| 1 |
<?php |
| 2 |
|
| 3 |
namespace WPIDE\App\Services\Security; |
| 4 |
|
| 5 |
use WPIDE\App\Kernel\Request; |
| 6 |
use WPIDE\App\Kernel\Response; |
| 7 |
use WPIDE\App\Services\Service; |
| 8 |
use WPIDE\App\Services\Logger\LoggerInterface; |
| 9 |
|
| 10 |
/** |
| 11 |
* @codeCoverageIgnore |
| 12 |
*/ |
| 13 |
class Security implements Service |
| 14 |
{ |
| 15 |
protected $request; |
| 16 |
|
| 17 |
protected $response; |
| 18 |
|
| 19 |
protected $logger; |
| 20 |
|
| 21 |
public function __construct(Request $request, Response $response, LoggerInterface $logger) |
| 22 |
{ |
| 23 |
$this->request = $request; |
| 24 |
$this->response = $response; |
| 25 |
$this->logger = $logger; |
| 26 |
} |
| 27 |
|
| 28 |
public function init(array $config = []) |
| 29 |
{ |
| 30 |
if(!wp_doing_ajax() || wp_doing_cron() || defined('WPIDE_DOING_TASK')) { |
| 31 |
return; |
| 32 |
} |
| 33 |
|
| 34 |
$nonce = wp_create_nonce(); |
| 35 |
|
| 36 |
$http_method = $this->request->getMethod(); |
| 37 |
|
| 38 |
if (in_array($http_method, ['GET', 'HEAD', 'OPTIONS'])) { |
| 39 |
$this->response->headers->set('X-CSRF-Token', $nonce); |
| 40 |
} else { |
| 41 |
$nonce = $this->request->headers->get('X-CSRF-Token'); |
| 42 |
|
| 43 |
if (wp_verify_nonce($nonce) === false) { |
| 44 |
$message = "Csrf token not valid"; |
| 45 |
$this->response->json($message, 403); |
| 46 |
$this->response->send(); |
| 47 |
$this->logger->log($message); |
| 48 |
die; |
| 49 |
} |
| 50 |
} |
| 51 |
|
| 52 |
if (! empty($config['ip_whitelist'])) $config['ip_allowlist'] = $config['ip_whitelist']; // deprecated, compatibility |
| 53 |
|
| 54 |
if (! empty($config['ip_allowlist'])) { |
| 55 |
$pass = false; |
| 56 |
foreach ($config['ip_allowlist'] as $ip) { |
| 57 |
if ($this->request->getClientIp() == $ip) { |
| 58 |
$pass = true; |
| 59 |
} |
| 60 |
} |
| 61 |
if (! $pass) { |
| 62 |
$message = "Forbidden - IP not found in allowlist ".$this->request->getClientIp(); |
| 63 |
$this->response->json($message, 403); |
| 64 |
$this->response->send(); |
| 65 |
$this->logger->log($message); |
| 66 |
die; |
| 67 |
} |
| 68 |
} |
| 69 |
|
| 70 |
if (! empty($config['ip_blacklist'])) $config['ip_denylist'] = $config['ip_blacklist']; // deprecated, compatibility |
| 71 |
|
| 72 |
if (! empty($config['ip_denylist'])) { |
| 73 |
$pass = true; |
| 74 |
foreach ($config['ip_denylist'] as $ip) { |
| 75 |
if ($this->request->getClientIp() == $ip) { |
| 76 |
$pass = false; |
| 77 |
} |
| 78 |
} |
| 79 |
if (! $pass) { |
| 80 |
$message = "Forbidden - IP matched against denylist ".$this->request->getClientIp(); |
| 81 |
$this->response->json($message, 403); |
| 82 |
$this->response->send(); |
| 83 |
$this->logger->log($message); |
| 84 |
die; |
| 85 |
} |
| 86 |
} |
| 87 |
|
| 88 |
} |
| 89 |
} |
| 90 |
|
