← All changes | includes/Utils/Helper.php +105 -8 3.6.4 → 3.7.2 View file →

		@@ -56,24 +56,49 @@
56	56
57	57	/**
58	58	* Collect IP from request.
59	59	*
	60	+ * Prefers REMOTE_ADDR since it cannot be spoofed by the client. When it is
	61	+ * a private/reserved address (reverse proxy, Docker bridge gateway like
	62	+ * 192.168.65.1, local dev), the forwarded headers are scanned for the first
	63	+ * public IP. If nothing public is found, the request is local: 127.0.0.1.
	64	+ *
60	65	* @return string
61	66	*/
62	67	public static function get_ip() {
63		- $ip = '127.0.0.1'; // Local IP
64		- if (! empty($_SERVER['HTTP_CLIENT_IP'])) {
65		- $ip = $_SERVER['HTTP_CLIENT_IP'];
66		- } elseif (! empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
67		- $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
68		- } else {
69		- $ip = ! empty($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : $ip;
	68	+ $remote_addr = ! empty($_SERVER['REMOTE_ADDR']) ? sanitize_text_field($_SERVER['REMOTE_ADDR']) : '';
	69	+
	70	+ if (self::is_public_ip($remote_addr)) {
	71	+ return $remote_addr;
70	72	}
71	73
72		- return sanitize_text_field($ip);
	74	+ foreach (['HTTP_X_FORWARDED_FOR', 'HTTP_CLIENT_IP'] as $header) {
	75	+ if (empty($_SERVER[$header])) {
	76	+ continue;
	77	+ }
	78	+ $candidates = explode(',', sanitize_text_field($_SERVER[$header]));
	79	+ foreach ($candidates as $candidate) {
	80	+ $candidate = trim($candidate);
	81	+ if (self::is_public_ip($candidate)) {
	82	+ return $candidate;
	83	+ }
	84	+ }
	85	+ }
	86	+
	87	+ return '127.0.0.1';
73	88	}
74	89
75	90	/**
	91	+ * Check whether a string is a valid public (non-private, non-reserved) IP.
	92	+ *
	93	+ * @param string $ip
	94	+ * @return bool
	95	+ */
	96	+ private static function is_public_ip($ip): bool {
	97	+ return (bool) filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE);
	98	+ }
	99	+
	100	+ /**
76	101	* Get views for front-end display
77	102	*
78	103	* @param string $name it will be file name only from the view's folder.
79	104	* @param array $data
		@@ -126,8 +151,13 @@
126	151	'Authorization' => 'Bearer ' . $api_key,
127	152	'x-templately-ip' => self::get_ip(),
128	153	'x-templately-url' => home_url('/'),
129	154	'x-templately-version' => defined( 'TEMPLATELY_VERSION' ) ? constant( 'TEMPLATELY_VERSION' ) : '1.0.0',
	155	+ // Force JSON responses so the cloud returns JSON errors instead of an HTML
	156	+ // error page (which json_decode() cannot parse). Binary/XML downloads
	157	+ // (zip pack, attachment WXR) use their own wp_remote_* calls and bypass
	158	+ // this helper, so they are unaffected. Callers can override via $extra_headers.
	159	+ 'Accept' => 'application/json',
130	160	];
131	161
132	162	// Add Content-Type for POST requests
133	163	if (strtoupper($method) === 'POST') {
		@@ -717,7 +747,74 @@
717	747	$r[$key] = $value;
718	748	}
719	749	}
720	750	return $r;
	751	+ }
	752	+
	753	+ /**
	754	+ * Creates the plugin's working directory under wp-uploads and blocks direct
	755	+ * web access to it.
	756	+ *
	757	+ * Everything the importer needs on disk lands here: the extracted pack (its
	758	+ * WXR, its template JSON, its attachments), the AI-generated page JSON, and
	759	+ * the FSI logs. wp-uploads is web-served, so these paths are not private just
	760	+ * because their session id is a uuid — the guards are what makes them
	761	+ * unreadable, not the name.
	762	+ *
	763	+ * .htaccess covers Apache and is inherited by everything below this point;
	764	+ * web.config covers IIS; index.php stops a directory listing on any server.
	765	+ * nginx honours none of them, so an nginx site still needs a location rule —
	766	+ * this raises the floor, it does not replace server configuration.
	767	+ *
	768	+ * @param string $dir Absolute path to create and protect.
	769	+ *
	770	+ * @return bool Whether the directory exists and is usable.
	771	+ */
	772	+ public static function protect_directory( $dir ) {
	773	+ if ( empty( $dir ) ) {
	774	+ return false;
	775	+ }
	776	+
	777	+ if ( ! is_dir( $dir ) && ! wp_mkdir_p( $dir ) ) {
	778	+ return false;
	779	+ }
	780	+
	781	+ $guards = [
	782	+ 'index.php' => "<?php\n// Silence is golden.\n",
	783	+ '.htaccess' => "# Templately working files — not for direct access.\n<IfModule mod_authz_core.c>\n\tRequire all denied\n</IfModule>\n<IfModule !mod_authz_core.c>\n\tOrder allow,deny\n\tDeny from all\n</IfModule>\n",
	784	+ 'web.config' => "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<configuration>\n\t<system.webServer>\n\t\t<authorization>\n\t\t\t<deny users=\"*\" />\n\t\t</authorization>\n\t</system.webServer>\n</configuration>\n",
	785	+ ];
	786	+
	787	+ foreach ( $guards as $file => $contents ) {
	788	+ $path = trailingslashit( $dir ) . $file;
	789	+ // Never overwrite: a site owner may have relaxed these deliberately.
	790	+ if ( ! file_exists( $path ) ) {
	791	+ @file_put_contents( $path, $contents ); // phpcs:ignore
	792	+ }
	793	+ }
	794	+
	795	+ return true;
	796	+ }
	797	+
	798	+ /**
	799	+ * Absolute path to the plugin's protected working directory in wp-uploads.
	800	+ *
	801	+ * @param string $sub Optional subdirectory ('tmp', 'log', 'preview', ...).
	802	+ *
	803	+ * @return string Trailing-slashed path, or '' when uploads is unusable.
	804	+ */
	805	+ public static function upload_dir( $sub = '' ) {
	806	+ $upload_dir = wp_upload_dir();
	807	+
	808	+ if ( ! empty( $upload_dir['error'] ) || empty( $upload_dir['basedir'] ) ) {
	809	+ return '';
	810	+ }
	811	+
	812	+ $base = trailingslashit( $upload_dir['basedir'] ) . 'templately' . DIRECTORY_SEPARATOR;
	813	+
	814	+ // The guards go on the root so every subdirectory inherits them.
	815	+ self::protect_directory( $base );
	816	+
	817	+ return '' === $sub ? $base : trailingslashit( $base . $sub );
721	818	}
722	819
723	820	}