← All changes | callback/streams.php +27 -11 5.22 → trunk View file →

		@@ -1,10 +1,17 @@
1	1	<?php
2		-
	2	+// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fread
	3	+// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fwrite
	4	+// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fsockopen
	5	+// We use php method like fread, fwrite to read only a portion of a file, we don't have a direct method for partial reads since WP_Filesystem doesn't support a direct equivalent to fread, fwrite.
	6	+// The entire file deals with custom stream handling
	7	+// We need direct socket/file operations for this functionality
	8	+// WordPress filesystem alternatives wouldn't work for this use case
	9	+// It's better to disable these specific rules at file level than adding individual ignore comments
3	10	if (!defined('ABSPATH')) exit;
4		-if (!class_exists('BVRespStream')) :
	11	+if (!class_exists('WPRRespStream')) :
5	12
6		- class BVStream extends BVCallbackBase {
	13	+ class WPRStream extends WPRCallbackBase {
7	14	public $bvb64stream;
8	15	public $bvb64cksize;
9	16	public $checksum;
10	17
		@@ -19,11 +26,11 @@
19	26
20	27	public static function startStream($account, $request) {
21	28	$result = array();
22	29	$params = $request->params;
23		- $stream = new BVRespStream($request);
	30	+ $stream = new WPRRespStream($request);
24	31	if ($request->isAPICall()) {
25		- $stream = new BVHttpStream($request);
	32	+ $stream = new WPRHttpStream($request);
26	33	if (!$stream->connect()) {
27	34	$apicallstatus = array(
28	35	"httperror" => "Cannot Open Connection to Host",
29	36	"streamerrno" => $stream->errno,
		@@ -67,25 +74,33 @@
67	74	}
68	75	}
69	76	}
70	77
71		-class BVRespStream extends BVStream {
	78	+class WPRRespStream extends WPRStream {
	79	+ public $bvboundry;
	80	+
72	81	function __construct($request) {
73	82	parent::__construct($request);
	83	+ // Restrict boundary to safe chars so raw echo cannot inject into response (XSS).
	84	+ $raw = isset($request->bvboundry) ? (string) $request->bvboundry : '';
	85	+ $sanitized = preg_replace('/[^a-zA-Z0-9_-]/', '', $raw);
	86	+ $this->bvboundry = $sanitized !== '' ? $sanitized : 'bvstream';
74	87	}
75	88
76	89	public function writeChunk($chunk) {
77		- echo "ckckckckck".$chunk."ckckckckck";
	90	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- bvboundry sanitized in constructor; raw stream protocol (not HTML), chunk must not be escaped or stream is corrupted
	91	+ echo $this->bvboundry . "ckckckckck" . $chunk . $this->bvboundry . "ckckckckck";
78	92	}
79	93	public function endStream() {
80		- echo "rerererere";
	94	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- bvboundry sanitized in constructor; raw stream protocol (not HTML)
	95	+ echo $this->bvboundry . "rerererere";
81	96
82	97	return array();
83	98	}
84	99	}
85	100
86		-class BVHttpStream extends BVStream {
87		- var $user_agent = 'BVHttpStream';
	101	+class WPRHttpStream extends WPRStream {
	102	+ var $user_agent = 'WPRHttpStream';
88	103	var $host;
89	104	var $port;
90	105	var $timeout = 20;
91	106	var $conn;
		@@ -165,9 +180,9 @@
165	180	$mph = array(
166	181	"Content-Disposition" => "form-data; name=bvinfile; filename=data",
167	182	"Content-Type" => "application/octet-stream"
168	183	);
169		- $rnd = rand(100000, 999999);
	184	+ $rnd = rand(100000, 999999); // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_rand
170	185	$this->boundary = "----".$rnd;
171	186	$prologue = "--".$this->boundary."\r\n";
172	187	foreach($mph as $key=>$val) {
173	188	$prologue .= $key.":".$val."\r\n";
		@@ -240,5 +255,6 @@
240	255	}
241	256	return $response;
242	257	}
243	258	}
	259	+// phpcs:enable
244	260	endif;