PluginProbe
Patchstack – WordPress & Plugins Security / 2.1.6
Patchstack – WordPress & Plugins Security v2.1.6
2.3.7 trunk 2.1.0 2.1.1 2.1.10 2.1.11 2.1.12 2.1.13 2.1.14 2.1.15 2.1.16 2.1.17 2.1.18 2.1.19 2.1.2 2.1.20 2.1.21 2.1.22 2.1.23 2.1.24 2.1.25 2.1.3 2.1.4 2.1.5 2.1.6 All 49 releases
← All changes | includes/api.php +11 -49 2.1.232.1.6 View file →
@@ -68,9 +68,9 @@
68 68 * Fetch the API Token from API Server.
69 69 *
70 70 * @param string $clientid The API client ID.
71 71 * @param string $secretkey The API secret key.
72 - * @return string|array|object
72 + * @return string|array
73 73 */
74 74 public function fetch_access_token( $clientid = '', $secretkey = '' ) {
75 75 // Skeleton for the response data.
76 76 $response_data = (object) array(
@@ -79,18 +79,10 @@
79 79 'expiresin' => '',
80 80 );
81 81
82 82 // Determine if the license id/key is set.
83 - $client_id = $this->get_blog_option( $this->blog_id, 'patchstack_clientid', $clientid );
84 -
85 - // Decrypt the secret key, if it is encrypted.
86 - $client_secret = $this->get_blog_option( $this->blog_id, 'patchstack_secretkey', $secretkey );
87 - $client_nonce = $this->get_blog_option( $this->blog_id, 'patchstack_secretkey_nonce', false );
88 - if ( $client_nonce ) {
89 - $client_secret = $this->decrypt( $client_secret, $client_nonce );
90 - }
91 -
92 - // Make sure these values are set.
83 + $client_id = $this->get_blog_option( $this->blog_id, 'patchstack_clientid', false ) ? $this->get_blog_option( $this->blog_id, 'patchstack_clientid', false ) : $clientid;
84 + $client_secret = $this->get_blog_option( $this->blog_id, 'patchstack_secretkey', false ) ? $this->get_blog_option( $this->blog_id, 'patchstack_secretkey', false ) : $secretkey;
93 85 if ( empty( $client_id ) || empty( $client_secret ) ) {
94 86 $response_data->result = 'failed';
95 87 $response_data->message = __( 'API keys missing! Unable to obtain an access token.', 'patchstack' );
96 88 return $response_data;
@@ -136,10 +128,17 @@
136 128 $response_data->message = 'expires_in value must be an integer';
137 129 return $response_data;
138 130 }
139 131 $response_data->expiresin = $result->expires_in != 0 ? time() + $result->expires_in : 0;
132 + } elseif ( ! empty( $result->expires_in ) ) {
133 + // Some providers supply the seconds until expiration rather than
134 + // the exact timestamp. Take a best guess at which we received.
135 + $expires = $options['expires'];
136 + if ( ! $this->isExpirationTimestamp( $expires ) ) {
137 + $expires += time();
138 + }
139 + $response_data->expiresin = $expires;
140 140 }
141 -
142 141 return $response_data;
143 142 } elseif ( isset( $result->error ) ) {
144 143 $response_data->result = $result->error;
145 144 $response_data->message = __( 'Unexpected error! Unable to obtain an access token.', 'patchstack' ) . $result->message;
@@ -175,10 +174,8 @@
175 174 $this->update_blog_option( $this->blog_id, 'patchstack_license_free', $response['free'] == false ? 0 : 1 );
176 175
177 176 if ( $response['free'] == true ) {
178 177 $this->update_blog_option( $this->blog_id, 'patchstack_show_settings', 0 );
179 - } else {
180 - $this->send_header_request();
181 178 }
182 179 }
183 180
184 181 if ( isset( $response['active'] ) && $response['active'] == true ) {
@@ -228,43 +225,8 @@
228 225 return;
229 226 }
230 227
231 228 return json_decode( wp_remote_retrieve_body( $response ), true );
232 - }
233 -
234 - /**
235 - * Send a request to our API for the IP address header.
236 - */
237 - public function send_header_request()
238 - {
239 - $header = get_option( 'patchstack_firewall_ip_header', '' );
240 - $computed = get_option( 'patchstack_ip_header_computed', 0 );
241 -
242 - if ( $header == '' && ! $computed ) {
243 - // Create an OTT token.
244 - $ott = md5( wp_generate_password( 32, true, true ) );
245 - update_option( 'patchstack_ott_action', $ott );
246 -
247 - // Tell our API.
248 - wp_remote_request(
249 - $this->plugin->api_url . '/api/header',
250 - array(
251 - 'method' => 'POST',
252 - 'timeout' => 60,
253 - 'redirection' => 5,
254 - 'httpversion' => '1.0',
255 - 'blocking' => true,
256 - 'headers' => array(
257 - 'Source-Host' => get_site_url(),
258 - ),
259 - 'body' => array(
260 - 'token' => $ott,
261 - 'url' => get_site_url()
262 - ),
263 - 'cookies' => array(),
264 - )
265 - );
266 - }
267 229 }
268 230
269 231 /**
270 232 * Get the firewall rules.