surecookie / inc / modules / script-blocking / utils.php

utils.php in SureCookie – GDPR Cookie Consent Banner, Cookie Scanner & Script Blocking trunk, at inc/modules/script-blocking/utils.php

113 lines 3.5 KB

Raw Download Zip

1	<?php
2	/**
3	* Utils Script Blocking.
4	*
5	* @package SureCookie\Inc\Modules\ScriptBlocking
6	* @since 0.0.1
7	*/
8
9	namespace SureCookie\Inc\Modules\ScriptBlocking;
10
11	use SureCookie\Inc\Functions\Settings;
12	use SureCookie\Inc\Modules\SiteScanner\SaasClient;
13
14	if ( ! defined( 'ABSPATH' ) ) {
15	exit; // Exit if accessed directly.
16	}
17
18	/**
19	* Utils
20	*
21	* @since 0.0.1
22	*/
23	class Utils {
24	/**
25	* Check whether script and content blocking feature is enabled.
26	*
27	* @since 0.0.1
28	* @return bool
29	*/
30	public static function is_blocking_enabled(): bool {
31	static $cached = null;
32
33	if ( $cached !== null ) {
34	return $cached;
35	}
36
37	$banner_enabled = (bool) Settings::get( 'banner_enabled' );
38	$feature_enabled = (bool) Settings::get( 'blocking_enabled' );
39	$status = $banner_enabled && $feature_enabled;
40
41	$cached = (bool) apply_filters( 'surecookie_is_blocking_enabled', $status );
42
43	return $cached;
44	}
45
46	/**
47	* Check if blocking should be processed based on geo-location rules.
48	*
49	* @since 0.0.1
50	* @return bool True if blocking should proceed, false to bypass.
51	*/
52	public static function should_process_based_on_geo(): bool {
53	return (bool) apply_filters( 'surecookie_should_process_blocking_geo', true );
54	}
55
56	/**
57	* Whether this request is the SaaS scanner presenting a valid bypass token.
58	*
59	* Lives here rather than in the Blocker because gating happens in more than
60	* one place: the Blocker rewrites the output buffer, while integrations such
61	* as Presto Player replace their markup in `render_block`, well before the
62	* buffer is filtered. Any code that hides a third-party resource must honour
63	* the same bypass, otherwise a scan sees a consent placeholder instead of the
64	* embed and the resource is never detected.
65	*
66	* @since 1.3.0
67	* @return bool
68	*/
69	public static function is_scan_bypass_request(): bool {
70	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Strict regex below rejects anything but [0-9a-f]{64}.
71	$header_value = $_SERVER['HTTP_X_SURECOOKIE_SCAN'] ?? '';
72
73	if ( ! is_string( $header_value ) \|\| ! preg_match( '/^[0-9a-f]{64}$/i', $header_value ) ) {
74	return false;
75	}
76
77	$stored_token = get_transient( SaasClient::SCAN_BYPASS_TRANSIENT_KEY );
78
79	// Fail closed if the transient is corrupted or returns a non-string (object cache edge cases).
80	if ( ! is_string( $stored_token ) \|\| ! preg_match( '/^[0-9a-f]{64}$/i', $stored_token ) ) {
81	return false;
82	}
83
84	return hash_equals( $stored_token, $header_value );
85	}
86
87	/**
88	* Whether this request is a scan looking at the site the way a consenting
89	* visitor would see it.
90	*
91	* True for the remote scanner's bypass request and, via the filter, for an
92	* assisted scan running in the admin's own browser. Both already stand the
93	* blocker down so the real third-party tags run; this is what tells the rest
94	* of the plugin that they should also be allowed to finish their work.
95	*
96	* @since 1.4.0
97	* @return bool
98	*/
99	public static function is_scan_probe(): bool {
100	/**
101	* Filter whether the current request is a scan probing the site.
102	*
103	* The assisted-scan collector answers true for its own requests. Return
104	* false to keep a scan gated exactly as a first-time visitor would be,
105	* accepting that anything consent withholds stays undetectable.
106	*
107	* @since 1.4.0
108	* @param bool $is_probe Whether this request is a scan probe.
109	*/
110	return (bool) apply_filters( 'surecookie_is_scan_probe', self::is_scan_bypass_request() );
111	}
112	}
113