stream / classes / class-filter-input.php

class-filter-input.php in Stream – Activity Log & Audit Trail 4.0.2, at classes/class-filter-input.php

166 lines 4.7 KB

Raw Download Zip

1	<?php
2	/**
3	* Processes form input
4	*
5	* @package WP_Stream
6	*/
7
8	namespace WP_Stream;
9
10	/**
11	* Class - Filter_Input
12	*/
13	class Filter_Input {
14
15	/**
16	* Callbacks to be used for input validation/sanitation.
17	*
18	* @var array
19	*/
20	public static $filter_callbacks = array(
21	FILTER_DEFAULT => null,
22	// Validate.
23	FILTER_VALIDATE_BOOLEAN => 'is_bool',
24	FILTER_VALIDATE_EMAIL => 'is_email',
25	FILTER_VALIDATE_FLOAT => 'is_float',
26	FILTER_VALIDATE_INT => 'is_int',
27	FILTER_VALIDATE_IP => array( __CLASS__, 'is_ip_address' ),
28	FILTER_VALIDATE_REGEXP => array( __CLASS__, 'is_regex' ),
29	FILTER_VALIDATE_URL => 'wp_http_validate_url',
30	// Sanitize.
31	FILTER_SANITIZE_EMAIL => 'sanitize_email',
32	FILTER_SANITIZE_ENCODED => 'esc_url_raw',
33	FILTER_SANITIZE_NUMBER_FLOAT => 'floatval',
34	FILTER_SANITIZE_NUMBER_INT => 'intval',
35	FILTER_SANITIZE_SPECIAL_CHARS => 'htmlspecialchars',
36	FILTER_SANITIZE_FULL_SPECIAL_CHARS => 'sanitize_text_field',
37	FILTER_SANITIZE_URL => 'esc_url_raw',
38	// Other.
39	FILTER_UNSAFE_RAW => null,
40	);
41
42	/**
43	* Returns input variable
44	*
45	* @param int $type Input type.
46	* @param string $variable_name Variable key.
47	* @param int $filter Filter callback.
48	* @param array $options Filter callback parameters.
49	* @throws \Exception Invalid input type provided.
50	* @return mixed
51	*/
52	public static function super( $type, $variable_name, $filter = null, $options = array() ) {
53	$super = null;
54
55	// @codingStandardsIgnoreStart
56	switch ( $type ) {
57	case INPUT_POST :
58	$super = $_POST;
59	break;
60	case INPUT_GET :
61	$super = $_GET;
62	break;
63	case INPUT_COOKIE :
64	$super = $_COOKIE;
65	break;
66	case INPUT_ENV :
67	$super = $_ENV;
68	break;
69	case INPUT_SERVER :
70	$super = $_SERVER;
71	break;
72	}
73	// @codingStandardsIgnoreEnd
74
75	if ( is_null( $super ) ) {
76	throw new \Exception( esc_html__( 'Invalid use, type must be one of INPUT_* family.', 'stream' ) );
77	}
78
79	$value = isset( $super[ $variable_name ] ) ? $super[ $variable_name ] : null;
80	$value = self::filter( $value, $filter, $options );
81
82	return $value;
83	}
84
85	/**
86	* Sanitize or validate input.
87	*
88	* @param mixed $value Raw input value.
89	* @param int $filter Filter callback.
90	* @param array $options Filter callback parameters.
91	*
92	* @return mixed
93	* @throws \Exception Unsupported filter provided.
94	*/
95	public static function filter( $value, $filter = null, $options = array() ) {
96	// Default filter is a sanitizer, not validator.
97	$filter_type = 'sanitizer';
98
99	// Only filter value if it is not null.
100	if ( isset( $value ) && $filter && FILTER_DEFAULT !== $filter ) {
101	if ( ! isset( self::$filter_callbacks[ $filter ] ) ) {
102	throw new \Exception( esc_html__( 'Filter not supported.', 'stream' ) );
103	}
104
105	$filter_callback = self::$filter_callbacks[ $filter ];
106	$result = call_user_func( $filter_callback, $value );
107
108	/**
109	* "filter_var / filter_input" treats validation/sanitization filters the same
110	* they both return output and change the var value, this shouldn't be the case here.
111	* We'll do a boolean check on validation function, and let sanitizers change the value
112	*/
113	$filter_type = ( $filter < 500 ) ? 'validator' : 'sanitizer';
114	if ( 'validator' === $filter_type ) { // Validation functions.
115	if ( ! $result ) {
116	$value = false;
117	}
118	} else { // Santization functions.
119	$value = $result;
120	}
121	}
122
123	// Detect FILTER_REQUIRE_ARRAY flag.
124	if ( isset( $value ) && is_int( $options ) && FILTER_REQUIRE_ARRAY === $options ) {
125	if ( ! is_array( $value ) ) {
126	$value = ( 'validator' === $filter_type ) ? false : null;
127	}
128	}
129
130	// Polyfill the `default` attribute only, for now.
131	if ( is_array( $options ) && ! empty( $options['options']['default'] ) ) {
132	if ( 'validator' === $filter_type && false === $value ) {
133	$value = $options['options']['default'];
134	} elseif ( 'sanitizer' === $filter_type && null === $value ) {
135	$value = $options['options']['default'];
136	}
137	}
138
139	return $value;
140	}
141
142	/**
143	* Returns whether the variable is a Regular Expression or not?
144	*
145	* @param string $maybe_regex Raw input value.
146	*
147	* @return boolean
148	*/
149	public static function is_regex( $maybe_regex ) {
150	$test = @preg_match( $maybe_regex, '' ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
151
152	return false !== $test;
153	}
154
155	/**
156	* Returns whether the variable is an IP address or not?
157	*
158	* @param string $maybe_ip Raw input.
159	*
160	* @return boolean
161	*/
162	public static function is_ip_address( $maybe_ip ) {
163	return false !== \WP_Http::is_ip_address( $maybe_ip );
164	}
165	}
166