← All changes
|
app/Services/Integrations/Calendars/RemoteCalendarHelper.php
+45
-1
1.5.1
→
2.5.0
View file →
| @@ -9,8 +9,50 @@ | ||
| 9 | 9 | use FluentBooking\Framework\Support\Arr; |
| 10 | 10 | |
| 11 | 11 | class RemoteCalendarHelper |
| 12 | 12 | { |
| 13 | + /** | |
| 14 | + * Remote calendar and webhook URLs are set by roles below `manage_options`, so by | |
| 15 | + * default they are held to WordPress' safe URL rules (no loopback/private/link-local | |
| 16 | + * address, and only ports 80, 443, 8080). Filter to allow an internal host or port. | |
| 17 | + * | |
| 18 | + * Callbacks get the URL under check, so compare the host, not the whole string. | |
| 19 | + */ | |
| 20 | + public static function shouldRejectUnsafeUrl($url, $context = 'remote_calendar') | |
| 21 | + { | |
| 22 | + return (bool) apply_filters('fluent_booking/reject_unsafe_remote_urls', true, $url, $context); | |
| 23 | + } | |
| 24 | + | |
| 25 | + /** | |
| 26 | + * Sanitize an operator supplied remote URL, returning false when it is not a plain | |
| 27 | + * http/https address this site is allowed to call. Callers own the error message. | |
| 28 | + * | |
| 29 | + * @param string $url | |
| 30 | + * @param string $context | |
| 31 | + * @return string|false | |
| 32 | + */ | |
| 33 | + public static function sanitizeRemoteUrl($url, $context = 'remote_calendar') | |
| 34 | + { | |
| 35 | + $url = esc_url_raw(trim((string) $url), ['http', 'https']); | |
| 36 | + | |
| 37 | + if (!$url) { | |
| 38 | + return false; | |
| 39 | + } | |
| 40 | + | |
| 41 | + // esc_url_raw() and wp_http_validate_url() both accept a scheme relative `//host`. | |
| 42 | + $scheme = strtolower((string) wp_parse_url($url, PHP_URL_SCHEME)); | |
| 43 | + | |
| 44 | + if (!in_array($scheme, ['http', 'https'], true)) { | |
| 45 | + return false; | |
| 46 | + } | |
| 47 | + | |
| 48 | + if (self::shouldRejectUnsafeUrl($url, $context) && !wp_http_validate_url($url)) { | |
| 49 | + return false; | |
| 50 | + } | |
| 51 | + | |
| 52 | + return $url; | |
| 53 | + } | |
| 54 | + | |
| 13 | 55 | public static function getUserRemoteCreatableCalendarSettings($userId) |
| 14 | 56 | { |
| 15 | 57 | $exist = Meta::where('object_type', '_calendar_user_meta') |
| 16 | 58 | ->where('object_id', $userId) |
| @@ -110,9 +152,9 @@ | ||
| 110 | 152 | public static function getRruleDates($rules, $sampleRange, $minDate, $maxDate, $args = [], $timezone = 'UTC') |
| 111 | 153 | { |
| 112 | 154 | try { |
| 113 | 155 | $durationSeconds = strtotime($sampleRange[1]) - strtotime($sampleRange[0]); |
| 114 | - | |
| 156 | + $timezone = DateTimeHelper::getValidatedTimeZone($timezone); | |
| 115 | 157 | // Define the time range you're interested in |
| 116 | 158 | $minDate = new \DateTime($minDate, new \DateTimeZone($timezone)); |
| 117 | 159 | $maxDate = new \DateTime($maxDate, new \DateTimeZone($timezone)); |
| 118 | 160 | $dtStart = new \DateTime($sampleRange[0], new \DateTimeZone($timezone)); |
| @@ -192,8 +234,10 @@ | ||
| 192 | 234 | |
| 193 | 235 | if (isset($cache[$cacheKey])) { |
| 194 | 236 | return $cache[$cacheKey]; |
| 195 | 237 | } |
| 238 | + | |
| 239 | + $timezone = DateTimeHelper::getValidatedTimeZone($timezone); | |
| 196 | 240 | |
| 197 | 241 | $refDate = new \DateTime($refDate, new \DateTimeZone('UTC')); |
| 198 | 242 | $refDate->setTimezone(new \DateTimeZone($timezone)); |
| 199 | 243 | |