PluginProbe
Patchstack – WordPress & Plugins Security / 2.1.7
Patchstack – WordPress & Plugins Security v2.1.7
2.3.7 trunk 2.1.0 2.1.1 2.1.10 2.1.11 2.1.12 2.1.13 2.1.14 2.1.15 2.1.16 2.1.17 2.1.18 2.1.19 2.1.2 2.1.20 2.1.21 2.1.22 2.1.23 2.1.24 2.1.25 2.1.3 2.1.4 2.1.5 2.1.6 All 49 releases
← All changes | includes/api.php +11 -54 2.1.242.1.7 View file →
@@ -68,9 +68,9 @@
68 68 * Fetch the API Token from API Server.
69 69 *
70 70 * @param string $clientid The API client ID.
71 71 * @param string $secretkey The API secret key.
72 - * @return string|array|object
72 + * @return string|array
73 73 */
74 74 public function fetch_access_token( $clientid = '', $secretkey = '' ) {
75 75 // Skeleton for the response data.
76 76 $response_data = (object) array(
@@ -79,18 +79,10 @@
79 79 'expiresin' => '',
80 80 );
81 81
82 82 // Determine if the license id/key is set.
83 - $client_id = $this->get_blog_option( $this->blog_id, 'patchstack_clientid', $clientid );
84 -
85 - // Decrypt the secret key, if it is encrypted.
86 - $client_secret = $this->get_blog_option( $this->blog_id, 'patchstack_secretkey', $secretkey );
87 - $client_nonce = $this->get_blog_option( $this->blog_id, 'patchstack_secretkey_nonce', false );
88 - if ( $client_nonce ) {
89 - $client_secret = $this->decrypt( $client_secret, $client_nonce );
90 - }
91 -
92 - // Make sure these values are set.
83 + $client_id = $this->get_blog_option( $this->blog_id, 'patchstack_clientid', false ) ? $this->get_blog_option( $this->blog_id, 'patchstack_clientid', false ) : $clientid;
84 + $client_secret = $this->get_blog_option( $this->blog_id, 'patchstack_secretkey', false ) ? $this->get_blog_option( $this->blog_id, 'patchstack_secretkey', false ) : $secretkey;
93 85 if ( empty( $client_id ) || empty( $client_secret ) ) {
94 86 $response_data->result = 'failed';
95 87 $response_data->message = __( 'API keys missing! Unable to obtain an access token.', 'patchstack' );
96 88 return $response_data;
@@ -136,10 +128,17 @@
136 128 $response_data->message = 'expires_in value must be an integer';
137 129 return $response_data;
138 130 }
139 131 $response_data->expiresin = $result->expires_in != 0 ? time() + $result->expires_in : 0;
132 + } elseif ( ! empty( $result->expires_in ) ) {
133 + // Some providers supply the seconds until expiration rather than
134 + // the exact timestamp. Take a best guess at which we received.
135 + $expires = $options['expires'];
136 + if ( ! $this->isExpirationTimestamp( $expires ) ) {
137 + $expires += time();
138 + }
139 + $response_data->expiresin = $expires;
140 140 }
141 -
142 141 return $response_data;
143 142 } elseif ( isset( $result->error ) ) {
144 143 $response_data->result = $result->error;
145 144 $response_data->message = __( 'Unexpected error! Unable to obtain an access token.', 'patchstack' ) . $result->message;
@@ -175,10 +174,8 @@
175 174 $this->update_blog_option( $this->blog_id, 'patchstack_license_free', $response['free'] == false ? 0 : 1 );
176 175
177 176 if ( $response['free'] == true ) {
178 177 $this->update_blog_option( $this->blog_id, 'patchstack_show_settings', 0 );
179 - } else {
180 - $this->send_header_request();
181 178 }
182 179 }
183 180
184 181 if ( isset( $response['active'] ) && $response['active'] == true ) {
@@ -184,13 +181,8 @@
184 181 if ( isset( $response['active'] ) && $response['active'] == true ) {
185 182 $this->update_blog_option( $this->blog_id, 'patchstack_license_activated', true );
186 183 }
187 184
188 - if ( isset( $response['class'] ) ) {
189 - $this->update_blog_option( $this->blog_id, 'patchstack_subscription_class', $response['class'] );
190 - $this->update_blog_option( $this->blog_id, 'patchstack_last_license_check', time() );
191 - }
192 -
193 185 return $response;
194 186 }
195 187
196 188 /**
@@ -233,43 +225,8 @@
233 225 return;
234 226 }
235 227
236 228 return json_decode( wp_remote_retrieve_body( $response ), true );
237 - }
238 -
239 - /**
240 - * Send a request to our API for the IP address header.
241 - */
242 - public function send_header_request()
243 - {
244 - $header = get_option( 'patchstack_firewall_ip_header', '' );
245 - $computed = get_option( 'patchstack_ip_header_computed', 0 );
246 -
247 - if ( $header == '' && ! $computed ) {
248 - // Create an OTT token.
249 - $ott = md5( wp_generate_password( 32, true, true ) );
250 - update_option( 'patchstack_ott_action', $ott );
251 -
252 - // Tell our API.
253 - wp_remote_request(
254 - $this->plugin->api_url . '/api/header',
255 - array(
256 - 'method' => 'POST',
257 - 'timeout' => 60,
258 - 'redirection' => 5,
259 - 'httpversion' => '1.0',
260 - 'blocking' => true,
261 - 'headers' => array(
262 - 'Source-Host' => get_site_url(),
263 - ),
264 - 'body' => array(
265 - 'token' => $ott,
266 - 'url' => get_site_url()
267 - ),
268 - 'cookies' => array(),
269 - )
270 - );
271 - }
272 229 }
273 230
274 231 /**
275 232 * Get the firewall rules.