| @@ -784,9 +784,14 @@ | ||
| 784 | 784 | $defined = explode( ',', trim( (string) $args ) ); |
| 785 | 785 | } elseif( is_integer( $args ) || is_float( $args ) ) { |
| 786 | 786 | $defined[0] = $args; |
| 787 | 787 | } elseif( is_serialized( $args ) ) { |
| 788 | - $defined = unserialize( $args ); | |
| 788 | + // SECURITY: refuse to instantiate any class — only scalars and arrays | |
| 789 | + // of scalars are recovered. Blocks PHP Object Injection via widget | |
| 790 | + // AJAX (forumids etc.) and any other caller that may receive | |
| 791 | + // attacker-controlled strings. | |
| 792 | + $defined = unserialize( $args, [ 'allowed_classes' => false ] ); | |
| 793 | + if( ! is_array( $defined ) ) $defined = (array) $defined; | |
| 789 | 794 | } elseif( strpos( (string) $args, '=' ) !== false ) { |
| 790 | 795 | parse_str( $args, $defined ); |
| 791 | 796 | } else { |
| 792 | 797 | $defined = (array) $args; |
| @@ -810,9 +815,13 @@ | ||
| 810 | 815 | if( ! function_exists( 'is_serialized' ) ) { |
| 811 | 816 | function is_serialized( $value ) { |
| 812 | 817 | if( $value == '' ) return false; |
| 813 | 818 | $value = trim( (string) $value ); |
| 814 | - $chsd = @unserialize( $value ); | |
| 819 | + // SECURITY: the very act of detecting a serialized payload must not | |
| 820 | + // instantiate classes — @unserialize() with the default options runs | |
| 821 | + // __wakeup() / __destruct() for any embedded object even when the | |
| 822 | + // caller only wanted to test the format. Limit to scalars/arrays. | |
| 823 | + $chsd = @unserialize( $value, [ 'allowed_classes' => false ] ); | |
| 815 | 824 | if( $chsd !== false || $value === 'b:0;' ) { |
| 816 | 825 | return true; |
| 817 | 826 | } else { |
| 818 | 827 | return false; |
| @@ -1136,9 +1145,14 @@ | ||
| 1136 | 1145 | if( $filter_views ) { |
| 1137 | 1146 | //to-do: don't increase views before all read point. |
| 1138 | 1147 | if( wpforo_setting( 'legal', 'cookies' ) ) { |
| 1139 | 1148 | $viwed_ids = wpforo_getcookie( wpforo_prefix( 'read_topics' ), false ); |
| 1140 | - if( empty( $viwed_ids ) || ! wpfval( $viwed_ids, $data['topicid'] ) ) { | |
| 1149 | + $has_viewed = ! empty( $viwed_ids ) && wpfval( $viwed_ids, $data['topicid'] ); | |
| 1150 | + if( ! $has_viewed && is_user_logged_in() ) { | |
| 1151 | + $viwed_db_ids = wpforo_current_usermeta( wpforo_prefix( 'read_topics' ) ); | |
| 1152 | + $has_viewed = ! empty( $viwed_db_ids ) && wpfval( $viwed_db_ids, $data['topicid'] ); | |
| 1153 | + } | |
| 1154 | + if( ! $has_viewed ) { | |
| 1141 | 1155 | WPF()->db->query( "UPDATE `" . WPF()->tables->topics . "` SET `views` = `views` + 1 WHERE `topicid` = " . intval( $data['topicid'] ) ); |
| 1142 | 1156 | } |
| 1143 | 1157 | } elseif( is_user_logged_in() ) { |
| 1144 | 1158 | if( wpfval( WPF()->current_usermeta, wpforo_prefix( 'read_topics' ) ) ) { |
| @@ -2812,8 +2826,89 @@ | ||
| 2812 | 2826 | return false; |
| 2813 | 2827 | } |
| 2814 | 2828 | } |
| 2815 | 2829 | |
| 2830 | +/** | |
| 2831 | + * Add a post to the guest's signed ownership cookie. | |
| 2832 | + * Called when a guest creates a new post or topic. | |
| 2833 | + * | |
| 2834 | + * @param int $postid The post ID to add to ownership | |
| 2835 | + */ | |
| 2836 | +function wpforo_add_guest_ownership( $postid ) { | |
| 2837 | + // Respect the forum cookie policy, like every other wpForo cookie writer. | |
| 2838 | + if( ! wpforo_setting( 'legal', 'cookies' ) ) return; | |
| 2839 | + | |
| 2840 | + $postid = (int) $postid; | |
| 2841 | + if( ! $postid ) return; | |
| 2842 | + | |
| 2843 | + $owned = wpforo_get_guest_owned_posts(); | |
| 2844 | + $owned[] = $postid; | |
| 2845 | + | |
| 2846 | + // Keep the newest N ids only, so the cookie can't grow past browser limits. | |
| 2847 | + $max = (int) apply_filters( 'wpforo_guest_ownership_max_posts', 100 ); | |
| 2848 | + $owned = array_values( array_unique( $owned ) ); | |
| 2849 | + if( $max > 0 && count( $owned ) > $max ) $owned = array_slice( $owned, - $max ); | |
| 2850 | + | |
| 2851 | + $data = wp_json_encode( $owned ); | |
| 2852 | + if( ! is_string( $data ) ) return; | |
| 2853 | + | |
| 2854 | + $signature = hash_hmac( 'sha256', $data, wp_salt( 'auth' ) ); | |
| 2855 | + $cookie_value = base64_encode( $data ) . '.' . $signature; | |
| 2856 | + | |
| 2857 | + $expire = time() + ( 30 * DAY_IN_SECONDS ); | |
| 2858 | + $secure = is_ssl() && 'https' === parse_url( get_option( 'home' ), PHP_URL_SCHEME ); | |
| 2859 | + $path = ( COOKIEPATH != SITECOOKIEPATH ) ? SITECOOKIEPATH : COOKIEPATH; | |
| 2860 | + | |
| 2861 | + // Suppressed: output may already have started on some themes/hooks, and a | |
| 2862 | + // failed cookie must degrade to "cannot edit", never to a PHP warning. | |
| 2863 | + @setcookie( 'wpforo_guest_ownership', $cookie_value, $expire, $path, COOKIE_DOMAIN, $secure, true ); | |
| 2864 | + | |
| 2865 | + // Make it readable within the same request. | |
| 2866 | + $_COOKIE['wpforo_guest_ownership'] = $cookie_value; | |
| 2867 | +} | |
| 2868 | + | |
| 2869 | +/** | |
| 2870 | + * Get list of post IDs this guest owns (verified via signature). | |
| 2871 | + * Returns empty array if cookie is missing, corrupted, or signature invalid. | |
| 2872 | + * | |
| 2873 | + * @return array List of post IDs | |
| 2874 | + */ | |
| 2875 | +function wpforo_get_guest_owned_posts() { | |
| 2876 | + $cookie = isset( $_COOKIE['wpforo_guest_ownership'] ) ? $_COOKIE['wpforo_guest_ownership'] : ''; | |
| 2877 | + | |
| 2878 | + // The cookie is fully attacker-controlled: it can arrive as an array | |
| 2879 | + // (wpforo_guest_ownership[]=x), which would fatal on strpos() in PHP 8. | |
| 2880 | + if( ! is_string( $cookie ) || $cookie === '' ) return []; | |
| 2881 | + | |
| 2882 | + $parts = explode( '.', $cookie, 2 ); | |
| 2883 | + if( count( $parts ) !== 2 ) return []; | |
| 2884 | + | |
| 2885 | + list( $data_b64, $signature ) = $parts; | |
| 2886 | + $data = base64_decode( $data_b64, true ); | |
| 2887 | + if( ! is_string( $data ) || $data === '' ) return []; | |
| 2888 | + | |
| 2889 | + // Verify HMAC signature - prevents forgery | |
| 2890 | + $expected = hash_hmac( 'sha256', $data, wp_salt( 'auth' ) ); | |
| 2891 | + if( ! hash_equals( $expected, $signature ) ) return []; | |
| 2892 | + | |
| 2893 | + $owned = json_decode( $data, true ); | |
| 2894 | + if( ! is_array( $owned ) ) return []; | |
| 2895 | + | |
| 2896 | + return array_values( array_filter( array_map( 'intval', $owned ) ) ); | |
| 2897 | +} | |
| 2898 | + | |
| 2899 | +/** | |
| 2900 | + * Check if the current guest owns a specific post. | |
| 2901 | + * Uses cryptographically signed cookie - cannot be forged. | |
| 2902 | + * | |
| 2903 | + * @param int $postid The post ID to check | |
| 2904 | + * @return bool True if guest owns this post | |
| 2905 | + */ | |
| 2906 | +function wpforo_guest_owns_post( $postid ) { | |
| 2907 | + $owned = wpforo_get_guest_owned_posts(); | |
| 2908 | + return in_array( (int) $postid, $owned, true ); | |
| 2909 | +} | |
| 2910 | + | |
| 2816 | 2911 | function wpforo_extra_html_parser( $extra_html = '', $allowed_html = [] ) { |
| 2817 | 2912 | if( $extra_html ) { |
| 2818 | 2913 | $extra_html = explode( ',', $extra_html ); |
| 2819 | 2914 | $extra_html = array_filter( $extra_html ); |
| @@ -2891,8 +2986,35 @@ | ||
| 2891 | 2986 | |
| 2892 | 2987 | return $data; |
| 2893 | 2988 | } |
| 2894 | 2989 | |
| 2990 | +/** | |
| 2991 | + * Build a REGEXP literal for searching inside a wp_json_encode() stored column. | |
| 2992 | + * | |
| 2993 | + * The haystack (profiles.fields, postmeta.metavalue) is written with wp_json_encode(), | |
| 2994 | + * which escapes forward slashes ("S/4HANA" is stored as S\/4HANA) and non-ASCII | |
| 2995 | + * characters (Ľ), so the needle must be encoded the same way or it can never match. | |
| 2996 | + * Callers must still wrap the result in esc_sql() before putting it in a query. | |
| 2997 | + * | |
| 2998 | + * @param string $value Raw needle. | |
| 2999 | + * | |
| 3000 | + * @return string Regex-literal needle, without SQL escaping. | |
| 3001 | + */ | |
| 3002 | +function wpforo_json_regexp_needle( $value ): string { | |
| 3003 | + $value = (string) $value; | |
| 3004 | + | |
| 3005 | + // esc_sql() cannot reliably escape invalid UTF-8 on a utf8mb4 connection and | |
| 3006 | + // wp_json_encode() returns false for it, so strip it before encoding. | |
| 3007 | + $clean = wp_check_invalid_utf8( $value, true ); | |
| 3008 | + $json = ( ! is_string( $clean ) || $clean === '' ) ? false : wp_json_encode( $clean ); | |
| 3009 | + | |
| 3010 | + // Never return an empty needle for a non-empty search term: in a substring | |
| 3011 | + // pattern that would match every row. \u0000 cannot occur in stored field data. | |
| 3012 | + if( ! is_string( $json ) || strlen( $json ) < 2 ) return ( $value === '' ) ? '' : preg_quote( '\u0000' ); | |
| 3013 | + | |
| 3014 | + return preg_quote( substr( $json, 1, -1 ) ); | |
| 3015 | +} | |
| 3016 | + | |
| 2895 | 3017 | function wpforo_trim( $data ) { |
| 2896 | 3018 | $data = is_array( $data ) ? array_map( 'wpforo_trim', $data ) : trim( (string) $data ); |
| 2897 | 3019 | |
| 2898 | 3020 | return $data; |
| @@ -3875,20 +3997,26 @@ | ||
| 3875 | 3997 | |
| 3876 | 3998 | return _wpforo_apply_email_shortcodes( $txt, compact( 'forumid', 'topicid', 'postid', 'owner', 'user', 'unsubscribe_link' ) ); |
| 3877 | 3999 | } |
| 3878 | 4000 | |
| 3879 | -function wpforo_send_email( $email, $sbj, $msg, $headers = '' ) { | |
| 4001 | +function wpforo_send_email( $email, $sbj, $msg, $headers = '', $context = 'general', $related_id = 0 ) { | |
| 3880 | 4002 | if( defined( 'IS_GO2WPFORO' ) && IS_GO2WPFORO ) return false; |
| 3881 | 4003 | if( apply_filters( 'break_wpforo_send_email', false, $email, $sbj, $msg, $headers ) ) return false; |
| 3882 | - $key = func_get_args(); | |
| 4004 | + $key = [ $email, $sbj, substr( $msg, 0, 100 ) ]; | |
| 3883 | 4005 | if( WPF()->ram_cache->exists( $key ) ) return false; |
| 3884 | - add_filter( 'wp_mail_content_type', 'wpforo_set_html_content_type', 999 ); | |
| 3885 | - if( wp_mail( $email, $sbj, $msg, ( $headers ?: wpforo_mail_headers() ) ) ) { | |
| 4006 | + | |
| 4007 | + if( isset( WPF()->email_queue ) ) { | |
| 4008 | + $result = WPF()->email_queue->queue_or_send( $email, $sbj, $msg, $headers, $context, $related_id ); | |
| 4009 | + } else { | |
| 4010 | + add_filter( 'wp_mail_content_type', 'wpforo_set_html_content_type', 999 ); | |
| 4011 | + $result = wp_mail( $email, $sbj, $msg, ( $headers ?: wpforo_mail_headers() ) ); | |
| 4012 | + remove_filter( 'wp_mail_content_type', 'wpforo_set_html_content_type' ); | |
| 4013 | + } | |
| 4014 | + | |
| 4015 | + if( $result ) { | |
| 3886 | 4016 | WPF()->ram_cache->set( $key, true ); |
| 3887 | - | |
| 3888 | 4017 | return true; |
| 3889 | 4018 | } |
| 3890 | - remove_filter( 'wp_mail_content_type', 'wpforo_set_html_content_type' ); | |
| 3891 | 4019 | |
| 3892 | 4020 | return false; |
| 3893 | 4021 | } |
| 3894 | 4022 | |
