fix: Repair broken batch-import file upload + validation - #27
Merged
Conversation
Critical bug: The batch-import preview never worked. wp_tempnam() always produces a file ending in .tmp, but ODW_Batch_Import::parse_file() detected the format solely from the on-disk extension. Every upload therefore hit 'Format nicht unterstützt (nur CSV oder JSON)' and failed. Fixes: - parse_file() now accepts an optional $original_name used for format detection, so temporary .tmp uploads are correctly recognised as CSV/JSON. The parameter is optional and backward-compatible. - AJAX preview handler passes the original filename to parse_file(). Security hardening (preview handler): - Validate the upload by its real file extension instead of the browser- supplied MIME type, which is trivially spoofable. - Verify the upload with is_uploaded_file() before moving it. - Properly wp_unslash()/sanitize $_FILES values. - Replace unlink() with wp_delete_file(). Code quality: - Remove unused SESSION_KEY constant (PHPStan: classConstant.unused). - Remove dead is_array() branch after array_combine (always true in PHP 8). - Add translators: comments and comment punctuation (PHPCS: 0 errors). Verified: a .tmp file with original name 'upload.csv' now parses to 1 record; previously returned 'Format nicht unterstützt'. Full suite: 90 tests pass, PHPStan clean, PHPCS 0 errors. https://claude.ai/code/session_01JB1xUQM892bVZ4Yv3MZjvq
This was referenced Jun 26, 2026
daimpad
added a commit
that referenced
this pull request
Jun 27, 2026
Bump version to 2.1.5 and document the batch-import fixes and security hardening from the recent review (PRs #27–#29). - open-data-wizard.php: version 2.1.4 -> 2.1.5 (header + ODW_VERSION) - CHANGELOG.md: new 2.1.5 entry (batch-import repair, demo dataset, cache TTL, CLI cache clear, quality clamp, delta overflow, XSS/CSV-injection/ JSON-LD @id hardening, upload validation, 2000-record cap) - README.md: batch-import notes (integer byte_size, Excel/BOM support, 2000-record limit, formula-injection neutralization), version badge - SECURITY.md: 2.1.5 version-history row, test count 90 -> 92, audit date - API.md: document that delta `since` rejects overflow/invalid dates - CLAUDE.md: add ODW_Batch_Import to structure + class table, correct CLI method names, test count 90 -> 92, current version 2.1.5 - E2E_TESTING.md: version/date footer Tests: 92 pass, PHPStan clean, PHPCS exit 0. Claude-Session: https://claude.ai/code/session_01JB1xUQM892bVZ4Yv3MZjvq Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔴 Critical Bug: Batch-Import Upload Completely Broken
The batch-import preview never worked.
wp_tempnam()always produces a file ending in.tmp, butparse_file()detected the format solely from the on-disk extension. Every upload therefore hit "Format nicht unterstützt" and failed silently.Proof
Fixes
1. Core Bug Fix
parse_file()now accepts optional$original_nameparameter for format detectionparse_file()2. Security Hardening (Preview Handler)
is_uploaded_file()verification beforemove_uploaded_file()wp_unslash()/sanitize_*()all$_FILESvaluesunlink()withwp_delete_file()3. Code Quality
SESSION_KEYconstant (PHPStan: classConstant.unused)is_array()branch afterarray_combine()(always true in PHP 8)Verification
Files Changed
includes/class-batch-import.php: +15 lines (fix + code quality)includes/class-admin.php: +19 lines (security hardening)🤖 Generated with Claude Code
Generated by Claude Code