← All changes | src/functions.php +142 -68 5.3.1 → 6.3.0 View file →

		@@ -9,9 +9,11 @@
9	9	use WP_Defender\Component\Crypt;
10	10	use WP_Defender\Component\Two_Fa;
11	11	use WP_Defender\Behavior\WPMUDEV;
12	12	use WP_Defender\Component\User_Agent;
	13	+use WP_Defender\Component\Config\Config_Hub_Helper;
13	14	use WP_Defender\Controller\Two_Factor;
	15	+use WP_Defender\Integrations\Dashboard_Whitelabel;
14	16	use WP_Defender\Model\Setting\Main_Setting;
15	17	use WP_Defender\Helper\Request;
16	18
17	19	if ( ! defined( 'ABSPATH' ) ) {
		@@ -28,9 +30,9 @@
28	30	*/
29	31	function defender_asset_url( string $path, bool $print_url = false ) {
30	32	$url = untrailingslashit( WP_DEFENDER_BASE_URL ) . $path;
31	33
32		- if ( empty( $print_url ) ) {
	34	+ if ( ! $print_url ) {
33	35	return $url;
34	36	}
35	37
36	38	echo esc_url_raw( $url );
		@@ -99,9 +101,9 @@
99	101
100	102	/**
101	103	* Returns the global DI container for the WP Defender plugin.
102	104	*
103		- * @return \WPMU_DEV\Defender\Vendor\DI\Container The global DI container.
	105	+ * @return \WP_Defender\Component\Container The global DI container.
104	106	*/
105	107	function wd_di() {
106	108	global $wp_defender_di;
107	109
		@@ -173,9 +175,9 @@
173	175	*/
174	176	function wp_timezone_string() {
175	177	$timezone_string = get_option( 'timezone_string' );
176	178
177		- if ( $timezone_string ) {
	179	+ if ( '' !== $timezone_string ) {
178	180	return $timezone_string;
179	181	}
180	182
181	183	$offset = (float) get_option( 'gmt_offset' );
		@@ -206,19 +208,15 @@
206	208
207	209	/**
208	210	* Get hostname.
209	211	*
210		- * @return string|null
	212	+ * @return string
211	213	*/
212		-function defender_get_hostname() {
	214	+function defender_get_hostname(): string {
213	215	$host = wp_parse_url( get_site_url(), PHP_URL_HOST );
214	216	$host = str_replace( 'www.', '', $host );
215	217	$host = explode( '.', $host );
216		- if ( is_array( $host ) ) {
217		- $host = array_shift( $host );
218		- } else {
219		- $host = null;
220		- }
	218	+ $host = array_shift( $host );
221	219
222	220	return $host;
223	221	}
224	222
		@@ -240,11 +238,19 @@
240	238	// Remove percent signs that are not part of an octet.
241	239	$title = str_replace( '%', '', $title );
242	240	// Restore octets.
243	241	$title = preg_replace( '|---([a-fA-F0-9][a-fA-F0-9])---|', '%$1', $title );
244		-
245		- if ( seems_utf8( $title ) ) {
246		- $title = utf8_uri_encode( $title, 200 );
	242	+ // Support for WordPress 6.9+ and older versions.
	243	+ if ( function_exists( 'wp_is_valid_utf8' ) ) {
	244	+ // New function since WP 6.9.0.
	245	+ if ( wp_is_valid_utf8( $title ) ) {
	246	+ $title = utf8_uri_encode( $title, 200 );
	247	+ }
	248	+ } elseif ( function_exists( 'seems_utf8' ) ) {
	249	+ // Old method (before WP 6.9.0).
	250	+ if ( seems_utf8( $title ) ) { // phpcs:ignore WordPress.WP.DeprecatedFunctions.seems_utf8Found
	251	+ $title = utf8_uri_encode( $title, 200 );
	252	+ }
247	253	}
248	254
249	255	// Kill entities.
250	256	$title = preg_replace( '/&.+?;/', '', $title );
		@@ -290,9 +296,12 @@
290	296	function defender_white_label_status() {
291	297	/* translators: %s: heart icon */
292	298	$footer_text = sprintf( esc_html__( 'Made with %s by WPMU DEV', 'defender-security' ), '<i class="sui-icon-heart"></i>' );
293	299	$custom_image = apply_filters( 'wpmudev_branding_hero_image', '' );
294		- $whitelabled = apply_filters( 'wpmudev_branding_hide_branding', false );
	300	+ $custom_image = is_string( $custom_image ) ? $custom_image : (string) $custom_image;
	301	+ $custom_image = trim( $custom_image );
	302	+ $whitelabeled = apply_filters( 'wpmudev_branding_hide_branding', false );
	303	+ $whitelabeled = is_bool( $whitelabeled ) ? $whitelabeled : (bool) $whitelabeled;
295	304
296	305	return array(
297	306	'hide_branding' => apply_filters( 'wpmudev_branding_hide_branding', false ),
298	307	'hide_doc_link' => apply_filters( 'wpmudev_branding_hide_doc_link', false ),
		@@ -298,20 +307,100 @@
298	307	'hide_doc_link' => apply_filters( 'wpmudev_branding_hide_doc_link', false ),
299	308	'footer_text' => apply_filters( 'wpmudev_branding_footer_text', $footer_text ),
300	309	'hero_image' => $custom_image,
301	310	'change_footer' => apply_filters( 'wpmudev_branding_change_footer', false ),
302		- 'is_unbranded' => empty( $custom_image ) && $whitelabled,
303		- 'is_rebranded' => ! empty( $custom_image ) && $whitelabled,
	311	+ 'is_unbranded' => '' === $custom_image && $whitelabeled,
	312	+ 'is_rebranded' => '' !== $custom_image && $whitelabeled,
304	313	);
305	314	}
306	315
307	316	/**
	317	+ * Get data of the whitelabel feature, e.g. hide_branding, hide_doc_link, footer_text, hero_image, change_footer.
	318	+ *
	319	+ * @return array
	320	+ * @since 6.0.0
	321	+ */
	322	+function defender_whitelabel_data(): array {
	323	+ $data = array(
	324	+ 'is_enabled' => false,
	325	+ );
	326	+
	327	+ if ( wd_di()->get( WPMUDEV::class )->is_whitelabel_enabled() ) {
	328	+ /* translators: %s: heart icon */
	329	+ $footer_text = sprintf( esc_html__( 'Made with %s by WPMU DEV', 'defender-security' ), '<i class="sui-icon-heart"></i>' );
	330	+ $custom_image = apply_filters( 'wpmudev_branding_hero_image', '' );
	331	+ $custom_image = is_string( $custom_image ) ? $custom_image : (string) $custom_image;
	332	+ $custom_image = trim( $custom_image );
	333	+ $whitelabeled = apply_filters( 'wpmudev_branding_hide_branding', false );
	334	+ $whitelabeled = is_bool( $whitelabeled ) ? $whitelabeled : (bool) $whitelabeled;
	335	+ $whitelabel = new Dashboard_Whitelabel();
	336	+ $plugin_name = $whitelabel->can_whitelabel() ? $whitelabel->get_plugin_name( Config_Hub_Helper::WDP_ID ) : false;
	337	+
	338	+ $plugin_icon_url = '';
	339	+ $plugin_icon_class = '';
	340	+ $plugin_icon_type = 'default';
	341	+
	342	+ if ( $whitelabel->can_whitelabel() ) {
	343	+ $wl_settings = WPMUDEV_Dashboard::$whitelabel->get_settings();
	344	+ $pid = Config_Hub_Helper::WDP_ID;
	345	+ $labels_networkwide = (bool) ( $wl_settings['labels_networkwide'] ?? true );
	346	+ $labels_subsites = array_map( 'intval', (array) ( $wl_settings['labels_subsites'] ?? array() ) );
	347	+ $apply_labels = ! is_multisite()
	348	+ || is_network_admin()
	349	+ || $labels_networkwide
	350	+ || in_array( get_current_blog_id(), $labels_subsites, true );
	351	+
	352	+ if ( $apply_labels && isset( $wl_settings['labels_config'][ $pid ] ) ) {
	353	+ $cfg = $wl_settings['labels_config'][ $pid ];
	354	+ $plugin_icon_type = sanitize_key( $cfg['icon_type'] ?? 'default' );
	355	+
	356	+ switch ( $plugin_icon_type ) {
	357	+ case 'dashicon':
	358	+ $plugin_icon_class = sanitize_html_class( $cfg['icon_class'] ?? '' );
	359	+ break;
	360	+ case 'upload':
	361	+ $thumb_id = (int) ( $cfg['thumb_id'] ?? 0 );
	362	+ if ( $thumb_id ) {
	363	+ $url = wp_get_attachment_image_url( $thumb_id, 'thumbnail', true );
	364	+ $plugin_icon_url = $url ? $url : '';
	365	+ }
	366	+ break;
	367	+ case 'link':
	368	+ $plugin_icon_url = esc_url_raw( $cfg['icon_url'] ?? '' );
	369	+ break;
	370	+ case 'none':
	371	+ $plugin_icon_url = null;
	372	+ break;
	373	+ }
	374	+ }
	375	+ }
	376	+
	377	+ $data = array(
	378	+ 'is_enabled' => true,
	379	+ 'hide_branding' => apply_filters( 'wpmudev_branding_hide_branding', false ),
	380	+ 'hide_doc_link' => apply_filters( 'wpmudev_branding_hide_doc_link', false ),
	381	+ 'footer_text' => apply_filters( 'wpmudev_branding_footer_text', $footer_text ),
	382	+ 'hero_image' => $custom_image,
	383	+ 'change_footer' => apply_filters( 'wpmudev_branding_change_footer', false ),
	384	+ 'is_unbranded' => '' === $custom_image && $whitelabeled,
	385	+ 'is_rebranded' => '' !== $custom_image && $whitelabeled,
	386	+ 'plugin_name' => is_string( $plugin_name ) && '' !== trim( $plugin_name ) ? $plugin_name : '',
	387	+ 'plugin_icon_url' => $plugin_icon_url,
	388	+ 'plugin_icon_class' => $plugin_icon_class,
	389	+ 'plugin_icon_type' => $plugin_icon_type,
	390	+ );
	391	+ }
	392	+
	393	+ return $data;
	394	+}
	395	+
	396	+/**
308	397	* Indicate this is not fresh setup.
309	398	*
310	399	* @since 2.5.5
311	400	*/
312	401	function defender_no_fresh_install() {
313		- if ( empty( get_site_option( 'wd_nofresh_install' ) ) ) {
	402	+ if ( false === get_site_option( 'wd_nofresh_install', false ) ) {
314	403	update_site_option( 'wd_nofresh_install', true );
315	404	}
316	405	}
317	406
		@@ -367,9 +456,8 @@
367	456	'wdf-2fa',
368	457	'wdf-advanced-tools',
369	458	'wdf-notification',
370	459	'wdf-setting',
371		- 'wdf-tutorial',
372	460	'wdf-expert-services',
373	461	);
374	462
375	463	return in_array( defender_get_current_page(), $pages, true );
		@@ -462,18 +550,14 @@
462	550	*
463	551	* @return string
464	552	* @since 3.0.0
465	553	*/
466		-function defender_generate_random_string( $length = 16, $strings = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567' ) {
	554	+function defender_generate_random_string( int $length = 16, string $strings = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567' ) {
467	555	if ( defined( 'DEFENDER_2FA_SECRET' ) ) {
468	556	// Only use in test.
469	557	return constant( 'DEFENDER_2FA_SECRET' );
470	558	}
471	559
472		- if ( ! is_string( $strings ) ) {
473		- return '';
474		- }
475		-
476	560	$secret = array();
477	561	for ( $i = 0; $i < $length; $i++ ) {
478	562	$secret[] = $strings[ Crypt::random_int( 0, strlen( $strings ) - 1 ) ];
479	563	}
		@@ -524,9 +608,9 @@
524	608	* @var Translation_Entry $value
525	609	*/
526	610	foreach ( $l10n['defender-security']->entries as $value ) {
527	611	// If there's a translation, use it; otherwise, use the original word/phrase.
528		- $items[ $value->key() ] = empty( $value->translations ) ? $value->key() : $value->translations[0];
	612	+ $items[ $value->key() ] = isset( $value->translations[0] ) ? $value->translations[0] : $value->key();
529	613	}
530	614
531	615	// Return the list of words/phrases and their translations.
532	616	return $items;
		@@ -575,9 +659,9 @@
575	659	*/
576	660	function defender_get_user_agent( $default_string = '' ) {
577	661	$user_agent = defender_get_data_from_request( 'HTTP_USER_AGENT', 's' );
578	662
579		- return ! empty( $user_agent ) ? User_Agent::fast_cleaning( $user_agent ) : $default_string;
	663	+ return '' !== $user_agent ? User_Agent::fast_cleaning( $user_agent ) : $default_string;
580	664	}
581	665
582	666	/**
583	667	* Check if it is a CLI request.
		@@ -598,9 +682,9 @@
598	682	* @since 4.2.0
599	683	*/
600	684	function defender_is_rest_api_request(): bool {
601	685	$request_uri = Request::get_request_uri();
602		- if ( empty( $request_uri ) ) {
	686	+ if ( '' === $request_uri ) {
603	687	return false;
604	688	}
605	689
606	690	$rest_prefix = trailingslashit( rest_get_url_prefix() );
		@@ -607,43 +691,8 @@
607	691
608	692	return false !== strpos( $request_uri, $rest_prefix );
609	693	}
610	694
611		-/**
612		- * Handle deprecated functions by logging or triggering actions.
613		- * This function is a wrapper for WordPress's _deprecated_function() function.
614		- * It is used to handle deprecated functions by either logging a deprecation
615		- * message or triggering an action. It checks if the current request is an AJAX
616		- * request or a REST API request and acts accordingly.
617		- *
618		- * @param string $function_name The function that was called.
619		- * @param string $version The version number that deprecated the function.
620		- * @param string $replacement (Optional) The function that should be used instead.
621		- *
622		- * @return void
623		- * @since 4.2.0
624		- */
625		-function defender_deprecated_function( string $function_name, string $version, string $replacement = '' ): void {
626		- /**
627		- * Filters whether to trigger an error for deprecated functions.
628		- *
629		- * @param bool $trigger Whether to trigger the error for deprecated functions. Default false.
630		- *
631		- * @since 4.2.1
632		- */
633		- if ( WP_DEBUG && apply_filters( 'defender_deprecated_function_trigger_error', false ) ) {
634		- if ( wp_doing_ajax() || defender_is_rest_api_request() ) {
635		- do_action( 'deprecated_function_run', $function_name, $replacement, $version );
636		-
637		- $log_string = "Function {$function_name} is deprecated since version {$version}!";
638		- $log_string .= $replacement ? " Use {$replacement} instead." : '';
639		- wp_die( esc_html( $log_string ) );
640		- } else {
641		- _deprecated_function( esc_html( $function_name ), esc_html( $version ), esc_html( $replacement ) );
642		- }
643		- }
644		-}
645		-
646	695	if ( ! function_exists( 'defender_get_data_from_request' ) ) {
647	696	/**
648	697	* Retrieves the value of a specific server data key after sanitizing it.
649	698	*
		@@ -661,9 +710,9 @@
661	710	string $nonce_action = ''
662	711	) {
663	712	if ( in_array( $source, array( 'r', 'p', 'g' ), true ) ) {
664	713	if (
665		- ! empty( $nonce_key ) && ! wp_verify_nonce(
	714	+ '' !== $nonce_key && ! wp_verify_nonce(
666	715	sanitize_text_field( wp_unslash( $_REQUEST[ $nonce_key ] ?? '' ) ),
667	716	$nonce_action
668	717	)
669	718	) {
		@@ -693,9 +742,9 @@
693	742	$data = array();
694	743	break;
695	744	}
696	745
697		- if ( empty( $key ) ) {
	746	+ if ( null === $key || '' === $key ) {
698	747	return $data;
699	748	} elseif ( 's' === $source ) {
700	749	return sanitize_text_field( wp_unslash( $data[ $key ] ?? '' ) );
701	750	} elseif ( 'data' === $key ) {
		@@ -700,9 +749,9 @@
700	749	return sanitize_text_field( wp_unslash( $data[ $key ] ?? '' ) );
701	750	} elseif ( 'data' === $key ) {
702	751	return json_decode( sanitize_text_field( wp_unslash( $data[ $key ] ?? '' ) ), true );
703	752	} elseif ( 'f' === $source && 'file' === $key && isset( $data[ $key ] ) ) {
704		- if ( ! empty( $data[ $key ]['name'] ) ) {
	753	+ if ( isset( $data[ $key ]['name'] ) && '' !== $data[ $key ]['name'] ) {
705	754	$data[ $key ]['name'] = sanitize_file_name( $data[ $key ]['name'] );
706	755	}
707	756
708	757	return $data[ $key ];
		@@ -749,8 +798,17 @@
749	798	return '';
750	799	}
751	800
752	801	/**
	802	+ * Is a site is from WPMU DEV unlimited hosting?
	803	+ *
	804	+ * @return bool
	805	+ */
	806	+function defender_is_unlimited_hosting(): bool {
	807	+ return defined( 'WPMUDEV_HOSTING_WEBSITE_ID' ) && '' !== WPMUDEV_HOSTING_WEBSITE_ID;
	808	+}
	809	+
	810	+/**
753	811	* Get an internal log file name.
754	812	*
755	813	* @return string
756	814	*/
		@@ -762,9 +820,9 @@
762	820	* Retrieves the current time, allowing overrides for testing.
763	821	*
764	822	* @return int The current timestamp.
765	823	*/
766		-function defender_get_current_time() {
	824	+function defender_get_current_time(): int {
767	825	/**
768	826	* Filter the current time.
769	827	*
770	828	* @since 5.2.0
		@@ -772,9 +830,10 @@
772	830	* @param int $time The current timestamp.
773	831	*
774	832	* @return int The current/filtered timestamp.
775	833	*/
776		- return (int) apply_filters( 'wpdef_current_time', time() );
	834	+ $current_time = apply_filters( 'wpdef_current_time', time() );
	835	+ return ! is_int( $current_time ) ? (int) $current_time : $current_time;
777	836	}
778	837
779	838	/**
780	839	* Get the current site domain.
		@@ -798,9 +857,10 @@
798	857	* @return string The filtered domain name.
799	858	*
800	859	* @since 5.2.0
801	860	*/
802		- $domain = (string) apply_filters( 'wpdef_current_site_domain', $domain );
	861	+ $domain = apply_filters( 'wpdef_current_site_domain', $domain );
	862	+ $domain = is_string( $domain ) ? $domain : (string) $domain;
803	863
804	864	return esc_html( $domain );
805	865	}
806	866
		@@ -806,10 +866,24 @@
806	866
807	867	/**
808	868	* WP_DEFENDER_PRO sometimes doesn't match WPMUDEV::is_pro().
809	869	*
810		- * @return bool.
	870	+ * @return bool
811	871	*/
812	872	function defender_is_wp_org_version(): bool {
813	873	return ! wd_di()->get( WPMUDEV::class )->is_pro()
814	874	&& ( defined( 'WP_DEFENDER_PRO' ) && ! WP_DEFENDER_PRO );
	875	+}
	876	+
	877	+/**
	878	+ * Get the user agent of the plugin.
	879	+ *
	880	+ * @return string
	881	+ */
	882	+function defender_get_own_user_agent(): string {
	883	+ return defender_is_wp_org_version()
	884	+ ? sprintf( 'Mozilla/5.0 (compatible; Defender/%1$s)', DEFENDER_VERSION )
	885	+ : sprintf(
	886	+ 'Mozilla/5.0 (compatible; WPMU DEV Defender/%1$s; +https://wpmudev.com)',
	887	+ DEFENDER_VERSION
	888	+ );
815	889	}