wpremote / protect / request.php

request.php in The WP Remote WordPress Plugin 5.85, at protect/request.php

337 lines 9.1 KB

Raw Download Zip

1	<?php
2
3	if (!defined('ABSPATH') && !defined('MCDATAPATH')) exit;
4
5	if (!class_exists('WPRProtectRequest_V585')) :
6	class WPRProtectRequest_V585 {
7	public $ip;
8	public $host = '';
9	public $uri;
10	public $method = '';
11	public $path = '';
12	public $timestamp;
13	public $get_params;
14	public $post_params;
15	public $cookies;
16	public $headers = array();
17	public $file_names = array();
18	public $json_params = array();
19	public $raw_body = '';
20	public $files;
21	public $respcode;
22	public $status = WPRProtectRequest_V585::STATUS_ALLOWED;
23	public $category = WPRProtectRequest_V585::CATEGORY_NORMAL;
24
25	public $wp_user;
26
27	private $can_get_raw_body = false;
28	private $max_raw_body_length = 1000000;
29	private $can_decode_json = false;
30	private $max_json_decode_depth = 512;
31
32	#XNOTE: SHould be part of Protect.
33	const STATUS_ALLOWED = 1;
34	const STATUS_BLOCKED = 2;
35	const STATUS_BYPASSED = 3;
36
37	const CATEGORY_BLACKLISTED = 1;
38	const CATEGORY_NORMAL = 10;
39	const CATEGORY_WHITELISTED = 20;
40	const CATEGORY_BOT_BLOCKED = 30;
41	const CATEGORY_COUNTRY_BLOCKED = 40;
42	const CATEGORY_USER_BLACKLISTED = 50;
43	const CATEGORY_RULE_BLOCKED = 60;
44	const CATEGORY_RULE_ALLOWED = 70;
45	const CATEGORY_PRIVATEIP = 80;
46	const CATEGORY_GLOBAL_BOT_BLOCKED = 90;
47
48	public function __construct($ip_header, $config) {
49	$this->ip = WPRProtectUtils_V585::getIP($ip_header);
50	$this->timestamp = time();
51	$this->get_params = $_GET; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
52	$this->cookies = $_COOKIE;
53	$this->post_params = $_POST; // phpcs:ignore WordPress.Security.NonceVerification.Missing
54	$this->files = $_FILES; // phpcs:ignore WordPress.Security.NonceVerification.Missing
55
56	if (array_key_exists('cangetrawbody', $config) && is_bool($config['cangetrawbody'])) {
57	$this->can_get_raw_body = $config['cangetrawbody'];
58	}
59
60	if (array_key_exists('maxrawbodylength', $config) && is_int($config['maxrawbodylength'])) {
61	$this->max_raw_body_length = $config['maxrawbodylength'];
62	}
63
64	if (array_key_exists('candecodejson', $config) && is_bool($config['candecodejson'])) {
65	$this->can_decode_json = $config['candecodejson'];
66	}
67
68	if (array_key_exists('maxjsondecodedepth', $config) && is_int($config['maxjsondecodedepth'])) {
69	$this->max_json_decode_depth = $config['maxjsondecodedepth'];
70	}
71
72	if (!empty($_FILES)) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
73	foreach ($_FILES as $input => $file) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
74	$this->file_names[$input] = $file['name'];
75	}
76	}
77	// phpcs:disable WordPress.Security.ValidatedSanitizedInput.MissingUnslash
78	if (is_array($_SERVER)) {
79	foreach ($_SERVER as $key => $value) {
80	if (strpos($key, 'HTTP_') === 0) {
81	$header = substr($key, 5);
82	$header = str_replace(array(' ', '_'), array('', ' '), $header);
83	$header = ucwords(strtolower($header));
84	$header = str_replace(' ', '-', $header);
85	$this->headers[$header] = $value;
86	}
87	}
88	// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
89	if (array_key_exists('CONTENT_TYPE', $_SERVER)) {
90	$this->headers['Content-Type'] = WPRHelper::unslashIfWPLoaded($_SERVER['CONTENT_TYPE']);
91	}
92	if (array_key_exists('CONTENT_LENGTH', $_SERVER)) {
93	$this->headers['Content-Length'] = WPRHelper::unslashIfWPLoaded($_SERVER['CONTENT_LENGTH']);
94	}
95	if (array_key_exists('REFERER', $_SERVER)) {
96	$this->headers['Referer'] = WPRHelper::unslashIfWPLoaded($_SERVER['REFERER']);
97	}
98	if (array_key_exists('HTTP_USER_AGENT', $_SERVER)) {
99	$this->headers['User-Agent'] = WPRHelper::unslashIfWPLoaded($_SERVER['HTTP_USER_AGENT']);
100	}
101
102	if (array_key_exists('Host', $this->headers)) {
103	$this->host = $this->headers['Host'];
104	} elseif (array_key_exists('SERVER_NAME', $_SERVER)) {
105	$this->host = WPRHelper::unslashIfWPLoaded($_SERVER['SERVER_NAME']);
106	}
107
108	$this->method = array_key_exists('REQUEST_METHOD', $_SERVER)
109	? WPRHelper::unslashIfWPLoaded($_SERVER['REQUEST_METHOD']) : 'GET';
110	$this->uri = array_key_exists('REQUEST_URI', $_SERVER) ? WPRHelper::unslashIfWPLoaded($_SERVER['REQUEST_URI']) : '';
111	$_uri = parse_url($this->uri);
112	$this->path = (is_array($_uri) && array_key_exists('path', $_uri)) ? $_uri['path'] : $this->uri;
113	// phpcs:enable
114	}
115
116	if ($this->can_get_raw_body) {
117	$_raw_body = file_get_contents("php://input", false, null, 0, $this->max_raw_body_length);
118	if ($_raw_body !== false) {
119	$this->raw_body = $_raw_body;
120	}
121	}
122
123	if ($this->can_decode_json) {
124	if ($this->getContentType() === "application/json" && !empty($this->raw_body)) {
125	$_json_params = WPRProtectUtils_V585::safeDecodeJSON($this->raw_body,
126	true, $this->max_json_decode_depth);
127	if (isset($_json_params)) {
128	$this->json_params['JSON'] = $_json_params;
129	}
130	}
131	}
132	}
133
134	public static function blacklistedCategories() {
135	return array(
136	WPRProtectRequest_V585::CATEGORY_BOT_BLOCKED,
137	WPRProtectRequest_V585::CATEGORY_COUNTRY_BLOCKED,
138	WPRProtectRequest_V585::CATEGORY_USER_BLACKLISTED,
139	WPRProtectRequest_V585::CATEGORY_GLOBAL_BOT_BLOCKED
140	);
141	}
142
143	public static function whitelistedCategories() {
144	return array(WPRProtectRequest_V585::CATEGORY_WHITELISTED);
145	}
146
147	public function setRespCode($code) {
148	$this->respcode = $code;
149	}
150
151	public function getRespCode() {
152	if (!isset($this->respcode) && function_exists('http_response_code')) {
153	$this->respcode = http_response_code();
154	}
155
156	return $this->respcode;
157	}
158
159	public function getStatus() {
160	return $this->status;
161	}
162
163	public function getCategory() {
164	return $this->category;
165	}
166
167	private function getKeyVal($array, $key) {
168	if (is_array($array)) {
169	if (is_array($key)) {
170	$_key = array_shift($key);
171	if (array_key_exists($_key, $array)) {
172	if (count($key) > 0) {
173	return $this->getKeyVal($array[$_key], $key);
174	} else {
175	return $array[$_key];
176	}
177	}
178	} else {
179	return array_key_exists($key, $array) ? $array[$key] : null;
180	}
181	}
182	return null;
183	}
184
185	public function getPostParams() {
186	if (func_num_args() > 0) {
187	$args = func_get_args();
188	return $this->getKeyVal($this->post_params, $args);
189	}
190	return $this->post_params;
191	}
192
193	public function getCookies() {
194	if (func_num_args() > 0) {
195	$args = func_get_args();
196	return $this->getKeyVal($this->cookies, $args);
197	}
198	return $this->cookies;
199	}
200
201	public function getGetParams() {
202	if (func_num_args() > 0) {
203	$args = func_get_args();
204	return $this->getKeyVal($this->get_params, $args);
205	}
206	return $this->get_params;
207	}
208
209	public function getAllParams() {
210	return array("getParams" => $this->get_params, "postParams" => $this->post_params, "jsonParams" => $this->json_params);
211	}
212
213	public function getHeader($key) {
214	if (array_key_exists($key, $this->headers)) {
215	return $this->headers[$key];
216	}
217	return null;
218	}
219
220	public function getHeaders() {
221	if (func_num_args() > 0) {
222	$args = func_get_args();
223	return $this->getKeyVal($this->headers, $args);
224	}
225	return $this->headers;
226	}
227
228	public function getFiles() {
229	if (func_num_args() > 0) {
230	$args = func_get_args();
231	return $this->getKeyVal($this->files, $args);
232	}
233	return $this->files;
234	}
235
236	public function getFileNames() {
237	if (func_num_args() > 0) {
238	$args = func_get_args();
239	return $this->getKeyVal($this->file_names, $args);
240	}
241	return $this->file_names;
242	}
243
244	public function getHost() {
245	return $this->host;
246	}
247
248	public function getURI() {
249	return $this->uri;
250	}
251
252	public function getAction() {
253	$post_action = $this->getPostParams('action');
254	if (isset($post_action)) {
255	return $post_action;
256	} else {
257	return $this->getGetParams('action');
258	}
259	}
260
261	public function getPath() {
262	return $this->path;
263	}
264
265	public function getIP() {
266	return $this->ip;
267	}
268
269	public function getMethod() {
270	return $this->method;
271	}
272
273	public function getTimestamp() {
274	return $this->timestamp;
275	}
276
277	public function getRequestID() {
278	if (!defined("BV_REQUEST_ID")) {
279	define("BV_REQUEST_ID", uniqid(mt_rand())); // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_mt_rand
280	}
281
282	return BV_REQUEST_ID;
283	}
284
285	public function getServerValue($key) {
286	if (isset($_SERVER) && array_key_exists($key, $_SERVER)) {
287	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
288	return WPRHelper::unslashIfWPLoaded($_SERVER[$key]);
289	}
290	return false;
291	}
292
293	public function getHeadersV2() {
294	return $this->headers;
295	}
296
297	public function getFilesV2() {
298	return $this->files;
299	}
300
301	public function getFileNamesV2() {
302	return $this->file_names;
303	}
304
305	public function getPostParamsV2() {
306	return $this->post_params;
307	}
308
309	public function getGetParamsV2() {
310	return $this->get_params;
311	}
312
313	public function getCookiesV2() {
314	return $this->cookies;
315	}
316
317	public function getJsonParams() {
318	return $this->json_params;
319	}
320
321	public function getRawBody() {
322	return $this->raw_body;
323	}
324
325	public function getContentType() {
326	if (array_key_exists('Content-Type', $this->headers)) {
327	return $this->headers['Content-Type'];
328	}
329	}
330
331	public function getContentLength() {
332	if (array_key_exists('Content-Length', $this->headers)) {
333	return $this->headers['Content-Length'];
334	}
335	}
336	}
337	endif;