10up / safe-svg

Enable SVG uploads and sanitize them to stop XML/SVG vulnerabilities in your WordPress website.
https://wordpress.org/plugins/safe-svg/
GNU General Public License v2.0
263 stars 31 forks source link

Add a filter around the return value from our `current_user_can_upload_svg` method #193

Closed dkotter closed 4 months ago

dkotter commented 4 months ago

Description of the Change

This PR adds a new filter, safe_svg_current_user_can_upload, around the returned value from our current_user_can_upload_svg method. This filter allows others to have more fine-tune control on who can or cannot upload svgs. For instance, this would allow you to lock down uploads to specific users, instead of specific roles. Or would allow you to allow non-logged in users the ability to upload svgs.

Closes #192

How to test the Change

  1. With this PR checked out, go to the Media Settings page and ensure your user account has permissions to upload
  2. Test uploading an svg and ensure it works
  3. Switch to an account that doesn't have permission to upload
  4. Ensure svgs aren't allowed
  5. Now use the new current_user_can_upload_svg and modify permissions, running through the tests again to ensure things work. As an example, could add add_filter( 'safe_svg_current_user_can_upload', '__return_false' ); and ensure that no one can upload svgs, or add_filter( 'safe_svg_current_user_can_upload', '__return_true' ); and ensure everyone can upload svgs.

Changelog Entry

Added - New filter, safe_svg_current_user_can_upload, allowing more control over who can upload svg files.

Credits

Props @dkotter

Checklist:

shmaltz commented 4 months ago

Thank you @dkotter !