| @@ -9,29 +9,8 @@ | ||
| 9 | 9 | |
| 10 | 10 | namespace Activitypub; |
| 11 | 11 | |
| 12 | 12 | /** |
| 13 | - * Get the ActivityPub ID for a WordPress object. | |
| 14 | - * | |
| 15 | - * Returns the canonical ActivityPub URI for a WP_Post or WP_Comment. | |
| 16 | - * | |
| 17 | - * @param \WP_Post|\WP_Comment $wp_object The WordPress post or comment. | |
| 18 | - * | |
| 19 | - * @return string|null The ActivityPub ID (a URL), or null if unsupported type. | |
| 20 | - */ | |
| 21 | -function get_object_id( $wp_object ) { | |
| 22 | - if ( $wp_object instanceof \WP_Post ) { | |
| 23 | - return get_post_id( $wp_object->ID ); | |
| 24 | - } | |
| 25 | - | |
| 26 | - if ( $wp_object instanceof \WP_Comment ) { | |
| 27 | - return get_comment_id( $wp_object ); | |
| 28 | - } | |
| 29 | - | |
| 30 | - return null; | |
| 31 | -} | |
| 32 | - | |
| 33 | -/** | |
| 34 | 13 | * Convert a string from camelCase to snake_case. |
| 35 | 14 | * |
| 36 | 15 | * @param string $input The string to convert. |
| 37 | 16 | * |
| @@ -335,99 +314,5 @@ | ||
| 335 | 314 | * @return string|false The embed HTML or false if not found. |
| 336 | 315 | */ |
| 337 | 316 | function get_embed_html( $url, $inline_css = true ) { |
| 338 | 317 | return Embed::get_html( $url, $inline_css ); |
| 339 | -} | |
| 340 | - | |
| 341 | -/** | |
| 342 | - * Get the client IP address for rate-limiting purposes. | |
| 343 | - * | |
| 344 | - * Walks the ordered list of $_SERVER keys returned by the | |
| 345 | - * `activitypub_client_ip_sources` filter (default: `['REMOTE_ADDR']`) and | |
| 346 | - * returns the first value that parses as a valid IP literal, validated via | |
| 347 | - * `filter_var( ..., FILTER_VALIDATE_IP )`. The result can be overridden | |
| 348 | - * outright via the `activitypub_client_ip` filter; that filter's output is | |
| 349 | - * also validated and replaced with `''` when it isn't a valid IP, so a | |
| 350 | - * misbehaving filter can't collide all callers into the same rate-limit | |
| 351 | - * bucket. | |
| 352 | - * | |
| 353 | - * Trusting any source other than `REMOTE_ADDR` is only safe behind a | |
| 354 | - * reverse proxy that sets and overwrites the corresponding header — see | |
| 355 | - * the `activitypub_client_ip_sources` filter docblock for guidance. | |
| 356 | - * | |
| 357 | - * Callers using the return value as a rate-limit key should treat an | |
| 358 | - * empty return as "client unidentifiable" and fail closed rather than | |
| 359 | - * share a single bucket across every such request. | |
| 360 | - * | |
| 361 | - * @since 8.1.0 | |
| 362 | - * | |
| 363 | - * @return string A valid IP address, or '' when no IP could be determined. | |
| 364 | - */ | |
| 365 | -function get_client_ip() { | |
| 366 | - // phpcs:disable WordPressVIPMinimum.Variables.ServerVariables.UserControlledHeaders | |
| 367 | - $ip = ''; | |
| 368 | - | |
| 369 | - /** | |
| 370 | - * Filter the ordered list of $_SERVER keys to consult as a source for the | |
| 371 | - * client IP. The first key whose value parses as a valid IP wins. | |
| 372 | - * | |
| 373 | - * Default: array( 'REMOTE_ADDR' ) — the actual TCP peer, the only value | |
| 374 | - * that an HTTP client cannot spoof. Trusting any other $_SERVER key is | |
| 375 | - * only safe when a reverse proxy in front of the site sets that key and | |
| 376 | - * overwrites any client-supplied version; otherwise an attacker can spoof | |
| 377 | - * the value and bypass the per-IP rate limits that depend on it. | |
| 378 | - * | |
| 379 | - * Common operator overrides: | |
| 380 | - * array( 'HTTP_CF_CONNECTING_IP' ) on Cloudflare. | |
| 381 | - * array( 'HTTP_TRUE_CLIENT_IP', 'REMOTE_ADDR' ) Akamai with a fallback. | |
| 382 | - * array( 'HTTP_X_REAL_IP' ) nginx that strips the client copy. | |
| 383 | - * | |
| 384 | - * X-Forwarded-For pitfall: even with a trusted proxy, an attacker can | |
| 385 | - * prepend their own value before the proxy appends the real client IP. | |
| 386 | - * This helper takes the leftmost entry, which is correct only when the | |
| 387 | - * trusted proxy fully overwrites the header. If you trust X-Forwarded-For | |
| 388 | - * end-to-end, prefer to resolve from the right by your known proxy count | |
| 389 | - * via the activitypub_client_ip filter. | |
| 390 | - * | |
| 391 | - * @since 8.2.0 | |
| 392 | - * | |
| 393 | - * @param string[] $sources $_SERVER keys to consult, in priority order. | |
| 394 | - */ | |
| 395 | - $sources = \apply_filters( 'activitypub_client_ip_sources', array( 'REMOTE_ADDR' ) ); | |
| 396 | - | |
| 397 | - if ( ! \is_array( $sources ) ) { | |
| 398 | - $sources = array( 'REMOTE_ADDR' ); | |
| 399 | - } | |
| 400 | - | |
| 401 | - foreach ( $sources as $source ) { | |
| 402 | - if ( ! \is_string( $source ) || empty( $_SERVER[ $source ] ) ) { | |
| 403 | - continue; | |
| 404 | - } | |
| 405 | - | |
| 406 | - // Some headers (e.g. X-Forwarded-For) may contain a comma-separated list; use the first IP. | |
| 407 | - $ip_list = \sanitize_text_field( \wp_unslash( $_SERVER[ $source ] ) ); | |
| 408 | - $candidate = \trim( \explode( ',', $ip_list )[0] ); | |
| 409 | - | |
| 410 | - if ( \filter_var( $candidate, FILTER_VALIDATE_IP ) ) { | |
| 411 | - $ip = $candidate; | |
| 412 | - break; | |
| 413 | - } | |
| 414 | - } | |
| 415 | - // phpcs:enable WordPressVIPMinimum.Variables.ServerVariables.UserControlledHeaders | |
| 416 | - | |
| 417 | - /** | |
| 418 | - * Filter the client IP address used for rate limiting. | |
| 419 | - * | |
| 420 | - * @since 8.1.0 | |
| 421 | - * | |
| 422 | - * @param string $ip The detected client IP address (empty when none could be determined). | |
| 423 | - */ | |
| 424 | - $ip = \apply_filters( 'activitypub_client_ip', $ip ); | |
| 425 | - | |
| 426 | - // Tolerate surrounding whitespace from filter callbacks; FILTER_VALIDATE_IP would otherwise reject it. | |
| 427 | - if ( \is_string( $ip ) ) { | |
| 428 | - $ip = \trim( $ip ); | |
| 429 | - } | |
| 430 | - | |
| 431 | - // Re-validate so a misbehaving filter can't return a sentinel string that would collapse all callers into one bucket. | |
| 432 | - return \is_string( $ip ) && \filter_var( $ip, FILTER_VALIDATE_IP ) ? $ip : ''; | |
| 433 | 318 | } |
