ExclusionSettings.php — Matomo Analytics – Powerful, Privacy-First Insights for WordPress 5.12.1

matomo / classes / WpMatomo / Admin / ExclusionSettings.php

matomo / classes / WpMatomo / Admin Last commit date

ExclusionSettings.php

177 lines

1	<?php
2	/**
3	* Matomo - free/libre analytics platform
4	*
5	* @link https://matomo.org
6	* @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
7	* @package matomo
8	*/
9
10	namespace WpMatomo\Admin;
11
12	use Piwik\IP;
13	use Piwik\Plugins\SitesManager\API;
14	use WpMatomo\Bootstrap;
15	use WpMatomo\Capabilities;
16	use WpMatomo\Settings;
17
18	if ( ! defined( 'ABSPATH' ) ) {
19	exit; // if accessed directly
20	}
21
22	class ExclusionSettings implements AdminSettingsInterface {
23	const NONCE_NAME = 'matomo_exclusion';
24	const FORM_NAME = 'matomo_exclusions';
25
26	/**
27	* @var Settings
28	*/
29	private $settings;
30
31	public function __construct( Settings $settings ) {
32	$this->settings = $settings;
33	}
34
35	public function get_title() {
36	return esc_html__( 'Exclusions', 'matomo' );
37	}
38
39	public function show_settings( $throw_exception = false ) {
40	global $wp_roles;
41	$settings_errors = [];
42	$was_updated = false;
43	try {
44	$was_updated = $this->update_if_submitted();
45	} catch ( InvalidIpException $e ) {
46	$settings_errors[] = $e->getMessage();
47	if ( $throw_exception ) {
48	throw $e;
49	}
50	}
51
52	Bootstrap::do_bootstrap();
53
54	$api = API::getInstance();
55	$excluded_ips = $this->from_comma_list( $api->getExcludedIpsGlobal() );
56	$excluded_query_params = $this->from_comma_list( $api->getExcludedQueryParametersGlobal() );
57	$excluded_user_agents = $this->join_on_newlines( $this->settings->get_global_user_agent_exclusions() );
58	$keep_url_fragments = $api->getKeepURLFragmentsGlobal();
59	$current_ip = $this->get_current_ip();
60	$settings = $this->settings;
61
62	include __DIR__ . '/views/exclusion_settings.php';
63	}
64
65	private function update_if_submitted() {
66	if ( isset( $_POST )
67	&& ! empty( $_POST[ self::FORM_NAME ] )
68	&& is_admin()
69	&& check_admin_referer( self::NONCE_NAME )
70	&& current_user_can( Capabilities::KEY_SUPERUSER ) ) {
71	Bootstrap::do_bootstrap();
72	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
73	$post = wp_unslash( $_POST[ self::FORM_NAME ] );
74
75	$api = API::getInstance();
76	if ( isset( $post['excluded_ips'] ) ) {
77	$ips = $this->to_comma_list( $post['excluded_ips'] );
78	if ( $ips !== $api->getExcludedIpsGlobal() ) {
79	try {
80	$api->setGlobalExcludedIps( $ips );
81	} catch ( \Exception $e ) {
82	// not escaped here on purpose, the message is escaped where it is rendered
83	// (see views/settings_errors.php); escaping twice would show HTML entities to the user
84	// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
85	throw new InvalidIpException( $e->getMessage() );
86	}
87	}
88	}
89
90	if ( isset( $post['excluded_query_parameters'] ) ) {
91	$params = $this->to_comma_list( $post['excluded_query_parameters'] );
92	if ( $params !== $api->getExcludedQueryParametersGlobal() ) {
93	$api->setGlobalExcludedQueryParameters( $params );
94	}
95	}
96
97	if ( isset( $post['excluded_user_agents'] ) ) {
98	$useragents = $this->split_on_newlines( $post['excluded_user_agents'] );
99	if ( $useragents !== $this->settings->get_global_user_agent_exclusions() ) {
100	$this->settings->set_global_user_agent_exclusions( $useragents );
101	}
102	}
103
104	$keep_fragments = ! empty( $post['keep_url_fragments'] );
105	// phpcs:ignore Universal.Operators.StrictComparisons.LooseNotEqual
106	if ( $keep_fragments != $api->getKeepURLFragmentsGlobal() ) {
107	$api->setKeepURLFragmentsGlobal( $keep_fragments );
108	}
109
110	$setting_values = [ Settings::OPTION_KEY_STEALTH => [] ];
111	if ( ! empty( $post[ Settings::OPTION_KEY_STEALTH ] ) ) {
112	$setting_values[ Settings::OPTION_KEY_STEALTH ] = $post[ Settings::OPTION_KEY_STEALTH ];
113	}
114
115	$this->settings->apply_changes( $setting_values );
116
117	return true;
118	}
119
120	return false;
121	}
122
123	/**
124	* @param array $value
125	* @return string
126	*/
127	private function split_on_newlines( $value ) {
128	if ( empty( $value ) ) {
129	return [];
130	}
131
132	$value = stripslashes( $value ); // WordPress adds slashes
133	$value = str_replace( "\r", '', $value );
134	$value = array_filter( explode( "\n", $value ) );
135	return $value;
136	}
137
138	/**
139	* @param array $value
140	* @return string
141	*/
142	private function join_on_newlines( $value ) {
143	if ( empty( $value ) ) {
144	return '';
145	}
146
147	return implode( "\n", array_filter( $value ) );
148	}
149
150	private function to_comma_list( $value ) {
151	$value = $this->split_on_newlines( $value );
152	return implode( ',', $value );
153	}
154
155	private function from_comma_list( $value ) {
156	return $this->join_on_newlines( explode( ',', $value ) );
157	}
158
159	/**
160	* do not sanitize $_SERVER variables
161	* phpcs:disable WordPress.Security.ValidatedSanitizedInput
162	*
163	* @return mixed\|string
164	*/
165	private function get_current_ip() {
166	if ( ! empty( $_SERVER['HTTP_CLIENT_IP'] ) ) {
167	$ip = $_SERVER['HTTP_CLIENT_IP'];
168	} elseif ( ! empty( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) {
169	$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
170	} else {
171	$ip = IP::getIpFromHeader();
172	}
173
174	return $ip;
175	}
176	}
177