wpremote / protect / request.php

request.php in The WP Remote WordPress Plugin 6.47, at protect/request.php

336 lines 8.8 KB

Raw Download Zip

1	<?php
2
3	if (!defined('ABSPATH') && !defined('MCDATAPATH')) exit;
4
5	if (!class_exists('WPRProtectRequest_V647')) :
6	class WPRProtectRequest_V647 {
7	public $ip;
8	public $host = '';
9	public $uri;
10	public $method = '';
11	public $path = '';
12	public $timestamp;
13	public $get_params;
14	public $post_params;
15	public $cookies;
16	public $headers = array();
17	public $file_names = array();
18	public $json_params = array();
19	public $raw_body = '';
20	public $files;
21	public $respcode;
22	public $status = WPRProtectRequest_V647::STATUS_ALLOWED;
23	public $category = WPRProtectRequest_V647::CATEGORY_NORMAL;
24
25	public $wp_user;
26
27	private $can_get_raw_body = false;
28	private $max_raw_body_length = 1000000;
29	private $can_decode_json = false;
30	private $max_json_decode_depth = 512;
31
32	#XNOTE: SHould be part of Protect.
33	const STATUS_ALLOWED = 1;
34	const STATUS_BLOCKED = 2;
35	const STATUS_BYPASSED = 3;
36
37	const CATEGORY_BLACKLISTED = 1;
38	const CATEGORY_NORMAL = 10;
39	const CATEGORY_WHITELISTED = 20;
40	const CATEGORY_BOT_BLOCKED = 30;
41	const CATEGORY_COUNTRY_BLOCKED = 40;
42	const CATEGORY_USER_BLACKLISTED = 50;
43	const CATEGORY_RULE_BLOCKED = 60;
44	const CATEGORY_RULE_ALLOWED = 70;
45	const CATEGORY_PRIVATEIP = 80;
46	const CATEGORY_GLOBAL_BOT_BLOCKED = 90;
47
48	public function __construct($ip_header, $config) {
49	$this->ip = WPRProtectUtils_V647::getIP($ip_header);
50	$this->timestamp = time();
51	$this->get_params = $_GET; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
52	$this->cookies = $_COOKIE;
53	$this->post_params = $_POST; // phpcs:ignore WordPress.Security.NonceVerification.Missing
54	$this->files = $_FILES; // phpcs:ignore WordPress.Security.NonceVerification.Missing
55
56	if (array_key_exists('cangetrawbody', $config) && is_bool($config['cangetrawbody'])) {
57	$this->can_get_raw_body = $config['cangetrawbody'];
58	}
59
60	if (array_key_exists('maxrawbodylength', $config) && is_int($config['maxrawbodylength'])) {
61	$this->max_raw_body_length = $config['maxrawbodylength'];
62	}
63
64	if (array_key_exists('candecodejson', $config) && is_bool($config['candecodejson'])) {
65	$this->can_decode_json = $config['candecodejson'];
66	}
67
68	if (array_key_exists('maxjsondecodedepth', $config) && is_int($config['maxjsondecodedepth'])) {
69	$this->max_json_decode_depth = $config['maxjsondecodedepth'];
70	}
71
72	if (!empty($_FILES)) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
73	foreach ($_FILES as $input => $file) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
74	$this->file_names[$input] = $file['name'];
75	}
76	}
77	if (is_array($_SERVER)) {
78	foreach ($_SERVER as $key => $value) {
79	if (strpos($key, 'HTTP_') === 0) {
80	$header = substr($key, 5);
81	$header = str_replace(array(' ', '_'), array('', ' '), $header);
82	$header = ucwords(strtolower($header));
83	$header = str_replace(' ', '-', $header);
84	$this->headers[$header] = $value;
85	}
86	}
87	$content_type = WPRHelper::getRawParam('SERVER', 'CONTENT_TYPE');
88	if (isset($content_type)) {
89	$this->headers['Content-Type'] = $content_type;
90	}
91	$content_length = WPRHelper::getRawParam('SERVER', 'CONTENT_LENGTH');
92	if (isset($content_length)) {
93	$this->headers['Content-Length'] = $content_length;
94	}
95	$referer = WPRHelper::getRawParam('SERVER', 'REFERER');
96	if (isset($referer)) {
97	$this->headers['Referer'] = $referer;
98	}
99	$http_user_agent = WPRHelper::getRawParam('SERVER', 'HTTP_USER_AGENT');
100	if (isset($http_user_agent)) {
101	$this->headers['User-Agent'] = $http_user_agent;
102	}
103
104	if (array_key_exists('Host', $this->headers)) {
105	$this->host = $this->headers['Host'];
106	} elseif (array_key_exists('SERVER_NAME', $_SERVER)) {
107	$this->host = WPRHelper::getRawParam('SERVER', 'SERVER_NAME');
108	}
109
110	$request_method = WPRHelper::getRawParam('SERVER', 'REQUEST_METHOD');
111	$this->method = isset($request_method) ? $request_method : 'GET';
112	$request_uri = WPRHelper::getRawParam('SERVER', 'REQUEST_URI');
113	$this->uri = isset($request_uri) ? $request_uri : '';
114	$_uri = parse_url($this->uri);
115	$this->path = (is_array($_uri) && array_key_exists('path', $_uri)) ? $_uri['path'] : $this->uri;
116	}
117
118	if ($this->can_get_raw_body) {
119	$_raw_body = file_get_contents("php://input", false, null, 0, $this->max_raw_body_length);
120	if ($_raw_body !== false) {
121	$this->raw_body = $_raw_body;
122	}
123	}
124
125	if ($this->can_decode_json) {
126	if ($this->getContentType() === "application/json" && !empty($this->raw_body)) {
127	$_json_params = WPRProtectUtils_V647::safeDecodeJSON($this->raw_body,
128	true, $this->max_json_decode_depth);
129	if (isset($_json_params)) {
130	$this->json_params['JSON'] = $_json_params;
131	}
132	}
133	}
134	}
135
136	public static function blacklistedCategories() {
137	return array(
138	WPRProtectRequest_V647::CATEGORY_BOT_BLOCKED,
139	WPRProtectRequest_V647::CATEGORY_COUNTRY_BLOCKED,
140	WPRProtectRequest_V647::CATEGORY_USER_BLACKLISTED,
141	WPRProtectRequest_V647::CATEGORY_GLOBAL_BOT_BLOCKED
142	);
143	}
144
145	public static function whitelistedCategories() {
146	return array(WPRProtectRequest_V647::CATEGORY_WHITELISTED);
147	}
148
149	public function setRespCode($code) {
150	$this->respcode = $code;
151	}
152
153	public function getRespCode() {
154	if (!isset($this->respcode) && function_exists('http_response_code')) {
155	$this->respcode = http_response_code();
156	}
157
158	return $this->respcode;
159	}
160
161	public function getStatus() {
162	return $this->status;
163	}
164
165	public function getCategory() {
166	return $this->category;
167	}
168
169	private function getKeyVal($array, $key) {
170	if (is_array($array)) {
171	if (is_array($key)) {
172	$_key = array_shift($key);
173	if (array_key_exists($_key, $array)) {
174	if (count($key) > 0) {
175	return $this->getKeyVal($array[$_key], $key);
176	} else {
177	return $array[$_key];
178	}
179	}
180	} else {
181	return array_key_exists($key, $array) ? $array[$key] : null;
182	}
183	}
184	return null;
185	}
186
187	public function getPostParams() {
188	if (func_num_args() > 0) {
189	$args = func_get_args();
190	return $this->getKeyVal($this->post_params, $args);
191	}
192	return $this->post_params;
193	}
194
195	public function getCookies() {
196	if (func_num_args() > 0) {
197	$args = func_get_args();
198	return $this->getKeyVal($this->cookies, $args);
199	}
200	return $this->cookies;
201	}
202
203	public function getGetParams() {
204	if (func_num_args() > 0) {
205	$args = func_get_args();
206	return $this->getKeyVal($this->get_params, $args);
207	}
208	return $this->get_params;
209	}
210
211	public function getAllParams() {
212	return array("getParams" => $this->get_params, "postParams" => $this->post_params, "jsonParams" => $this->json_params);
213	}
214
215	public function getHeader($key) {
216	if (array_key_exists($key, $this->headers)) {
217	return $this->headers[$key];
218	}
219	return null;
220	}
221
222	public function getHeaders() {
223	if (func_num_args() > 0) {
224	$args = func_get_args();
225	return $this->getKeyVal($this->headers, $args);
226	}
227	return $this->headers;
228	}
229
230	public function getFiles() {
231	if (func_num_args() > 0) {
232	$args = func_get_args();
233	return $this->getKeyVal($this->files, $args);
234	}
235	return $this->files;
236	}
237
238	public function getFileNames() {
239	if (func_num_args() > 0) {
240	$args = func_get_args();
241	return $this->getKeyVal($this->file_names, $args);
242	}
243	return $this->file_names;
244	}
245
246	public function getHost() {
247	return $this->host;
248	}
249
250	public function getURI() {
251	return $this->uri;
252	}
253
254	public function getAction() {
255	$post_action = $this->getPostParams('action');
256	if (isset($post_action)) {
257	return $post_action;
258	} else {
259	return $this->getGetParams('action');
260	}
261	}
262
263	public function getPath() {
264	return $this->path;
265	}
266
267	public function getIP() {
268	return $this->ip;
269	}
270
271	public function getMethod() {
272	return $this->method;
273	}
274
275	public function getTimestamp() {
276	return $this->timestamp;
277	}
278
279	public function getRequestID() {
280	if (!defined("WPR_REQUEST_ID")) {
281	define("WPR_REQUEST_ID", uniqid(mt_rand())); // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_mt_rand
282	}
283
284	return WPR_REQUEST_ID;
285	}
286
287	public function getServerValue($key) {
288	$val = WPRHelper::getRawParam('SERVER', $key);
289	return isset($val) ? $val : false;
290	}
291
292	public function getHeadersV2() {
293	return $this->headers;
294	}
295
296	public function getFilesV2() {
297	return $this->files;
298	}
299
300	public function getFileNamesV2() {
301	return $this->file_names;
302	}
303
304	public function getPostParamsV2() {
305	return $this->post_params;
306	}
307
308	public function getGetParamsV2() {
309	return $this->get_params;
310	}
311
312	public function getCookiesV2() {
313	return $this->cookies;
314	}
315
316	public function getJsonParams() {
317	return $this->json_params;
318	}
319
320	public function getRawBody() {
321	return $this->raw_body;
322	}
323
324	public function getContentType() {
325	if (array_key_exists('Content-Type', $this->headers)) {
326	return $this->headers['Content-Type'];
327	}
328	}
329
330	public function getContentLength() {
331	if (array_key_exists('Content-Length', $this->headers)) {
332	return $this->headers['Content-Length'];
333	}
334	}
335	}
336	endif;