← All changes | classes/class-filter-input.php +98 -49 3.2.3 → 4.0.2 View file →

		@@ -1,30 +1,55 @@
1	1	<?php
	2	+/**
	3	+ * Processes form input
	4	+ *
	5	+ * @package WP_Stream
	6	+ */
	7	+
2	8	namespace WP_Stream;
3	9
	10	+/**
	11	+ * Class - Filter_Input
	12	+ */
4	13	class Filter_Input {
	14	+
	15	+ /**
	16	+ * Callbacks to be used for input validation/sanitation.
	17	+ *
	18	+ * @var array
	19	+ */
5	20	public static $filter_callbacks = array(
6		- FILTER_DEFAULT => null,
7		- // Validate
8		- FILTER_VALIDATE_BOOLEAN => 'is_bool',
9		- FILTER_VALIDATE_EMAIL => 'is_email',
10		- FILTER_VALIDATE_FLOAT => 'is_float',
11		- FILTER_VALIDATE_INT => 'is_int',
12		- FILTER_VALIDATE_IP => array( __CLASS__, 'is_ip_address' ),
13		- FILTER_VALIDATE_REGEXP => array( __CLASS__, 'is_regex' ),
14		- FILTER_VALIDATE_URL => 'wp_http_validate_url',
15		- // Sanitize
16		- FILTER_SANITIZE_EMAIL => 'sanitize_email',
17		- FILTER_SANITIZE_ENCODED => 'esc_url_raw',
18		- FILTER_SANITIZE_NUMBER_FLOAT => 'floatval',
19		- FILTER_SANITIZE_NUMBER_INT => 'intval',
20		- FILTER_SANITIZE_SPECIAL_CHARS => 'htmlspecialchars',
21		- FILTER_SANITIZE_STRING => 'sanitize_text_field',
22		- FILTER_SANITIZE_URL => 'esc_url_raw',
23		- // Other
24		- FILTER_UNSAFE_RAW => null,
	21	+ FILTER_DEFAULT => null,
	22	+ // Validate.
	23	+ FILTER_VALIDATE_BOOLEAN => 'is_bool',
	24	+ FILTER_VALIDATE_EMAIL => 'is_email',
	25	+ FILTER_VALIDATE_FLOAT => 'is_float',
	26	+ FILTER_VALIDATE_INT => 'is_int',
	27	+ FILTER_VALIDATE_IP => array( __CLASS__, 'is_ip_address' ),
	28	+ FILTER_VALIDATE_REGEXP => array( __CLASS__, 'is_regex' ),
	29	+ FILTER_VALIDATE_URL => 'wp_http_validate_url',
	30	+ // Sanitize.
	31	+ FILTER_SANITIZE_EMAIL => 'sanitize_email',
	32	+ FILTER_SANITIZE_ENCODED => 'esc_url_raw',
	33	+ FILTER_SANITIZE_NUMBER_FLOAT => 'floatval',
	34	+ FILTER_SANITIZE_NUMBER_INT => 'intval',
	35	+ FILTER_SANITIZE_SPECIAL_CHARS => 'htmlspecialchars',
	36	+ FILTER_SANITIZE_FULL_SPECIAL_CHARS => 'sanitize_text_field',
	37	+ FILTER_SANITIZE_URL => 'esc_url_raw',
	38	+ // Other.
	39	+ FILTER_UNSAFE_RAW => null,
25	40	);
26	41
	42	+ /**
	43	+ * Returns input variable
	44	+ *
	45	+ * @param int $type Input type.
	46	+ * @param string $variable_name Variable key.
	47	+ * @param int $filter Filter callback.
	48	+ * @param array $options Filter callback parameters.
	49	+ * @throws \Exception Invalid input type provided.
	50	+ * @return mixed
	51	+ */
27	52	public static function super( $type, $variable_name, $filter = null, $options = array() ) {
28	53	$super = null;
29	54
30	55	// @codingStandardsIgnoreStart
		@@ -50,67 +75,91 @@
50	75	if ( is_null( $super ) ) {
51	76	throw new \Exception( esc_html__( 'Invalid use, type must be one of INPUT_* family.', 'stream' ) );
52	77	}
53	78
54		- $var = isset( $super[ $variable_name ] ) ? $super[ $variable_name ] : null;
55		- $var = self::filter( $var, $filter, $options );
	79	+ $value = isset( $super[ $variable_name ] ) ? $super[ $variable_name ] : null;
	80	+ $value = self::filter( $value, $filter, $options );
56	81
57		- return $var;
	82	+ return $value;
58	83	}
59	84
60		- public static function filter( $var, $filter = null, $options = array() ) {
61		- // Default filter is a sanitizer, not validator
	85	+ /**
	86	+ * Sanitize or validate input.
	87	+ *
	88	+ * @param mixed $value Raw input value.
	89	+ * @param int $filter Filter callback.
	90	+ * @param array $options Filter callback parameters.
	91	+ *
	92	+ * @return mixed
	93	+ * @throws \Exception Unsupported filter provided.
	94	+ */
	95	+ public static function filter( $value, $filter = null, $options = array() ) {
	96	+ // Default filter is a sanitizer, not validator.
62	97	$filter_type = 'sanitizer';
63	98
64		- // Only filter value if it is not null
65		- if ( isset( $var ) && $filter && FILTER_DEFAULT !== $filter ) {
	99	+ // Only filter value if it is not null.
	100	+ if ( isset( $value ) && $filter && FILTER_DEFAULT !== $filter ) {
66	101	if ( ! isset( self::$filter_callbacks[ $filter ] ) ) {
67	102	throw new \Exception( esc_html__( 'Filter not supported.', 'stream' ) );
68	103	}
69	104
70	105	$filter_callback = self::$filter_callbacks[ $filter ];
71		- $result = call_user_func( $filter_callback, $var );
	106	+ $result = call_user_func( $filter_callback, $value );
72	107
73		- // filter_var / filter_input treats validation/sanitization filters the same
74		- // they both return output and change the var value, this shouldn't be the case here.
75		- // We'll do a boolean check on validation function, and let sanitizers change the value
	108	+ /**
	109	+ * "filter_var / filter_input" treats validation/sanitization filters the same
	110	+ * they both return output and change the var value, this shouldn't be the case here.
	111	+ * We'll do a boolean check on validation function, and let sanitizers change the value
	112	+ */
76	113	$filter_type = ( $filter < 500 ) ? 'validator' : 'sanitizer';
77		- if ( 'validator' === $filter_type ) { // Validation functions
	114	+ if ( 'validator' === $filter_type ) { // Validation functions.
78	115	if ( ! $result ) {
79		- $var = false;
	116	+ $value = false;
80	117	}
81		- } else { // Santization functions
82		- $var = $result;
	118	+ } else { // Santization functions.
	119	+ $value = $result;
83	120	}
84	121	}
85	122
86		- // Detect FILTER_REQUIRE_ARRAY flag
87		- if ( isset( $var ) && is_int( $options ) && FILTER_REQUIRE_ARRAY === $options ) {
88		- if ( ! is_array( $var ) ) {
89		- $var = ( 'validator' === $filter_type ) ? false : null;
	123	+ // Detect FILTER_REQUIRE_ARRAY flag.
	124	+ if ( isset( $value ) && is_int( $options ) && FILTER_REQUIRE_ARRAY === $options ) {
	125	+ if ( ! is_array( $value ) ) {
	126	+ $value = ( 'validator' === $filter_type ) ? false : null;
90	127	}
91	128	}
92	129
93	130	// Polyfill the `default` attribute only, for now.
94	131	if ( is_array( $options ) && ! empty( $options['options']['default'] ) ) {
95		- if ( 'validator' === $filter_type && false === $var ) {
96		- $var = $options['options']['default'];
97		- } elseif ( 'sanitizer' === $filter_type && null === $var ) {
98		- $var = $options['options']['default'];
	132	+ if ( 'validator' === $filter_type && false === $value ) {
	133	+ $value = $options['options']['default'];
	134	+ } elseif ( 'sanitizer' === $filter_type && null === $value ) {
	135	+ $value = $options['options']['default'];
99	136	}
100	137	}
101	138
102		- return $var;
	139	+ return $value;
103	140	}
104	141
105		- public static function is_regex( $var ) {
106		- // @codingStandardsIgnoreStart
107		- $test = @preg_match( $var, '' );
108		- // @codingStandardsIgnoreEnd
	142	+ /**
	143	+ * Returns whether the variable is a Regular Expression or not?
	144	+ *
	145	+ * @param string $maybe_regex Raw input value.
	146	+ *
	147	+ * @return boolean
	148	+ */
	149	+ public static function is_regex( $maybe_regex ) {
	150	+ $test = @preg_match( $maybe_regex, '' ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
109	151
110	152	return false !== $test;
111	153	}
112	154
113		- public static function is_ip_address( $var ) {
114		- return false !== \WP_Http::is_ip_address( $var );
	155	+ /**
	156	+ * Returns whether the variable is an IP address or not?
	157	+ *
	158	+ * @param string $maybe_ip Raw input.
	159	+ *
	160	+ * @return boolean
	161	+ */
	162	+ public static function is_ip_address( $maybe_ip ) {
	163	+ return false !== \WP_Http::is_ip_address( $maybe_ip );
115	164	}
116	165	}