← All changes | includes/Api.php +9 -4 0.3 → trunk View file →

		@@ -24,8 +24,11 @@
24	24
25	25	new Api\Plugins();
26	26	new Api\Themes();
27	27	new Api\Updates();
	28	+ new Api\Cache();
	29	+ new Api\Health();
	30	+ new Api\UpdatesData();
28	31	}
29	32
30	33	/**
31	34	* Check if API key is valid.
		@@ -32,13 +35,15 @@
32	35	*
33	36	* @return bool
34	37	*/
35	38	public function has_valid_key() {
36		- if ( flywp()->has_key() && flywp()->get_key() === $this->get_bearer_token() ) {
37		- return true;
	39	+ $token = $this->get_bearer_token();
	40	+
	41	+ if ( ! flywp()->has_key() || ! is_string( $token ) ) {
	42	+ return false;
38	43	}
39	44
40		- return false;
	45	+ return hash_equals( flywp()->get_key(), $token );
41	46	}
42	47
43	48	/**
44	49	* Get bearer token from Authorization header.
		@@ -49,9 +54,9 @@
49	54	if ( ! isset( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
50	55	return false;
51	56	}
52	57
53		- $auth_header = $_SERVER['HTTP_AUTHORIZATION'];
	58	+ $auth_header = sanitize_text_field( wp_unslash( $_SERVER['HTTP_AUTHORIZATION'] ) );
54	59
55	60	if ( ! preg_match( '/Bearer\s(\S+)/', $auth_header, $matches ) ) {
56	61	return false;
57	62	}