patchstack / includes / core.php

core.php in Patchstack – WordPress & Plugins Security 2.1.4, at includes/core.php

244 lines 6.7 KB

Raw Download Zip

1	<?php
2
3	// Do not allow the file to be called directly.
4	if ( ! defined( 'ABSPATH' ) ) {
5	exit;
6	}
7
8	/**
9	* The core class is used as a base class for all the other classes.
10	* This will allow us to declare certain global methods/variables.
11	*/
12	class P_Core {
13
14	/**
15	* This will allow us to communicate between classes.
16	*
17	* @var Patchstack
18	*/
19	public $plugin;
20
21	/**
22	* Whether or not the site is a multisite.
23	*
24	* @var boolean
25	*/
26	private $is_multi_site = false;
27
28	/**
29	* Allowed HTML for the wp_kses function used to render certain paragraphs of texts.
30	*
31	* @var array
32	*/
33	public $allowed_html = array(
34	'a' => array(
35	'href' => array(),
36	'title' => array(),
37	'target' => array()
38	),
39	'p' => array(
40	'style' => array()
41	),
42	'span' => array(
43	'style' => array()
44	),
45	'br' => array(),
46	'strong' => array(),
47	'b' => array(),
48	'i' => array(
49	'style' => array()
50	),
51	'label' => array(
52	'for' => array(),
53	'style' => array()
54	),
55	'input' => array(
56	'type' => array(),
57	'class' => array(),
58	'name' => array(),
59	'id' => array(),
60	'value' => array(),
61	'checked' => array(),
62	'style' => array()
63	),
64	'textarea' => array(
65	'rows' => array(),
66	'id' => array(),
67	'name' => array()
68	),
69	'select' => array(
70	'name' => array(),
71	'id' => array(),
72	'data-selected' => array()
73	),
74	'option' => array(
75	'value' => array(),
76	'selected' => array()
77	),
78	'table' => array(
79	'class' => array(),
80	'style' => array()
81	),
82	'thead' => array(),
83	'th' => array(
84	'style' => array()
85	),
86	'tr' => array(),
87	'td' => array(),
88	'div' => array(
89	'class' => array(),
90	'style' => array()
91	)
92	);
93
94	/**
95	* @param Patchstack $plugin
96	* @return void
97	*/
98	public function __construct( $plugin ) {
99	$this->plugin = $plugin;
100	$this->is_multi_site = is_multisite();
101	}
102
103	/**
104	* In case of multisite we want to determine if there's a difference between the
105	* network setting and site setting and if so, use the site setting.
106	*
107	* @param string $name
108	* @param mixed $default
109	* @return mixed
110	*/
111	public function get_option( $name, $default = false ) {
112	// We always want to return the site option on the default settings management page.
113	if ( isset( $_GET['page'] ) && $_GET['page'] == 'patchstack-multisite-settings' && is_super_admin() ) {
114	return get_site_option( $name, $default );
115	}
116
117	// Get the setting of the current site.
118	$secondary = get_option( $name, $default );
119
120	// Get the setting of the network and in case there's a difference,
121	// return the value of site.
122	$main = get_site_option( $name, $default );
123	return $main != $secondary ? $secondary : $main;
124	}
125
126	/**
127	* In case we need to retrieve the option of a specific site, we can use this.
128	* It will determine if it's on a multisite environment and if so, use get_blog_option.
129	*
130	* @param int $site_id
131	* @param string $name
132	* @param mixed $default
133	* @return mixed
134	*/
135	public function get_blog_option( $site_id, $name, $default = false ) {
136	if ( $this->is_multi_site ) {
137	return get_blog_option( $site_id, $name, $default );
138	}
139
140	return get_option( $name, $default );
141	}
142
143	/**
144	* In case we need to update the option of a specific site, we can use this.
145	* It will determine if it's on a multisite environment and if so, use update_blog_option.
146	*
147	* @param int $site_id
148	* @param string $name
149	* @param mixed $value
150	* @return mixed
151	*/
152	public function update_blog_option( $site_id, $name, $value ) {
153	if ( $this->is_multi_site ) {
154	return update_blog_option( $site_id, $name, $value );
155	}
156
157	return update_option( $name, $value );
158	}
159
160	/**
161	* Determine if the license is active and not expired.
162	*
163	* @return boolean
164	*/
165	public function license_is_active() {
166	if ( get_option( 'patchstack_license_activated', 0 ) ) {
167	return true;
168	}
169
170	$expiry = get_option( 'patchstack_license_expiry', '' );
171	if ( $expiry != '' && ( strtotime( $expiry ) < ( time() + ( 3600 * 24 ) ) ) ) {
172	return true;
173	}
174
175	return false;
176	}
177
178	/**
179	* Determine if a given PHP function is disabled or not.
180	*
181	* @param string $name Name of the function to check.
182	* @return boolean Whether or not the function is available to call.
183	*/
184	public function function_available( $name ) {
185	$safe_mode = ini_get( 'safe_mode' );
186	if ( $safe_mode && strtolower( $safe_mode ) != 'off' ) {
187	return false;
188	}
189
190	// Determine if the function is available.
191	if ( in_array( $name, array_map( 'trim', explode( ',', ini_get( 'disable_functions' ) ) ) ) ) {
192	return false;
193	}
194
195	return true;
196	}
197
198	/**
199	* Attempt to get the client IP by checking all possible IP (proxy) headers.
200	*
201	* @return string
202	*/
203	public function get_ip() {
204	// IP address header override set?
205	$override = get_site_option( 'patchstack_firewall_ip_header', '' );
206	if ( $override != '' && isset( $_SERVER[ $override ] ) ) {
207	return $_SERVER[ $override ];
208	}
209
210	// IP address headers which should have priority and be used regardless of other headers.
211	$priority = array( 'HTTP_CF_CONNECTING_IP', 'HTTP_X_SUCURI_CLIENTIP' );
212	foreach ( $priority as $header ) {
213	if ( isset( $_SERVER[ $header ] ) && filter_var( $_SERVER[ $header ], FILTER_VALIDATE_IP ) !== false ) {
214	return $_SERVER[ $header ];
215	}
216	}
217
218	// Special case for hosts that have a weird configuration.
219	if ( $this->function_available( 'php_uname' ) ) {
220	$uname = @php_uname();
221
222	// Bluehos and Hostmonster store the real IP in $_SERVER['REMOTE_ADDR'] but the proxy IP in HTTP_X_FORWARDED_FOR.t
223	if ( strpos( $uname, 'bluehost' ) !== false \|\| strpos( $uname, 'hostmonster' ) !== false ) {
224	return $_SERVER['REMOTE_ADDR'];
225	}
226
227	// Hostgator stores the real IP in $_SERVER['REMOTE_ADDR'] but the proxy IP in HTTP_X_FORWARDED_FOR.
228	if ( ( strpos( $uname, 'websitewelcome' ) \|\| strpos( $uname, 'hostgator' ) ) && isset( $_SERVER['HTTP_X_FORWARDED_FOR'] ) && $_SERVER['HTTP_X_FORWARDED_FOR'] != $_SERVER['REMOTE_ADDR'] ) {
229	return $_SERVER['REMOTE_ADDR'];
230	}
231	}
232
233	// In order of priority, try to get the IP address.
234	$allowed = array( 'HTTP_X_REAL_IP', 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'SUCURI_RIP', 'REMOTE_ADDR' );
235	foreach ( $allowed as $header ) {
236	if ( isset( $_SERVER[ $header ] ) && filter_var( $_SERVER[ $header ], FILTER_VALIDATE_IP ) !== false ) {
237	return $_SERVER[ $header ];
238	}
239	}
240
241	return '127.0.0.1';
242	}
243	}
244