From c05b946900beac049ff901af196a52d4bde169ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Milo=C5=A1=20Jovanovi=C4=87?= <mrjovanovic@posteo.eu>
Date: Tue, 22 Sep 2026 08:23:40 -0700
Subject: [PATCH] initial commit

---
 disable-heif.php | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 disable-heif.php

diff --git a/disable-heif.php b/disable-heif.php
new file mode 100644
index 0000000..57eca92
--- /dev/null
+++ b/disable-heif.php
@@ -0,0 +1,36 @@
+<?php
+/**
+ * Plugin Name: Block HEIF/AVIF uploads (libheif CVE-2026-84383)
+ * Should be installed on all Wordpress installations"
+ */
+
+const NH_MSG = 'HEIC/HEIF and AVIF images can\'t be uploaded here. Please convert to JPEG first.';
+
+function nh_is_heif($path, $name = '') {
+    if (preg_match('/\.(hei[cf]s?|avifs?)$/i', $name)) return true;
+    $h = @file_get_contents($path, false, null, 0, 32);
+    return $h && substr($h, 4, 4) === 'ftyp'
+        && preg_match('/heic|heix|hevc|hevx|heim|heis|mif1|msf1|avif|avis/', substr($h, 8, 24));
+}
+
+// Friendly error
+function nh_prefilter($file) {
+    if (empty($file['error']) && nh_is_heif($file['tmp_name'], $file['name'])) {
+        $file['error'] = NH_MSG;
+    }
+    return $file;
+}
+add_filter('wp_handle_upload_prefilter', 'nh_prefilter');   // normal uploads
+add_filter('wp_handle_sideload_prefilter', 'nh_prefilter'); // REST/editor/URL impors
+
+// Generic errors
+add_filter('upload_mimes', fn($m) =>
+    array_filter($m, fn($t) => !preg_match('#^image/(hei[cf]|avif)#i', $t)));
+
+add_filter('wp_check_filetype_and_ext', function ($data, $file, $filename) {
+    if (nh_is_heif($file, $filename)) $data['ext'] = $data['type'] = false;
+    return $data;
+}, 10, 3);
+
+// Keep WordPress away from imagick
+add_filter('wp_image_editors', fn() => ['WP_Image_Editor_GD']);