plugin)(.*?)(# END protect-uploads Plugin)/is', '', $htaccessContent); file_put_contents(self::get_uploads_dir() . '/.htaccess', $htaccessContent, LOCK_EX); // if htaccess is empty, we remove it. if (strlen(preg_replace("/(^[\r\n]*|[\r\n]+)[\s\t]*[\r\n]+/", "", file_get_contents(self::get_uploads_dir() . '/.htaccess'))) == 0) { wp_delete_file(self::get_uploads_dir() . '/.htaccess'); } // self::register_message('The htaccess file has been updated.'); } } public function get_protective_files_array() { $uploads_files = ['index.php', 'index.html', '.htaccess']; $response = []; foreach ($uploads_files as $file) { if (file_exists(self::get_uploads_dir() . '/' . $file)) { $response[] = $file; } } return $response; } public function check_protective_file($file) { if (in_array($file, self::get_protective_files_array())) { return true; } else { return false; } } public function get_uploads_root_response_code() { $response = wp_safe_remote_get( self::get_uploads_url(), array( 'timeout' => 5, 'redirection' => 2, 'headers' => array(), 'blocking' => true, ) ); if ( is_wp_error( $response ) ) { return 0; } return (int) wp_remote_retrieve_response_code( $response ); } public function get_htaccess_content() { return file_get_contents(self::get_uploads_dir() . '/.htaccess'); } public function check_htaccess_is_self_generated() { if (self::check_protective_file('.htaccess') && preg_match('/' . self::get_htaccess_identifier() . '/', self::get_htaccess_content())) { return true; } else { return false; } } // heart? <3 public function check_uploads_is_protected() { foreach (self::get_protective_files_array() as $file) { if ($file === 'index.html') { return true; break; } if ($file === 'index.php') { return true; break; } if ($file === '.htaccess' && self::get_uploads_root_response_code() === 200) { return false; break; } } if (self::get_uploads_root_response_code() === 403) { return true; } else { return false; } } public function check_protective_file_removable() { if( self::check_protective_file('index.html') ) { return false; } elseif( self::check_protective_file('.htaccess') === false && self::get_uploads_root_response_code() === 403 ) { return false; } else { return true; } } public function get_uploads_protection_message_array() { $response = []; foreach (self::get_protective_files_array() as $file) { if ($file === '.htaccess' && self::get_uploads_root_response_code() === 403) { $response[] = ' ' . esc_html__('.htaccess file is present and access to uploads directory returns 403 code.', 'protect-uploads'); } if ($file === 'index.php') { $response[] = ' ' . __('index.php file is present.', 'protect-uploads'); } if ($file === 'index.html') { $response[] = ' ' . __('index.html file is present.', 'protect-uploads'); } } if (self::check_protective_file('.htaccess') === true && self::get_uploads_root_response_code() === 200) { $response[] = ' ' . __('.htaccess file is present but not protecting uploads directory.', 'protect-uploads'); } if (self::check_protective_file('.htaccess') === false && self::get_uploads_root_response_code() === 403) { $response[] = ' ' . __('Access to uploads directory is protected (403) with a global .htaccess or another global declaration.', 'protect-uploads'); } return $response; } public function check_apache() { if (!function_exists('apache_get_modules')) { self::register_message('The Protect Uploads plugin cannot work without Apache. Yourself or your web host has to activate this module.'); } } public function register_message($message, $type = 'updated', $id = 0) { $this->messages['apache'][] = array( 'message' => $message, 'type' => $type, 'id' => $id ); } public function display_messages() { $output = ''; // Check for settings-updated query parameter // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Display-only parameter, no data processing if ( isset( $_GET['settings-updated'] ) && 'true' === sanitize_text_field( wp_unslash( $_GET['settings-updated'] ) ) ) { $output .= '

' . esc_html__( 'Settings saved successfully.', 'protect-uploads' ) . '

'; } // Display any registered messages if ( ! empty( $this->messages ) ) { foreach ( $this->messages as $name => $messages ) { foreach ( $messages as $message ) { // Ensure valid message type (updated, error, warning, info) $type = in_array($message['type'], array('updated', 'error', 'warning', 'info')) ? $message['type'] : 'updated'; $output .= '

' . esc_html( $message['message'] ) . '

'; } } } return $output; } public function save_settings() { // Only run when the form is submitted if ( ! isset( $_POST['submit'] ) ) { return; } // Get, unslash, and sanitize the nonce value first. $nonce = isset( $_POST['protect-uploads_nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['protect-uploads_nonce'] ) ) : ''; // Verify nonce IMMEDIATELY after checking form submission if ( ! wp_verify_nonce( $nonce, 'submit_form' ) ) { wp_die( esc_html__( 'Security check failed.', 'protect-uploads' ) ); } // Check user capabilities (Now after nonce check) if ( ! current_user_can( 'manage_options' ) ) { wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'protect-uploads' ) ); } // Get the current active tab $active_tab = isset( $_GET['tab'] ) ? sanitize_key( $_GET['tab'] ) : 'directory-protection'; // Load existing settings to preserve values not on this form $current_settings = get_option( 'protect_uploads_settings', array() ); $settings = is_array( $current_settings ) ? $current_settings : array(); // Sanitize and validate settings (Now after nonce check) // Update only the fields from the current form $settings['enable_watermark'] = isset( $_POST['enable_watermark'] ); $settings['watermark_text'] = sanitize_text_field( wp_unslash( $_POST['watermark_text'] ?? '' ) ); $settings['watermark_position'] = sanitize_key( wp_unslash( $_POST['watermark_position'] ?? 'bottom-right' ) ); $settings['watermark_opacity'] = absint( $_POST['watermark_opacity'] ?? 50 ); $settings['watermark_font_size'] = sanitize_key( wp_unslash( $_POST['watermark_font_size'] ?? 'medium' ) ); // Ensure font size is saved $settings['enable_right_click_protection'] = isset( $_POST['enable_right_click_protection'] ); $settings['enable_password_protection'] = isset( $_POST['enable_password_protection'] ); // 'protection_method' is handled separately below before final save // Validate watermark position $valid_positions = array( 'top-left', 'top-right', 'bottom-left', 'bottom-right', 'center' ); if ( ! in_array( $settings['watermark_position'], $valid_positions, true ) ) { $settings['watermark_position'] = 'bottom-right'; } // Validate font size $valid_sizes = array( 'small', 'medium', 'large' ); if ( ! in_array( $settings['watermark_font_size'], $valid_sizes, true ) ) { $settings['watermark_font_size'] = 'medium'; } // Ensure opacity is between 0 and 100 $settings['watermark_opacity'] = min( 100, max( 0, $settings['watermark_opacity'] ) ); // Handle protection method $protection = 'index'; // Default value if not set $previous_protection = $this->settings['protection_method']; // Store previous setting $protection_changed = false; if ( isset( $_POST['protection'] ) ) { $sanitized_protection = sanitize_key( wp_unslash( $_POST['protection'] ) ); if ( in_array( $sanitized_protection, array( 'index', 'htaccess' ), true ) ) { // Only allow index or htaccess to be saved $protection = $sanitized_protection; // If protection method changed, we need to remove the old protection files if ($previous_protection !== $protection) { $protection_changed = true; if ($previous_protection === 'index') { $this->remove_index(); } elseif ($previous_protection === 'htaccess') { $this->remove_htaccess(); } } } } $settings['protection_method'] = $protection; // Save the chosen protection method to the settings array // Update settings in the database update_option( 'protect_uploads_settings', $settings ); $this->settings = $settings; // Update the local property as well // If we're on the directory protection tab or the protection method changed, // we need to ensure the proper protection is applied if ($active_tab === 'directory-protection' || $protection_changed) { // Apply the protection method $this->save_form($protection); } // Add success message $this->register_message( __( 'Settings saved successfully.', 'protect-uploads' ), 'updated' ); // Redirect to prevent form resubmission, preserving the active tab wp_safe_redirect( add_query_arg( array( 'settings-updated' => 'true', 'tab' => $active_tab ), wp_get_referer() ) ); exit; } /** * Check if a specific directory is protected * * @param string $directory Path to directory to check * @return bool True if directory is protected, false otherwise */ public function check_directory_is_protected($directory) { // Check if directory has index.php file if (file_exists($directory . '/index.php')) { return true; } // Check if directory has index.html file if (file_exists($directory . '/index.html')) { return true; } // Check if uploads directory has .htaccess and it's returning 403 if ($directory === self::get_uploads_dir() && file_exists($directory . '/.htaccess') && self::get_uploads_root_response_code() === 403) { return true; } // If we're checking a subdirectory, the parent directory's .htaccess may protect it if ($directory !== self::get_uploads_dir() && self::get_uploads_root_response_code() === 403) { return true; } return false; } /** * Check if the server is running Nginx * * @return bool True if server is running Nginx, false otherwise */ public function is_nginx() { if ( ! empty( $_SERVER['SERVER_SOFTWARE'] ) ) { $server_software = sanitize_text_field( wp_unslash( $_SERVER['SERVER_SOFTWARE'] ) ); return ( stripos( $server_software, 'nginx' ) !== false ); } return false; } }