← All changes | helper.php +61 -2 6.48 → 6.76 View file →

		@@ -2,13 +2,59 @@
2	2	if (!defined('ABSPATH') && !defined('MCDATAPATH') && !defined('PHP_ERR_MONIT_PATH')) exit;
3	3
4	4	if (!class_exists('WPRHelper')) :
5	5	class WPRHelper {
	6	+ const MIN_SALT_LENGTH = 32;
	7	+ const SALT_PLACEHOLDER = 'put your unique phrase here';
	8	+ const SALT_CONSTANTS = array(
	9	+ 'AUTH_KEY', 'AUTH_SALT', 'SECURE_AUTH_KEY', 'SECURE_AUTH_SALT',
	10	+ 'LOGGED_IN_KEY', 'LOGGED_IN_SALT', 'NONCE_KEY', 'NONCE_SALT'
	11	+ );
	12	+
	13	+ public static function configSalt($constant) {
	14	+ if (!defined($constant)) {
	15	+ return null;
	16	+ }
	17	+
	18	+ $value = constant($constant);
	19	+ if (!is_string($value) || strlen($value) < self::MIN_SALT_LENGTH) {
	20	+ return null;
	21	+ }
	22	+
	23	+ if (self::isSaltPlaceholder($value) || self::isSharedSalt($constant, $value)) {
	24	+ return null;
	25	+ }
	26	+
	27	+ return $value;
	28	+ }
	29	+
	30	+ private static function isSaltPlaceholder($value) {
	31	+ if ($value === self::SALT_PLACEHOLDER) {
	32	+ return true;
	33	+ }
	34	+
	35	+ #wp-config-sample.php is localized for some locales, so the placeholder is
	36	+ #not always the English string. wp_salt() guards the translated form too.
	37	+ // phpcs:ignore WordPress.WP.I18n.MissingArgDomain
	38	+ return function_exists('__') && $value === __('put your unique phrase here');
	39	+ }
	40	+
	41	+ private static function isSharedSalt($constant, $value) {
	42	+ foreach (self::SALT_CONSTANTS as $other) {
	43	+ if ($other !== $constant && defined($other) && constant($other) === $value) {
	44	+ return true;
	45	+ }
	46	+ }
	47	+
	48	+ return false;
	49	+ }
	50	+
6	51	public static function safePregMatch($pattern, $subject, &$matches = null, $flags = 0, $offset = 0) {
7	52	if (!is_string($pattern) || !is_string($subject)) {
8	53	return false;
9	54	}
10		- return preg_match($pattern, $subject, $matches, $flags, $offset);
	55	+ $result = @preg_match($pattern, $subject, $matches, $flags, $offset);
	56	+ return $result === false ? false : $result;
11	57	}
12	58
13	59	# XNOTE - The below function assumes valid input
14	60	# $array should be an array and $keys should be an array of string, or integer data
		@@ -74,8 +120,21 @@
74	120	}
75	121	return $updated_subject;
76	122	}
77	123
	124	+ public static function safeStrReplaceFirst($search, $replace, $subject) {
	125	+ if (!is_string($search) || !is_string($replace) || !is_string($subject) || $search === '') {
	126	+ return $subject;
	127	+ }
	128	+
	129	+ $position = strpos($subject, $search);
	130	+ if ($position === false) {
	131	+ return $subject;
	132	+ }
	133	+
	134	+ return substr_replace($subject, $replace, $position, strlen($search));
	135	+ }
	136	+
78	137	public static function preInitWPHook($hook_name, $function_name, $priority, $accepted_args) {
79	138	global $wp_filter;
80	139
81	140	// Check if $wp_filter is not initialized or not an array
		@@ -349,5 +408,5 @@
349	408	return $value !== null ? self::maybeUnslashValue($value) : null;
350	409	}
351	410	// phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Missing
352	411	}
353		-endif;
	412	+endif;