edb/studio-2013
Archived
9
0 Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

Updates bonanza

Browse Source
This commit is contained in:
nikolark committed 2014-07-24 14:38:32 +02:00
1 parent d26191c9f8
commit 9d480fc3c5
1366 files changed
+220321 -90180
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

wp-includes/http.php
+200 -16
View File
@@ -28,6 +28,90 @@ function _wp_http_get_object() {
return $http;
}
/**
* Retrieve the raw response from a safe HTTP request.
*
* This function is ideal when the HTTP request is being made to an arbitrary
* URL. The URL is validated to avoid redirection and request forgery attacks.
*
* @see wp_remote_request() For more information on the response array format
* and default arguments.
*
* @since 3.6.0
*
* @param string $url Site URL to retrieve.
* @param array $args Optional. Override the defaults.
* @return WP_Error|array The response or WP_Error on failure.
*/
function wp_safe_remote_request( $url, $args = array() ) {
$args['reject_unsafe_urls'] = true;
$http = _wp_http_get_object();
return $http->request( $url, $args );
}
/**
* Retrieve the raw response from a safe HTTP request using the GET method.
*
* This function is ideal when the HTTP request is being made to an arbitrary
* URL. The URL is validated to avoid redirection and request forgery attacks.
*
* @see wp_remote_request() For more information on the response array format
* and default arguments.
*
* @since 3.6.0
*
* @param string $url Site URL to retrieve.
* @param array $args Optional. Override the defaults.
* @return WP_Error|array The response or WP_Error on failure.
*/
function wp_safe_remote_get( $url, $args = array() ) {
$args['reject_unsafe_urls'] = true;
$http = _wp_http_get_object();
return $http->get( $url, $args );
}
/**
* Retrieve the raw response from a safe HTTP request using the POST method.
*
* This function is ideal when the HTTP request is being made to an arbitrary
* URL. The URL is validated to avoid redirection and request forgery attacks.
*
* @see wp_remote_request() For more information on the response array format
* and default arguments.
*
* @since 3.6.0
*
* @param string $url Site URL to retrieve.
* @param array $args Optional. Override the defaults.
* @return WP_Error|array The response or WP_Error on failure.
*/
function wp_safe_remote_post( $url, $args = array() ) {
$args['reject_unsafe_urls'] = true;
$http = _wp_http_get_object();
return $http->post( $url, $args );
}
/**
* Retrieve the raw response from a safe HTTP request using the HEAD method.
*
* This function is ideal when the HTTP request is being made to an arbitrary
* URL. The URL is validated to avoid redirection and request forgery attacks.
*
* @see wp_remote_request() For more information on the response array format
* and default arguments.
*
* @since 3.6.0
*
* @param string $url Site URL to retrieve.
* @param array $args Optional. Override the defaults.
* @return WP_Error|array The response or WP_Error on failure.
*/
function wp_safe_remote_head( $url, $args = array() ) {
$args['reject_unsafe_urls'] = true;
$http = _wp_http_get_object();
return $http->head( $url, $args );
}
/**
* Retrieve the raw response from the HTTP request.
*
@@ -49,6 +133,25 @@ function _wp_http_get_object() {
* This function is called first to make the request and there are other API
* functions to abstract out the above convoluted setup.
*
* List of default arguments:
* 'method' => 'GET'
* - Default 'GET' for wp_remote_get()
* - Default 'POST' for wp_remote_post()
* - Default 'HEAD' for wp_remote_head()
* 'timeout' => 5
* 'redirection' => 5
* 'httpversion' => '1.0'
* 'user-agent' => 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' )
* 'blocking' => true
* 'headers' => array()
* 'cookies' => array()
* 'body' => null
* 'compress' => false,
* 'decompress' => true,
* 'sslverify' => true,
* 'stream' => false,
* 'filename' => null
*
* @since 2.7.0
*
* @param string $url Site URL to retrieve.
@@ -63,7 +166,7 @@ function wp_remote_request($url, $args = array()) {
/**
* Retrieve the raw response from the HTTP request using the GET method.
*
* @see wp_remote_request() For more information on the response array format.
* @see wp_remote_request() For more information on the response array format and default arguments.
*
* @since 2.7.0
*
@@ -79,7 +182,7 @@ function wp_remote_get($url, $args = array()) {
/**
* Retrieve the raw response from the HTTP request using the POST method.
*
* @see wp_remote_request() For more information on the response array format.
* @see wp_remote_request() For more information on the response array format and default arguments.
*
* @since 2.7.0
*
@@ -95,7 +198,7 @@ function wp_remote_post($url, $args = array()) {
/**
* Retrieve the raw response from the HTTP request using the HEAD method.
*
* @see wp_remote_request() For more information on the response array format.
* @see wp_remote_request() For more information on the response array format and default arguments.
*
* @since 2.7.0
*
@@ -235,11 +338,18 @@ function get_http_origin() {
if ( ! empty ( $_SERVER[ 'HTTP_ORIGIN' ] ) )
$origin = $_SERVER[ 'HTTP_ORIGIN' ];
/**
* Change the origin of an HTTP request.
*
* @since 3.4.0
*
* @param string $origin The original origin for the request.
*/
return apply_filters( 'http_origin', $origin );
}
/**
* Retrieve list of allowed http origins.
* Retrieve list of allowed HTTP origins.
*
* @since 3.4.0
*
@@ -257,11 +367,24 @@ function get_allowed_http_origins() {
'https://' . $home_origin[ 'host' ],
) );
/**
* Change the origin types allowed for HTTP requests.
*
* @since 3.4.0
*
* @param array $allowed_origins {
* Default allowed HTTP origins.
* @type string Non-secure URL for admin origin.
* @type string Secure URL for admin origin.
* @type string Non-secure URL for home origin.
* @type string Secure URL for home origin.
* }
*/
return apply_filters( 'allowed_http_origins' , $allowed_origins );
}
/**
* Determines if the http origin is an authorized one.
* Determines if the HTTP origin is an authorized one.
*
* @since 3.4.0
*
@@ -277,6 +400,14 @@ function is_allowed_http_origin( $origin = null ) {
if ( $origin && ! in_array( $origin, get_allowed_http_origins() ) )
$origin = '';
/**
* Change the allowed HTTP origin result.
*
* @since 3.4.0
*
* @param string $origin Result of check for allowed origin.
* @param string $origin_arg original origin string passed into is_allowed_http_origin function.
*/
return apply_filters( 'allowed_http_origin', $origin, $origin_arg );
}
@@ -320,12 +451,12 @@ function send_origin_headers() {
* @return mixed URL or false on failure.
*/
function wp_http_validate_url( $url ) {
$url = esc_url_raw( $url, array( 'http', 'https' ) );
$url = wp_kses_bad_protocol( $url, array( 'http', 'https' ) );
if ( ! $url )
return false;
$parsed_url = @parse_url( $url );
if ( ! $parsed_url )
if ( ! $parsed_url || empty( $parsed_url['host'] ) )
return false;
if ( isset( $parsed_url['user'] ) || isset( $parsed_url['pass'] ) )
@@ -348,15 +479,27 @@ function wp_http_validate_url( $url ) {
$ip = false;
}
if ( $ip ) {
if ( '127.0.0.1' === $ip )
return false;
$parts = array_map( 'intval', explode( '.', $ip ) );
if ( 10 === $parts[0] )
return false;
if ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
return false;
if ( 192 === $parts[0] && 168 === $parts[1] )
return false;
if ( '127.0.0.1' === $ip
|| ( 10 === $parts[0] )
|| ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
|| ( 192 === $parts[0] && 168 === $parts[1] )
) {
// If host appears local, reject unless specifically allowed.
/**
* Check if HTTP request is external or not.
*
* Allows to change and allow external requests for the HTTP request.
*
* @since 3.6.0
*
* @param bool false Whether HTTP request is external or not.
* @param string $host IP of the requested host.
* @param string $url URL of the requested host.
*/
if ( ! apply_filters( 'http_request_host_is_external', false, $host, $url ) )
return false;
}
}
}
@@ -367,8 +510,49 @@ function wp_http_validate_url( $url ) {
if ( 80 === $port || 443 === $port || 8080 === $port )
return $url;
if ( $parsed_home && $same_host && $parsed_home['port'] === $port )
if ( $parsed_home && $same_host && isset( $parsed_home['port'] ) && $parsed_home['port'] === $port )
return $url;
return false;
}
/**
* Whitelists allowed redirect hosts for safe HTTP requests as well.
*
* Attached to the http_request_host_is_external filter.
*
* @since 3.6.0
*
* @param bool $is_external
* @param string $host
* @return bool
*/
function allowed_http_request_hosts( $is_external, $host ) {
if ( ! $is_external && wp_validate_redirect( 'http://' . $host ) )
$is_external = true;
return $is_external;
}
/**
* Whitelists any domain in a multisite installation for safe HTTP requests.
*
* Attached to the http_request_host_is_external filter.
*
* @since 3.6.0
*
* @param bool $is_external
* @param string $host
* @return bool
*/
function ms_allowed_http_request_hosts( $is_external, $host ) {
global $wpdb;
static $queried = array();
if ( $is_external )
return $is_external;
if ( $host === get_current_site()->domain )
return true;
if ( isset( $queried[ $host ] ) )
return $queried[ $host ];
$queried[ $host ] = (bool) $wpdb->get_var( $wpdb->prepare( "SELECT domain FROM $wpdb->blogs WHERE domain = %s LIMIT 1", $host ) );
return $queried[ $host ];
}