← All changes | callback/streams.php +40 -21 5.16 → trunk View file →

		@@ -1,10 +1,17 @@
1	1	<?php
2		-
	2	+// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fread
	3	+// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fwrite
	4	+// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fsockopen
	5	+// We use php method like fread, fwrite to read only a portion of a file, we don't have a direct method for partial reads since WP_Filesystem doesn't support a direct equivalent to fread, fwrite.
	6	+// The entire file deals with custom stream handling
	7	+// We need direct socket/file operations for this functionality
	8	+// WordPress filesystem alternatives wouldn't work for this use case
	9	+// It's better to disable these specific rules at file level than adding individual ignore comments
3	10	if (!defined('ABSPATH')) exit;
4		-if (!class_exists('BVRespStream')) :
	11	+if (!class_exists('WPRRespStream')) :
5	12
6		- class BVStream extends BVCallbackBase {
	13	+ class WPRStream extends WPRCallbackBase {
7	14	public $bvb64stream;
8	15	public $bvb64cksize;
9	16	public $checksum;
10	17
		@@ -19,11 +26,11 @@
19	26
20	27	public static function startStream($account, $request) {
21	28	$result = array();
22	29	$params = $request->params;
23		- $stream = new BVRespStream($request);
	30	+ $stream = new WPRRespStream($request);
24	31	if ($request->isAPICall()) {
25		- $stream = new BVHttpStream($request);
	32	+ $stream = new WPRHttpStream($request);
26	33	if (!$stream->connect()) {
27	34	$apicallstatus = array(
28	35	"httperror" => "Cannot Open Connection to Host",
29	36	"streamerrno" => $stream->errno,
		@@ -44,45 +51,56 @@
44	51	}
45	52	return array('stream' => $stream);
46	53	}
47	54
48		- public function writeStream($_string) {
49		- if (strlen($_string) > 0) {
50		- $chunk = "";
	55	+ public function writeStream($chunk) {
	56	+ if (strlen($chunk) > 0) {
	57	+ $bvb64_prefix = "";
51	58	if ($this->bvb64stream) {
52	59	$chunk_size = $this->bvb64cksize;
53		- $_string = $this->base64Encode($_string, $chunk_size);
54		- $chunk .= "BVB64" . ":";
	60	+ $chunk = $this->base64Encode($chunk, $chunk_size);
	61	+ $bvb64_prefix .= "BVB64" . ":";
55	62	}
56		- $chunk .= (strlen($_string) . ":" . $_string);
	63	+
	64	+ $hash_prefix = "";
57	65	if ($this->checksum == 'crc32') {
58		- $chunk = "CRC32" . ":" . crc32($_string) . ":" . $chunk;
	66	+ $hash_prefix .= "CRC32" . ":" . crc32($chunk) . ":";
59	67	} else if ($this->checksum == 'md5') {
60		- $chunk = "MD5" . ":" . md5($_string) . ":" . $chunk;
	68	+ $hash_prefix .= "MD5" . ":" . md5($chunk) . ":";
61	69	}
	70	+
	71	+ $chunk = $hash_prefix . $bvb64_prefix . strlen($chunk) . ":" . $chunk;
	72	+
62	73	$this->writeChunk($chunk);
63	74	}
64	75	}
65	76	}
66	77
67		-class BVRespStream extends BVStream {
	78	+class WPRRespStream extends WPRStream {
	79	+ public $bvboundry;
	80	+
68	81	function __construct($request) {
69	82	parent::__construct($request);
	83	+ // Restrict boundary to safe chars so raw echo cannot inject into response (XSS).
	84	+ $raw = isset($request->bvboundry) ? (string) $request->bvboundry : '';
	85	+ $sanitized = preg_replace('/[^a-zA-Z0-9_-]/', '', $raw);
	86	+ $this->bvboundry = $sanitized !== '' ? $sanitized : 'bvstream';
70	87	}
71	88
72		- public function writeChunk($_string) {
73		- echo "ckckckckck".$_string."ckckckckck";
	89	+ public function writeChunk($chunk) {
	90	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- bvboundry sanitized in constructor; raw stream protocol (not HTML), chunk must not be escaped or stream is corrupted
	91	+ echo $this->bvboundry . "ckckckckck" . $chunk . $this->bvboundry . "ckckckckck";
74	92	}
75		-
76	93	public function endStream() {
77		- echo "rerererere";
	94	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- bvboundry sanitized in constructor; raw stream protocol (not HTML)
	95	+ echo $this->bvboundry . "rerererere";
78	96
79	97	return array();
80	98	}
81	99	}
82	100
83		-class BVHttpStream extends BVStream {
84		- var $user_agent = 'BVHttpStream';
	101	+class WPRHttpStream extends WPRStream {
	102	+ var $user_agent = 'WPRHttpStream';
85	103	var $host;
86	104	var $port;
87	105	var $timeout = 20;
88	106	var $conn;
		@@ -162,9 +180,9 @@
162	180	$mph = array(
163	181	"Content-Disposition" => "form-data; name=bvinfile; filename=data",
164	182	"Content-Type" => "application/octet-stream"
165	183	);
166		- $rnd = rand(100000, 999999);
	184	+ $rnd = rand(100000, 999999); // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_rand
167	185	$this->boundary = "----".$rnd;
168	186	$prologue = "--".$this->boundary."\r\n";
169	187	foreach($mph as $key=>$val) {
170	188	$prologue .= $key.":".$val."\r\n";
		@@ -237,5 +255,6 @@
237	255	}
238	256	return $response;
239	257	}
240	258	}
	259	+// phpcs:enable
241	260	endif;