class-wc-https.php — WooCommerce 10.8.0-beta.2

woocommerce / includes / class-wc-https.php

woocommerce / includes Last commit date

class-wc-https.php

139 lines

1	<?php
2
3	if ( ! defined( 'ABSPATH' ) ) {
4	exit; // Exit if accessed directly
5	}
6
7	/**
8	* WC_HTTPS class.
9	*
10	* @class WC_HTTPS
11	* @version 2.2.0
12	* @package WooCommerce\Classes
13	* @category Class
14	* @author WooThemes
15	*/
16	class WC_HTTPS {
17
18	/**
19	* Hook in our HTTPS functions if we're on the frontend. This will ensure any links output to a page (when viewing via HTTPS) are also served over HTTPS.
20	*/
21	public static function init() {
22	if ( 'yes' === get_option( 'woocommerce_force_ssl_checkout' ) && ! is_admin() ) {
23	// HTTPS urls with SSL on
24	$filters = array(
25	'post_thumbnail_html',
26	'wp_get_attachment_image_attributes',
27	'wp_get_attachment_url',
28	'option_stylesheet_url',
29	'option_template_url',
30	'script_loader_src',
31	'style_loader_src',
32	'template_directory_uri',
33	'stylesheet_directory_uri',
34	'site_url',
35	);
36
37	foreach ( $filters as $filter ) {
38	add_filter( $filter, array( __CLASS__, 'force_https_url' ), 999 );
39	}
40
41	add_filter( 'page_link', array( __CLASS__, 'force_https_page_link' ), 10, 2 );
42	add_action( 'template_redirect', array( __CLASS__, 'force_https_template_redirect' ) );
43
44	if ( 'yes' == get_option( 'woocommerce_unforce_ssl_checkout' ) ) {
45	add_action( 'template_redirect', array( __CLASS__, 'unforce_https_template_redirect' ) );
46	}
47	}
48	add_action( 'http_api_curl', array( __CLASS__, 'http_api_curl' ), 10, 3 );
49	}
50
51	/**
52	* Force https for urls.
53	*
54	* @param mixed $content
55	* @return string
56	*/
57	public static function force_https_url( $content ) {
58	if ( is_ssl() ) {
59	if ( is_array( $content ) ) {
60	$content = array_map( 'WC_HTTPS::force_https_url', $content );
61	} else {
62	$content = str_replace( 'http:', 'https:', (string) $content );
63	}
64	}
65	return $content;
66	}
67
68	/**
69	* Force a post link to be SSL if needed.
70	*
71	* @param string $link
72	* @param int $page_id
73	*
74	* @return string
75	*/
76	public static function force_https_page_link( $link, $page_id ) {
77	if ( in_array( $page_id, array( get_option( 'woocommerce_checkout_page_id' ), get_option( 'woocommerce_myaccount_page_id' ) ) ) ) {
78	$link = str_replace( 'http:', 'https:', $link );
79	} elseif ( 'yes' === get_option( 'woocommerce_unforce_ssl_checkout' ) && ! wc_site_is_https() ) {
80	$link = str_replace( 'https:', 'http:', $link );
81	}
82	return $link;
83	}
84
85	/**
86	* Template redirect - if we end up on a page ensure it has the correct http/https url.
87	*/
88	public static function force_https_template_redirect() {
89	if ( ! is_ssl() && ( is_checkout() \|\| is_account_page() \|\| apply_filters( 'woocommerce_force_ssl_checkout', false ) ) ) {
90
91	if ( 0 === strpos( $_SERVER['REQUEST_URI'], 'http' ) ) {
92	wp_safe_redirect( preg_replace( '\|^http://\|', 'https://', $_SERVER['REQUEST_URI'] ) );
93	exit;
94	} else {
95	wp_safe_redirect( 'https://' . ( ! empty( $_SERVER['HTTP_X_FORWARDED_HOST'] ) ? $_SERVER['HTTP_X_FORWARDED_HOST'] : $_SERVER['HTTP_HOST'] ) . $_SERVER['REQUEST_URI'] );
96	exit;
97	}
98	}
99	}
100
101	/**
102	* Template redirect - if we end up on a page ensure it has the correct http/https url.
103	*/
104	public static function unforce_https_template_redirect() {
105	if ( function_exists( 'is_customize_preview' ) && is_customize_preview() ) {
106	return;
107	}
108
109	if ( ! wc_site_is_https() && is_ssl() && $_SERVER['REQUEST_URI'] && ! is_checkout() && ! wp_doing_ajax() && ! is_account_page() && apply_filters( 'woocommerce_unforce_ssl_checkout', true ) ) {
110
111	if ( 0 === strpos( $_SERVER['REQUEST_URI'], 'http' ) ) {
112	wp_safe_redirect( preg_replace( '\|^https://\|', 'http://', $_SERVER['REQUEST_URI'] ) );
113	exit;
114	} else {
115	wp_safe_redirect( 'http://' . ( ! empty( $_SERVER['HTTP_X_FORWARDED_HOST'] ) ? $_SERVER['HTTP_X_FORWARDED_HOST'] : $_SERVER['HTTP_HOST'] ) . $_SERVER['REQUEST_URI'] );
116	exit;
117	}
118	}
119	}
120
121	/**
122	* Force posts to PayPal to use TLS v1.2. See:
123	* https://core.trac.wordpress.org/ticket/36320
124	* https://core.trac.wordpress.org/ticket/34924#comment:13
125	* https://www.paypal-knowledge.com/infocenter/index?page=content&widgetview=true&id=FAQ1914&viewlocale=en_US
126	*
127	* @param string $handle
128	* @param mixed $r
129	* @param string $url
130	*/
131	public static function http_api_curl( $handle, $r, $url ) {
132	if ( strstr( $url, 'https://' ) && ( strstr( $url, '.paypal.com/nvp' ) \|\| strstr( $url, '.paypal.com/cgi-bin/webscr' ) ) ) {
133	curl_setopt( $handle, CURLOPT_SSLVERSION, 6 );
134	}
135	}
136	}
137
138	WC_HTTPS::init();
139