wpide / App / Services / Security / Security.php

Security.php in WPIDE – File Manager & Code Editor trunk, at App/Services/Security/Security.php

101 lines 2.9 KB

Raw Download Zip

1	<?php
2
3	namespace WPIDE\App\Services\Security;
4
5	use WPIDE\App\Kernel\Request;
6	use WPIDE\App\Kernel\Response;
7	use WPIDE\App\Services\Service;
8	use WPIDE\App\Services\Logger\LoggerInterface;
9	use const WPIDE\Constants\SLUG;
10
11	/**
12	* @codeCoverageIgnore
13	*/
14	class Security implements Service
15	{
16	protected $request;
17
18	protected $response;
19
20	protected $logger;
21
22	public function __construct(Request $request, Response $response, LoggerInterface $logger)
23	{
24	$this->request = $request;
25	$this->response = $response;
26	$this->logger = $logger;
27	}
28
29	public function init(array $config = [])
30	{
31	if(wp_doing_cron() \|\| defined('WPIDE_DOING_TASK') \|\| ! $this->isProtectedRequest()) {
32	return;
33	}
34
35	$nonce = wp_create_nonce();
36
37	$http_method = $this->request->getMethod();
38
39	if (in_array($http_method, ['GET', 'HEAD', 'OPTIONS'])) {
40	$this->response->headers->set('X-CSRF-Token', $nonce);
41	} else {
42	$nonce = $this->request->headers->get('X-CSRF-Token');
43
44	if (wp_verify_nonce($nonce) === false) {
45	$message = "Csrf token not valid";
46	$this->response->json($message, 403);
47	$this->response->send();
48	$this->logger->log($message);
49	die;
50	}
51	}
52
53	if (! empty($config['ip_whitelist'])) $config['ip_allowlist'] = $config['ip_whitelist']; // deprecated, compatibility
54
55	if (! empty($config['ip_allowlist'])) {
56	$pass = false;
57	foreach ($config['ip_allowlist'] as $ip) {
58	if ($this->request->getClientIp() == $ip) {
59	$pass = true;
60	}
61	}
62	if (! $pass) {
63	$message = "Forbidden - IP not found in allowlist ".$this->request->getClientIp();
64	$this->response->json($message, 403);
65	$this->response->send();
66	$this->logger->log($message);
67	die;
68	}
69	}
70
71	if (! empty($config['ip_blacklist'])) $config['ip_denylist'] = $config['ip_blacklist']; // deprecated, compatibility
72
73	if (! empty($config['ip_denylist'])) {
74	$pass = true;
75	foreach ($config['ip_denylist'] as $ip) {
76	if ($this->request->getClientIp() == $ip) {
77	$pass = false;
78	}
79	}
80	if (! $pass) {
81	$message = "Forbidden - IP matched against denylist ".$this->request->getClientIp();
82	$this->response->json($message, 403);
83	$this->response->send();
84	$this->logger->log($message);
85	die;
86	}
87	}
88
89	}
90
91	protected function isProtectedRequest(): bool
92	{
93	if(wp_doing_ajax()) {
94	return true;
95	}
96
97	return $this->request->query->get('page') === SLUG
98	&& $this->request->query->has('req');
99	}
100	}
101