Utils.php — GiveWP – Donation Plugin and Fundraising Platform 3.18.0

give / src / Helpers / Utils.php

give / src / Helpers Last commit date

Form 2 years ago Frontend 2 years ago Gateways 4 years ago ArrayDataSet.php 4 years ago Call.php 3 years ago Date.php 4 years ago EnqueueScript.php 4 years ago Hooks.php 4 years ago Html.php 4 years ago IntlTelInput.php 2 years ago Language.php 2 years ago Table.php 4 years ago Utils.php 1 year ago

Utils.php

207 lines

1	<?php
2
3	namespace Give\Helpers;
4
5	/**
6	* Class Utils
7	*
8	* @package Give\Helpers
9	*/
10	class Utils
11	{
12	/**
13	* Extract query param from URL
14	*
15	* @since 2.7.0
16	*
17	* @param string $url
18	* @param string $queryParamName
19	* @param mixed $default
20	*
21	* @return string
22	*/
23	public static function getQueryParamFromURL($url, $queryParamName, $default = '')
24	{
25	$queryArgs = wp_parse_args(parse_url($url, PHP_URL_QUERY));
26
27	return isset($queryArgs[$queryParamName]) ? give_clean($queryArgs[$queryParamName]) : $default;
28	}
29
30	/**
31	* This function will change request url with other url.
32	*
33	* @since 2.7.0
34	*
35	* @param string $location Requested URL.
36	* @param string $url URL.
37	* @param array $removeArgs Remove extra query params.
38	* @param array $addArgs add extra query params.
39	*
40	* @return string
41	*/
42	public static function switchRequestedURL($location, $url, $addArgs = [], $removeArgs = [])
43	{
44	$queryString = [];
45
46	if ($index = strpos($location, '?')) {
47	$queryString = wp_parse_args(substr($location, strpos($location, '?') + 1));
48	}
49
50	if ($index = strpos($url, '?')) {
51	$queryString = array_merge($queryString, wp_parse_args(substr($url, strpos($url, '?') + 1)));
52	}
53
54	$url = add_query_arg(
55	$queryString,
56	$url
57	);
58
59	if ($removeArgs) {
60	foreach ($removeArgs as $name) {
61	$url = add_query_arg([$name => false], $url);
62	}
63	}
64
65	if ($addArgs) {
66	foreach ($addArgs as $name => $value) {
67	$url = add_query_arg([$name => $value], $url);
68	}
69	}
70
71	return esc_url_raw($url);
72	}
73
74	/**
75	* Remove giveDonationAction from URL.
76	*
77	* @since 2.7.0
78	*
79	* @param $url
80	*
81	* @return string
82	*/
83	public static function removeDonationAction($url)
84	{
85	return esc_url_raw( add_query_arg(['giveDonationAction' => false], $url) );
86	}
87
88	/**
89	* Determines whether a plugin is active.
90	*
91	* Only plugins installed in the plugins/ folder can be active.
92	*
93	* Plugins in the mu-plugins/ folder can't be "activated," so this function will
94	* return false for those plugins.
95	*
96	* For more information on this and similar theme functions, check out
97	* the {@link https://developer.wordpress.org/themes/basics/conditional-tags/
98	* Conditional Tags} article in the Theme Developer Handbook.
99	*
100	* @since 2.7.0
101	*
102	* @param string $plugin Path to the plugin file relative to the plugins directory.
103	*
104	* @return bool True, if in the active plugins list. False, not in the list.
105	*/
106	public static function isPluginActive($plugin)
107	{
108	if ( ! function_exists('is_plugin_active')) {
109	include_once ABSPATH . 'wp-admin/includes/plugin.php';
110	}
111
112	return is_plugin_active($plugin);
113	}
114
115	/**
116	* @since 3.17.2
117	*/
118	public static function removeBackslashes($data)
119	{
120	/**
121	* The stripslashes_deep() method removes only the first backslash occurrence from
122	* a given string, so we are using the ltrim() method to make sure we are removing
123	* all other occurrences. We need to remove these backslashes from the beginner of
124	* the input because attackers can use them to bypass the is_serialized() check.
125	*/
126	$data = stripslashes_deep($data);
127	$data = is_string($data) ? ltrim($data, '\\') : $data;
128
129	return $data;
130	}
131
132	/**
133	* The regular expression attempts to capture the basic structure of a serialized array
134	* or object. This is more robust than the is_serialized() function but still not perfect.
135	*
136	* @since 3.17.2
137	*/
138	public static function containsSerializedDataRegex($data): bool
139	{
140	if ( ! is_string($data)) {
141	return false;
142	}
143
144	$pattern = '/(a:\d+:\{.\})\|(O:\d+:"[^"]+":\{.\})/';
145
146	return preg_match($pattern, $data) === 1;
147	}
148
149	/**
150	* @since 3.17.2
151	*/
152	public static function isSerialized($data): bool
153	{
154	$data = self::removeBackslashes($data);
155
156	if (is_serialized($data) \|\| self::containsSerializedDataRegex($data)) {
157	return true;
158	}
159
160	return false;
161	}
162
163	/**
164	* @since 3.17.2
165	*/
166	public static function safeUnserialize($data)
167	{
168	$data = self::removeBackslashes($data);
169
170	/**
171	* We are setting the allowed_classes to false as a default to
172	* prevent the injection of objects that can run unwished code.
173	*
174	* From PHP docs:
175	* allowed_classes - Either an array of class names which should be accepted, false to accept no classes, or
176	* true to accept all classes. If this option is defined and unserialize() encounters an object of a class
177	* that isn't to be accepted, then the object will be instantiated as __PHP_Incomplete_Class instead. Omitting
178	* this option is the same as defining it as true: PHP will attempt to instantiate objects of any class.
179	*/
180	$unserializedData = @unserialize(trim($data), ['allowed_classes' => false]);
181
182	/*
183	* In case the passed string is not unserializeable, false is returned.
184	*
185	* @see https://www.php.net/manual/en/function.unserialize.php
186	*/
187
188	return ! $unserializedData && ! self::containsSerializedDataRegex($data) ? $data : $unserializedData;
189	}
190
191	/**
192	* Avoid insecure usage of `unserialize` when the data could be submitted by the user.
193	*
194	* @since 3.16.1
195	*
196	* @param string $data Data that might be unserialized.
197	*
198	* @return mixed Unserialized data can be any type.
199	*/
200	public static function maybeSafeUnserialize($data)
201	{
202	return self::isSerialized($data)
203	? self::safeUnserialize($data)
204	: $data;
205	}
206	}
207