API Documentation
Table of Contents
Namespaces
Constants
- JPKCOM_CF7_UPLOAD_PATH_VERSION : mixed = '1.0.8'
- WPCF7_UPLOADS_TMP_DIR : mixed = \WP_CONTENT_DIR . '/.ht.private/uploads/wpcf7_u...
Functions
- jpkcom_cf7_upload_path_guard_files() : array<string, string>
- Access guards written into the upload directories.
- jpkcom_cf7_upload_path_protect_dir() : void
- Ensure the CF7 temporary upload directory carries its own access protection.
Constants
JPKCOM_CF7_UPLOAD_PATH_VERSION
public
mixed
JPKCOM_CF7_UPLOAD_PATH_VERSION
= '1.0.8'
WPCF7_UPLOADS_TMP_DIR
public
mixed
WPCF7_UPLOADS_TMP_DIR
= \WP_CONTENT_DIR . '/.ht.private/uploads/wpcf7_uploads'
Functions
jpkcom_cf7_upload_path_guard_files()
Access guards written into the upload directories.
jpkcom_cf7_upload_path_guard_files() : array<string, string>
Tags
Return values
array<string, string> —Map of file name => file contents.
jpkcom_cf7_upload_path_protect_dir()
Ensure the CF7 temporary upload directory carries its own access protection.
jpkcom_cf7_upload_path_protect_dir() : void
This plugin picks the upload location, so it should also guarantee that the location is unreachable over HTTP. Until now that guarantee was borrowed from two external facts, neither of which this plugin controls:
- Contact Form 7 drops its own
.htaccessinto the directory. True today, but it is CF7's implementation detail, not a contract. - Many server configs deny any request path containing a dot-segment, which
is what actually protects the
.ht.privateprefix on nginx —.htaccessis ignored there entirely.
Note that the .ht. prefix alone does not invoke Apache's stock
<FilesMatch "^\.ht"> rule: that matches the requested file name, not the
directories above it, so .ht.private/…/file.pdf is not covered by it.
Writing the guards here makes the protection a property of this plugin instead of an inherited coincidence. Runs on activation and re-verifies once a day, so a deleted guard file heals itself.