← All changes | protect/fw/rule/engine.php +42 -37 6.48 → 6.76 View file →

		@@ -1,17 +1,17 @@
1	1	<?php
2	2	// phpcs:disable WordPress.Security.EscapeOutput.ExceptionNotEscaped
3	3	if (!defined('ABSPATH') && !defined('MCDATAPATH')) exit;
4	4
5		-if (!class_exists('WPRProtectFWRuleEngine_V648')) :
	5	+if (!class_exists('WPRProtectFWRuleEngine_V676')) :
6	6	require_once dirname( __FILE__ ) . '/functions.php';
7	7
8		-class WPRProtectFWRuleEngine_V648 {
9		- use WPRProtectFWRuleStringFunc_V648;
10		- use WPRProtectFWRuleArrayFunc_V648;
11		- use WPRProtectFWRuleMiscFunc_V648;
12		- use WPRProtectFWRuleRequestFunc_V648;
13		- use WPRProtectFWRuleWPFunc_V648;
	8	+class WPRProtectFWRuleEngine_V676 {
	9	+ use WPRProtectFWRuleStringFunc_V676;
	10	+ use WPRProtectFWRuleArrayFunc_V676;
	11	+ use WPRProtectFWRuleMiscFunc_V676;
	12	+ use WPRProtectFWRuleRequestFunc_V676;
	13	+ use WPRProtectFWRuleWPFunc_V676;
14	14
15	15	private $request;
16	16	private $variables;
17	17
		@@ -18,13 +18,15 @@
18	18	private $error;
19	19	private $ex_stack = array();
20	20	private $ex_stack_inx = -1;
21	21
22		- const VERSION = 1.2;
	22	+ const VERSION = 1.4;
23	23
24	24	const MAX_DEPTH_TO_ALLOWED_TYPE_FUNC = 8;
	25	+ const MAX_ARRAY_KEYS_TO_TRAVERSE = 10000;
	26	+ const WILDCARD_KEY = '*';
25	27	const FUNC_NAME_PREFIX = '_rf_';
26		- const CONST_NAME_PREFIX = 'WPRProtectFWRule_V648::';
	28	+ const CONST_NAME_PREFIX = 'WPRProtectFWRule_V676::';
27	29	const ALLOWED_EXT_CONSTANTS = [
28	30	'DOING_CRON'
29	31	];
30	32
		@@ -29,11 +31,15 @@
29	31	];
30	32
31	33	public function __construct($request = null, $variables = array()) {
32	34	$this->request = $request;
33		- $this->variables = self::toAllowedType($variables);
	35	+ $this->variables = $variables;
34	36	}
35	37
	38	+ public static function normalizeVariables($variables) {
	39	+ return self::toAllowedType($variables);
	40	+ }
	41	+
36	42	public function hasError() {
37	43	return isset($this->error);
38	44	}
39	45
		@@ -45,9 +51,9 @@
45	51
46	52	public function evaluate($rule) {
47	53	try {
48	54	return $this->executeStmt($rule->logic);
49		- } catch (WPRProtectRuleError_V648 $e) {
	55	+ } catch (WPRProtectRuleError_V676 $e) {
50	56	$this->error = $e;
51	57	}
52	58	}
53	59
		@@ -54,11 +60,10 @@
54	60	private static function toAllowedType($value, $depth = 1) {
55	61	if ($depth > self::MAX_DEPTH_TO_ALLOWED_TYPE_FUNC) {
56	62	return null;
57	63	}
58		-
59	64	switch (gettype($value)) {
60		- case 'null':
	65	+ case 'NULL':
61	66	case 'boolean':
62	67	case 'integer':
63	68	case 'double':
64	69	case 'string':
		@@ -117,9 +122,9 @@
117	122	}
118	123
119	124	private function getValue($stmt) {
120	125	if (!is_array($stmt) || empty($stmt["type"])) {
121		- throw new WPRProtectRuleError_V648(
	126	+ throw new WPRProtectRuleError_V676(
122	127	$this->addExState("InvalidStatementError: Malformed value statement"));
123	128	}
124	129
125	130	$this->incrOpCnt();
		@@ -126,9 +131,9 @@
126	131
127	132	switch ($stmt["type"]) {
128	133	case "NUMBER":
129	134	if (!isset($stmt["value"]) || !is_int($stmt["value"])) {
130		- throw new WPRProtectRuleError_V648(
	135	+ throw new WPRProtectRuleError_V676(
131	136	$this->addExState("TypeError: Value is not a number")
132	137	);
133	138	}
134	139
		@@ -134,9 +139,9 @@
134	139
135	140	return $stmt["value"];
136	141	case "STRING":
137	142	if (!isset($stmt["value"]) || !is_string($stmt["value"])) {
138		- throw new WPRProtectRuleError_V648(
	143	+ throw new WPRProtectRuleError_V676(
139	144	$this->addExState("TypeError: Value is not a string")
140	145	);
141	146	}
142	147
		@@ -142,9 +147,9 @@
142	147
143	148	return $stmt["value"];
144	149	case "BOOL":
145	150	if (!isset($stmt["value"]) || !is_bool($stmt["value"])) {
146		- throw new WPRProtectRuleError_V648(
	151	+ throw new WPRProtectRuleError_V676(
147	152	$this->addExState("TypeError: Value is not a boolean")
148	153	);
149	154	}
150	155
		@@ -150,9 +155,9 @@
150	155
151	156	return $stmt["value"];
152	157	case "CONST":
153	158	if (!isset($stmt["value"]) || !is_string($stmt["value"])) {
154		- throw new WPRProtectRuleError_V648(
	159	+ throw new WPRProtectRuleError_V676(
155	160	$this->addExState("TypeError: Invalid constant name")
156	161	);
157	162	}
158	163
		@@ -162,9 +167,9 @@
162	167	$name = self::CONST_NAME_PREFIX . $name;
163	168	}
164	169
165	170	if (!defined($name)) {
166		- throw new WPRProtectRuleError_V648(
	171	+ throw new WPRProtectRuleError_V676(
167	172	$this->addExState("TypeError: Undefined constant" . $stmt["value"])
168	173	);
169	174	}
170	175
		@@ -170,9 +175,9 @@
170	175
171	176	return constant($name);
172	177	case "ARRAY":
173	178	if (!isset($stmt["value"]) || !is_array($stmt["value"])) {
174		- throw new WPRProtectRuleError_V648(
	179	+ throw new WPRProtectRuleError_V676(
175	180	$this->addExState("TypeError: Value is not a array")
176	181	);
177	182	}
178	183
		@@ -201,9 +206,9 @@
201	206	}
202	207
203	208	private function executeStmt($stmt) {
204	209	if (!is_array($stmt) || empty($stmt["type"])) {
205		- throw new WPRProtectRuleError_V648(
	210	+ throw new WPRProtectRuleError_V676(
206	211	$this->addExState("InvalidStatementError: Malformed logic statement")
207	212	);
208	213	}
209	214
		@@ -213,9 +218,9 @@
213	218
214	219	switch ($stmt["type"]) {
215	220	case "AND":
216	221	if (empty($stmt["left_operand"]) || empty($stmt["right_operand"])) {
217		- throw new WPRProtectRuleError_V648(
	222	+ throw new WPRProtectRuleError_V676(
218	223	$this->addExState("InvalidOperandError: Malformed operand(s)")
219	224	);
220	225	}
221	226
		@@ -222,9 +227,9 @@
222	227	$return_val = $this->getValue($stmt["left_operand"]) && $this->getValue($stmt["right_operand"]);
223	228	break;
224	229	case "OR":
225	230	if (empty($stmt["left_operand"]) || empty($stmt["right_operand"])) {
226		- throw new WPRProtectRuleError_V648(
	231	+ throw new WPRProtectRuleError_V676(
227	232	$this->addExState("InvalidOperandError: Malformed operand(s)")
228	233	);
229	234	}
230	235
		@@ -231,9 +236,9 @@
231	236	$return_val = $this->getValue($stmt["left_operand"]) || $this->getValue($stmt["right_operand"]);
232	237	break;
233	238	case "NOT":
234	239	if (empty($stmt["value"])) {
235		- throw new WPRProtectRuleError_V648(
	240	+ throw new WPRProtectRuleError_V676(
236	241	$this->addExState("InvalidOperandError: Malformed operand")
237	242	);
238	243	}
239	244
		@@ -240,9 +245,9 @@
240	245	$return_val = !$this->getValue($stmt["value"]);
241	246	break;
242	247	case "FUNCTION":
243	248	if (empty($stmt["name"]) || !is_string($stmt["name"])) {
244		- throw new WPRProtectRuleError_V648(
	249	+ throw new WPRProtectRuleError_V676(
245	250	$this->addExState("InvalidFunctionName: Malformed name")
246	251	);
247	252	}
248	253
		@@ -249,15 +254,15 @@
249	254	$name = self::FUNC_NAME_PREFIX . $stmt["name"];
250	255	$handler = array($this, $name);
251	256
252	257	if (!is_callable($handler)) {
253		- throw new WPRProtectRuleError_V648(
	258	+ throw new WPRProtectRuleError_V676(
254	259	$this->addExState("UndefinedFunctionCall: " . $stmt["name"])
255	260	);
256	261	}
257	262
258	263	if (!array_key_exists('args', $stmt) || !is_array($stmt['args'])) {
259		- throw new WPRProtectRuleError_V648(
	264	+ throw new WPRProtectRuleError_V676(
260	265	$this->addExState("InvalidArguments: Malformed args")
261	266	);
262	267	}
263	268
		@@ -268,9 +273,9 @@
268	273
269	274	$return_val = self::toAllowedType(call_user_func_array($handler, $args));
270	275	break;
271	276	default:
272		- throw new WPRProtectRuleError_V648(
	277	+ throw new WPRProtectRuleError_V676(
273	278	$this->addExState("UnknownOperation: -")
274	279	);
275	280	}
276	281
		@@ -279,9 +284,9 @@
279	284	}
280	285
281	286	private function processRuleFunctionParams($func_name, $args_cnt, $args, $required_params = 0, $param_types = array()) {
282	287	if (($args_cnt < $required_params)) {
283		- throw new WPRProtectRuleError_V648(
	288	+ throw new WPRProtectRuleError_V676(
284	289	$this->addExState("ArgumentCountError: Too few arguments for " . $func_name)
285	290	);
286	291	}
287	292
		@@ -286,9 +291,9 @@
286	291	}
287	292
288	293	foreach ($param_types as $pos => $type) {
289	294	if (!is_int($pos)) {
290		- throw new WPRProtectRuleError_V648(
	295	+ throw new WPRProtectRuleError_V676(
291	296	$this->addExState("InvalidParamType: " . $pos)
292	297	);
293	298	}
294	299
		@@ -294,9 +299,9 @@
294	299
295	300	switch ($type) {
296	301	case "string":
297	302	if (!isset($args[$pos]) || !is_string($args[$pos])) {
298		- throw new WPRProtectRuleError_V648(
	303	+ throw new WPRProtectRuleError_V676(
299	304	$this->addExState("TypeError: " . $func_name . " param at " . $pos . " is not a string.")
300	305	);
301	306	}
302	307	break;
		@@ -301,9 +306,9 @@
301	306	}
302	307	break;
303	308	case 'integer':
304	309	if (!isset($args[$pos]) || !is_int($args[$pos])) {
305		- throw new WPRProtectRuleError_V648(
	310	+ throw new WPRProtectRuleError_V676(
306	311	$this->addExState("TypeError: " . $func_name . " param at " . $pos . " is not a integer.")
307	312	);
308	313	}
309	314	break;
		@@ -308,9 +313,9 @@
308	313	}
309	314	break;
310	315	case 'double':
311	316	if (!isset($args[$pos]) || !is_double($args[$pos])) {
312		- throw new WPRProtectRuleError_V648(
	317	+ throw new WPRProtectRuleError_V676(
313	318	$this->addExState("TypeError: " . $func_name . " param at " . $pos . " is not a double.")
314	319	);
315	320	}
316	321	break;
		@@ -315,9 +320,9 @@
315	320	}
316	321	break;
317	322	case 'boolean':
318	323	if (!isset($args[$pos]) || !is_bool($args[$pos])) {
319		- throw new WPRProtectRuleError_V648(
	324	+ throw new WPRProtectRuleError_V676(
320	325	$this->addExState("TypeError: " . $func_name . " param at " . $pos . " is not a boolean.")
321	326	);
322	327	}
323	328	break;
		@@ -322,9 +327,9 @@
322	327	}
323	328	break;
324	329	case 'array':
325	330	if (!isset($args[$pos]) || !is_array($args[$pos])) {
326		- throw new WPRProtectRuleError_V648(
	331	+ throw new WPRProtectRuleError_V676(
327	332	$this->addExState("TypeError: " . $func_name . " param at " . $pos . " is not an array.")
328	333	);
329	334	}
330	335	break;
		@@ -330,9 +335,9 @@
330	335	break;
331	336	case 'mixed':
332	337	break;
333	338	default:
334		- throw new WPRProtectRuleError_V648(
	339	+ throw new WPRProtectRuleError_V676(
335	340	$this->addExState("InvalidParamTypeError: Invalid type at " . $pos . " for " . $func_name)
336	341	);
337	342	}
338	343	}
		@@ -339,5 +344,5 @@
339	344
340	345	return $args;
341	346	}
342	347	}
343		-endif;
	348	+endif;