Patch PHP Arbitrary File Download vulnerability

patch-code-sample-arbitrary-file-download.php

<?php

  public function file_download() {
          if ( !is_admin() || !is_user_logged_in() )
                  return;

          if ( isset($_GET['page']) && isset($_GET['download']) ) {
                  if ( $_GET['page'] !== $this->menu_base )
                          return;

                  if ($this->wp_version_check('2.5') && function_exists('check_admin_referer'))
                          check_admin_referer('backup', self::NONCE_NAME);

                  $getdata = $this->get_real_get_data();

                  $archive_path = realpath( $this->get_archive_path() );

                  $file = realpath($getdata['download']);

                  if ( $archive_path !== substr($file, 0, strlen($archive_path))) {
                          $file = FALSE;
                  }

                  $archive_extension = $this->get_archive_extension();
                  $archive_extension_len = strlen( $archive_extension );
                  if ( strtolower( substr( $file, -4 ) ) != '.log' && strtolower( substr( $file, - $archive_extension_len ) ) != $archive_extension) {
                          $file = FALSE;
                  }

                  if ($file !== FALSE && $archive_path !== FALSE) {

                          if( strtolower( substr( $file, -4 ) ) == '.log' ) {
                                  header("Content-Type: text/plain;");
                          } else {
                                  header("Content-Type: application/octet-stream;");
                          }
                          header("Content-Disposition: attachment; filename=".urlencode(basename($file)));

                  }

          }
  }