← All changes | back/Core/wordpress/security.php +292 -0 11.1.1 → 11.1.0 View file →

		@@ -1,0 +1,292 @@
	1	+<?php
	2	+
	3	+defined('ABSPATH') || die('Restricted Access');
	4	+
	5	+use AcyMailing\Helpers\UpdatemeHelper;
	6	+
	7	+/**
	8	+ * @param mixed $default
	9	+ *
	10	+ * @return mixed
	11	+ */
	12	+function acym_getVar(string $type, string $name, $default = null, string $source = 'REQUEST', int $mask = 0)
	13	+{
	14	+ $source = strtoupper($source);
	15	+
	16	+ switch ($source) {
	17	+ case 'FILES':
	18	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verification is the caller's responsibility for this generic helper.
	19	+ $input = &$_FILES;
	20	+ break;
	21	+ case 'COOKIE':
	22	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verification is the caller's responsibility for this generic helper.
	23	+ $input = &$_COOKIE;
	24	+ break;
	25	+ case 'SERVER':
	26	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verification is the caller's responsibility for this generic helper.
	27	+ $input = &$_SERVER;
	28	+ break;
	29	+ case 'SESSION':
	30	+ acym_session();
	31	+ $input = &$_SESSION;
	32	+ break;
	33	+ default:
	34	+ $source = 'REQUEST';
	35	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is the caller's responsibility for this generic helper.
	36	+ $input = &$_REQUEST;
	37	+ break;
	38	+ }
	39	+
	40	+ if (!isset($input[$name])) {
	41	+ return $default;
	42	+ }
	43	+
	44	+ $result = $input[$name];
	45	+ unset($input);
	46	+ if ($type === 'array') {
	47	+ $result = (array)$result;
	48	+ }
	49	+
	50	+ // WP alters every variable in $_REQUEST... Seriously...
	51	+ if (in_array($source, ['POST', 'REQUEST', 'GET', 'COOKIE'])) {
	52	+ $result = acym_stripslashes($result);
	53	+ }
	54	+
	55	+ return acym_cleanVar($result, $type, $mask);
	56	+}
	57	+
	58	+function acym_stripslashes($element)
	59	+{
	60	+ if (is_array($element)) {
	61	+ foreach ($element as &$oneCell) {
	62	+ $oneCell = acym_stripslashes($oneCell);
	63	+ }
	64	+ } elseif (is_string($element)) {
	65	+ $element = stripslashes($element);
	66	+ }
	67	+
	68	+ return $element;
	69	+}
	70	+
	71	+function acym_cleanVar($var, $type, $mask)
	72	+{
	73	+ if (is_array($var)) {
	74	+ foreach ($var as $i => $val) {
	75	+ $var[$i] = acym_cleanVar($val, $type, $mask);
	76	+ }
	77	+
	78	+ return $var;
	79	+ }
	80	+
	81	+ switch ($type) {
	82	+ case 'string':
	83	+ $var = strval($var);
	84	+ break;
	85	+ case 'int':
	86	+ $var = intval($var);
	87	+ break;
	88	+ case 'float':
	89	+ $var = floatval($var);
	90	+ break;
	91	+ case 'bool':
	92	+ case 'boolean':
	93	+ $var = boolval($var);
	94	+ break;
	95	+ case 'word':
	96	+ $var = preg_replace('#[^a-zA-Z_]#', '', $var);
	97	+ break;
	98	+ case 'cmd':
	99	+ $var = preg_replace('#[^a-zA-Z0-9_\.-]#', '', $var);
	100	+ $var = ltrim($var, '.');
	101	+ break;
	102	+ default:
	103	+ break;
	104	+ }
	105	+
	106	+ if (!is_string($var)) {
	107	+ return $var;
	108	+ }
	109	+
	110	+ $var = trim($var);
	111	+
	112	+ if ($mask & ACYM_ALLOWRAW) {
	113	+ return $var;
	114	+ }
	115	+
	116	+ if (!preg_match('//u', $var)) {
	117	+ // String contains invalid byte sequence, remove it
	118	+ $var = htmlspecialchars_decode(htmlspecialchars($var, ENT_IGNORE, 'UTF-8'));
	119	+ }
	120	+
	121	+ if (!($mask & ACYM_ALLOWHTML)) {
	122	+ $var = preg_replace('#<[a-zA-Z/]+[^>]*>#Uis', '', $var);
	123	+ }
	124	+
	125	+ return $var;
	126	+}
	127	+
	128	+function acym_setVar(string $name, $value): void
	129	+{
	130	+ $_REQUEST[$name] = $value;
	131	+}
	132	+
	133	+/**
	134	+ * Function detecting the context of a request, not related to security checks
	135	+ */
	136	+function acym_isAdmin(): bool
	137	+{
	138	+ // Outside of /wp-admin we are on the front-end, whatever the request parameters say
	139	+ if (!is_admin()) {
	140	+ return false;
	141	+ }
	142	+
	143	+ $page = acym_getVar('string', 'page', '');
	144	+
	145	+ return !in_array($page, [ACYM_COMPONENT.'_front', 'front'], true);
	146	+}
	147	+
	148	+function acym_cmsLoaded(): void
	149	+{
	150	+ defined('ABSPATH') || die('Restricted access');
	151	+}
	152	+
	153	+function acym_isDebug(): bool
	154	+{
	155	+ return defined('WP_DEBUG') && WP_DEBUG;
	156	+}
	157	+
	158	+function acym_askLog(bool $current = true, string $message = 'ACYM_NOTALLOWED', string $type = 'error'): void
	159	+{
	160	+ //If the user is not logged in, we just redirect him to the login page....
	161	+ $url = acym_rootURI().'wp-login.php';
	162	+ if ($current) {
	163	+ $url .= '&redirect_to='.base64_encode(acym_currentURL());
	164	+ }
	165	+
	166	+ acym_redirect($url, $message, $type);
	167	+}
	168	+
	169	+function acym_getDefaultConfigValues(): array
	170	+{
	171	+ $allPref = [];
	172	+
	173	+ $allPref['from_name'] = get_option('fromname', '');
	174	+ $allPref['from_email'] = get_option('admin_email', '');
	175	+ $allPref['bounce_email'] = $allPref['from_email'];
	176	+ $allPref['sendmail_path'] = '';
	177	+ $allPref['smtp_port'] = get_option('mailserver_port', '');
	178	+ $allPref['smtp_secured'] = $allPref['smtp_port'] == 465 ? 'ssl' : '';
	179	+ $allPref['smtp_auth'] = 1;
	180	+ $allPref['smtp_username'] = get_option('mailserver_login', '');
	181	+ $allPref['smtp_password'] = get_option('mailserver_pass', '');
	182	+ $allPref['mailer_method'] = empty($allPref['smtp_host']) ? 'phpmail' : 'smtp';
	183	+ $allPref['smtp_host'] = get_option('mailserver_url', '');
	184	+ $allPref['cron_savepath'] = ACYM_LOGS_FOLDER.'report{year}_{month}.log';
	185	+
	186	+ return $allPref;
	187	+}
	188	+
	189	+function acym_hasAdminPermissions(): bool
	190	+{
	191	+ return current_user_can('manage_options');
	192	+}
	193	+
	194	+/**
	195	+ * May the user reach the AcyMailing back-end at all? Same rule as the menu visibility (Menu::addMenus).
	196	+ */
	197	+function acym_hasBackofficeAccess(): bool
	198	+{
	199	+ $config = acym_config();
	200	+ $allowedGroups = explode(',', $config->get('wp_access', 'administrator'));
	201	+
	202	+ $userGroups = acym_getGroupsByUser();
	203	+ foreach ($userGroups as $oneGroup) {
	204	+ if ($oneGroup == 'administrator' || in_array($oneGroup, $allowedGroups)) {
	205	+ return true;
	206	+ }
	207	+ }
	208	+
	209	+ return false;
	210	+}
	211	+
	212	+function acym_cmsPermission(): void
	213	+{
	214	+ if (!acym_hasAdminPermissions()) {
	215	+ return;
	216	+ }
	217	+
	218	+ $config = acym_config();
	219	+ $roles = acym_getGroups();
	220	+ $options = [];
	221	+ $selected = explode(',', $config->get('wp_access', 'administrator'));
	222	+
	223	+ foreach ($roles as $name => $oneRole) {
	224	+ if ($name === 'administrator') {
	225	+ continue;
	226	+ }
	227	+ $options[$name] = $oneRole->text;
	228	+ }
	229	+
	230	+ asort($options);
	231	+
	232	+ echo '<div class="cell grid-x">
	233	+ <label class="cell large-3 medium-5 small-9">'.esc_html(acym_translation('ACYM_ACCESS')).' ';
	234	+ acym_info(['textShownInTooltip' => 'ACYM_ACCESS_DESC']);
	235	+ echo '</label>
	236	+ <div class="cell auto">';
	237	+
	238	+ acym_selectMultiple(
	239	+ $options,
	240	+ 'config[wp_access]',
	241	+ $selected,
	242	+ ['class' => 'acym__select'],
	243	+ 'value',
	244	+ 'text',
	245	+ true,
	246	+ );
	247	+
	248	+ echo '</div>
	249	+ </div>';
	250	+}
	251	+
	252	+function acym_triggerCmsHook(string $action, array $args = [], bool $isAction = true)
	253	+{
	254	+ array_unshift($args, $action);
	255	+
	256	+ return call_user_func_array($isAction ? 'do_action' : 'apply_filters', $args);
	257	+}
	258	+
	259	+function acym_getCmsCaptcha(): array
	260	+{
	261	+ return [];
	262	+}
	263	+
	264	+function acym_loadCaptcha(string $captchaPluginName, string $id): void
	265	+{
	266	+}
	267	+
	268	+function acym_checkCaptcha(string $captchaPluginName, ?string $response = null): bool
	269	+{
	270	+ return true;
	271	+}
	272	+
	273	+function acym_getSiteSalt(): string
	274	+{
	275	+ return wp_salt('auth');
	276	+}
	277	+
	278	+function acym_stripTags(string $text): string
	279	+{
	280	+ return wp_strip_all_tags($text);
	281	+}
	282	+
	283	+function acym_setSession(string $name, $value, bool $remove = false): void
	284	+{
	285	+ acym_session();
	286	+
	287	+ if ($remove) {
	288	+ unset($_SESSION[$name]);
	289	+ } else {
	290	+ $_SESSION[$name] = $value;
	291	+ }
	292	+}