PluginProbe
The WP Remote WordPress Plugin / 6.36
The WP Remote WordPress Plugin v6.36
6.72 6.69 6.65 6.62 6.48 6.47 4.87 4.97 5.05 5.09 5.16 5.22 5.24 5.25 5.38 5.41 5.42 5.45 5.47 5.53 5.56 5.65 5.68 5.72 5.73 All 53 releases
← All changes | callback/streams.php +30 -14 5.056.36 View file →
@@ -1,6 +1,13 @@
1 1 <?php
2 -
2 +// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fread
3 +// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fwrite
4 +// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fsockopen
5 +// We use php method like fread, fwrite to read only a portion of a file, we don't have a direct method for partial reads since WP_Filesystem doesn't support a direct equivalent to fread, fwrite.
6 +// The entire file deals with custom stream handling
7 +// We need direct socket/file operations for this functionality
8 +// WordPress filesystem alternatives wouldn't work for this use case
9 +// It's better to disable these specific rules at file level than adding individual ignore comments
3 10 if (!defined('ABSPATH')) exit;
4 11 if (!class_exists('BVRespStream')) :
5 12
6 13 class BVStream extends BVCallbackBase {
@@ -44,22 +51,26 @@
44 51 }
45 52 return array('stream' => $stream);
46 53 }
47 54
48 - public function writeStream($_string) {
49 - if (strlen($_string) > 0) {
50 - $chunk = "";
55 + public function writeStream($chunk) {
56 + if (strlen($chunk) > 0) {
57 + $bvb64_prefix = "";
51 58 if ($this->bvb64stream) {
52 59 $chunk_size = $this->bvb64cksize;
53 - $_string = $this->base64Encode($_string, $chunk_size);
54 - $chunk .= "BVB64" . ":";
60 + $chunk = $this->base64Encode($chunk, $chunk_size);
61 + $bvb64_prefix .= "BVB64" . ":";
55 62 }
56 - $chunk .= (strlen($_string) . ":" . $_string);
63 +
64 + $hash_prefix = "";
57 65 if ($this->checksum == 'crc32') {
58 - $chunk = "CRC32" . ":" . crc32($_string) . ":" . $chunk;
66 + $hash_prefix .= "CRC32" . ":" . crc32($chunk) . ":";
59 67 } else if ($this->checksum == 'md5') {
60 - $chunk = "MD5" . ":" . md5($_string) . ":" . $chunk;
68 + $hash_prefix .= "MD5" . ":" . md5($chunk) . ":";
61 69 }
70 +
71 + $chunk = $hash_prefix . $bvb64_prefix . strlen($chunk) . ":" . $chunk;
72 +
62 73 $this->writeChunk($chunk);
63 74 }
64 75 }
65 76 }
@@ -64,18 +75,22 @@
64 75 }
65 76 }
66 77
67 78 class BVRespStream extends BVStream {
79 + public $bvboundry;
80 +
68 81 function __construct($request) {
69 82 parent::__construct($request);
83 + $this->bvboundry = $request->bvboundry;
70 84 }
71 85
72 - public function writeChunk($_string) {
73 - echo "ckckckckck".$_string."ckckckckck";
86 + public function writeChunk($chunk) {
87 + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- chunk should not be escaped
88 + echo $this->bvboundry . "ckckckckck" . $chunk . $this->bvboundry . "ckckckckck";
74 89 }
75 -
76 90 public function endStream() {
77 - echo "rerererere";
91 + // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
92 + echo $this->bvboundry . "rerererere";
78 93
79 94 return array();
80 95 }
81 96 }
@@ -162,9 +177,9 @@
162 177 $mph = array(
163 178 "Content-Disposition" => "form-data; name=bvinfile; filename=data",
164 179 "Content-Type" => "application/octet-stream"
165 180 );
166 - $rnd = rand(100000, 999999);
181 + $rnd = rand(100000, 999999); // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_rand
167 182 $this->boundary = "----".$rnd;
168 183 $prologue = "--".$this->boundary."\r\n";
169 184 foreach($mph as $key=>$val) {
170 185 $prologue .= $key.":".$val."\r\n";
@@ -237,5 +252,6 @@
237 252 }
238 253 return $response;
239 254 }
240 255 }
256 +// phpcs:enable
241 257 endif;