ip-locator / functions.php

functions.php in IP Locator trunk, at functions.php

204 lines 6.0 KB

Raw Download Zip

1	<?php
2	/**
3	* Global functions.
4	*
5	* @package Functions
6	* @author Pierre Lannoy <https://pierre.lannoy.fr/>.
7	* @since 3.0.0
8	*/
9
10	if ( ! function_exists('decalog_get_psr_log_version') ) {
11	/**
12	* Get the needed version of PSR-3.
13	*
14	* @return int The PSR-3 needed version.
15	* @since 4.0.0
16	*/
17	function decalog_get_psr_log_version() {
18	$required = 1;
19	if ( ! defined( 'DECALOG_PSR_LOG_VERSION') ) {
20	define( 'DECALOG_PSR_LOG_VERSION', 'V1' );
21	}
22	switch ( strtolower( DECALOG_PSR_LOG_VERSION ) ) {
23	case 'v3':
24	$required = 3;
25	break;
26	case 'auto':
27	if ( class_exists( '\Psr\Log\NullLogger') ) {
28	$reflection = new \ReflectionMethod(\Psr\Log\NullLogger::class, 'log');
29	foreach ( $reflection->getParameters() as $param ) {
30	if ( 'message' === $param->getName() ) {
31	if ( str_contains($param->getType() ?? '', '\|') ) {
32	$required = 3;
33	}
34	}
35	}
36	}
37	}
38	return $required;
39	}
40	}
41
42	/**
43	* Downloads a URL to a local temporary file using the WordPress HTTP API.
44	*
45	* Please note that the calling function must unlink() the file.
46	*
47	* @param string $url The URL of the file to download.
48	* @param int $timeout The timeout for the request to download the file.
49	* Default 300 seconds.
50	* @param bool $signature_verification Whether to perform Signature Verification.
51	* Default false.
52	* @param string $ua The user-agent to use.
53	* @return string\|WP_Error Filename on success, WP_Error on failure.
54	* @since 3.0.0
55	*/
56	function iplocator_download_url( $url, $timeout = 300, $signature_verification = false, $ua = '' ) {
57	// WARNING: The file is not automatically deleted, the script must unlink() the file.
58	if ( ! $url ) {
59	return new WP_Error( 'http_no_url', __( 'Invalid URL Provided.' ) );
60	}
61
62	$url_filename = basename( parse_url( $url, PHP_URL_PATH ) );
63
64	$tmpfname = wp_tempnam( $url_filename );
65	if ( ! $tmpfname ) {
66	return new WP_Error( 'http_no_file', __( 'Could not create Temporary file.' ) );
67	}
68
69	$http = _wp_http_get_object();
70	$response = $http->get(
71	$url,
72	[
73	'timeout' => $timeout,
74	'stream' => true,
75	'filename' => $tmpfname,
76	'headers' => [
77	'user-agent' => $ua,
78	]
79	]
80	);
81
82	if ( is_wp_error( $response ) ) {
83	unlink( $tmpfname );
84	return $response;
85	}
86
87	$response_code = wp_remote_retrieve_response_code( $response );
88
89	if ( 200 != $response_code ) {
90	$data = array(
91	'code' => $response_code,
92	);
93
94	// Retrieve a sample of the response body for debugging purposes.
95	$tmpf = fopen( $tmpfname, 'rb' );
96	if ( $tmpf ) {
97	/**
98	* Filters the maximum error response body size in `download_url()`.
99	*
100	* @since 5.1.0
101	*
102	* @see download_url()
103	*
104	* @param int $size The maximum error response body size. Default 1 KB.
105	*/
106	$response_size = apply_filters( 'download_url_error_max_body_size', KB_IN_BYTES );
107	$data['body'] = fread( $tmpf, $response_size );
108	fclose( $tmpf );
109	}
110
111	unlink( $tmpfname );
112	return new WP_Error( 'http_404', trim( wp_remote_retrieve_response_message( $response ) ), $data );
113	}
114
115	$content_md5 = wp_remote_retrieve_header( $response, 'content-md5' );
116	if ( $content_md5 ) {
117	$md5_check = verify_file_md5( $tmpfname, $content_md5 );
118	if ( is_wp_error( $md5_check ) ) {
119	unlink( $tmpfname );
120	return $md5_check;
121	}
122	}
123
124	// If the caller expects signature verification to occur, check to see if this URL supports it.
125	if ( $signature_verification ) {
126	/**
127	* Filters the list of hosts which should have Signature Verification attempted on.
128	*
129	* @since 5.2.0
130	*
131	* @param string[] $hostnames List of hostnames.
132	*/
133	$signed_hostnames = apply_filters( 'wp_signature_hosts', array( 'wordpress.org', 'downloads.wordpress.org', 's.w.org' ) );
134	$signature_verification = in_array( parse_url( $url, PHP_URL_HOST ), $signed_hostnames, true );
135	}
136
137	// Perform signature valiation if supported.
138	if ( $signature_verification ) {
139	$signature = wp_remote_retrieve_header( $response, 'x-content-signature' );
140	if ( ! $signature ) {
141	// Retrieve signatures from a file if the header wasn't included.
142	// WordPress.org stores signatures at $package_url.sig.
143
144	$signature_url = false;
145	$url_path = parse_url( $url, PHP_URL_PATH );
146
147	if ( '.zip' === substr( $url_path, -4 ) \|\| '.tar.gz' === substr( $url_path, -7 ) ) {
148	$signature_url = str_replace( $url_path, $url_path . '.sig', $url );
149	}
150
151	/**
152	* Filters the URL where the signature for a file is located.
153	*
154	* @since 5.2.0
155	*
156	* @param false\|string $signature_url The URL where signatures can be found for a file, or false if none are known.
157	* @param string $url The URL being verified.
158	*/
159	$signature_url = apply_filters( 'wp_signature_url', $signature_url, $url );
160
161	if ( $signature_url ) {
162	$signature_request = wp_safe_remote_get(
163	$signature_url,
164	array(
165	'limit_response_size' => 10 * KB_IN_BYTES, // 10KB should be large enough for quite a few signatures.
166	)
167	);
168
169	if ( ! is_wp_error( $signature_request ) && 200 === wp_remote_retrieve_response_code( $signature_request ) ) {
170	$signature = explode( "\n", wp_remote_retrieve_body( $signature_request ) );
171	}
172	}
173	}
174
175	// Perform the checks.
176	$signature_verification = verify_file_signature( $tmpfname, $signature, basename( parse_url( $url, PHP_URL_PATH ) ) );
177	}
178
179	if ( is_wp_error( $signature_verification ) ) {
180	if (
181	/**
182	* Filters whether Signature Verification failures should be allowed to soft fail.
183	*
184	* WARNING: This may be removed from a future release.
185	*
186	* @since 5.2.0
187	*
188	* @param bool $signature_softfail If a softfail is allowed.
189	* @param string $url The url being accessed.
190	*/
191	apply_filters( 'wp_signature_softfail', true, $url )
192	) {
193	$signature_verification->add_data( $tmpfname, 'softfail-filename' );
194	} else {
195	// Hard-fail.
196	unlink( $tmpfname );
197	}
198
199	return $signature_verification;
200	}
201
202	return $tmpfname;
203	}
204