引言：为什么需要自定义上传文件类型？
WordPress默认支持一系列常见的文件类型上传，但在实际项目中，您可能需要上传特殊格式的文件。无论是PDF文档、CAD图纸、PSD源文件，还是企业专用的文件格式，扩展上传文件类型是WordPress开发中的常见需求。
常见应用场景：
- 企业网站：允许上传PDF、DOC、XLS等办公文档
- 设计机构：需要上传PSD、AI、SKETCH等源文件
- 工程公司：支持上传DWG、DXF等CAD图纸
- 音视频平台：允许上传专业媒体格式
- 教育机构：需要上传特定教学文件格式
- 开发团队：共享代码文件、配置文件
一、理解WordPress文件上传机制
1. 默认支持的文件类型
WordPress默认通过wp_get_mime_types()函数定义允许上传的文件类型：
// WordPress核心定义的MIME类型
array(
'jpg|jpeg|jpe' => 'image/jpeg',
'gif' => 'image/gif',
'png' => 'image/png',
'bmp' => 'image/bmp',
'tiff|tif' => 'image/tiff',
'webp' => 'image/webp',
'ico' => 'image/x-icon',
'pdf' => 'application/pdf',
'doc' => 'application/msword',
'docx' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
'xls' => 'application/vnd.ms-excel',
'xlsx' => 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
'ppt' => 'application/vnd.ms-powerpoint',
'pptx' => 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
'zip' => 'application/zip',
'rar' => 'application/x-rar-compressed',
'mp3' => 'audio/mpeg',
'mp4' => 'video/mp4',
'mpeg' => 'video/mpeg',
'webm' => 'video/webm',
'txt' => 'text/plain',
'csv' => 'text/csv',
'xml' => 'text/xml',
'json' => 'application/json',
)2. 上传安全检查机制
WordPress通过多层验证确保上传安全：
- 文件扩展名验证：检查是否在允许列表中
- MIME类型验证：检查实际文件类型
- 文件大小限制：默认2MB（可通过php.ini修改）
- 恶意代码检测：扫描可疑内容
- 文件重命名：防止覆盖和特殊字符
二、基础方法：通过代码扩展文件类型
方法1：使用functions.php添加单个文件类型
<?php
/**
* 方法1：添加单个MIME类型到允许列表
* 添加到当前主题的functions.php文件中
*/
// 1. 添加新的MIME类型
add_filter('upload_mimes', 'custom_upload_mimes');
function custom_upload_mimes($mimes) {
// 添加AI文件支持
$mimes['ai'] = 'application/postscript';
// 添加PSD文件支持
$mimes['psd'] = 'application/x-photoshop';
// 添加Sketch文件支持
$mimes['sketch'] = 'application/zip';
// 添加CAD文件支持
$mimes['dwg'] = 'application/acad';
$mimes['dxf'] = 'application/dxf';
// 添加3D模型文件
$mimes['stl'] = 'application/sla';
$mimes['obj'] = 'text/plain';
$mimes['fbx'] = 'application/octet-stream';
// 添加编程文件
$mimes['py'] = 'text/x-python';
$mimes['js'] = 'text/javascript';
$mimes['php'] = 'text/x-php';
$mimes['sql'] = 'application/sql';
// 添加字体文件
$mimes['ttf'] = 'font/ttf';
$mimes['otf'] = 'font/otf';
$mimes['woff'] = 'font/woff';
$mimes['woff2'] = 'font/woff2';
// 添加电子书格式
$mimes['epub'] = 'application/epub+zip';
$mimes['mobi'] = 'application/x-mobipocket-ebook';
return $mimes;
}
// 2. 为特定MIME类型添加扩展名映射
add_filter('mime_types', 'custom_mime_types');
function custom_mime_types($mime_types) {
// 为已存在的MIME类型添加更多扩展名
$mime_types['svg'] = 'image/svg+xml';
$mime_types['svgz'] = 'image/svg+xml';
// 自定义映射
$mime_types['indd'] = 'application/x-indesign';
$mime_types['aep'] = 'application/vnd.adobe.aftereffects.project';
return $mime_types;
}
?>方法2：批量添加多个文件类型
<?php
/**
* 方法2：批量添加文件类型
* 适用于需要添加大量特定类型文件的场景
*/
add_filter('upload_mimes', 'batch_add_file_types');
function batch_add_file_types($mimes) {
// 定义要添加的文件类型数组
$new_mimes = array(
// 设计文件
'eps' => 'application/postscript',
'indd' => 'application/x-indesign',
'cdr' => 'application/coreldraw',
'fig' => 'application/fig',
// 视频编辑文件
'prproj' => 'application/vnd.adobe.premiere.pro',
'aep' => 'application/vnd.adobe.aftereffects.project',
'fcp' => 'application/x-finalcutpro',
// 数据文件
'sql' => 'application/sql',
'yaml' => 'application/x-yaml',
'toml' => 'application/toml',
'env' => 'text/plain',
// 压缩文件
'7z' => 'application/x-7z-compressed',
'tar' => 'application/x-tar',
'gz' => 'application/x-gzip',
'bz2' => 'application/x-bzip2',
// 配置文件
'ini' => 'text/plain',
'conf' => 'text/plain',
'cfg' => 'text/plain',
// 专业软件文件
'max' => 'application/3dsmax',
'mb' => 'application/maya',
'blend' => 'application/x-blender',
// 电子电路
'sch' => 'application/eagle-schematic',
'brd' => 'application/eagle-board',
);
// 合并到现有MIME类型数组中
return array_merge($mimes, $new_mimes);
}
?>方法3：条件性添加文件类型
<?php
/**
* 方法3：根据用户角色或页面条件添加文件类型
* 实现更精细的控制
*/
add_filter('upload_mimes', 'conditional_file_types');
function conditional_file_types($mimes) {
// 示例1：只允许管理员上传特定文件类型
if (current_user_can('manage_options')) {
$mimes['php'] = 'text/x-php';
$mimes['sql'] = 'application/sql';
$mimes['env'] = 'text/plain';
}
// 示例2：在特定页面上允许更多文件类型
global $post;
if (is_admin() && isset($_GET['post'])) {
$post_id = $_GET['post'];
$post_type = get_post_type($post_id);
if ($post_type === 'design_project') {
$mimes['psd'] = 'application/x-photoshop';
$mimes['ai'] = 'application/postscript';
$mimes['sketch'] = 'application/zip';
} elseif ($post_type === 'software_project') {
$mimes['zip'] = 'application/zip';
$mimes['tar'] = 'application/x-tar';
$mimes['gz'] = 'application/x-gzip';
}
}
// 示例3：根据用户元数据控制
$user_id = get_current_user_id();
if ($user_id) {
$user_role = get_userdata($user_id)->roles[0];
if ($user_role === 'designer') {
$mimes['psd'] = 'application/x-photoshop';
$mimes['ai'] = 'application/postscript';
} elseif ($user_role === 'developer') {
$mimes['zip'] = 'application/zip';
$mimes['sql'] = 'application/sql';
}
}
return $mimes;
}
?>三、高级控制：精细化管理文件上传
1. 控制文件大小限制
<?php
/**
* 调整文件上传大小限制
*/
// 1. 通过PHP配置调整（需要服务器权限）
@ini_set('upload_max_size', '64M');
@ini_set('post_max_size', '64M');
@ini_set('max_execution_time', '300');
// 2. WordPress特定的文件大小限制
add_filter('upload_size_limit', 'custom_upload_size_limit');
function custom_upload_size_limit($size) {
// 根据用户角色设置不同限制
if (current_user_can('manage_options')) {
return 1024 * 1024 * 100; // 管理员：100MB
} elseif (current_user_can('editor')) {
return 1024 * 1024 * 50; // 编辑：50MB
} else {
return 1024 * 1024 * 20; // 其他用户：20MB
}
}
// 3. 特定文件类型的尺寸限制
add_filter('wp_handle_upload_prefilter', 'custom_file_size_limit');
function custom_file_size_limit($file) {
$file_type = $file['type'];
$file_size = $file['size'];
$size_limits = array(
'image/' => 10 * 1024 * 1024, // 图片：10MB
'video/' => 100 * 1024 * 1024, // 视频：100MB
'application/' => 50 * 1024 * 1024, // 应用：50MB
'text/' => 5 * 1024 * 1024, // 文本：5MB
);
foreach ($size_limits as $type_prefix => $limit) {
if (strpos($file_type, $type_prefix) === 0) {
if ($file_size > $limit) {
$file['error'] = sprintf(
'文件大小不能超过 %s。当前文件大小为 %s。',
size_format($limit),
size_format($file_size)
);
break;
}
}
}
return $file;
}
?>2. 文件类型安全验证
<?php
/**
* 增强文件类型安全检查
* 防止文件扩展名欺骗攻击
*/
// 1. 验证真实MIME类型
add_filter('wp_check_filetype_and_ext', 'validate_real_mime_type', 10, 4);
function validate_real_mime_type($file_data, $file, $filename, $mimes) {
$filetype = wp_check_filetype($filename, $mimes);
// 获取文件真实MIME类型
$real_mime = mime_content_type($file);
// 验证扩展名与真实MIME类型匹配
$allowed_mimes = array(
'jpg|jpeg|jpe' => array('image/jpeg', 'image/pjpeg'),
'gif' => array('image/gif'),
'png' => array('image/png'),
'pdf' => array('application/pdf'),
'zip' => array('application/zip', 'application/x-zip-compressed'),
// 添加更多验证规则
);
if (!empty($filetype['ext']) && !empty($filetype['type'])) {
$ext = $filetype['ext'];
$type = $filetype['type'];
foreach ($allowed_mimes as $allowed_ext => $allowed_types) {
if (preg_match('!^(' . $allowed_ext . ')$!i', $ext)) {
if (!in_array($real_mime, $allowed_types)) {
$file_data['ext'] = false;
$file_data['type'] = false;
}
break;
}
}
}
return $file_data;
}
// 2. 禁止危险文件类型
add_filter('upload_mimes', 'disable_dangerous_file_types', 999);
function disable_dangerous_file_types($mimes) {
// 危险文件类型列表
$dangerous_types = array(
'php', 'php3', 'php4', 'php5', 'php7', 'phtml',
'pl', 'cgi', 'htaccess', 'htpasswd',
'py', 'pyc', 'pyo',
'sh', 'bash', 'zsh',
'exe', 'msi', 'bat', 'cmd', 'scr',
'js', 'jse', 'vbs', 'vbe', 'wsf',
'jar', 'class',
);
foreach ($dangerous_types as $type) {
unset($mimes[$type]);
}
return $mimes;
}
?>3. 文件重命名与组织
<?php
/**
* 自定义文件上传重命名规则
* 提高文件管理效率和安全性
*/
// 1. 自定义文件名生成
add_filter('wp_handle_upload_prefilter', 'custom_filename_upload');
function custom_filename_upload($file) {
// 获取文件信息
$pathinfo = pathinfo($file['name']);
$extension = isset($pathinfo['extension']) ? '.' . $pathinfo['extension'] : '';
// 生成新文件名规则
$new_filename = '';
// 规则1：时间戳 + 随机数
$new_filename = date('Ymd-His') . '-' . wp_rand(100, 999);
// 规则2：用户ID + 时间戳
if (is_user_logged_in()) {
$user_id = get_current_user_id();
$new_filename = 'user-' . $user_id . '-' . time();
}
// 规则3：根据文件类型分类
$file_type = wp_check_filetype($file['name']);
if (strpos($file_type['type'], 'image/') === 0) {
$new_filename = 'img-' . $new_filename;
} elseif (strpos($file_type['type'], 'video/') === 0) {
$new_filename = 'video-' . $new_filename;
} elseif (strpos($file_type['type'], 'application/') === 0) {
$new_filename = 'doc-' . $new_filename;
}
// 应用新文件名
if ($new_filename) {
$file['name'] = sanitize_file_name($new_filename . $extension);
}
return $file;
}
// 2. 按日期组织上传文件
add_filter('upload_dir', 'organize_uploads_by_date_type');
function organize_uploads_by_date_type($uploads) {
$time = current_time('mysql');
$y = substr($time, 0, 4);
$m = substr($time, 5, 2);
$d = substr($time, 8, 2);
// 获取当前上传的文件类型
$file_type = '';
if (isset($_FILES['async-upload'])) {
$file_info = wp_check_filetype($_FILES['async-upload']['name']);
$file_type = $file_info['type'];
}
// 根据文件类型创建子目录
$type_dir = '';
if (strpos($file_type, 'image/') === 0) {
$type_dir = '/images';
} elseif (strpos($file_type, 'video/') === 0) {
$type_dir = '/videos';
} elseif (strpos($file_type, 'audio/') === 0) {
$type_dir = '/audios';
} else {
$type_dir = '/documents';
}
// 构建新路径
$uploads['subdir'] = $type_dir . '/' . $y . '/' . $m . '/' . $d;
$uploads['path'] = $uploads['basedir'] . $uploads['subdir'];
$uploads['url'] = $uploads['baseurl'] . $uploads['subdir'];
return $uploads;
}
?>四、插件化解决方案
1. 创建自定义文件上传插件
<?php
/**
* Plugin Name: Advanced File Upload Manager
* Plugin URI: https://yourwebsite.com/
* Description: 增强WordPress文件上传功能，支持自定义文件类型
* Version: 1.0.0
* Author: Your Name
* License: GPL v2 or later
*/
// 防止直接访问
if (!defined('ABSPATH')) {
exit;
}
class Advanced_File_Upload_Manager {
private static $instance = null;
private $allowed_types = array();
public static function get_instance() {
if (null === self::$instance) {
self::$instance = new self();
}
return self::$instance;
}
private function __construct() {
add_action('init', array($this, 'init'));
add_action('admin_menu', array($this, 'add_admin_menu'));
add_action('admin_init', array($this, 'register_settings'));
}
public function init() {
// 从数据库加载允许的文件类型
$this->allowed_types = get_option('afum_allowed_types', array());
// 添加过滤器
add_filter('upload_mimes', array($this, 'add_custom_mime_types'));
add_filter('wp_handle_upload_prefilter', array($this, 'validate_upload'));
// 添加上传界面
add_action('post-upload-ui', array($this, 'add_upload_notice'));
}
public function add_custom_mime_types($mimes) {
if (!empty($this->allowed_types)) {
foreach ($this->allowed_types as $ext => $mime) {
if (!isset($mimes[$ext])) {
$mimes[$ext] = $mime;
}
}
}
return $mimes;
}
public function validate_upload($file) {
$filetype = wp_check_filetype($file['name']);
// 检查是否在允许列表中
if (!empty($this->allowed_types) && !isset($this->allowed_types[$filetype['ext']])) {
$allowed_extensions = implode(', ', array_keys($this->allowed_types));
$file['error'] = sprintf(
'不支持的文件类型。允许的类型: %s',
$allowed_extensions
);
}
return $file;
}
public function add_upload_notice() {
if (!empty($this->allowed_types)) {
echo '<div class="upload-notice">';
echo '<p><strong>支持的文件类型:</strong> ';
echo implode(', ', array_keys($this->allowed_types));
echo '</p>';
echo '</div>';
// 添加样式
echo '<style>
.upload-notice {
background: #f0f6fc;
border: 1px solid #c3c4c7;
border-left-color: #72aee6;
border-left-width: 4px;
padding: 12px;
margin: 15px 0;
}
</style>';
}
}
public function add_admin_menu() {
add_options_page(
'文件上传设置',
'文件上传管理',
'manage_options',
'afum-settings',
array($this, 'render_settings_page')
);
}
public function register_settings() {
register_setting('afum_settings', 'afum_allowed_types');
add_settings_section(
'afum_main_section',
'文件类型设置',
null,
'afum-settings'
);
add_settings_field(
'afum_allowed_types',
'允许的文件类型',
array($this, 'render_types_field'),
'afum-settings',
'afum_main_section'
);
}
public function render_types_field() {
$current_types = get_option('afum_allowed_types', array());
$common_types = array(
'pdf' => 'PDF文档',
'doc' => 'Word文档',
'docx' => 'Word文档(新)',
'xls' => 'Excel表格',
'xlsx' => 'Excel表格(新)',
'ppt' => 'PowerPoint',
'pptx' => 'PowerPoint(新)',
'psd' => 'Photoshop文件',
'ai' => 'Illustrator文件',
'zip' => '压缩文件',
'rar' => 'RAR压缩文件',
);
?>
<div id="afum-types-container">
<?php foreach ($common_types as $ext => $name): ?>
<label style="display: inline-block; margin-right: 15px; margin-bottom: 10px;">
<input type="checkbox"
name="afum_allowed_types[<?php echo esc_attr($ext); ?>]"
value="<?php echo esc_attr($ext); ?>"
<?php checked(isset($current_types[$ext])); ?>>
<?php echo esc_html($name . ' (.' . $ext . ')'); ?>
</label>
<?php endforeach; ?>
<div style="margin-top: 20px;">
<h4>自定义文件类型:</h4>
<div id="custom-types">
<?php if (!empty($current_types)): ?>
<?php foreach ($current_types as $ext => $mime): ?>
<?php if (!isset($common_types[$ext])): ?>
<div class="custom-type">
<input type="text"
name="afum_custom_ext[]"
value="<?php echo esc_attr($ext); ?>"
placeholder="扩展名" style="width: 100px;">
<input type="text"
name="afum_custom_mime[]"
value="<?php echo esc_attr($mime); ?>"
placeholder="MIME类型" style="width: 300px;">
<button type="button" class="button remove-type">删除</button>
</div>
<?php endif; ?>
<?php endforeach; ?>
<?php endif; ?>
</div>
<button type="button" id="add-custom-type" class="button">添加自定义类型</button>
</div>
</div>
<script>
jQuery(document).ready(function($) {
$('#add-custom-type').on('click', function() {
var html = '<div class="custom-type" style="margin-bottom: 10px;">' +
'<input type="text" name="afum_custom_ext[]" placeholder="扩展名" style="width: 100px;">' +
'<input type="text" name="afum_custom_mime[]" placeholder="MIME类型" style="width: 300px;">' +
'<button type="button" class="button remove-type">删除</button>' +
'</div>';
$('#custom-types').append(html);
});
$(document).on('click', '.remove-type', function() {
$(this).closest('.custom-type').remove();
});
});
</script>
<?php
}
public function render_settings_page() {
?>
<div class="wrap">
<h1>高级文件上传管理</h1>
<form method="post" action="options.php">
<?php
settings_fields('afum_settings');
do_settings_sections('afum-settings');
submit_button();
?>
</form>
</div>
<?php
}
}
// 初始化插件
Advanced_File_Upload_Manager::get_instance();
?>2. 集成到现有插件
<?php
/**
* 示例：在现有插件中集成文件类型管理
*/
// 在插件初始化时添加文件类型
add_action('init', 'myplugin_add_file_types');
function myplugin_add_file_types() {
// 只有插件启用时才添加文件类型
if (get_option('myplugin_enable_custom_uploads')) {
add_filter('upload_mimes', 'myplugin_custom_mime_types');
}
}
function myplugin_custom_mime_types($mimes) {
$plugin_mimes = array(
'myplugin' => 'application/x-myplugin',
'mydata' => 'application/x-mydata',
);
return array_merge($mimes, $plugin_mimes);
}
// 添加上传短代码
add_shortcode('myplugin_upload', 'myplugin_upload_shortcode');
function myplugin_upload_shortcode($atts) {
if (!is_user_logged_in()) {
return '<p>请先登录以使用上传功能。</p>';
}
ob_start();
?>
<div class="myplugin-upload-container">
<form method="post" enctype="multipart/form-data" class="myplugin-upload-form">
<?php wp_nonce_field('myplugin_upload', 'myplugin_upload_nonce'); ?>
<div class="form-group">
<label for="myplugin_file">选择文件:</label>
<input type="file" name="myplugin_file" id="myplugin_file"
accept=".myplugin,.mydata,.json,.xml" required>
<p class="description">支持的文件类型: .myplugin, .mydata, .json, .xml</p>
</div>
<div class="form-group">
<label for="file_description">文件描述:</label>
<textarea name="file_description" id="file_description" rows="3"></textarea>
</div>
<button type="submit" class="button button-primary">上传文件</button>
</form>
<div id="upload-result"></div>
</div>
<style>
.myplugin-upload-container {
max-width: 600px;
margin: 20px auto;
padding: 20px;
background: #f9f9f9;
border: 1px solid #ddd;
border-radius: 5px;
}
.myplugin-upload-container .form-group {
margin-bottom: 15px;
}
.myplugin-upload-container label {
display: block;
margin-bottom: 5px;
font-weight: bold;
}
.myplugin-upload-container input[type="file"],
.myplugin-upload-container textarea {
width: 100%;
padding: 8px;
border: 1px solid #ddd;
border-radius: 3px;
}
.myplugin-upload-container .description {
font-size: 12px;
color: #666;
margin-top: 5px;
}
</style>
<script>
jQuery(document).ready(function($) {
$('.myplugin-upload-form').on('submit', function(e) {
e.preventDefault();
var formData = new FormData(this);
$.ajax({
url: '<?php echo admin_url("admin-ajax.php"); ?>',
type: 'POST',
data: formData,
processData: false,
contentType: false,
beforeSend: function() {
$('#upload-result').html('<p>上传中...</p>');
},
success: function(response) {
$('#upload-result').html(response.data.message);
},
error: function() {
$('#upload-result').html('<p style="color: red;">上传失败，请重试。</p>');
}
});
});
});
</script>
<?php
return ob_get_clean();
}
// AJAX处理上传
add_action('wp_ajax_myplugin_handle_upload', 'myplugin_handle_upload');
add_action('wp_ajax_nopriv_myplugin_handle_upload', 'myplugin_handle_upload');
function myplugin_handle_upload() {
// 安全检查
if (!wp_verify_nonce($_POST['myplugin_upload_nonce'], 'myplugin_upload')) {
wp_send_json_error(array('message' => '安全检查失败'));
}
if (!is_user_logged_in()) {
wp_send_json_error(array('message' => '请先登录'));
}
// 处理文件上传
if (!empty($_FILES['myplugin_file'])) {
$file = $_FILES['myplugin_file'];
// 检查文件类型
$allowed_types = array(
'myplugin' => 'application/x-myplugin',
'mydata' => 'application/x-mydata',
'json' => 'application/json',
'xml' => 'text/xml',
);
$filetype = wp_check_filetype($file['name'], $allowed_types);
if (!$filetype['ext'] || !$filetype['type']) {
wp_send_json_error(array('message' => '不支持的文件类型'));
}
// 上传文件
$upload = wp_handle_upload($file, array('test_form' => false));
if (isset($upload['error'])) {
wp_send_json_error(array('message' => '上传失败: ' . $upload['error']));
}
// 保存文件信息到数据库
$file_data = array(
'user_id' => get_current_user_id(),
'filename' => basename($upload['file']),
'url' => $upload['url'],
'type' => $filetype['type'],
'size' => $file['size'],
'description' => sanitize_textarea_field($_POST['file_description']),
'upload_time' => current_time('mysql'),
);
// 这里可以保存到自定义数据库表
// save_myplugin_file($file_data);
wp_send_json_success(array(
'message' => '文件上传成功！',
'file_url' => $upload['url'],
));
}
wp_send_json_error(array('message' => '没有选择文件'));
}
?>五、实战案例：企业文档管理系统
完整的企业文档上传解决方案
<?php
/**
* 企业文档管理系统
* 功能：支持多种办公文档上传，自动分类，权限控制
*/
class Enterprise_Document_Manager {
private $allowed_document_types = array();
public function __construct() {
$this->setup_document_types();
add_action('init', array($this, 'init'));
}
private function setup_document_types() {
$this->allowed_document_types = array(
// 办公文档
'doc' => array(
'mime' => 'application/msword',
'name' => 'Word文档(97-2003)',
'icon' => 'dashicons-media-document',
),
'docx' => array(
'mime' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
'name' => 'Word文档',
'icon' => 'dashicons-media-document',
),
'xls' => array(
'mime' => 'application/vnd.ms-excel',
'name' => 'Excel表格(97-2003)',
'icon' => 'dashicons-media-spreadsheet',
),
'xlsx' => array(
'mime' => 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
'name' => 'Excel表格',
'icon' => 'dashicons-media-spreadsheet',
),
'ppt' => array(
'mime' => 'application/vnd.ms-powerpoint',
'name' => 'PowerPoint(97-2003)',
'icon' => 'dashicons-media-interactive',
),
'pptx' => array(
'mime' => 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
'name' => 'PowerPoint',
'icon' => 'dashicons-media-interactive',
),
'pdf' => array(
'mime' => 'application/pdf',
'name' => 'PDF文档',
'icon' => 'dashicons-pdf',
),
// 文本文件
'txt' => array(
'mime' => 'text/plain',
'name' => '文本文件',
'icon' => 'dashicons-text',
),
'csv' => array(
'mime' => 'text/csv',
'name' => 'CSV文件',
'icon' => 'dashicons-media-spreadsheet',
),
// 图片文件
'jpg' => array(
'mime' => 'image/jpeg',
'name' => 'JPEG图片',
'icon' => 'dashicons-format-image',
),
'png' => array(
'mime' => 'image/png',
'name' => 'PNG图片',
'icon' => 'dashicons-format-image',
),
// 压缩文件
'zip' => array(
'mime' => 'application/zip',
'name' => 'ZIP压缩包',
'icon' => 'dashicons-media-archive',
),
'rar' => array(
'mime' => 'application/x-rar-compressed',
'name' => 'RAR压缩包',
'icon' => 'dashicons-media-archive',
),
// 企业特定格式
'dwg' => array(
'mime' => 'image/vnd.dwg',
'name' => 'CAD图纸',
'icon' => 'dashicons-admin-site',
),
'stp' => array(
'mime' => 'application/step',
'name' => 'STEP模型',
'icon' => 'dashicons-admin-site',
),
);
}
public function init() {
// 添加MIME类型支持
add_filter('upload_mimes', array($this, 'add_document_mime_types'));
// 添加上传前的验证
add_filter('wp_handle_upload_prefilter', array($this, 'validate_document_upload'));
// 添加上传后的处理
add_filter('wp_generate_attachment_metadata', array($this, 'process_uploaded_document'), 10, 2);
// 添加上传界面
add_action('post-upload-ui', array($this, 'add_document_upload_ui'));
// 注册自定义文章类型
$this->register_document_post_type();
}
public function add_document_mime_types($mimes) {
foreach ($this->allowed_document_types as $ext => $type_info) {
$mimes[$ext] = $type_info['mime'];
}
return $mimes;
}
public function validate_document_upload($file) {
$filetype = wp_check_filetype($file['name']);
$ext = $filetype['ext'];
// 检查文件类型是否允许
if (!isset($this->allowed_document_types[$ext])) {
$allowed_extensions = array();
foreach ($this->allowed_document_types as $ext => $info) {
$allowed_extensions[] = '.' . $ext;
}
$file['error'] = sprintf(
'不支持的文件类型。企业文档系统支持以下格式: %s',
implode(', ', $allowed_extensions)
);
return $file;
}
// 检查文件大小（根据不同文件类型设置不同限制）
$size_limits = array(
'image/' => 10 * 1024 * 1024, // 图片：10MB
'application/' => 50 * 1024 * 1024, // 文档：50MB
'text/' => 5 * 1024 * 1024, // 文本：5MB
);
$file_size = $file['size'];
$file_mime = $filetype['type'];
foreach ($size_limits as $mime_prefix => $limit) {
if (strpos($file_mime, $mime_prefix) === 0) {
if ($file_size > $limit) {
$file['error'] = sprintf(
'文件大小不能超过 %s。当前文件大小为 %s。',
size_format($limit),
size_format($file_size)
);
break;
}
}
}
return $file;
}
public function process_uploaded_document($metadata, $attachment_id) {
$file_path = get_attached_file($attachment_id);
$filetype = wp_check_filetype($file_path);
$ext = $filetype['ext'];
if (isset($this->allowed_document_types[$ext])) {
$document_type = $this->allowed_document_types[$ext]['name'];
// 更新附件元数据
update_post_meta($attachment_id, '_document_type', $document_type);
update_post_meta($attachment_id, '_document_category', $this->get_document_category($ext));
// 记录上传信息
$user_id = get_current_user_id();
update_post_meta($attachment_id, '_uploaded_by', $user_id);
update_post_meta($attachment_id, '_upload_time', current_time('mysql'));
update_post_meta($attachment_id, '_file_size', filesize($file_path));
// 自动创建文档记录
$this->create_document_record($attachment_id);
}
return $metadata;
}
private function get_document_category($extension) {
$categories = array(
'办公文档' => array('doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'pdf'),
'文本文件' => array('txt', 'csv'),
'设计文件' => array('dwg', 'stp', 'ai', 'psd'),
'压缩文件' => array('zip', 'rar', '7z'),
'图片文件' => array('jpg', 'png', 'gif', 'bmp'),
);
foreach ($categories as $category => $extensions) {
if (in_array($extension, $extensions)) {
return $category;
}
}
return '其他文件';
}
private function create_document_record($attachment_id) {
$attachment = get_post($attachment_id);
$document_data = array(
'post_title' => $attachment->post_title,
'post_content' => '',
'post_status' => 'publish',
'post_type' => 'enterprise_document',
'meta_input' => array(
'attachment_id' => $attachment_id,
'file_url' => wp_get_attachment_url($attachment_id),
'file_size' => get_post_meta($attachment_id, '_file_size', true),
'document_type' => get_post_meta($attachment_id, '_document_type', true),
'uploaded_by' => get_post_meta($attachment_id, '_uploaded_by', true),
'upload_time' => get_post_meta($attachment_id, '_upload_time', true),
),
);
wp_insert_post($document_data);
}
public function add_document_upload_ui() {
?>
<div class="enterprise-upload-notice">
<h3>企业文档上传说明</h3>
<div class="document-types-grid">
<?php foreach ($this->allowed_document_types as $ext => $type_info): ?>
<div class="document-type-item">
<span class="dashicons <?php echo esc_attr($type_info['icon']); ?>"></span>
<span class="document-name"><?php echo esc_html($type_info['name']); ?></span>
<span class="document-extension">.<?php echo esc_html($ext); ?></span>
</div>
<?php endforeach; ?>
</div>
<p class="upload-limits">
<strong>上传限制:</strong><br>
• 图片文件: ≤ 10MB<br>
• 文档文件: ≤ 50MB<br>
• 压缩文件: ≤ 100MB
</p>
</div>
<style>
.enterprise-upload-notice {
background: #f8f9fa;
border: 2px solid #dee2e6;
border-radius: 8px;
padding: 20px;
margin: 20px 0;
}
.enterprise-upload-notice h3 {
margin-top: 0;
color: #2c3e50;
border-bottom: 2px solid #3498db;
padding-bottom: 10px;
}
.document-types-grid {
display: grid;
grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
gap: 10px;
margin: 15px 0;
}
.document-type-item {
background: white;
border: 1px solid #ddd;
border-radius: 4px;
padding: 10px;
display: flex;
align-items: center;
gap: 8px;
}
.document-type-item .dashicons {
color: #3498db;
font-size: 20px;
width: 20px;
height: 20px;
}
.document-name {
flex-grow: 1;
font-size: 13px;
}
.document-extension {
background: #ecf0f1;
color: #7f8c8d;
padding: 2px 6px;
border-radius: 3px;
font-size: 11px;
font-family: monospace;
}
.upload-limits {
background: #fff3cd;
border: 1px solid #ffeaa7;
border-radius: 4px;
padding: 10px;
margin: 15px 0 0;
color: #856404;
}
</style>
<?php
}
private function register_document_post_type() {
$labels = array(
'name' => '企业文档',
'singular_name' => '文档',
'menu_name' => '文档管理',
'add_new' => '添加文档',
'add_new_item' => '添加新文档',
'edit_item' => '编辑文档',
'new_item' => '新文档',
'view_item' => '查看文档',
'search_items' => '搜索文档',
'not_found' => '未找到文档',
'not_found_in_trash' => '回收站中无文档',
);
$args = array(
'labels' => $labels,
'public' => true,
'publicly_queryable' => true,
'show_ui' => true,
'show_in_menu' => true,
'query_var' => true,
'rewrite' => array('slug' => 'document'),
'capability_type' => 'post',
'has_archive' => true,
'hierarchical' => false,
'menu_position' => 20,
'menu_icon' => 'dashicons-media-document',
'supports' => array('title', 'editor', 'thumbnail', 'custom-fields'),
'taxonomies' => array('document_category'),
);
register_post_type('enterprise_document', $args);
// 注册文档分类
register_taxonomy(
'document_category',
'enterprise_document',
array(
'label' => '文档分类',
'rewrite' => array('slug' => 'document-category'),
'hierarchical' => true,
'show_admin_column' => true,
)
);
}
}
// 初始化企业文档管理系统
new Enterprise_Document_Manager();
?>六、安全最佳实践
1. 安全配置检查清单
<?php
/**
* 文件上传安全增强模块
*/
class File_Upload_Security {
public function __construct() {
add_filter('wp_handle_upload_prefilter', array($this, 'security_checks'), 1);
add_filter('wp_handle_upload', array($this, 'post_upload_checks'), 10, 2);
add_action('wp_handle_upload_error', array($this, 'log_upload_errors'));
}
public function security_checks($file) {
// 1. 验证文件扩展名
$this->validate_file_extension($file);
// 2. 检查文件头（魔术字节）
$this->check_file_signature($file);
// 3. 扫描恶意内容
$this->scan_for_malware($file);
// 4. 验证文件大小
$this->validate_file_size($file);
// 5. 检查上传频率
$this->check_upload_frequency();
return $file;
}
private function validate_file_extension($file) {
$pathinfo = pathinfo($file['name']);
$extension = strtolower($pathinfo['extension']);
// 危险扩展名黑名单
$dangerous_extensions = array(
'php', 'php3', 'php4', 'php5', 'php6', 'php7', 'phtml',
'phar', 'phps',
'pl', 'cgi', 'py', 'pyc', 'pyo',
'exe', 'msi', 'bat', 'cmd', 'scr', 'com',
'js', 'jse', 'vbs', 'vbe', 'wsf', 'wsh',
'sh', 'bash', 'zsh', 'ksh',
'jar', 'class', 'war', 'ear',
'apk', 'ipa',
'dll', 'so', 'dylib',
'hta', 'cpl', 'msc', 'msp', 'mst',
'reg', 'inf', 'ins', 'isp',
'ade', 'adp', 'app', 'bas', 'chm', 'crt',
'cpl', 'hlp', 'hta', 'inf', 'ins', 'isp',
'jse', 'lnk', 'mdb', 'mde', 'msc', 'msi',
'msp', 'mst', 'pcd', 'reg', 'scr', 'sct',
'shb', 'sys', 'url', 'vb', 'vbe', 'vbs',
'wsc', 'wsf', 'wsh',
);
if (in_array($extension, $dangerous_extensions)) {
$file['error'] = '安全限制：不允许上传此类型文件。';
return $file;
}
// 检查双重扩展名
if (preg_match('/\.(php|exe|js).*\.(php|exe|js)$/i', $file['name'])) {
$file['error'] = '安全限制：检测到可疑的文件名。';
return $file;
}
}
private function check_file_signature($file) {
$tmp_path = $file['tmp_name'];
if (!file_exists($tmp_path)) {
return;
}
// 读取文件头
$handle = @fopen($tmp_path, 'r');
if (!$handle) {
return;
}
$header = fread($handle, 256);
fclose($handle);
// 检查常见危险文件签名
$dangerous_signatures = array(
'<?php' => 'PHP文件',
'MZ' => 'Windows可执行文件',
'%PDF' => 'PDF文件（可包含JS）',
'GIF' => 'GIF图片',
"\xFF\xD8\xFF" => 'JPEG图片',
"\x89PNG" => 'PNG图片',
);
foreach ($dangerous_signatures as $signature => $type) {
if (strpos($header, $signature) === 0) {
$pathinfo = pathinfo($file['name']);
$extension = strtolower($pathinfo['extension']);
// 检查签名与扩展名是否匹配
$expected_extensions = array(
'<?php' => array('php', 'php3', 'php4', 'php5', 'php7', 'phtml'),
'MZ' => array('exe', 'dll', 'sys'),
'%PDF' => array('pdf'),
'GIF' => array('gif'),
"\xFF\xD8\xFF" => array('jpg', 'jpeg'),
"\x89PNG" => array('png'),
);
if (isset($expected_extensions[$signature])) {
if (!in_array($extension, $expected_extensions[$signature])) {
$file['error'] = sprintf(
'安全警告：文件内容与扩展名不匹配。检测到%s签名。',
$type
);
return;
}
}
}
}
}
private function scan_for_malware($file) {
$tmp_path = $file['tmp_name'];
if (!file_exists($tmp_path)) {
return;
}
// 检查文件内容
$content = file_get_contents($tmp_path);
// 常见的恶意代码模式
$malware_patterns = array(
'/eval\s*\(/i' => 'eval函数调用',
'/base64_decode/i' => 'Base64解码',
'/system\s*\(/i' => '系统命令执行',
'/shell_exec/i' => 'Shell执行',
'/passthru/i' => 'Passthru执行',
'/proc_open/i' => '进程打开',
'/popen/i' => '管道打开',
'/curl_exec/i' => 'cURL执行',
'/file_get_contents\s*\(.*http/i' => '远程文件包含',
'/fsockopen/i' => '套接字打开',
'/pfsockopen/i' => '持久套接字',
);
foreach ($malware_patterns as $pattern => $description) {
if (preg_match($pattern, $content)) {
$file['error'] = sprintf(
'安全警告：检测到可疑代码模式：%s',
$description
);
return;
}
}
}
public function post_upload_checks($upload, $context) {
if (isset($upload['file'])) {
// 设置安全权限
chmod($upload['file'], 0644);
// 记录上传日志
$this->log_upload_activity($upload);
// 扫描上传的文件
$this->scan_uploaded_file($upload['file']);
}
return $upload;
}
private function log_upload_activity($upload) {
$log_entry = sprintf(
"[%s] 文件上传: %s | 大小: %s | 用户: %s | IP: %s\n",
current_time('mysql'),
basename($upload['file']),
size_format(filesize($upload['file'])),
get_current_user_id(),
$_SERVER['REMOTE_ADDR']
);
$log_file = WP_CONTENT_DIR . '/uploads/upload-security.log';
file_put_contents($log_file, $log_entry, FILE_APPEND | LOCK_EX);
}
}
?>七、故障排除与调试
1. 常见问题解决方案
<?php
/**
* 文件上传调试工具
*/
class File_Upload_Debugger {
public static function debug_upload_issues() {
add_action('admin_notices', array(__CLASS__, 'show_upload_errors'));
add_action('wp_ajax_test_upload_config', array(__CLASS__, 'test_upload_config'));
if (current_user_can('manage_options')) {
add_action('admin_bar_menu', array(__CLASS__, 'add_debug_toolbar'), 100);
}
}
public static function show_upload_errors() {
global $pagenow;
if ($pagenow === 'media-new.php' || $pagenow === 'upload.php') {
$errors = array();
// 检查上传目录权限
$upload_dir = wp_upload_dir();
if (!wp_is_writable($upload_dir['path'])) {
$errors[] = '上传目录不可写: ' . $upload_dir['path'];
}
// 检查PHP配置
$max_upload_size = wp_max_upload_size();
$post_max_size = self::size_to_bytes(ini_get('post_max_size'));
$upload_max_filesize = self::size_to_bytes(ini_get('upload_max_filesize'));
if ($upload_max_filesize < $max_upload_size) {
$errors[] = sprintf(
'upload_max_filesize (%s) 小于WordPress限制 (%s)',
size_format($upload_max_filesize),
size_format($max_upload_size)
);
}
if ($post_max_size < $max_upload_size) {
$errors[] = sprintf(
'post_max_size (%s) 小于WordPress限制 (%s)',
size_format($post_max_size),
size_format($max_upload_size)
);
}
// 显示错误
if (!empty($errors)) {
echo '<div class="notice notice-error">';
echo '<h3>文件上传配置问题</h3>';
echo '<ul>';
foreach ($errors as $error) {
echo '<li>' . esc_html($error) . '</li>';
}
echo '</ul>';
echo '</div>';
}
}
}
public static function add_debug_toolbar($admin_bar) {
$admin_bar->add_node(array(
'id' => 'upload-debug',
'title' => '上传调试',
'href' => '#',
'meta' => array(
'title' => '测试文件上传配置',
'onclick' => 'javascript:testUploadConfig(); return false;',
),
));
add_action('admin_footer', array(__CLASS__, 'debug_script'));
}
public static function debug_script() {
?>
<script>
function testUploadConfig() {
var data = {
'action': 'test_upload_config',
'nonce': '<?php echo wp_create_nonce("upload_debug"); ?>'
};
jQuery.post(ajaxurl, data, function(response) {
alert(response.data);
});
}
</script>
<?php
}
public static function test_upload_config() {
check_ajax_referer('upload_debug', 'nonce');
$results = array();
// 测试1：上传目录
$upload_dir = wp_upload_dir();
$results[] = '上传目录: ' . $upload_dir['path'];
$results[] = '可写: ' . (wp_is_writable($upload_dir['path']) ? '是' : '否');
// 测试2：PHP配置
$results[] = 'upload_max_filesize: ' . ini_get('upload_max_filesize');
$results[] = 'post_max_size: ' . ini_get('post_max_size');
$results[] = 'max_execution_time: ' . ini_get('max_execution_time');
$results[] = 'memory_limit: ' . ini_get('memory_limit');
// 测试3：WordPress配置
$results[] = 'wp_max_upload_size: ' . size_format(wp_max_upload_size());
// 测试4：MIME类型
$mime_types = wp_get_mime_types();
$results[] = '支持的MIME类型数量: ' . count($mime_types);
wp_send_json_success(implode("\n", $results));
}
private static function size_to_bytes($size) {
$unit = preg_replace('/[^bkmgtpezy]/i', '', $size);
$size = preg_replace('/[^0-9\.]/', '', $size);
if ($unit) {
return round($size * pow(1024, stripos('bkmgtpezy', $unit[0])));
}
return round($size);
}
}
// 启用调试
File_Upload_Debugger::debug_upload_issues();
?>八、性能优化建议
1. 大规模文件上传优化
<?php
/**
* 大规模文件上传性能优化
*/
class Bulk_Upload_Optimizer {
public function __construct() {
// 分块上传支持
add_filter('plupload_init', array($this, 'configure_plupload'));
// 并行上传优化
add_filter('upload_post_params', array($this, 'add_upload_params'));
// 内存使用优化
add_action('wp_handle_upload', array($this, 'optimize_memory_usage'), 1, 2);
}
public function configure_plupload($plupload_init) {
// 增加分块大小
$plupload_init['chunk_size'] = '2mb';
// 增加最大重试次数
$plupload_init['max_retries'] = 5;
// 启用并行上传
$plupload_init['multi_selection'] = true;
// 增加同时上传文件数
$plupload_init['max_file_count'] = 20;
return $plupload_init;
}
public function add_upload_params($params) {
// 添加上传会话ID
if (!session_id()) {
session_start();
}
$params['upload_session'] = session_id();
// 添加用户上下文
if (is_user_logged_in()) {
$params['user_id'] = get_current_user_id();
$params['user_role'] = current(wp_get_current_user()->roles);
}
return $params;
}
public function optimize_memory_usage($upload, $context) {
// 清理内存
if (function_exists('gc_collect_cycles')) {
gc_collect_cycles();
}
// 重置WordPress对象缓存
wp_cache_flush();
return $upload;
}
/**
* 处理大文件上传
*/
public static function handle_large_upload($file_path) {
$max_memory = 64 * 1024 * 1024; // 64MB
if (filesize($file_path) > $max_memory) {
// 使用流式处理大文件
$handle = fopen($file_path, 'r');
if ($handle) {
$chunk_size = 8192; // 8KB
while (!feof($handle)) {
$chunk = fread($handle, $chunk_size);
// 处理文件块
self::process_chunk($chunk);
// 清理内存
unset($chunk);
if (memory_get_usage() > $max_memory * 0.8) {
if (function_exists('gc_collect_cycles')) {
gc_collect_cycles();
}
}
}
fclose($handle);
}
}
}
private static function process_chunk($chunk) {
// 在这里处理文件块
// 例如：计算哈希、扫描内容等
return true;
}
}
?>总结与最佳实践
核心要点回顾
- 理解MIME类型系统：WordPress通过MIME类型验证文件
- 使用正确的钩子：
upload_mimes是添加新文件类型的主要过滤器 - 安全第一：始终验证文件内容和类型，防止恶意上传
- 性能考虑：大文件需要特殊处理，注意内存使用
- 用户体验：提供清晰的上传反馈和错误信息
实施建议
对于小型网站：
- 使用
functions.php添加必要文件类型 - 保持简单，只添加真正需要的类型
- 定期审查和清理
对于企业级应用：
- 创建专门的插件管理文件类型
- 实现细粒度的权限控制
- 添加完整的日志和审计功能
- 考虑性能优化和缓存策略
安全规范：
- 永远不要允许上传可执行文件
- 验证文件内容和扩展名是否匹配
- 设置合理的文件大小限制
- 定期扫描上传目录
- 保持WordPress和所有插件更新
通过本文介绍的方法，您可以根据具体需求灵活扩展WordPress的文件上传功能，同时确保网站的安全和性能。无论您需要支持专业设计文件、企业文档还是特殊数据格式，WordPress都能通过适当的配置满足您的需求。
湘公网安备43020002000238