wfAPI.php — Wordfence Security – Firewall, Malware Scan, and Login Security 5.1.2

wordfence / lib / wfAPI.php

wordfence / lib Last commit date

wfAPI.php

196 lines

1	<?php
2	require_once('wordfenceConstants.php');
3	require_once('wordfenceClass.php');
4	class wfAPI {
5	public $lastHTTPStatus = '';
6	public $lastCurlErrorNo = '';
7	private $curlContent = 0;
8	private $APIKey = '';
9	private $wordpressVersion = '';
10	private static $maintMsg = "The Wordfence scanning server could not be contacted.";
11	public function __construct($apiKey, $wordpressVersion){
12	$this->APIKey = $apiKey;
13	$this->wordpressVersion = $wordpressVersion;
14	}
15	public function getStaticURL($url){ // In the form '/something.bin' without quotes
16	return $this->getURL($this->getAPIURL() . $url);
17	}
18	public function call($action, $getParams = array(), $postParams = array()){
19	$json = $this->getURL($this->getAPIURL() . '/v' . WORDFENCE_API_VERSION . '/?' . $this->makeAPIQueryString() . '&' . self::buildQuery(
20	array_merge(
21	array('action' => $action),
22	$getParams
23	)), $postParams);
24	if(! $json){
25	throw new Exception("We received an empty data response from the Wordfence scanning servers when calling the '$action' function.");
26	}
27
28	$dat = json_decode($json, true);
29	if(isset($dat['_isPaidKey'])){
30	wfConfig::set('keyExpDays', $dat['_keyExpDays']);
31	if($dat['_keyExpDays'] > -1){
32	wfConfig::set('isPaid', 1);
33	} else if($dat['_keyExpDays'] < 0){
34	wfConfig::set('isPaid', '');
35	}
36	}
37
38	if(! is_array($dat)){
39	throw new Exception("We received a data structure that is not the expected array when contacting the Wordfence scanning servers and calling the '$action' function.");
40	}
41	if(is_array($dat) && isset($dat['errorMsg'])){
42	throw new Exception($dat['errorMsg']);
43	}
44	return $dat;
45	}
46	public function curlWrite($h, $d){
47	$this->curlContent .= $d;
48	return strlen($d);
49	}
50	protected function getURL($url, $postParams = array()){
51	if(function_exists('curl_init')){
52	$this->curlDataWritten = 0;
53	$this->curlContent = "";
54	$curl = curl_init($url);
55	curl_setopt ($curl, CURLOPT_TIMEOUT, 900);
56	curl_setopt ($curl, CURLOPT_USERAGENT, "Wordfence.com UA " . (defined('WORDFENCE_VERSION') ? WORDFENCE_VERSION : '[Unknown version]') );
57	curl_setopt ($curl, CURLOPT_RETURNTRANSFER, TRUE);
58	curl_setopt ($curl, CURLOPT_HEADER, 0);
59	curl_setopt ($curl, CURLOPT_SSL_VERIFYPEER, false);
60	curl_setopt ($curl, CURLOPT_SSL_VERIFYHOST, false);
61	curl_setopt ($curl, CURLOPT_WRITEFUNCTION, array($this, 'curlWrite'));
62	curl_setopt($curl, CURLOPT_POST, true);
63	curl_setopt($curl, CURLOPT_POSTFIELDS, $postParams);
64	wordfence::status(4, 'info', "CURL fetching URL: " . $url);
65	$curlResult = curl_exec($curl);
66
67	$httpStatus = curl_getinfo($curl, CURLINFO_HTTP_CODE);
68	$this->lastCurlErrorNo = curl_errno($curl);
69	if($httpStatus == 200){
70	curl_close($curl);
71	return $this->curlContent;
72	} else {
73	$cerror = curl_error($curl);
74	curl_close($curl);
75	throw new Exception("We received an error response when trying to contact the Wordfence scanning servers. The HTTP status code was [$httpStatus] and the curl error number was [" . $this->lastCurlErrorNo . "] " . ($cerror ? (' and the error from CURL was: ' . $cerror) : ''));
76	}
77	} else {
78	wordfence::status(4, 'info', "Fetching URL with file_get: " . $url);
79	$data = $this->fileGet($url, $postParams);
80	if($data === false){
81	$err = error_get_last();
82	if($err){
83	throw new Exception("We received an error response when trying to contact the Wordfence scanning servers using PHP's file_get_contents function. The error was: " . var_export($err, true));
84	} else {
85	throw new Exception("We received an empty response when trying to contact the Wordfence scanning servers using PHP's file_get_contents function.");
86	}
87	}
88	return $data;
89	}
90
91	}
92	private function fileGet($url, $postParams){
93	$body = "";
94	if(is_array($postParams)){
95	$bodyArr = array();
96	foreach($postParams as $key => $val){
97	$bodyArr[] = urlencode($key) . '=' . urlencode($val);
98	}
99	$body = implode('&', $bodyArr);
100	} else {
101	$body = $postParams;
102	}
103	$opts = array('http' =>
104	array(
105	'method' => 'POST',
106	'content' => $body,
107	'header' => "Content-Type: application/x-www-form-urlencoded\r\n",
108	'timeout' => 60
109	)
110	);
111	$context = stream_context_create($opts);
112	return @file_get_contents($url, false, $context, -1);
113	}
114	public function binCall($func, $postData){
115	$url = $this->getAPIURL() . '/v' . WORDFENCE_API_VERSION . '/?' . $this->makeAPIQueryString() . '&action=' . $func;
116	if(function_exists('curl_init')){
117	$curl = curl_init($url);
118	curl_setopt ($curl, CURLOPT_TIMEOUT, 900);
119	//curl_setopt($curl, CURLOPT_VERBOSE, true);
120	curl_setopt ($curl, CURLOPT_USERAGENT, "Wordfence");
121	curl_setopt ($curl, CURLOPT_RETURNTRANSFER, TRUE);
122	curl_setopt ($curl, CURLOPT_SSL_VERIFYPEER, false);
123	curl_setopt ($curl, CURLOPT_SSL_VERIFYHOST, false);
124	curl_setopt($curl, CURLOPT_POST, true);
125	if($postData){
126	curl_setopt($curl, CURLOPT_POSTFIELDS, $postData);
127	} else {
128	curl_setopt($curl, CURLOPT_POSTFIELDS, array());
129	}
130	$data = curl_exec($curl);
131
132	$httpStatus = curl_getinfo($curl, CURLINFO_HTTP_CODE);
133	if($httpStatus != 200){
134	$cError = curl_error($curl);
135	curl_close($curl);
136	if($cError){
137	throw new Exception("We received an error response when trying to fetch binary data from the Wordfence scanning server. The HTTP status was [$httpStatus] with error: $cError");
138	} else {
139	throw new Exception("We received an error HTTP response when trying to fetch binary data from the Wordfence scanning server: [$httpStatus]");
140	}
141	}
142	} else {
143	$data = $this->fileGet($url, $postData);
144	if($data === false){
145	$err = error_get_last();
146	if($err){
147	throw new Exception("We received an error response when trying to fetch binary data from the Wordfence scanning server using file_get_contents: $err");
148	} else {
149	throw new Exception("We received an error when trying to fetch binary data from the Wordfence scanning server using file_get_contents. There was no message explaining the error.");
150	}
151	}
152	$httpStatus = '200';
153	}
154	if(preg_match('/\{.*errorMsg/', $data)){
155	$jdat = @json_decode($data, true);
156	if(is_array($jdat) && $jdat['errorMsg']){
157	throw new Exception($jdat['errorMsg']);
158	}
159	}
160	return array('code' => $httpStatus, 'data' => $data);
161	}
162	public function makeAPIQueryString(){
163	$siteurl = '';
164	if(function_exists('get_bloginfo')){
165	if(is_multisite()){
166	$siteurl = network_home_url();
167	$siteurl = rtrim($siteurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
168	} else {
169	$siteurl = home_url();
170	}
171	}
172	return self::buildQuery(array(
173	'v' => $this->wordpressVersion,
174	's' => $siteurl,
175	'k' => $this->APIKey
176	));
177	}
178	private function buildQuery($data){
179	if(version_compare(phpversion(), '5.1.2', '>=')){
180	return http_build_query($data, '', '&'); //arg_separator parameter was only added in PHP 5.1.2. We do this because some PHP.ini's have arg_separator.output set to '&'
181	} else {
182	return http_build_query($data);
183	}
184	}
185	private function getAPIURL(){
186	$ssl_supported = false;
187	if(defined('CURL_VERSION_SSL') && function_exists('curl_version')){
188	$version = curl_version();
189	$ssl_supported = ($version['features'] & CURL_VERSION_SSL);
190	}
191	return $ssl_supported ? WORDFENCE_API_URL_SEC : WORDFENCE_API_URL_NONSEC;
192	}
193	}
194
195	?>
196