← All changes | callback/streams.php +23 -42 6.47 → 4.84 View file →

		@@ -1,17 +1,10 @@
1	1	<?php
2		-// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fread
3		-// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fwrite
4		-// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fsockopen
5		-// We use php method like fread, fwrite to read only a portion of a file, we don't have a direct method for partial reads since WP_Filesystem doesn't support a direct equivalent to fread, fwrite.
6		-// The entire file deals with custom stream handling
7		-// We need direct socket/file operations for this functionality
8		-// WordPress filesystem alternatives wouldn't work for this use case
9		-// It's better to disable these specific rules at file level than adding individual ignore comments
	2	+
10	3	if (!defined('ABSPATH')) exit;
11		-if (!class_exists('WPRRespStream')) :
	4	+if (!class_exists('BVRespStream')) :
12	5
13		- class WPRStream extends WPRCallbackBase {
	6	+ class BVStream extends BVCallbackBase {
14	7	public $bvb64stream;
15	8	public $bvb64cksize;
16	9	public $checksum;
17	10
		@@ -26,11 +19,11 @@
26	19
27	20	public static function startStream($account, $request) {
28	21	$result = array();
29	22	$params = $request->params;
30		- $stream = new WPRRespStream($request);
	23	+ $stream = new BVRespStream($request);
31	24	if ($request->isAPICall()) {
32		- $stream = new WPRHttpStream($request);
	25	+ $stream = new BVHttpStream($request);
33	26	if (!$stream->connect()) {
34	27	$apicallstatus = array(
35	28	"httperror" => "Cannot Open Connection to Host",
36	29	"streamerrno" => $stream->errno,
		@@ -51,56 +44,45 @@
51	44	}
52	45	return array('stream' => $stream);
53	46	}
54	47
55		- public function writeStream($chunk) {
56		- if (strlen($chunk) > 0) {
57		- $bvb64_prefix = "";
	48	+ public function writeStream($_string) {
	49	+ if (strlen($_string) > 0) {
	50	+ $chunk = "";
58	51	if ($this->bvb64stream) {
59	52	$chunk_size = $this->bvb64cksize;
60		- $chunk = $this->base64Encode($chunk, $chunk_size);
61		- $bvb64_prefix .= "BVB64" . ":";
	53	+ $_string = $this->base64Encode($_string, $chunk_size);
	54	+ $chunk .= "BVB64" . ":";
62	55	}
63		-
64		- $hash_prefix = "";
	56	+ $chunk .= (strlen($_string) . ":" . $_string);
65	57	if ($this->checksum == 'crc32') {
66		- $hash_prefix .= "CRC32" . ":" . crc32($chunk) . ":";
	58	+ $chunk = "CRC32" . ":" . crc32($_string) . ":" . $chunk;
67	59	} else if ($this->checksum == 'md5') {
68		- $hash_prefix .= "MD5" . ":" . md5($chunk) . ":";
	60	+ $chunk = "MD5" . ":" . md5($_string) . ":" . $chunk;
69	61	}
70		-
71		- $chunk = $hash_prefix . $bvb64_prefix . strlen($chunk) . ":" . $chunk;
72		-
73	62	$this->writeChunk($chunk);
74	63	}
75	64	}
76	65	}
77	66
78		-class WPRRespStream extends WPRStream {
79		- public $bvboundry;
80		-
	67	+class BVRespStream extends BVStream {
81	68	function __construct($request) {
82	69	parent::__construct($request);
83		- // Restrict boundary to safe chars so raw echo cannot inject into response (XSS).
84		- $raw = isset($request->bvboundry) ? (string) $request->bvboundry : '';
85		- $sanitized = preg_replace('/[^a-zA-Z0-9_-]/', '', $raw);
86		- $this->bvboundry = $sanitized !== '' ? $sanitized : 'bvstream';
87	70	}
88	71
89		- public function writeChunk($chunk) {
90		- // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- bvboundry sanitized in constructor; raw stream protocol (not HTML), chunk must not be escaped or stream is corrupted
91		- echo $this->bvboundry . "ckckckckck" . $chunk . $this->bvboundry . "ckckckckck";
	72	+ public function writeChunk($_string) {
	73	+ echo "ckckckckck".$_string."ckckckckck";
92	74	}
	75	+
93	76	public function endStream() {
94		- // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- bvboundry sanitized in constructor; raw stream protocol (not HTML)
95		- echo $this->bvboundry . "rerererere";
	77	+ echo "rerererere";
96	78
97	79	return array();
98	80	}
99	81	}
100	82
101		-class WPRHttpStream extends WPRStream {
102		- var $user_agent = 'WPRHttpStream';
	83	+class BVHttpStream extends BVStream {
	84	+ var $user_agent = 'BVHttpStream';
103	85	var $host;
104	86	var $port;
105	87	var $timeout = 20;
106	88	var $conn;
		@@ -180,9 +162,9 @@
180	162	$mph = array(
181	163	"Content-Disposition" => "form-data; name=bvinfile; filename=data",
182	164	"Content-Type" => "application/octet-stream"
183	165	);
184		- $rnd = rand(100000, 999999); // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_rand
	166	+ $rnd = rand(100000, 999999);
185	167	$this->boundary = "----".$rnd;
186	168	$prologue = "--".$this->boundary."\r\n";
187	169	foreach($mph as $key=>$val) {
188	170	$prologue .= $key.":".$val."\r\n";
		@@ -225,9 +207,9 @@
225	207	stream_set_timeout($this->conn, 300);
226	208	while (!feof($this->conn)) {
227	209	$line = fgets($this->conn, 4096);
228	210	if (1 == $state) {
229		- if (!WPRHelper::safePregMatch('/HTTP\/(\\d\\.\\d)\\s*(\\d+)\\s*(.*)/', $line, $m)) {
	211	+ if (!preg_match('/HTTP\/(\\d\\.\\d)\\s*(\\d+)\\s*(.*)/', $line, $m)) {
230	212	$response['httperror'] = "Status code line invalid: ".htmlentities($line);
231	213	return $response;
232	214	}
233	215	$response['http_version'] = $m[1];
		@@ -240,9 +222,9 @@
240	222	if ($conlen > 0)
241	223	$response['body'] = fread($this->conn, $conlen);
242	224	return $response;
243	225	}
244		- if (!WPRHelper::safePregMatch('/([^:]+):\\s*(.*)/', $line, $m)) {
	226	+ if (!preg_match('/([^:]+):\\s*(.*)/', $line, $m)) {
245	227	// Skip to the next header
246	228	continue;
247	229	}
248	230	$key = strtolower(trim($m[1]));
		@@ -255,6 +237,5 @@
255	237	}
256	238	return $response;
257	239	}
258	240	}
259		-// phpcs:enable
260	241	endif;