← All changes | protect/request.php +99 -34 5.47 → 6.02 View file →

		@@ -1,9 +1,10 @@
1	1	<?php
	2	+
2	3	if (!defined('ABSPATH') && !defined('MCDATAPATH')) exit;
3	4
4		-if (!class_exists('WPRProtectRequest_V547')) :
5		-class WPRProtectRequest_V547 {
	5	+if (!class_exists('WPRProtectRequest_V602')) :
	6	+class WPRProtectRequest_V602 {
6	7	public $ip;
7	8	public $host = '';
8	9	public $uri;
9	10	public $method = '';
		@@ -13,15 +14,22 @@
13	14	public $post_params;
14	15	public $cookies;
15	16	public $headers = array();
16	17	public $file_names = array();
	18	+ public $json_params = array();
	19	+ public $raw_body = '';
17	20	public $files;
18	21	public $respcode;
19		- public $status = WPRProtectRequest_V547::STATUS_ALLOWED;
20		- public $category = WPRProtectRequest_V547::CATEGORY_NORMAL;
	22	+ public $status = WPRProtectRequest_V602::STATUS_ALLOWED;
	23	+ public $category = WPRProtectRequest_V602::CATEGORY_NORMAL;
21	24
22	25	public $wp_user;
23	26
	27	+ private $can_get_raw_body = false;
	28	+ private $max_raw_body_length = 1000000;
	29	+ private $can_decode_json = false;
	30	+ private $max_json_decode_depth = 512;
	31	+
24	32	#XNOTE: SHould be part of Protect.
25	33	const STATUS_ALLOWED = 1;
26	34	const STATUS_BLOCKED = 2;
27	35	const STATUS_BYPASSED = 3;
		@@ -36,17 +44,34 @@
36	44	const CATEGORY_RULE_ALLOWED = 70;
37	45	const CATEGORY_PRIVATEIP = 80;
38	46	const CATEGORY_GLOBAL_BOT_BLOCKED = 90;
39	47
40		- public function __construct($ip_header) {
41		- $this->ip = WPRProtectUtils_V547::getIP($ip_header);
	48	+ public function __construct($ip_header, $config) {
	49	+ $this->ip = WPRProtectUtils_V602::getIP($ip_header);
42	50	$this->timestamp = time();
43		- $this->get_params = $_GET;
	51	+ $this->get_params = $_GET; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
44	52	$this->cookies = $_COOKIE;
45		- $this->post_params = $_POST;
46		- $this->files = $_FILES;
47		- if (!empty($_FILES)) {
48		- foreach ($_FILES as $input => $file) {
	53	+ $this->post_params = $_POST; // phpcs:ignore WordPress.Security.NonceVerification.Missing
	54	+ $this->files = $_FILES; // phpcs:ignore WordPress.Security.NonceVerification.Missing
	55	+
	56	+ if (array_key_exists('cangetrawbody', $config) && is_bool($config['cangetrawbody'])) {
	57	+ $this->can_get_raw_body = $config['cangetrawbody'];
	58	+ }
	59	+
	60	+ if (array_key_exists('maxrawbodylength', $config) && is_int($config['maxrawbodylength'])) {
	61	+ $this->max_raw_body_length = $config['maxrawbodylength'];
	62	+ }
	63	+
	64	+ if (array_key_exists('candecodejson', $config) && is_bool($config['candecodejson'])) {
	65	+ $this->can_decode_json = $config['candecodejson'];
	66	+ }
	67	+
	68	+ if (array_key_exists('maxjsondecodedepth', $config) && is_int($config['maxjsondecodedepth'])) {
	69	+ $this->max_json_decode_depth = $config['maxjsondecodedepth'];
	70	+ }
	71	+
	72	+ if (!empty($_FILES)) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
	73	+ foreach ($_FILES as $input => $file) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
49	74	$this->file_names[$input] = $file['name'];
50	75	}
51	76	}
52	77	if (is_array($_SERVER)) {
		@@ -58,46 +83,68 @@
58	83	$header = str_replace(' ', '-', $header);
59	84	$this->headers[$header] = $value;
60	85	}
61	86	}
62		- if (array_key_exists('CONTENT_TYPE', $_SERVER)) {
63		- $this->headers['Content-Type'] = $_SERVER['CONTENT_TYPE'];
	87	+ $content_type = WPRHelper::getRawParam('SERVER', 'CONTENT_TYPE');
	88	+ if (isset($content_type)) {
	89	+ $this->headers['Content-Type'] = $content_type;
64	90	}
65		- if (array_key_exists('CONTENT_LENGTH', $_SERVER)) {
66		- $this->headers['Content-Length'] = $_SERVER['CONTENT_LENGTH'];
	91	+ $content_length = WPRHelper::getRawParam('SERVER', 'CONTENT_LENGTH');
	92	+ if (isset($content_length)) {
	93	+ $this->headers['Content-Length'] = $content_length;
67	94	}
68		- if (array_key_exists('REFERER', $_SERVER)) {
69		- $this->headers['Referer'] = $_SERVER['REFERER'];
	95	+ $referer = WPRHelper::getRawParam('SERVER', 'REFERER');
	96	+ if (isset($referer)) {
	97	+ $this->headers['Referer'] = $referer;
70	98	}
71		- if (array_key_exists('HTTP_USER_AGENT', $_SERVER)) {
72		- $this->headers['User-Agent'] = $_SERVER['HTTP_USER_AGENT'];
	99	+ $http_user_agent = WPRHelper::getRawParam('SERVER', 'HTTP_USER_AGENT');
	100	+ if (isset($http_user_agent)) {
	101	+ $this->headers['User-Agent'] = $http_user_agent;
73	102	}
74	103
75	104	if (array_key_exists('Host', $this->headers)) {
76	105	$this->host = $this->headers['Host'];
77	106	} elseif (array_key_exists('SERVER_NAME', $_SERVER)) {
78		- $this->host = $_SERVER['SERVER_NAME'];
	107	+ $this->host = WPRHelper::getRawParam('SERVER', 'SERVER_NAME');
79	108	}
80	109
81		- $this->method = array_key_exists('REQUEST_METHOD', $_SERVER)
82		- ? $_SERVER['REQUEST_METHOD'] : 'GET';
83		- $this->uri = array_key_exists('REQUEST_URI', $_SERVER) ? $_SERVER['REQUEST_URI'] : '';
	110	+ $request_method = WPRHelper::getRawParam('SERVER', 'REQUEST_METHOD');
	111	+ $this->method = isset($request_method) ? $request_method : 'GET';
	112	+ $request_uri = WPRHelper::getRawParam('SERVER', 'REQUEST_URI');
	113	+ $this->uri = isset($request_uri) ? $request_uri : '';
84	114	$_uri = parse_url($this->uri);
85	115	$this->path = (is_array($_uri) && array_key_exists('path', $_uri)) ? $_uri['path'] : $this->uri;
86	116	}
	117	+
	118	+ if ($this->can_get_raw_body) {
	119	+ $_raw_body = file_get_contents("php://input", false, null, 0, $this->max_raw_body_length);
	120	+ if ($_raw_body !== false) {
	121	+ $this->raw_body = $_raw_body;
	122	+ }
	123	+ }
	124	+
	125	+ if ($this->can_decode_json) {
	126	+ if ($this->getContentType() === "application/json" && !empty($this->raw_body)) {
	127	+ $_json_params = WPRProtectUtils_V602::safeDecodeJSON($this->raw_body,
	128	+ true, $this->max_json_decode_depth);
	129	+ if (isset($_json_params)) {
	130	+ $this->json_params['JSON'] = $_json_params;
	131	+ }
	132	+ }
	133	+ }
87	134	}
88	135
89	136	public static function blacklistedCategories() {
90	137	return array(
91		- WPRProtectRequest_V547::CATEGORY_BOT_BLOCKED,
92		- WPRProtectRequest_V547::CATEGORY_COUNTRY_BLOCKED,
93		- WPRProtectRequest_V547::CATEGORY_USER_BLACKLISTED,
94		- WPRProtectRequest_V547::CATEGORY_GLOBAL_BOT_BLOCKED
	138	+ WPRProtectRequest_V602::CATEGORY_BOT_BLOCKED,
	139	+ WPRProtectRequest_V602::CATEGORY_COUNTRY_BLOCKED,
	140	+ WPRProtectRequest_V602::CATEGORY_USER_BLACKLISTED,
	141	+ WPRProtectRequest_V602::CATEGORY_GLOBAL_BOT_BLOCKED
95	142	);
96	143	}
97	144
98	145	public static function whitelistedCategories() {
99		- return array(WPRProtectRequest_V547::CATEGORY_WHITELISTED);
	146	+ return array(WPRProtectRequest_V602::CATEGORY_WHITELISTED);
100	147	}
101	148
102	149	public function setRespCode($code) {
103	150	$this->respcode = $code;
		@@ -161,9 +208,9 @@
161	208	return $this->get_params;
162	209	}
163	210
164	211	public function getAllParams() {
165		- return array("getParams" => $this->get_params, "postParams" => $this->post_params);
	212	+ return array("getParams" => $this->get_params, "postParams" => $this->post_params, "jsonParams" => $this->json_params);
166	213	}
167	214
168	215	public function getHeader($key) {
169	216	if (array_key_exists($key, $this->headers)) {
		@@ -230,9 +277,9 @@
230	277	}
231	278
232	279	public function getRequestID() {
233	280	if (!defined("BV_REQUEST_ID")) {
234		- define("BV_REQUEST_ID", uniqid(mt_rand()));
	281	+ define("BV_REQUEST_ID", uniqid(mt_rand())); // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_mt_rand
235	282	}
236	283
237	284	return BV_REQUEST_ID;
238	285	}
		@@ -237,12 +284,10 @@
237	284	return BV_REQUEST_ID;
238	285	}
239	286
240	287	public function getServerValue($key) {
241		- if (isset($_SERVER) && array_key_exists($key, $_SERVER)) {
242		- return $_SERVER[$key];
243		- }
244		- return false;
	288	+ $val = WPRHelper::getRawParam('SERVER', $key);
	289	+ return isset($val) ? $val : false;
245	290	}
246	291
247	292	public function getHeadersV2() {
248	293	return $this->headers;
		@@ -265,7 +310,27 @@
265	310	}
266	311
267	312	public function getCookiesV2() {
268	313	return $this->cookies;
	314	+ }
	315	+
	316	+ public function getJsonParams() {
	317	+ return $this->json_params;
	318	+ }
	319	+
	320	+ public function getRawBody() {
	321	+ return $this->raw_body;
	322	+ }
	323	+
	324	+ public function getContentType() {
	325	+ if (array_key_exists('Content-Type', $this->headers)) {
	326	+ return $this->headers['Content-Type'];
	327	+ }
	328	+ }
	329	+
	330	+ public function getContentLength() {
	331	+ if (array_key_exists('Content-Length', $this->headers)) {
	332	+ return $this->headers['Content-Length'];
	333	+ }
269	334	}
270	335	}
271	336	endif;