← All changes | protect/request.php +37 -33 5.72 → 6.36 View file →

		@@ -1,9 +1,10 @@
1	1	<?php
	2	+
2	3	if (!defined('ABSPATH') && !defined('MCDATAPATH')) exit;
3	4
4		-if (!class_exists('WPRProtectRequest_V572')) :
5		-class WPRProtectRequest_V572 {
	5	+if (!class_exists('WPRProtectRequest_V636')) :
	6	+class WPRProtectRequest_V636 {
6	7	public $ip;
7	8	public $host = '';
8	9	public $uri;
9	10	public $method = '';
		@@ -17,10 +18,10 @@
17	18	public $json_params = array();
18	19	public $raw_body = '';
19	20	public $files;
20	21	public $respcode;
21		- public $status = WPRProtectRequest_V572::STATUS_ALLOWED;
22		- public $category = WPRProtectRequest_V572::CATEGORY_NORMAL;
	22	+ public $status = WPRProtectRequest_V636::STATUS_ALLOWED;
	23	+ public $category = WPRProtectRequest_V636::CATEGORY_NORMAL;
23	24
24	25	public $wp_user;
25	26
26	27	private $can_get_raw_body = false;
		@@ -44,14 +45,14 @@
44	45	const CATEGORY_PRIVATEIP = 80;
45	46	const CATEGORY_GLOBAL_BOT_BLOCKED = 90;
46	47
47	48	public function __construct($ip_header, $config) {
48		- $this->ip = WPRProtectUtils_V572::getIP($ip_header);
	49	+ $this->ip = WPRProtectUtils_V636::getIP($ip_header);
49	50	$this->timestamp = time();
50		- $this->get_params = $_GET;
	51	+ $this->get_params = $_GET; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
51	52	$this->cookies = $_COOKIE;
52		- $this->post_params = $_POST;
53		- $this->files = $_FILES;
	53	+ $this->post_params = $_POST; // phpcs:ignore WordPress.Security.NonceVerification.Missing
	54	+ $this->files = $_FILES; // phpcs:ignore WordPress.Security.NonceVerification.Missing
54	55
55	56	if (array_key_exists('cangetrawbody', $config) && is_bool($config['cangetrawbody'])) {
56	57	$this->can_get_raw_body = $config['cangetrawbody'];
57	58	}
		@@ -67,10 +68,10 @@
67	68	if (array_key_exists('maxjsondecodedepth', $config) && is_int($config['maxjsondecodedepth'])) {
68	69	$this->max_json_decode_depth = $config['maxjsondecodedepth'];
69	70	}
70	71
71		- if (!empty($_FILES)) {
72		- foreach ($_FILES as $input => $file) {
	72	+ if (!empty($_FILES)) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
	73	+ foreach ($_FILES as $input => $file) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
73	74	$this->file_names[$input] = $file['name'];
74	75	}
75	76	}
76	77	if (is_array($_SERVER)) {
		@@ -82,30 +83,35 @@
82	83	$header = str_replace(' ', '-', $header);
83	84	$this->headers[$header] = $value;
84	85	}
85	86	}
86		- if (array_key_exists('CONTENT_TYPE', $_SERVER)) {
87		- $this->headers['Content-Type'] = $_SERVER['CONTENT_TYPE'];
	87	+ $content_type = WPRHelper::getRawParam('SERVER', 'CONTENT_TYPE');
	88	+ if (isset($content_type)) {
	89	+ $this->headers['Content-Type'] = $content_type;
88	90	}
89		- if (array_key_exists('CONTENT_LENGTH', $_SERVER)) {
90		- $this->headers['Content-Length'] = $_SERVER['CONTENT_LENGTH'];
	91	+ $content_length = WPRHelper::getRawParam('SERVER', 'CONTENT_LENGTH');
	92	+ if (isset($content_length)) {
	93	+ $this->headers['Content-Length'] = $content_length;
91	94	}
92		- if (array_key_exists('REFERER', $_SERVER)) {
93		- $this->headers['Referer'] = $_SERVER['REFERER'];
	95	+ $referer = WPRHelper::getRawParam('SERVER', 'REFERER');
	96	+ if (isset($referer)) {
	97	+ $this->headers['Referer'] = $referer;
94	98	}
95		- if (array_key_exists('HTTP_USER_AGENT', $_SERVER)) {
96		- $this->headers['User-Agent'] = $_SERVER['HTTP_USER_AGENT'];
	99	+ $http_user_agent = WPRHelper::getRawParam('SERVER', 'HTTP_USER_AGENT');
	100	+ if (isset($http_user_agent)) {
	101	+ $this->headers['User-Agent'] = $http_user_agent;
97	102	}
98	103
99	104	if (array_key_exists('Host', $this->headers)) {
100	105	$this->host = $this->headers['Host'];
101	106	} elseif (array_key_exists('SERVER_NAME', $_SERVER)) {
102		- $this->host = $_SERVER['SERVER_NAME'];
	107	+ $this->host = WPRHelper::getRawParam('SERVER', 'SERVER_NAME');
103	108	}
104	109
105		- $this->method = array_key_exists('REQUEST_METHOD', $_SERVER)
106		- ? $_SERVER['REQUEST_METHOD'] : 'GET';
107		- $this->uri = array_key_exists('REQUEST_URI', $_SERVER) ? $_SERVER['REQUEST_URI'] : '';
	110	+ $request_method = WPRHelper::getRawParam('SERVER', 'REQUEST_METHOD');
	111	+ $this->method = isset($request_method) ? $request_method : 'GET';
	112	+ $request_uri = WPRHelper::getRawParam('SERVER', 'REQUEST_URI');
	113	+ $this->uri = isset($request_uri) ? $request_uri : '';
108	114	$_uri = parse_url($this->uri);
109	115	$this->path = (is_array($_uri) && array_key_exists('path', $_uri)) ? $_uri['path'] : $this->uri;
110	116	}
111	117
		@@ -117,9 +123,9 @@
117	123	}
118	124
119	125	if ($this->can_decode_json) {
120	126	if ($this->getContentType() === "application/json" && !empty($this->raw_body)) {
121		- $_json_params = WPRProtectUtils_V572::safeDecodeJSON($this->raw_body,
	127	+ $_json_params = WPRProtectUtils_V636::safeDecodeJSON($this->raw_body,
122	128	true, $this->max_json_decode_depth);
123	129	if (isset($_json_params)) {
124	130	$this->json_params['JSON'] = $_json_params;
125	131	}
		@@ -128,17 +134,17 @@
128	134	}
129	135
130	136	public static function blacklistedCategories() {
131	137	return array(
132		- WPRProtectRequest_V572::CATEGORY_BOT_BLOCKED,
133		- WPRProtectRequest_V572::CATEGORY_COUNTRY_BLOCKED,
134		- WPRProtectRequest_V572::CATEGORY_USER_BLACKLISTED,
135		- WPRProtectRequest_V572::CATEGORY_GLOBAL_BOT_BLOCKED
	138	+ WPRProtectRequest_V636::CATEGORY_BOT_BLOCKED,
	139	+ WPRProtectRequest_V636::CATEGORY_COUNTRY_BLOCKED,
	140	+ WPRProtectRequest_V636::CATEGORY_USER_BLACKLISTED,
	141	+ WPRProtectRequest_V636::CATEGORY_GLOBAL_BOT_BLOCKED
136	142	);
137	143	}
138	144
139	145	public static function whitelistedCategories() {
140		- return array(WPRProtectRequest_V572::CATEGORY_WHITELISTED);
	146	+ return array(WPRProtectRequest_V636::CATEGORY_WHITELISTED);
141	147	}
142	148
143	149	public function setRespCode($code) {
144	150	$this->respcode = $code;
		@@ -271,9 +277,9 @@
271	277	}
272	278
273	279	public function getRequestID() {
274	280	if (!defined("BV_REQUEST_ID")) {
275		- define("BV_REQUEST_ID", uniqid(mt_rand()));
	281	+ define("BV_REQUEST_ID", uniqid(mt_rand())); // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_mt_rand
276	282	}
277	283
278	284	return BV_REQUEST_ID;
279	285	}
		@@ -278,12 +284,10 @@
278	284	return BV_REQUEST_ID;
279	285	}
280	286
281	287	public function getServerValue($key) {
282		- if (isset($_SERVER) && array_key_exists($key, $_SERVER)) {
283		- return $_SERVER[$key];
284		- }
285		- return false;
	288	+ $val = WPRHelper::getRawParam('SERVER', $key);
	289	+ return isset($val) ? $val : false;
286	290	}
287	291
288	292	public function getHeadersV2() {
289	293	return $this->headers;