| @@ -15,9 +15,8 @@ | ||
| 15 | 15 | use Parsely\Services\Content_API\Content_API_Service; |
| 16 | 16 | use Parsely\Services\Suggestions_API\Suggestions_API_Service; |
| 17 | 17 | use Parsely\UI\Metadata_Renderer; |
| 18 | 18 | use Parsely\UI\Settings_Page; |
| 19 | -use Parsely\Utils\Utils; | |
| 20 | 19 | use WP_Post; |
| 21 | 20 | |
| 22 | 21 | /** |
| 23 | 22 | * Holds most of the logic for the plugin. |
| @@ -1202,8 +1201,9 @@ | ||
| 1202 | 1201 | * |
| 1203 | 1202 | * This is needed for environments, such as wp-now, that block remote requests. |
| 1204 | 1203 | * |
| 1205 | 1204 | * @since 3.13.0 |
| 1205 | + * @since 3.24.2 Matches the Parse.ly hosts exactly, over HTTPS. | |
| 1206 | 1206 | * @access private |
| 1207 | 1207 | */ |
| 1208 | 1208 | private function allow_parsely_remote_requests(): void { |
| 1209 | 1209 | $allowed_urls = array( |
| @@ -1214,14 +1214,20 @@ | ||
| 1214 | 1214 | |
| 1215 | 1215 | add_filter( |
| 1216 | 1216 | 'http_request_host_is_external', |
| 1217 | 1217 | function ( bool $external, string $host, string $url ) use ( $allowed_urls ) { |
| 1218 | - // Check if the URL matches any URLs on the allowed list. | |
| 1219 | - foreach ( $allowed_urls as $allowed_url ) { | |
| 1220 | - if ( Utils::str_starts_with( $url, $allowed_url ) ) { | |
| 1221 | - return true; | |
| 1222 | - } | |
| 1218 | + $scheme = strtolower( (string) wp_parse_url( $url, PHP_URL_SCHEME ) ); | |
| 1219 | + $allowed_hosts = array_map( | |
| 1220 | + static function ( string $allowed_url ): string { | |
| 1221 | + return (string) wp_parse_url( $allowed_url, PHP_URL_HOST ); | |
| 1222 | + }, | |
| 1223 | + $allowed_urls | |
| 1224 | + ); | |
| 1225 | + | |
| 1226 | + if ( 'https' === $scheme && in_array( strtolower( $host ), $allowed_hosts, true ) ) { | |
| 1227 | + return true; | |
| 1223 | 1228 | } |
| 1229 | + | |
| 1224 | 1230 | return $external; |
| 1225 | 1231 | }, |
| 1226 | 1232 | 10, |
| 1227 | 1233 | 3 |
