class.jetpack-client.php — Jetpack – WP Security, Backup, Speed, & Growth 7.2.1

jetpack / class.jetpack-client.php

jetpack Last commit date

class.jetpack-client.php

389 lines

1	<?php
2
3	class Jetpack_Client {
4	const WPCOM_JSON_API_VERSION = '1.1';
5
6	/**
7	* Makes an authorized remote request using Jetpack_Signature
8	*
9	* @return array\|WP_Error WP HTTP response on success
10	*/
11	public static function remote_request( $args, $body = null ) {
12	$defaults = array(
13	'url' => '',
14	'user_id' => 0,
15	'blog_id' => 0,
16	'auth_location' => JETPACK_CLIENT__AUTH_LOCATION,
17	'method' => 'POST',
18	'timeout' => 10,
19	'redirection' => 0,
20	'headers' => array(),
21	'stream' => false,
22	'filename' => null,
23	'sslverify' => true,
24	);
25
26	$args = wp_parse_args( $args, $defaults );
27
28	$args['blog_id'] = (int) $args['blog_id'];
29
30	if ( 'header' != $args['auth_location'] ) {
31	$args['auth_location'] = 'query_string';
32	}
33
34	$token = Jetpack_Data::get_access_token( $args['user_id'] );
35	if ( !$token ) {
36	return new Jetpack_Error( 'missing_token' );
37	}
38
39	$method = strtoupper( $args['method'] );
40
41	$timeout = intval( $args['timeout'] );
42
43	$redirection = $args['redirection'];
44	$stream = $args['stream'];
45	$filename = $args['filename'];
46	$sslverify = $args['sslverify'];
47
48	$request = compact( 'method', 'body', 'timeout', 'redirection', 'stream', 'filename', 'sslverify' );
49
50	@list( $token_key, $secret ) = explode( '.', $token->secret );
51	if ( empty( $token ) \|\| empty( $secret ) ) {
52	return new Jetpack_Error( 'malformed_token' );
53	}
54
55	$token_key = sprintf( '%s:%d:%d', $token_key, JETPACK__API_VERSION, $token->external_user_id );
56
57	require_once JETPACK__PLUGIN_DIR . 'class.jetpack-signature.php';
58
59	$time_diff = (int) Jetpack_Options::get_option( 'time_diff' );
60	$jetpack_signature = new Jetpack_Signature( $token->secret, $time_diff );
61
62	$timestamp = time() + $time_diff;
63
64	if( function_exists( 'wp_generate_password' ) ) {
65	$nonce = wp_generate_password( 10, false );
66	} else {
67	$nonce = substr( sha1( rand( 0, 1000000 ) ), 0, 10);
68	}
69
70	// Kind of annoying. Maybe refactor Jetpack_Signature to handle body-hashing
71	if ( is_null( $body ) ) {
72	$body_hash = '';
73
74	} else {
75	// Allow arrays to be used in passing data.
76	$body_to_hash = $body;
77
78	if ( is_array( $body ) ) {
79	// We cast this to a new variable, because the array form of $body needs to be
80	// maintained so it can be passed into the request later on in the code.
81	if ( count( $body ) > 0 ) {
82	$body_to_hash = json_encode( self::_stringify_data( $body ) );
83	} else {
84	$body_to_hash = '';
85	}
86	}
87
88	if ( ! is_string( $body_to_hash ) ) {
89	return new Jetpack_Error( 'invalid_body', 'Body is malformed.' );
90	}
91
92	$body_hash = jetpack_sha1_base64( $body_to_hash );
93	}
94
95	$auth = array(
96	'token' => $token_key,
97	'timestamp' => $timestamp,
98	'nonce' => $nonce,
99	'body-hash' => $body_hash,
100	);
101
102	if ( false !== strpos( $args['url'], 'xmlrpc.php' ) ) {
103	$url_args = array(
104	'for' => 'jetpack',
105	'wpcom_blog_id' => Jetpack_Options::get_option( 'id' ),
106	);
107	} else {
108	$url_args = array();
109	}
110
111	if ( 'header' != $args['auth_location'] ) {
112	$url_args += $auth;
113	}
114
115	$url = add_query_arg( urlencode_deep( $url_args ), $args['url'] );
116	$url = Jetpack::fix_url_for_bad_hosts( $url );
117
118	$signature = $jetpack_signature->sign_request( $token_key, $timestamp, $nonce, $body_hash, $method, $url, $body, false );
119
120	if ( !$signature \|\| is_wp_error( $signature ) ) {
121	return $signature;
122	}
123
124	// Send an Authorization header so various caches/proxies do the right thing
125	$auth['signature'] = $signature;
126	$auth['version'] = JETPACK__VERSION;
127	$header_pieces = array();
128	foreach ( $auth as $key => $value ) {
129	$header_pieces[] = sprintf( '%s="%s"', $key, $value );
130	}
131	$request['headers'] = array_merge( $args['headers'], array(
132	'Authorization' => "X_JETPACK " . join( ' ', $header_pieces ),
133	) );
134
135	if ( 'header' != $args['auth_location'] ) {
136	$url = add_query_arg( 'signature', urlencode( $signature ), $url );
137	}
138
139	return Jetpack_Client::_wp_remote_request( $url, $request );
140	}
141
142	/**
143	* Wrapper for wp_remote_request(). Turns off SSL verification for certain SSL errors.
144	* This is lame, but many, many, many hosts have misconfigured SSL.
145	*
146	* When Jetpack is registered, the jetpack_fallback_no_verify_ssl_certs option is set to the current time if:
147	* 1. a certificate error is found AND
148	* 2. not verifying the certificate works around the problem.
149	*
150	* The option is checked on each request.
151	*
152	* @internal
153	* @see Jetpack::fix_url_for_bad_hosts()
154	*
155	* @return array\|WP_Error WP HTTP response on success
156	*/
157	public static function _wp_remote_request( $url, $args, $set_fallback = false ) {
158	/**
159	* SSL verification (`sslverify`) for the JetpackClient remote request
160	* defaults to off, use this filter to force it on.
161	*
162	* Return `true` to ENABLE SSL verification, return `false`
163	* to DISABLE SSL verification.
164	*
165	* @since 3.6.0
166	*
167	* @param bool Whether to force `sslverify` or not.
168	*/
169	if ( apply_filters( 'jetpack_client_verify_ssl_certs', false ) ) {
170	return wp_remote_request( $url, $args );
171	}
172
173	$fallback = Jetpack_Options::get_option( 'fallback_no_verify_ssl_certs' );
174	if ( false === $fallback ) {
175	Jetpack_Options::update_option( 'fallback_no_verify_ssl_certs', 0 );
176	}
177
178	if ( (int) $fallback ) {
179	// We're flagged to fallback
180	$args['sslverify'] = false;
181	}
182
183	$response = wp_remote_request( $url, $args );
184
185	if (
186	!$set_fallback // We're not allowed to set the flag on this request, so whatever happens happens
187	\|\|
188	isset( $args['sslverify'] ) && !$args['sslverify'] // No verification - no point in doing it again
189	\|\|
190	!is_wp_error( $response ) // Let it ride
191	) {
192	Jetpack_Client::set_time_diff( $response, $set_fallback );
193	return $response;
194	}
195
196	// At this point, we're not flagged to fallback and we are allowed to set the flag on this request.
197
198	$message = $response->get_error_message();
199
200	// Is it an SSL Certificate verification error?
201	if (
202	false === strpos( $message, '14090086' ) // OpenSSL SSL3 certificate error
203	&&
204	false === strpos( $message, '1407E086' ) // OpenSSL SSL2 certificate error
205	&&
206	false === strpos( $message, 'error setting certificate verify locations' ) // cURL CA bundle not found
207	&&
208	false === strpos( $message, 'Peer certificate cannot be authenticated with' ) // cURL CURLE_SSL_CACERT: CA bundle found, but not helpful
209	// different versions of curl have different error messages
210	// this string should catch them all
211	&&
212	false === strpos( $message, 'Problem with the SSL CA cert' ) // cURL CURLE_SSL_CACERT_BADFILE: probably access rights
213	) {
214	// No, it is not.
215	return $response;
216	}
217
218	// Redo the request without SSL certificate verification.
219	$args['sslverify'] = false;
220	$response = wp_remote_request( $url, $args );
221
222	if ( !is_wp_error( $response ) ) {
223	// The request went through this time, flag for future fallbacks
224	Jetpack_Options::update_option( 'fallback_no_verify_ssl_certs', time() );
225	Jetpack_Client::set_time_diff( $response, $set_fallback );
226	}
227
228	return $response;
229	}
230
231	public static function set_time_diff( &$response, $force_set = false ) {
232	$code = wp_remote_retrieve_response_code( $response );
233
234	// Only trust the Date header on some responses
235	if ( 200 != $code && 304 != $code && 400 != $code && 401 != $code ) {
236	return;
237	}
238
239	if ( !$date = wp_remote_retrieve_header( $response, 'date' ) ) {
240	return;
241	}
242
243	if ( 0 >= $time = (int) strtotime( $date ) ) {
244	return;
245	}
246
247	$time_diff = $time - time();
248
249	if ( $force_set ) { // during register
250	Jetpack_Options::update_option( 'time_diff', $time_diff );
251	} else { // otherwise
252	$old_diff = Jetpack_Options::get_option( 'time_diff' );
253	if ( false === $old_diff \|\| abs( $time_diff - (int) $old_diff ) > 10 ) {
254	Jetpack_Options::update_option( 'time_diff', $time_diff );
255	}
256	}
257	}
258
259	/**
260	* Queries the WordPress.com REST API with a user token.
261	*
262	* @param string $path REST API path.
263	* @param string $version REST API version. Default is `2`.
264	* @param array $args Arguments to {@see WP_Http}. Default is `array()`.
265	* @param string $body Body passed to {@see WP_Http}. Default is `null`.
266	* @param string $base_api_path REST API root. Default is `wpcom`.
267	*
268	* @return array\|WP_Error $response Response data, else {@see WP_Error} on failure.
269	*/
270	public static function wpcom_json_api_request_as_user( $path, $version = '2', $args = array(), $body = null, $base_api_path = 'wpcom' ) {
271	$base_api_path = trim( $base_api_path, '/' );
272	$version = ltrim( $version, 'v' );
273	$path = ltrim( $path, '/' );
274
275	$args = array_intersect_key( $args, array(
276	'headers' => 'array',
277	'method' => 'string',
278	'timeout' => 'int',
279	'redirection' => 'int',
280	'stream' => 'boolean',
281	'filename' => 'string',
282	'sslverify' => 'boolean',
283	) );
284
285	$args['user_id'] = get_current_user_id();
286	$args['method'] = isset( $args['method'] ) ? strtoupper( $args['method'] ) : 'GET';
287	$args['url'] = sprintf( '%s://%s/%s/v%s/%s', self::protocol(), JETPACK__WPCOM_JSON_API_HOST, $base_api_path, $version, $path );
288
289	if ( isset( $body ) && ! isset( $args['headers'] ) && in_array( $args['method'], array( 'POST', 'PUT', 'PATCH' ), true ) ) {
290	$args['headers'] = array( 'Content-Type' => 'application/json' );
291	}
292
293	if ( isset( $body ) && ! is_string( $body ) ) {
294	$body = wp_json_encode( $body );
295	}
296
297	return self::remote_request( $args, $body );
298	}
299
300	/**
301	* Query the WordPress.com REST API using the blog token
302	*
303	* @param string $path
304	* @param string $version
305	* @param array $args
306	* @param string $body
307	* @param string $base_api_path
308	* @return array\|WP_Error $response Data.
309	*/
310	static function wpcom_json_api_request_as_blog( $path, $version = self::WPCOM_JSON_API_VERSION, $args = array(), $body = null, $base_api_path = 'rest' ) {
311	$filtered_args = array_intersect_key( $args, array(
312	'headers' => 'array',
313	'method' => 'string',
314	'timeout' => 'int',
315	'redirection' => 'int',
316	'stream' => 'boolean',
317	'filename' => 'string',
318	'sslverify' => 'boolean',
319	) );
320
321	// unprecedingslashit
322	$_path = preg_replace( '/^\//', '', $path );
323
324	// Use GET by default whereas `remote_request` uses POST
325	$request_method = ( isset( $filtered_args['method'] ) ) ? $filtered_args['method'] : 'GET';
326
327	$url = sprintf( '%s://%s/%s/v%s/%s', self::protocol(), JETPACK__WPCOM_JSON_API_HOST, $base_api_path, $version, $_path );
328
329	$validated_args = array_merge( $filtered_args, array(
330	'url' => $url,
331	'blog_id' => (int) Jetpack_Options::get_option( 'id' ),
332	'method' => $request_method,
333	) );
334
335	return Jetpack_Client::remote_request( $validated_args, $body );
336	}
337
338	/**
339	* Takes an array or similar structure and recursively turns all values into strings. This is used to
340	* make sure that body hashes are made ith the string version, which is what will be seen after a
341	* server pulls up the data in the $_POST array.
342	*
343	* @param array\|mixed $data
344	*
345	* @return array\|string
346	*/
347	public static function _stringify_data( $data ) {
348
349	// Booleans are special, lets just makes them and explicit 1/0 instead of the 0 being an empty string.
350	if ( is_bool( $data ) ) {
351	return $data ? "1" : "0";
352	}
353
354	// Cast objects into arrays.
355	if ( is_object( $data ) ) {
356	$data = (array) $data;
357	}
358
359	// Non arrays at this point should be just converted to strings.
360	if ( ! is_array( $data ) ) {
361	return (string)$data;
362	}
363
364	foreach ( $data as $key => &$value ) {
365	$value = self::_stringify_data( $value );
366	}
367
368	return $data;
369	}
370
371	/**
372	* Gets protocol string.
373	*
374	* @return string `https` (if possible), else `http`.
375	*/
376	public static function protocol() {
377	/**
378	* Determines whether Jetpack can send outbound https requests to the WPCOM api.
379	*
380	* @since 3.6.0
381	*
382	* @param bool $proto Defaults to true.
383	*/
384	$https = apply_filters( 'jetpack_can_make_outbound_https', true );
385
386	return $https ? 'https' : 'http';
387	}
388	}
389