give / src / Helpers / Utils.php

Utils.php in GiveWP – Donation Plugin and Fundraising Platform 4.1.0, at src/Helpers/Utils.php

236 lines 7.2 KB

Raw Download Zip

1	<?php
2
3	namespace Give\Helpers;
4
5	/**
6	* Class Utils
7	*
8	* @package Give\Helpers
9	*/
10	class Utils
11	{
12	/**
13	* Extract query param from URL
14	*
15	* @since 2.7.0
16	*
17	* @param string $url
18	* @param string $queryParamName
19	* @param mixed $default
20	*
21	* @return string
22	*/
23	public static function getQueryParamFromURL($url, $queryParamName, $default = '')
24	{
25	$queryArgs = wp_parse_args(parse_url($url, PHP_URL_QUERY));
26
27	return isset($queryArgs[$queryParamName]) ? give_clean($queryArgs[$queryParamName]) : $default;
28	}
29
30	/**
31	* This function will change request url with other url.
32	*
33	* @since 2.7.0
34	*
35	* @param string $location Requested URL.
36	* @param string $url URL.
37	* @param array $removeArgs Remove extra query params.
38	* @param array $addArgs add extra query params.
39	*
40	* @return string
41	*/
42	public static function switchRequestedURL($location, $url, $addArgs = [], $removeArgs = [])
43	{
44	$queryString = [];
45
46	if ($index = strpos($location, '?')) {
47	$queryString = wp_parse_args(substr($location, strpos($location, '?') + 1));
48	}
49
50	if ($index = strpos($url, '?')) {
51	$queryString = array_merge($queryString, wp_parse_args(substr($url, strpos($url, '?') + 1)));
52	}
53
54	$url = add_query_arg(
55	$queryString,
56	$url
57	);
58
59	if ($removeArgs) {
60	foreach ($removeArgs as $name) {
61	$url = add_query_arg([$name => false], $url);
62	}
63	}
64
65	if ($addArgs) {
66	foreach ($addArgs as $name => $value) {
67	$url = add_query_arg([$name => $value], $url);
68	}
69	}
70
71	return esc_url_raw($url);
72	}
73
74	/**
75	* Remove giveDonationAction from URL.
76	*
77	* @since 2.7.0
78	*
79	* @param $url
80	*
81	* @return string
82	*/
83	public static function removeDonationAction($url)
84	{
85	return esc_url_raw( add_query_arg(['giveDonationAction' => false], $url) );
86	}
87
88	/**
89	* Determines whether a plugin is active.
90	*
91	* Only plugins installed in the plugins/ folder can be active.
92	*
93	* Plugins in the mu-plugins/ folder can't be "activated," so this function will
94	* return false for those plugins.
95	*
96	* For more information on this and similar theme functions, check out
97	* the {@link https://developer.wordpress.org/themes/basics/conditional-tags/
98	* Conditional Tags} article in the Theme Developer Handbook.
99	*
100	* @since 2.7.0
101	*
102	* @param string $plugin Path to the plugin file relative to the plugins directory.
103	*
104	* @return bool True, if in the active plugins list. False, not in the list.
105	*/
106	public static function isPluginActive($plugin)
107	{
108	if ( ! function_exists('is_plugin_active')) {
109	include_once ABSPATH . 'wp-admin/includes/plugin.php';
110	}
111
112	return is_plugin_active($plugin);
113	}
114
115	/**
116	* @since 3.17.2
117	*/
118	public static function removeBackslashes($data)
119	{
120	/**
121	* The stripslashes_deep() method removes only the first backslash occurrence from
122	* a given string, so we are using the ltrim() method to make sure we are removing
123	* all other occurrences. We need to remove these backslashes from the beginner of
124	* the input because attackers can use them to bypass the is_serialized() check.
125	*/
126	$data = stripslashes_deep($data);
127	$data = is_string($data) ? ltrim($data, '\\') : $data;
128
129	return $data;
130	}
131
132	/**
133	* Decode strings recursively to prevent double (or more) encoded strings
134	*
135	* @since 3.19.4
136	*/
137	public static function recursiveUrlDecode(string $data): string
138	{
139	$decoded = urldecode($data);
140
141	return $decoded === $data ? $data : self::recursiveUrlDecode($decoded);
142	}
143
144	/**
145	* The regular expression attempts to capture the basic structure of all data types that can be serialized by PHP.
146	*
147	* @since 3.19.4 Decode the string and remove any character not allowed in a serialized string
148	* @since 3.19.3 Support all types of serialized data instead of only objects and arrays
149	* @since 3.17.2
150	*/
151	public static function containsSerializedDataRegex($data): bool
152	{
153	if ( ! is_string($data)) {
154	return false;
155	}
156
157	$data = self::recursiveUrlDecode($data);
158
159	/**
160	* This regular expression removes any special character that is not:
161	* a Letter (a-zA-Z), number (0-9), or any of the characters {}, :, ;, ", ', ., [, ], (, ), ,
162	*/
163	$data = preg_replace('/[^a-zA-Z0-9:{};"\'.\[\](),]/', '', $data);
164
165	$pattern = '/
166	(a:\d+:\{.*}) \| # Matches arrays (e.g: a:2:{i:0;s:5:"hello";i:1;i:42;})
167	(O:\d+:"[^"]+":\{.*}) \| # Matches objects (e.g: O:8:"stdClass":1:{s:4:"name";s:5:"James";})
168	(s:\d+:"[^"]*";) \| # Matches strings (e.g: s:5:"hello";)
169	(i:\d+;) \| # Matches integers (e.g: i:42;)
170	(b:[01];) \| # Matches booleans (e.g: b:1; or b:0;)
171	(d:\d+(\.\d+)?;) \| # Matches floats (e.g: d:3.14;)
172	(N;) # Matches NULL (e.g: N;)
173	/x';
174
175	return preg_match($pattern, $data) === 1;
176	}
177
178	/**
179	* @since 3.17.2
180	*/
181	public static function isSerialized($data): bool
182	{
183	$data = self::removeBackslashes($data);
184
185	if (is_serialized($data) \|\| self::containsSerializedDataRegex($data)) {
186	return true;
187	}
188
189	return false;
190	}
191
192	/**
193	* @since 3.17.2
194	*/
195	public static function safeUnserialize($data)
196	{
197	$data = self::removeBackslashes($data);
198
199	/**
200	* We are setting the allowed_classes to false as a default to
201	* prevent the injection of objects that can run unwished code.
202	*
203	* From PHP docs:
204	* allowed_classes - Either an array of class names which should be accepted, false to accept no classes, or
205	* true to accept all classes. If this option is defined and unserialize() encounters an object of a class
206	* that isn't to be accepted, then the object will be instantiated as __PHP_Incomplete_Class instead. Omitting
207	* this option is the same as defining it as true: PHP will attempt to instantiate objects of any class.
208	*/
209	$unserializedData = @unserialize(trim($data), ['allowed_classes' => false]);
210
211	/*
212	* In case the passed string is not unserializeable, false is returned.
213	*
214	* @see https://www.php.net/manual/en/function.unserialize.php
215	*/
216
217	return ! $unserializedData && ! self::containsSerializedDataRegex($data) ? $data : $unserializedData;
218	}
219
220	/**
221	* Avoid insecure usage of `unserialize` when the data could be submitted by the user.
222	*
223	* @since 3.16.1
224	*
225	* @param string $data Data that might be unserialized.
226	*
227	* @return mixed Unserialized data can be any type.
228	*/
229	public static function maybeSafeUnserialize($data)
230	{
231	return self::isSerialized($data)
232	? self::safeUnserialize($data)
233	: $data;
234	}
235	}
236