<?php
/**
 * Plugin Name: Block HEIF/AVIF uploads (libheif CVE-2026-84383)
 * Should be installed on all Wordpress installations"
 */

const NH_MSG = 'HEIC/HEIF and AVIF images can\'t be uploaded here. Please convert to JPEG first.';

function nh_is_heif($path, $name = '') {
    if (preg_match('/\.(hei[cf]s?|avifs?)$/i', $name)) return true;
    $h = @file_get_contents($path, false, null, 0, 32);
    return $h && substr($h, 4, 4) === 'ftyp'
        && preg_match('/heic|heix|hevc|hevx|heim|heis|mif1|msf1|avif|avis/', substr($h, 8, 24));
}

// Friendly error
function nh_prefilter($file) {
    if (empty($file['error']) && nh_is_heif($file['tmp_name'], $file['name'])) {
        $file['error'] = NH_MSG;
    }
    return $file;
}
add_filter('wp_handle_upload_prefilter', 'nh_prefilter');   // normal uploads
add_filter('wp_handle_sideload_prefilter', 'nh_prefilter'); // REST/editor/URL impors

// Generic errors
add_filter('upload_mimes', fn($m) =>
    array_filter($m, fn($t) => !preg_match('#^image/(hei[cf]|avif)#i', $t)));

add_filter('wp_check_filetype_and_ext', function ($data, $file, $filename) {
    if (nh_is_heif($file, $filename)) $data['ext'] = $data['type'] = false;
    return $data;
}, 10, 3);

// Keep WordPress away from imagick
add_filter('wp_image_editors', fn() => ['WP_Image_Editor_GD']);