Form
2 years ago
Frontend
2 years ago
Gateways
4 years ago
ArrayDataSet.php
4 years ago
Call.php
3 years ago
Date.php
4 years ago
EnqueueScript.php
4 years ago
Hooks.php
4 years ago
Html.php
4 years ago
IntlTelInput.php
2 years ago
Language.php
2 years ago
Table.php
4 years ago
Utils.php
1 year ago
Utils.php
236 lines
| 1 | <?php |
| 2 | |
| 3 | namespace Give\Helpers; |
| 4 | |
| 5 | /** |
| 6 | * Class Utils |
| 7 | * |
| 8 | * @package Give\Helpers |
| 9 | */ |
| 10 | class Utils |
| 11 | { |
| 12 | /** |
| 13 | * Extract query param from URL |
| 14 | * |
| 15 | * @since 2.7.0 |
| 16 | * |
| 17 | * @param string $url |
| 18 | * @param string $queryParamName |
| 19 | * @param mixed $default |
| 20 | * |
| 21 | * @return string |
| 22 | */ |
| 23 | public static function getQueryParamFromURL($url, $queryParamName, $default = '') |
| 24 | { |
| 25 | $queryArgs = wp_parse_args(parse_url($url, PHP_URL_QUERY)); |
| 26 | |
| 27 | return isset($queryArgs[$queryParamName]) ? give_clean($queryArgs[$queryParamName]) : $default; |
| 28 | } |
| 29 | |
| 30 | /** |
| 31 | * This function will change request url with other url. |
| 32 | * |
| 33 | * @since 2.7.0 |
| 34 | * |
| 35 | * @param string $location Requested URL. |
| 36 | * @param string $url URL. |
| 37 | * @param array $removeArgs Remove extra query params. |
| 38 | * @param array $addArgs add extra query params. |
| 39 | * |
| 40 | * @return string |
| 41 | */ |
| 42 | public static function switchRequestedURL($location, $url, $addArgs = [], $removeArgs = []) |
| 43 | { |
| 44 | $queryString = []; |
| 45 | |
| 46 | if ($index = strpos($location, '?')) { |
| 47 | $queryString = wp_parse_args(substr($location, strpos($location, '?') + 1)); |
| 48 | } |
| 49 | |
| 50 | if ($index = strpos($url, '?')) { |
| 51 | $queryString = array_merge($queryString, wp_parse_args(substr($url, strpos($url, '?') + 1))); |
| 52 | } |
| 53 | |
| 54 | $url = add_query_arg( |
| 55 | $queryString, |
| 56 | $url |
| 57 | ); |
| 58 | |
| 59 | if ($removeArgs) { |
| 60 | foreach ($removeArgs as $name) { |
| 61 | $url = add_query_arg([$name => false], $url); |
| 62 | } |
| 63 | } |
| 64 | |
| 65 | if ($addArgs) { |
| 66 | foreach ($addArgs as $name => $value) { |
| 67 | $url = add_query_arg([$name => $value], $url); |
| 68 | } |
| 69 | } |
| 70 | |
| 71 | return esc_url_raw($url); |
| 72 | } |
| 73 | |
| 74 | /** |
| 75 | * Remove giveDonationAction from URL. |
| 76 | * |
| 77 | * @since 2.7.0 |
| 78 | * |
| 79 | * @param $url |
| 80 | * |
| 81 | * @return string |
| 82 | */ |
| 83 | public static function removeDonationAction($url) |
| 84 | { |
| 85 | return esc_url_raw( add_query_arg(['giveDonationAction' => false], $url) ); |
| 86 | } |
| 87 | |
| 88 | /** |
| 89 | * Determines whether a plugin is active. |
| 90 | * |
| 91 | * Only plugins installed in the plugins/ folder can be active. |
| 92 | * |
| 93 | * Plugins in the mu-plugins/ folder can't be "activated," so this function will |
| 94 | * return false for those plugins. |
| 95 | * |
| 96 | * For more information on this and similar theme functions, check out |
| 97 | * the {@link https://developer.wordpress.org/themes/basics/conditional-tags/ |
| 98 | * Conditional Tags} article in the Theme Developer Handbook. |
| 99 | * |
| 100 | * @since 2.7.0 |
| 101 | * |
| 102 | * @param string $plugin Path to the plugin file relative to the plugins directory. |
| 103 | * |
| 104 | * @return bool True, if in the active plugins list. False, not in the list. |
| 105 | */ |
| 106 | public static function isPluginActive($plugin) |
| 107 | { |
| 108 | if ( ! function_exists('is_plugin_active')) { |
| 109 | include_once ABSPATH . 'wp-admin/includes/plugin.php'; |
| 110 | } |
| 111 | |
| 112 | return is_plugin_active($plugin); |
| 113 | } |
| 114 | |
| 115 | /** |
| 116 | * @since 3.17.2 |
| 117 | */ |
| 118 | public static function removeBackslashes($data) |
| 119 | { |
| 120 | /** |
| 121 | * The stripslashes_deep() method removes only the first backslash occurrence from |
| 122 | * a given string, so we are using the ltrim() method to make sure we are removing |
| 123 | * all other occurrences. We need to remove these backslashes from the beginner of |
| 124 | * the input because attackers can use them to bypass the is_serialized() check. |
| 125 | */ |
| 126 | $data = stripslashes_deep($data); |
| 127 | $data = is_string($data) ? ltrim($data, '\\') : $data; |
| 128 | |
| 129 | return $data; |
| 130 | } |
| 131 | |
| 132 | /** |
| 133 | * Decode strings recursively to prevent double (or more) encoded strings |
| 134 | * |
| 135 | * @since 3.19.4 |
| 136 | */ |
| 137 | public static function recursiveUrlDecode(string $data): string |
| 138 | { |
| 139 | $decoded = urldecode($data); |
| 140 | |
| 141 | return $decoded === $data ? $data : self::recursiveUrlDecode($decoded); |
| 142 | } |
| 143 | |
| 144 | /** |
| 145 | * The regular expression attempts to capture the basic structure of all data types that can be serialized by PHP. |
| 146 | * |
| 147 | * @since 3.19.4 Decode the string and remove any character not allowed in a serialized string |
| 148 | * @since 3.19.3 Support all types of serialized data instead of only objects and arrays |
| 149 | * @since 3.17.2 |
| 150 | */ |
| 151 | public static function containsSerializedDataRegex($data): bool |
| 152 | { |
| 153 | if ( ! is_string($data)) { |
| 154 | return false; |
| 155 | } |
| 156 | |
| 157 | $data = self::recursiveUrlDecode($data); |
| 158 | |
| 159 | /** |
| 160 | * This regular expression removes any special character that is not: |
| 161 | * a Letter (a-zA-Z), number (0-9), or any of the characters {}, :, ;, ", ', ., [, ], (, ), , |
| 162 | */ |
| 163 | $data = preg_replace('/[^a-zA-Z0-9:{};"\'.\[\](),]/', '', $data); |
| 164 | |
| 165 | $pattern = '/ |
| 166 | (a:\d+:\{.*}) | # Matches arrays (e.g: a:2:{i:0;s:5:"hello";i:1;i:42;}) |
| 167 | (O:\d+:"[^"]+":\{.*}) | # Matches objects (e.g: O:8:"stdClass":1:{s:4:"name";s:5:"James";}) |
| 168 | (s:\d+:"[^"]*";) | # Matches strings (e.g: s:5:"hello";) |
| 169 | (i:\d+;) | # Matches integers (e.g: i:42;) |
| 170 | (b:[01];) | # Matches booleans (e.g: b:1; or b:0;) |
| 171 | (d:\d+(\.\d+)?;) | # Matches floats (e.g: d:3.14;) |
| 172 | (N;) # Matches NULL (e.g: N;) |
| 173 | /x'; |
| 174 | |
| 175 | return preg_match($pattern, $data) === 1; |
| 176 | } |
| 177 | |
| 178 | /** |
| 179 | * @since 3.17.2 |
| 180 | */ |
| 181 | public static function isSerialized($data): bool |
| 182 | { |
| 183 | $data = self::removeBackslashes($data); |
| 184 | |
| 185 | if (is_serialized($data) || self::containsSerializedDataRegex($data)) { |
| 186 | return true; |
| 187 | } |
| 188 | |
| 189 | return false; |
| 190 | } |
| 191 | |
| 192 | /** |
| 193 | * @since 3.17.2 |
| 194 | */ |
| 195 | public static function safeUnserialize($data) |
| 196 | { |
| 197 | $data = self::removeBackslashes($data); |
| 198 | |
| 199 | /** |
| 200 | * We are setting the allowed_classes to false as a default to |
| 201 | * prevent the injection of objects that can run unwished code. |
| 202 | * |
| 203 | * From PHP docs: |
| 204 | * allowed_classes - Either an array of class names which should be accepted, false to accept no classes, or |
| 205 | * true to accept all classes. If this option is defined and unserialize() encounters an object of a class |
| 206 | * that isn't to be accepted, then the object will be instantiated as __PHP_Incomplete_Class instead. Omitting |
| 207 | * this option is the same as defining it as true: PHP will attempt to instantiate objects of any class. |
| 208 | */ |
| 209 | $unserializedData = @unserialize(trim($data), ['allowed_classes' => false]); |
| 210 | |
| 211 | /* |
| 212 | * In case the passed string is not unserializeable, false is returned. |
| 213 | * |
| 214 | * @see https://www.php.net/manual/en/function.unserialize.php |
| 215 | */ |
| 216 | |
| 217 | return ! $unserializedData && ! self::containsSerializedDataRegex($data) ? $data : $unserializedData; |
| 218 | } |
| 219 | |
| 220 | /** |
| 221 | * Avoid insecure usage of `unserialize` when the data could be submitted by the user. |
| 222 | * |
| 223 | * @since 3.16.1 |
| 224 | * |
| 225 | * @param string $data Data that might be unserialized. |
| 226 | * |
| 227 | * @return mixed Unserialized data can be any type. |
| 228 | */ |
| 229 | public static function maybeSafeUnserialize($data) |
| 230 | { |
| 231 | return self::isSerialized($data) |
| 232 | ? self::safeUnserialize($data) |
| 233 | : $data; |
| 234 | } |
| 235 | } |
| 236 |