← All changes | helper.php +199 -9 5.72 → 6.76 View file →

		@@ -2,13 +2,59 @@
2	2	if (!defined('ABSPATH') && !defined('MCDATAPATH') && !defined('PHP_ERR_MONIT_PATH')) exit;
3	3
4	4	if (!class_exists('WPRHelper')) :
5	5	class WPRHelper {
	6	+ const MIN_SALT_LENGTH = 32;
	7	+ const SALT_PLACEHOLDER = 'put your unique phrase here';
	8	+ const SALT_CONSTANTS = array(
	9	+ 'AUTH_KEY', 'AUTH_SALT', 'SECURE_AUTH_KEY', 'SECURE_AUTH_SALT',
	10	+ 'LOGGED_IN_KEY', 'LOGGED_IN_SALT', 'NONCE_KEY', 'NONCE_SALT'
	11	+ );
	12	+
	13	+ public static function configSalt($constant) {
	14	+ if (!defined($constant)) {
	15	+ return null;
	16	+ }
	17	+
	18	+ $value = constant($constant);
	19	+ if (!is_string($value) || strlen($value) < self::MIN_SALT_LENGTH) {
	20	+ return null;
	21	+ }
	22	+
	23	+ if (self::isSaltPlaceholder($value) || self::isSharedSalt($constant, $value)) {
	24	+ return null;
	25	+ }
	26	+
	27	+ return $value;
	28	+ }
	29	+
	30	+ private static function isSaltPlaceholder($value) {
	31	+ if ($value === self::SALT_PLACEHOLDER) {
	32	+ return true;
	33	+ }
	34	+
	35	+ #wp-config-sample.php is localized for some locales, so the placeholder is
	36	+ #not always the English string. wp_salt() guards the translated form too.
	37	+ // phpcs:ignore WordPress.WP.I18n.MissingArgDomain
	38	+ return function_exists('__') && $value === __('put your unique phrase here');
	39	+ }
	40	+
	41	+ private static function isSharedSalt($constant, $value) {
	42	+ foreach (self::SALT_CONSTANTS as $other) {
	43	+ if ($other !== $constant && defined($other) && constant($other) === $value) {
	44	+ return true;
	45	+ }
	46	+ }
	47	+
	48	+ return false;
	49	+ }
	50	+
6	51	public static function safePregMatch($pattern, $subject, &$matches = null, $flags = 0, $offset = 0) {
7	52	if (!is_string($pattern) || !is_string($subject)) {
8	53	return false;
9	54	}
10		- return preg_match($pattern, $subject, $matches, $flags, $offset);
	55	+ $result = @preg_match($pattern, $subject, $matches, $flags, $offset);
	56	+ return $result === false ? false : $result;
11	57	}
12	58
13	59	# XNOTE - The below function assumes valid input
14	60	# $array should be an array and $keys should be an array of string, or integer data
		@@ -49,18 +95,21 @@
49	95
50	96	return array_key_first($array);
51	97	}
52	98
53		- public static function safePregReplace($replace_regex, $replace_string, $element) {
54		- if (!is_string($replace_regex) || !is_string($replace_string) || !is_string($element)) {
	99	+ public static function safePregReplace($replace_regex, $replace_string, $element, $limit = -1) {
	100	+ if (!is_string($replace_regex) || !is_string($replace_string) || !is_string($element) || !is_int($limit)) {
55	101	return $element;
56	102	}
57		- $updated_element = preg_replace($replace_regex, $replace_string, $element);
	103	+
	104	+ $updated_element = preg_replace($replace_regex, $replace_string, $element, $limit);
	105	+
58	106	if ($updated_element === null && preg_last_error() !== PREG_NO_ERROR) {
59	107	return $element;
60	108	}
	109	+
61	110	return $updated_element;
62		- }
	111	+ }
63	112
64	113	public static function safeStrReplace($search, $replace, $subject) {
65	114	if (!is_string($search) || !is_string($replace) || !is_string($subject)) {
66	115	return $subject;
		@@ -71,8 +120,21 @@
71	120	}
72	121	return $updated_subject;
73	122	}
74	123
	124	+ public static function safeStrReplaceFirst($search, $replace, $subject) {
	125	+ if (!is_string($search) || !is_string($replace) || !is_string($subject) || $search === '') {
	126	+ return $subject;
	127	+ }
	128	+
	129	+ $position = strpos($subject, $search);
	130	+ if ($position === false) {
	131	+ return $subject;
	132	+ }
	133	+
	134	+ return substr_replace($subject, $replace, $position, strlen($search));
	135	+ }
	136	+
75	137	public static function preInitWPHook($hook_name, $function_name, $priority, $accepted_args) {
76	138	global $wp_filter;
77	139
78	140	// Check if $wp_filter is not initialized or not an array
		@@ -121,11 +183,14 @@
121	183	public static function fileRemovePattern($fname, $pattern, $is_regex = false) {
122	184	if (!is_string($fname) || !is_string($pattern)) {
123	185	return;
124	186	}
125		- if (!file_exists($fname)) return;
126	187
127		- $content = file_get_contents($fname);
	188	+ if (!WPRWPFileSystem::getInstance()->exists($fname)) {
	189	+ return;
	190	+ }
	191	+
	192	+ $content = WPRWPFileSystem::getInstance()->getContents($fname);
128	193	if ($content !== false) {
129	194	if ($is_regex !== false) {
130	195	$modified_content = preg_replace($pattern, "", $content);
131	196	} else {
		@@ -136,9 +201,10 @@
136	201	return;
137	202	}
138	203
139	204	if ($content !== $modified_content) {
140		- file_put_contents($fname, $modified_content);
	205	+ WPRWPFileSystem::getInstance()->putContents($fname, $modified_content,
	206	+ WPRWPFileSystem::getInstance()->getchmodOctal($fname));
141	207	}
142	208	}
143	209	}
144	210
		@@ -217,6 +283,130 @@
217	283	}
218	284
219	285	return array(true, $decrypted_data);
220	286	}
	287	+
	288	+ public static function get_direct_filesystem() {
	289	+ require_once ABSPATH . 'wp-admin/includes/class-wp-filesystem-base.php';
	290	+ require_once ABSPATH . 'wp-admin/includes/class-wp-filesystem-direct.php';
	291	+ return new WP_Filesystem_Direct(new StdClass());
	292	+ }
	293	+
	294	+ /**
	295	+ * Maybe unslash a value if WordPress is loaded
	296	+ *
	297	+ * @param string $value The value to potentially unslash
	298	+ * @return string The unslashed value if WP is loaded, original value otherwise
	299	+ */
	300	+ public static function maybeUnslashValue($value) {
	301	+ if (function_exists('wp_unslash')) {
	302	+ return wp_unslash($value);
	303	+ }
	304	+ return $value;
	305	+ }
	306	+
	307	+ /**
	308	+ * Get and sanitize a string parameter from superglobal
	309	+ *
	310	+ * @param string $superglobal The superglobal type ('GET', 'POST', etc.)
	311	+ * @param string $key The parameter key to retrieve
	312	+ * @param string $context The sanitization context ('text', 'email', 'url')
	313	+ * @return string|null Sanitized string value or null if invalid or unknown context
	314	+ */
	315	+ public static function getStringParamSanitized($superglobal, $key, $context) {
	316	+ $raw_value = self::getRawParam($superglobal, $key);
	317	+
	318	+ if (!is_string($raw_value)) {
	319	+ return null;
	320	+ }
	321	+
	322	+ switch ($context) {
	323	+ case 'text':
	324	+ if (!function_exists('sanitize_text_field')) {
	325	+ return null;
	326	+ }
	327	+ return sanitize_text_field($raw_value);
	328	+ case 'email':
	329	+ if (!function_exists('sanitize_email')) {
	330	+ return null;
	331	+ }
	332	+ return sanitize_email($raw_value);
	333	+ case 'url':
	334	+ if (!function_exists('esc_url_raw')) {
	335	+ return null;
	336	+ }
	337	+ return esc_url_raw($raw_value);
	338	+ default:
	339	+ return null;
	340	+ }
	341	+ }
	342	+
	343	+ /**
	344	+ * Get and escape a string parameter from superglobal
	345	+ *
	346	+ * @param string $superglobal The superglobal type ('GET', 'POST', etc.)
	347	+ * @param string $key The parameter key to retrieve
	348	+ * @param string $context The escaping context ('attr', 'html', 'url')
	349	+ * @return string|null Escaped string value or null if invalid or unknown context
	350	+ */
	351	+ public static function getStringParamEscaped($superglobal, $key, $context) {
	352	+ $raw_value = self::getRawParam($superglobal, $key);
	353	+
	354	+ if (!is_string($raw_value)) {
	355	+ return null;
	356	+ }
	357	+
	358	+ switch ($context) {
	359	+ case 'attr':
	360	+ if (!function_exists('esc_attr')) {
	361	+ return null;
	362	+ }
	363	+ return esc_attr($raw_value);
	364	+ case 'html':
	365	+ if (!function_exists('esc_html')) {
	366	+ return null;
	367	+ }
	368	+ return esc_html($raw_value);
	369	+ case 'url':
	370	+ if (!function_exists('esc_url')) {
	371	+ return null;
	372	+ }
	373	+ return esc_url($raw_value);
	374	+ default:
	375	+ return null;
	376	+ }
	377	+ }
	378	+
	379	+ // phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Missing
	380	+ /**
	381	+ * Get raw parameter value from superglobal
	382	+ *
	383	+ * @param string $superglobal The superglobal type ('GET', 'POST', etc.)
	384	+ * @param string $key The parameter key to retrieve
	385	+ * @return mixed Raw parameter value or null if not found
	386	+ */
	387	+ public static function getRawParam($superglobal, $key) {
	388	+ $value = null;
	389	+
	390	+ switch (strtoupper($superglobal)) {
	391	+ case 'GET':
	392	+ $value = isset($_GET[$key]) ? $_GET[$key] : null;
	393	+ break;
	394	+ case 'POST':
	395	+ $value = isset($_POST[$key]) ? $_POST[$key] : null;
	396	+ break;
	397	+ case 'COOKIE':
	398	+ $value = isset($_COOKIE[$key]) ? $_COOKIE[$key] : null;
	399	+ break;
	400	+ case 'REQUEST':
	401	+ $value = isset($_REQUEST[$key]) ? $_REQUEST[$key] : null;
	402	+ break;
	403	+ case 'SERVER':
	404	+ $value = isset($_SERVER[$key]) ? $_SERVER[$key] : null;
	405	+ break;
	406	+ }
	407	+
	408	+ return $value !== null ? self::maybeUnslashValue($value) : null;
	409	+ }
	410	+ // phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Missing
221	411	}
222		-endif;
	412	+endif;