← All changes | includes/editor-assets-api.php +50 -7 4.1.0 → 4.2.1 View file →

		@@ -13,8 +13,14 @@
13	13	const ASSETS_DATA_EXPIRATION = 'ASSETS_DATA_EXPIRATION';
14	14
15	15	const DEFAULT_EXPIRATION_TIME = '+1 hour';
16	16
	17	+ const PRODUCTION_URL = 'https://assets.elementor.com';
	18	+ const STAGING_URL = 'https://assets.stg.elementor.red';
	19	+ const DEV_URL = 'https://assets.dev.builder.elementor.red';
	20	+
	21	+ private static ?array $allowed_hosts = null;
	22	+
17	23	public function __construct( array $config ) {
18	24	$this->config = $config;
19	25	}
20	26
		@@ -39,16 +45,11 @@
39	45	return $assets_data;
40	46	}
41	47
42	48	private function fetch_data(): array {
43		- $response = wp_remote_get( $this->config( static::ASSETS_DATA_URL ) );
	49	+ $url = $this->config( static::ASSETS_DATA_URL );
	50	+ $data = self::do_safe_get_request( $url );
44	51
45		- if ( is_wp_error( $response ) || \WP_Http::OK !== (int) wp_remote_retrieve_response_code( $response ) ) {
46		- return [];
47		- }
48		-
49		- $data = json_decode( wp_remote_retrieve_body( $response ), true );
50		-
51	52	if ( ! $this->has_valid_data( $data ) ) {
52	53	return [];
53	54	}
54	55
		@@ -114,6 +115,48 @@
114	115	}
115	116
116	117	private static function is_non_empty_array( $value ): bool {
117	118	return is_array( $value ) && ! empty( $value );
	119	+ }
	120	+
	121	+ private static function get_allowed_hosts(): array {
	122	+ if ( null !== self::$allowed_hosts ) {
	123	+ return self::$allowed_hosts;
	124	+ }
	125	+
	126	+ self::$allowed_hosts = array_values( array_filter( array_map(
	127	+ fn( $url ) => wp_parse_url( $url, PHP_URL_HOST ),
	128	+ [ self::PRODUCTION_URL, self::STAGING_URL, self::DEV_URL ]
	129	+ ) ) );
	130	+
	131	+ return self::$allowed_hosts;
	132	+ }
	133	+
	134	+ public static function is_allowed_url( $url ): bool {
	135	+ if ( ! is_string( $url ) || ! wp_http_validate_url( $url ) ) {
	136	+ return false;
	137	+ }
	138	+
	139	+ if ( 'https' !== wp_parse_url( $url, PHP_URL_SCHEME ) ) {
	140	+ return false;
	141	+ }
	142	+
	143	+ return in_array( wp_parse_url( $url, PHP_URL_HOST ), self::get_allowed_hosts(), true );
	144	+ }
	145	+
	146	+ public static function do_safe_get_request( $url ) {
	147	+ if ( ! self::is_allowed_url( $url ) ) {
	148	+ return null;
	149	+ }
	150	+
	151	+ $response = wp_safe_remote_get( $url, [
	152	+ 'timeout' => 5,
	153	+ 'limit_response_size' => 512 * KB_IN_BYTES,
	154	+ ] );
	155	+
	156	+ if ( is_wp_error( $response ) || \WP_Http::OK !== (int) wp_remote_retrieve_response_code( $response ) ) {
	157	+ return null;
	158	+ }
	159	+
	160	+ return json_decode( wp_remote_retrieve_body( $response ), true );
118	161	}
119	162	}