← All changes | app/Services/Integrations/Calendars/RemoteCalendarHelper.php +42 -0 1.5.21 → 2.5.0 View file →

		@@ -9,8 +9,50 @@
9	9	use FluentBooking\Framework\Support\Arr;
10	10
11	11	class RemoteCalendarHelper
12	12	{
	13	+ /**
	14	+ * Remote calendar and webhook URLs are set by roles below `manage_options`, so by
	15	+ * default they are held to WordPress' safe URL rules (no loopback/private/link-local
	16	+ * address, and only ports 80, 443, 8080). Filter to allow an internal host or port.
	17	+ *
	18	+ * Callbacks get the URL under check, so compare the host, not the whole string.
	19	+ */
	20	+ public static function shouldRejectUnsafeUrl($url, $context = 'remote_calendar')
	21	+ {
	22	+ return (bool) apply_filters('fluent_booking/reject_unsafe_remote_urls', true, $url, $context);
	23	+ }
	24	+
	25	+ /**
	26	+ * Sanitize an operator supplied remote URL, returning false when it is not a plain
	27	+ * http/https address this site is allowed to call. Callers own the error message.
	28	+ *
	29	+ * @param string $url
	30	+ * @param string $context
	31	+ * @return string|false
	32	+ */
	33	+ public static function sanitizeRemoteUrl($url, $context = 'remote_calendar')
	34	+ {
	35	+ $url = esc_url_raw(trim((string) $url), ['http', 'https']);
	36	+
	37	+ if (!$url) {
	38	+ return false;
	39	+ }
	40	+
	41	+ // esc_url_raw() and wp_http_validate_url() both accept a scheme relative `//host`.
	42	+ $scheme = strtolower((string) wp_parse_url($url, PHP_URL_SCHEME));
	43	+
	44	+ if (!in_array($scheme, ['http', 'https'], true)) {
	45	+ return false;
	46	+ }
	47	+
	48	+ if (self::shouldRejectUnsafeUrl($url, $context) && !wp_http_validate_url($url)) {
	49	+ return false;
	50	+ }
	51	+
	52	+ return $url;
	53	+ }
	54	+
13	55	public static function getUserRemoteCreatableCalendarSettings($userId)
14	56	{
15	57	$exist = Meta::where('object_type', '_calendar_user_meta')
16	58	->where('object_id', $userId)