← All changes | protect/fw/rule/engine.php +43 -37 5.56 → 6.76 View file →

		@@ -1,16 +1,17 @@
1	1	<?php
	2	+// phpcs:disable WordPress.Security.EscapeOutput.ExceptionNotEscaped
2	3	if (!defined('ABSPATH') && !defined('MCDATAPATH')) exit;
3	4
4		-if (!class_exists('WPRProtectFWRuleEngine_V556')) :
	5	+if (!class_exists('WPRProtectFWRuleEngine_V676')) :
5	6	require_once dirname( __FILE__ ) . '/functions.php';
6	7
7		-class WPRProtectFWRuleEngine_V556 {
8		- use WPRProtectFWRuleStringFunc_V556;
9		- use WPRProtectFWRuleArrayFunc_V556;
10		- use WPRProtectFWRuleMiscFunc_V556;
11		- use WPRProtectFWRuleRequestFunc_V556;
12		- use WPRProtectFWRuleWPFunc_V556;
	8	+class WPRProtectFWRuleEngine_V676 {
	9	+ use WPRProtectFWRuleStringFunc_V676;
	10	+ use WPRProtectFWRuleArrayFunc_V676;
	11	+ use WPRProtectFWRuleMiscFunc_V676;
	12	+ use WPRProtectFWRuleRequestFunc_V676;
	13	+ use WPRProtectFWRuleWPFunc_V676;
13	14
14	15	private $request;
15	16	private $variables;
16	17
		@@ -17,13 +18,15 @@
17	18	private $error;
18	19	private $ex_stack = array();
19	20	private $ex_stack_inx = -1;
20	21
21		- const VERSION = 1.2;
	22	+ const VERSION = 1.4;
22	23
23	24	const MAX_DEPTH_TO_ALLOWED_TYPE_FUNC = 8;
	25	+ const MAX_ARRAY_KEYS_TO_TRAVERSE = 10000;
	26	+ const WILDCARD_KEY = '*';
24	27	const FUNC_NAME_PREFIX = '_rf_';
25		- const CONST_NAME_PREFIX = 'WPRProtectFWRule_V556::';
	28	+ const CONST_NAME_PREFIX = 'WPRProtectFWRule_V676::';
26	29	const ALLOWED_EXT_CONSTANTS = [
27	30	'DOING_CRON'
28	31	];
29	32
		@@ -28,11 +31,15 @@
28	31	];
29	32
30	33	public function __construct($request = null, $variables = array()) {
31	34	$this->request = $request;
32		- $this->variables = self::toAllowedType($variables);
	35	+ $this->variables = $variables;
33	36	}
34	37
	38	+ public static function normalizeVariables($variables) {
	39	+ return self::toAllowedType($variables);
	40	+ }
	41	+
35	42	public function hasError() {
36	43	return isset($this->error);
37	44	}
38	45
		@@ -44,9 +51,9 @@
44	51
45	52	public function evaluate($rule) {
46	53	try {
47	54	return $this->executeStmt($rule->logic);
48		- } catch (WPRProtectRuleError_V556 $e) {
	55	+ } catch (WPRProtectRuleError_V676 $e) {
49	56	$this->error = $e;
50	57	}
51	58	}
52	59
		@@ -53,11 +60,10 @@
53	60	private static function toAllowedType($value, $depth = 1) {
54	61	if ($depth > self::MAX_DEPTH_TO_ALLOWED_TYPE_FUNC) {
55	62	return null;
56	63	}
57		-
58	64	switch (gettype($value)) {
59		- case 'null':
	65	+ case 'NULL':
60	66	case 'boolean':
61	67	case 'integer':
62	68	case 'double':
63	69	case 'string':
		@@ -116,9 +122,9 @@
116	122	}
117	123
118	124	private function getValue($stmt) {
119	125	if (!is_array($stmt) || empty($stmt["type"])) {
120		- throw new WPRProtectRuleError_V556(
	126	+ throw new WPRProtectRuleError_V676(
121	127	$this->addExState("InvalidStatementError: Malformed value statement"));
122	128	}
123	129
124	130	$this->incrOpCnt();
		@@ -125,9 +131,9 @@
125	131
126	132	switch ($stmt["type"]) {
127	133	case "NUMBER":
128	134	if (!isset($stmt["value"]) || !is_int($stmt["value"])) {
129		- throw new WPRProtectRuleError_V556(
	135	+ throw new WPRProtectRuleError_V676(
130	136	$this->addExState("TypeError: Value is not a number")
131	137	);
132	138	}
133	139
		@@ -133,9 +139,9 @@
133	139
134	140	return $stmt["value"];
135	141	case "STRING":
136	142	if (!isset($stmt["value"]) || !is_string($stmt["value"])) {
137		- throw new WPRProtectRuleError_V556(
	143	+ throw new WPRProtectRuleError_V676(
138	144	$this->addExState("TypeError: Value is not a string")
139	145	);
140	146	}
141	147
		@@ -141,9 +147,9 @@
141	147
142	148	return $stmt["value"];
143	149	case "BOOL":
144	150	if (!isset($stmt["value"]) || !is_bool($stmt["value"])) {
145		- throw new WPRProtectRuleError_V556(
	151	+ throw new WPRProtectRuleError_V676(
146	152	$this->addExState("TypeError: Value is not a boolean")
147	153	);
148	154	}
149	155
		@@ -149,9 +155,9 @@
149	155
150	156	return $stmt["value"];
151	157	case "CONST":
152	158	if (!isset($stmt["value"]) || !is_string($stmt["value"])) {
153		- throw new WPRProtectRuleError_V556(
	159	+ throw new WPRProtectRuleError_V676(
154	160	$this->addExState("TypeError: Invalid constant name")
155	161	);
156	162	}
157	163
		@@ -161,9 +167,9 @@
161	167	$name = self::CONST_NAME_PREFIX . $name;
162	168	}
163	169
164	170	if (!defined($name)) {
165		- throw new WPRProtectRuleError_V556(
	171	+ throw new WPRProtectRuleError_V676(
166	172	$this->addExState("TypeError: Undefined constant" . $stmt["value"])
167	173	);
168	174	}
169	175
		@@ -169,9 +175,9 @@
169	175
170	176	return constant($name);
171	177	case "ARRAY":
172	178	if (!isset($stmt["value"]) || !is_array($stmt["value"])) {
173		- throw new WPRProtectRuleError_V556(
	179	+ throw new WPRProtectRuleError_V676(
174	180	$this->addExState("TypeError: Value is not a array")
175	181	);
176	182	}
177	183
		@@ -200,9 +206,9 @@
200	206	}
201	207
202	208	private function executeStmt($stmt) {
203	209	if (!is_array($stmt) || empty($stmt["type"])) {
204		- throw new WPRProtectRuleError_V556(
	210	+ throw new WPRProtectRuleError_V676(
205	211	$this->addExState("InvalidStatementError: Malformed logic statement")
206	212	);
207	213	}
208	214
		@@ -212,9 +218,9 @@
212	218
213	219	switch ($stmt["type"]) {
214	220	case "AND":
215	221	if (empty($stmt["left_operand"]) || empty($stmt["right_operand"])) {
216		- throw new WPRProtectRuleError_V556(
	222	+ throw new WPRProtectRuleError_V676(
217	223	$this->addExState("InvalidOperandError: Malformed operand(s)")
218	224	);
219	225	}
220	226
		@@ -221,9 +227,9 @@
221	227	$return_val = $this->getValue($stmt["left_operand"]) && $this->getValue($stmt["right_operand"]);
222	228	break;
223	229	case "OR":
224	230	if (empty($stmt["left_operand"]) || empty($stmt["right_operand"])) {
225		- throw new WPRProtectRuleError_V556(
	231	+ throw new WPRProtectRuleError_V676(
226	232	$this->addExState("InvalidOperandError: Malformed operand(s)")
227	233	);
228	234	}
229	235
		@@ -230,9 +236,9 @@
230	236	$return_val = $this->getValue($stmt["left_operand"]) || $this->getValue($stmt["right_operand"]);
231	237	break;
232	238	case "NOT":
233	239	if (empty($stmt["value"])) {
234		- throw new WPRProtectRuleError_V556(
	240	+ throw new WPRProtectRuleError_V676(
235	241	$this->addExState("InvalidOperandError: Malformed operand")
236	242	);
237	243	}
238	244
		@@ -239,9 +245,9 @@
239	245	$return_val = !$this->getValue($stmt["value"]);
240	246	break;
241	247	case "FUNCTION":
242	248	if (empty($stmt["name"]) || !is_string($stmt["name"])) {
243		- throw new WPRProtectRuleError_V556(
	249	+ throw new WPRProtectRuleError_V676(
244	250	$this->addExState("InvalidFunctionName: Malformed name")
245	251	);
246	252	}
247	253
		@@ -248,15 +254,15 @@
248	254	$name = self::FUNC_NAME_PREFIX . $stmt["name"];
249	255	$handler = array($this, $name);
250	256
251	257	if (!is_callable($handler)) {
252		- throw new WPRProtectRuleError_V556(
	258	+ throw new WPRProtectRuleError_V676(
253	259	$this->addExState("UndefinedFunctionCall: " . $stmt["name"])
254	260	);
255	261	}
256	262
257	263	if (!array_key_exists('args', $stmt) || !is_array($stmt['args'])) {
258		- throw new WPRProtectRuleError_V556(
	264	+ throw new WPRProtectRuleError_V676(
259	265	$this->addExState("InvalidArguments: Malformed args")
260	266	);
261	267	}
262	268
		@@ -267,9 +273,9 @@
267	273
268	274	$return_val = self::toAllowedType(call_user_func_array($handler, $args));
269	275	break;
270	276	default:
271		- throw new WPRProtectRuleError_V556(
	277	+ throw new WPRProtectRuleError_V676(
272	278	$this->addExState("UnknownOperation: -")
273	279	);
274	280	}
275	281
		@@ -278,9 +284,9 @@
278	284	}
279	285
280	286	private function processRuleFunctionParams($func_name, $args_cnt, $args, $required_params = 0, $param_types = array()) {
281	287	if (($args_cnt < $required_params)) {
282		- throw new WPRProtectRuleError_V556(
	288	+ throw new WPRProtectRuleError_V676(
283	289	$this->addExState("ArgumentCountError: Too few arguments for " . $func_name)
284	290	);
285	291	}
286	292
		@@ -285,9 +291,9 @@
285	291	}
286	292
287	293	foreach ($param_types as $pos => $type) {
288	294	if (!is_int($pos)) {
289		- throw new WPRProtectRuleError_V556(
	295	+ throw new WPRProtectRuleError_V676(
290	296	$this->addExState("InvalidParamType: " . $pos)
291	297	);
292	298	}
293	299
		@@ -293,9 +299,9 @@
293	299
294	300	switch ($type) {
295	301	case "string":
296	302	if (!isset($args[$pos]) || !is_string($args[$pos])) {
297		- throw new WPRProtectRuleError_V556(
	303	+ throw new WPRProtectRuleError_V676(
298	304	$this->addExState("TypeError: " . $func_name . " param at " . $pos . " is not a string.")
299	305	);
300	306	}
301	307	break;
		@@ -300,9 +306,9 @@
300	306	}
301	307	break;
302	308	case 'integer':
303	309	if (!isset($args[$pos]) || !is_int($args[$pos])) {
304		- throw new WPRProtectRuleError_V556(
	310	+ throw new WPRProtectRuleError_V676(
305	311	$this->addExState("TypeError: " . $func_name . " param at " . $pos . " is not a integer.")
306	312	);
307	313	}
308	314	break;
		@@ -307,9 +313,9 @@
307	313	}
308	314	break;
309	315	case 'double':
310	316	if (!isset($args[$pos]) || !is_double($args[$pos])) {
311		- throw new WPRProtectRuleError_V556(
	317	+ throw new WPRProtectRuleError_V676(
312	318	$this->addExState("TypeError: " . $func_name . " param at " . $pos . " is not a double.")
313	319	);
314	320	}
315	321	break;
		@@ -314,9 +320,9 @@
314	320	}
315	321	break;
316	322	case 'boolean':
317	323	if (!isset($args[$pos]) || !is_bool($args[$pos])) {
318		- throw new WPRProtectRuleError_V556(
	324	+ throw new WPRProtectRuleError_V676(
319	325	$this->addExState("TypeError: " . $func_name . " param at " . $pos . " is not a boolean.")
320	326	);
321	327	}
322	328	break;
		@@ -321,9 +327,9 @@
321	327	}
322	328	break;
323	329	case 'array':
324	330	if (!isset($args[$pos]) || !is_array($args[$pos])) {
325		- throw new WPRProtectRuleError_V556(
	331	+ throw new WPRProtectRuleError_V676(
326	332	$this->addExState("TypeError: " . $func_name . " param at " . $pos . " is not an array.")
327	333	);
328	334	}
329	335	break;
		@@ -329,9 +335,9 @@
329	335	break;
330	336	case 'mixed':
331	337	break;
332	338	default:
333		- throw new WPRProtectRuleError_V556(
	339	+ throw new WPRProtectRuleError_V676(
334	340	$this->addExState("InvalidParamTypeError: Invalid type at " . $pos . " for " . $func_name)
335	341	);
336	342	}
337	343	}
		@@ -338,5 +344,5 @@
338	344
339	345	return $args;
340	346	}
341	347	}
342		-endif;
	348	+endif;