← All changes
|
vendor/wpfluent/framework/src/WPFluent/Http/Client.php
+35
-4
2.4.01
→
2.10.01
View file →
| @@ -84,16 +84,27 @@ | ||
| 84 | 84 | protected $body = []; |
| 85 | 85 | |
| 86 | 86 | /** |
| 87 | 87 | * Request query params to pass with the url. |
| 88 | - * | |
| 88 | + * | |
| 89 | 89 | * @var array |
| 90 | 90 | */ |
| 91 | 91 | protected $query = []; |
| 92 | 92 | |
| 93 | 93 | /** |
| 94 | + * Whether to reject unsafe URLs via wp_safe_remote_request. | |
| 95 | + * When true, dispatch() uses wp_safe_remote_request() instead of | |
| 96 | + * wp_remote_request(), which runs the URL through wp_http_validate_url() | |
| 97 | + * and refuses loopback addresses, private IP ranges, and non-standard | |
| 98 | + * ports. Off by default for backwards compatibility with internal calls. | |
| 99 | + * | |
| 100 | + * @var bool | |
| 101 | + */ | |
| 102 | + protected $useSafeRemote = false; | |
| 103 | + | |
| 104 | + /** | |
| 94 | 105 | * Stores args temporarily for then(). |
| 95 | - * | |
| 106 | + * | |
| 96 | 107 | * @var null|array |
| 97 | 108 | */ |
| 98 | 109 | private $args = null; |
| 99 | 110 | |
| @@ -152,9 +163,9 @@ | ||
| 152 | 163 | } |
| 153 | 164 | |
| 154 | 165 | /** |
| 155 | 166 | * Sets the sslverify option. |
| 156 | - * | |
| 167 | + * | |
| 157 | 168 | * @return self |
| 158 | 169 | */ |
| 159 | 170 | public function secure($verify = true) |
| 160 | 171 | { |
| @@ -161,8 +172,27 @@ | ||
| 161 | 172 | return $this->withOption('sslverify', $verify); |
| 162 | 173 | } |
| 163 | 174 | |
| 164 | 175 | /** |
| 176 | + * Route dispatch through wp_safe_remote_request() instead of | |
| 177 | + * wp_remote_request() — mirrors WordPress's wp_safe_remote_* family. | |
| 178 | + * | |
| 179 | + * Runs the URL through wp_http_validate_url() first, which refuses | |
| 180 | + * loopback addresses, private IP ranges, and non-standard ports. Use | |
| 181 | + * when the target URL is user/admin-configurable and you need SSRF | |
| 182 | + * protection. Standard external HTTPS endpoints on ports 80/443/8080 | |
| 183 | + * are unaffected. | |
| 184 | + * | |
| 185 | + * @param bool $enabled | |
| 186 | + * @return self | |
| 187 | + */ | |
| 188 | + public function safe($enabled = true) | |
| 189 | + { | |
| 190 | + $this->useSafeRemote = $enabled; | |
| 191 | + return $this; | |
| 192 | + } | |
| 193 | + | |
| 194 | + /** | |
| 165 | 195 | * Sets one or more headers. |
| 166 | 196 | * |
| 167 | 197 | * @return self |
| 168 | 198 | */ |
| @@ -389,9 +419,10 @@ | ||
| 389 | 419 | * @return array (response) |
| 390 | 420 | */ |
| 391 | 421 | protected function dispatch($url, $args) |
| 392 | 422 | { |
| 393 | - $response = wp_remote_request($url, $args); | |
| 423 | + $fn = $this->useSafeRemote ? 'wp_safe_remote_request' : 'wp_remote_request'; | |
| 424 | + $response = $fn($url, $args); | |
| 394 | 425 | |
| 395 | 426 | if (is_wp_error($response)) { |
| 396 | 427 | throw new Exception($response->get_error_message(), 500); |
| 397 | 428 | } |