From b13b08cb664e9f1b19fbff1350648a3d80f2b2b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rabbi=20Islam=20Rony=20=E2=9A=A1=EF=B8=8F?= <35329385+RabbiIslamRony@users.noreply.github.com> Date: Tue, 8 Sep 2026 16:21:00 +0600 Subject: [PATCH 1/3] fix: validate CSV imports with WordPress file checks --- includes/classes/class-tools.php | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/includes/classes/class-tools.php b/includes/classes/class-tools.php index e9209e30a5..dd5cb01edc 100644 --- a/includes/classes/class-tools.php +++ b/includes/classes/class-tools.php @@ -1123,19 +1123,16 @@ public static function validate_csv_file( $file ) { return new WP_Error( 'invalid_csv_file', 'Invalid file path or file does not exists.' ); } - if ( ! wp_check_filetype( $file )['ext'] === 'csv' ) { - return new WP_Error( 'invalid_csv_file', 'The file must be a CSV file.' ); - } + $file_type = wp_check_filetype_and_ext( + $file, + wp_basename( $file ), + [ + 'csv' => 'text/csv', + ] + ); - $mime_type = mime_content_type( $file ); - if ( ! in_array( $mime_type, [ 'text/csv','text/plain', 'application/csv' ], true ) ) { - return new WP_Error( - 'invalid_csv_file', - sprintf( - 'Invalid file type. Only text/plain, text/csv, and application/csv are supported, given "%s".', - $mime_type - ) - ); + if ( 'csv' !== $file_type['ext'] || 'text/csv' !== $file_type['type'] ) { + return new WP_Error( 'invalid_csv_file', 'The file must be a valid CSV file.' ); } return $file; From 942b738ca88ffc2ef1079dc43d7fe84c525258c0 Mon Sep 17 00:00:00 2001 From: Sohan Chowdhury Date: Wed, 9 Sep 2026 15:32:48 +0600 Subject: [PATCH 2/3] fix: validate CSV files uploaded by WordPress importer --- includes/classes/class-tools.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/includes/classes/class-tools.php b/includes/classes/class-tools.php index dd5cb01edc..a602c935e2 100644 --- a/includes/classes/class-tools.php +++ b/includes/classes/class-tools.php @@ -1123,9 +1123,16 @@ public static function validate_csv_file( $file ) { return new WP_Error( 'invalid_csv_file', 'Invalid file path or file does not exists.' ); } + $filename = wp_basename( $file ); + + // WordPress appends .txt to files handled by wp_import_handle_upload(). + if ( '.csv.txt' === strtolower( substr( $filename, -8 ) ) ) { + $filename = substr( $filename, 0, -4 ); + } + $file_type = wp_check_filetype_and_ext( $file, - wp_basename( $file ), + $filename, [ 'csv' => 'text/csv', ] From 6ecaf16834d23e8f1256467597f4574add7df6c5 Mon Sep 17 00:00:00 2001 From: Sohan Chowdhury Date: Wed, 9 Sep 2026 15:36:48 +0600 Subject: [PATCH 3/3] fix: support deduplicated WordPress CSV import names --- includes/classes/class-tools.php | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/includes/classes/class-tools.php b/includes/classes/class-tools.php index a602c935e2..5d3f3c2104 100644 --- a/includes/classes/class-tools.php +++ b/includes/classes/class-tools.php @@ -1125,10 +1125,8 @@ public static function validate_csv_file( $file ) { $filename = wp_basename( $file ); - // WordPress appends .txt to files handled by wp_import_handle_upload(). - if ( '.csv.txt' === strtolower( substr( $filename, -8 ) ) ) { - $filename = substr( $filename, 0, -4 ); - } + // WordPress appends .txt and may add a numeric suffix to importer uploads. + $filename = preg_replace( '/\.csv(?:-\d+)?\.txt$/i', '.csv', $filename ); $file_type = wp_check_filetype_and_ext( $file,