Index: http.php =================================================================== --- http.php (revision 10621) +++ http.php (working copy) @@ -13,159 +13,26 @@ */ /** - * Implementation for deflate and gzip transfer encodings. - * - * Includes RFC 1950, RFC 1951, and RFC 1952. - * - * @since unknown - * @package WordPress - * @subpackage HTTP - */ -class WP_Http_Encoding { - - /** - * Compress raw string using the deflate format. - * - * Supports the RFC 1951 standard. - * - * @since unknown - * - * @param string $raw String to compress. - * @param int $level Optional, default is 9. Compression level, 9 is highest. - * @param string $supports Optional, not used. When implemented it will choose the right compression based on what the server supports. - * @return string|bool False on failure. - */ - function compress( $raw, $level = 9, $supports = null ) { - return gzdeflate( $raw, $level ); - } - - /** - * Decompression of deflated string. - * - * Will attempt to decompress using the RFC 1950 standard, and if that fails - * then the RFC 1951 standard deflate will be attempted. Finally, the RFC - * 1952 standard gzip decode will be attempted. If all fail, then the - * original compressed string will be returned. - * - * @since unknown - * - * @param string $compressed String to decompress. - * @param int $length The optional length of the compressed data. - * @return string|bool False on failure. - */ - function decompress( $compressed, $length = null ) { - $decompressed = gzinflate( $compressed ); - - if( false !== $decompressed ) - return $decompressed; - - $decompressed = gzuncompress( $compressed ); - - if( false !== $decompressed ) - return $decompressed; - - $decompressed = gzdecode( $compressed ); - - if( false !== $decompressed ) - return $decompressed; - - return $compressed; - } - - /** - * What encoding types to accept and their priority values. - * - * @since unknown - * - * @return string Types of encoding to accept. - */ - function accept_encoding() { - $type = array(); - if( function_exists( 'gzinflate' ) ) - $type[] = 'deflate;q=1.0'; - - if( function_exists( 'gzuncompress' ) ) - $type[] = 'compress;q=0.5'; - - if( function_exists( 'gzdecode' ) ) - $type[] = 'gzip;q=0.5'; - - return implode(', ', $type); - } - - /** - * What enconding the content used when it was compressed to send in the headers. - * - * @since unknown - * - * @return string Content-Encoding string to send in the header. - */ - function content_encoding() { - return 'deflate'; - } - - /** - * Whether the content be decoded based on the headers. - * - * @since unknown - * - * @param array|string $headers All of the available headers. - * @return bool - */ - function should_decode($headers) { - if( is_array( $headers ) ) { - if( array_key_exists('content-encoding', $headers) && ! empty( $headers['content-encoding'] ) ) - return true; - } else if( is_string( $headers ) ) { - return ( stripos($headers, 'content-encoding:') !== false ); - } - - return false; - } - - /** - * Whether decompression and compression are supported by the PHP version. - * - * Each function is tested instead of checking for the zlib extension, to - * ensure that the functions all exist in the PHP version and aren't - * disabled. - * - * @since unknown - * - * @return bool - */ - function is_available() { - return ( function_exists('gzuncompress') || function_exists('gzdeflate') || - function_exists('gzinflate') ); - } -} - -/** * WordPress HTTP Class for managing HTTP Transports and making HTTP requests. * - * This class is called for the functionality of making HTTP requests and should - * replace Snoopy functionality, eventually. There is no available functionality - * to add HTTP transport implementations, since most of the HTTP transports are - * added and available for use. + * This class is called for the functionality of making HTTP requests and should replace Snoopy + * functionality, eventually. There is no available functionality to add HTTP transport + * implementations, since most of the HTTP transports are added and available for use. * - * The exception is that cURL is not available as a transport and lacking an - * implementation. It will be added later and should be a patch on the WordPress - * Trac. + * The exception is that cURL is not available as a transport and lacking an implementation. It will + * be added later and should be a patch on the WordPress Trac. * - * There are no properties, because none are needed and for performance reasons. - * Some of the functions are static and while they do have some overhead over - * functions in PHP4, the purpose is maintainability. When PHP5 is finally the - * requirement, it will be easy to add the static keyword to the code. It is not - * as easy to convert a function to a method after enough code uses the old way. + * There are no properties, because none are needed and for performance reasons. Some of the + * functions are static and while they do have some overhead over functions in PHP4, the purpose is + * maintainability. When PHP5 is finally the requirement, it will be easy to add the static keyword + * to the code. It is not as easy to convert a function to a method after enough code uses the old + * way. * - * Debugging includes several actions, which pass different variables for - * debugging the HTTP API. + * Debugging includes several actions, which pass different variables for debugging the HTTP API. * - * http_transport_get_debug - gives working, nonblocking, and - * blocking transports. + * http_transport_get_debug - gives working, nonblocking, and blocking transports. * - * http_transport_post_debug - gives working, nonblocking, and - * blocking transports. + * http_transport_post_debug - gives working, nonblocking, and blocking transports. * * @package WordPress * @subpackage HTTP @@ -228,19 +95,19 @@ static $working_transport, $blocking_transport, $nonblocking_transport; if ( is_null($working_transport) ) { - if ( true === WP_Http_ExtHttp::test() && apply_filters('use_http_extension_transport', true) ) { + if ( true === WP_Http_ExtHttp::test() ) { $working_transport['exthttp'] = new WP_Http_ExtHttp(); $blocking_transport[] = &$working_transport['exthttp']; - } else if ( true === WP_Http_Curl::test() && apply_filters('use_curl_transport', true) ) { + } else if ( true === WP_Http_Curl::test() ) { $working_transport['curl'] = new WP_Http_Curl(); $blocking_transport[] = &$working_transport['curl']; - } else if ( true === WP_Http_Streams::test() && apply_filters('use_streams_transport', true) ) { + } else if ( true === WP_Http_Streams::test() ) { $working_transport['streams'] = new WP_Http_Streams(); $blocking_transport[] = &$working_transport['streams']; - } else if ( true === WP_Http_Fopen::test() && apply_filters('use_fopen_transport', true) && ( isset($args['ssl']) && !$args['ssl'] ) ) { + } else if ( true === WP_Http_Fopen::test() && ( isset($args['ssl']) && !$args['ssl'] ) ) { $working_transport['fopen'] = new WP_Http_Fopen(); $blocking_transport[] = &$working_transport['fopen']; - } else if ( true === WP_Http_Fsockopen::test() && apply_filters('use_fsockopen_transport', true) && ( isset($args['ssl']) && !$args['ssl'] ) ) { + } else if ( true === WP_Http_Fsockopen::test() && ( isset($args['ssl']) && !$args['ssl'] ) ) { $working_transport['fsockopen'] = new WP_Http_Fsockopen(); $blocking_transport[] = &$working_transport['fsockopen']; } @@ -279,16 +146,16 @@ static $working_transport, $blocking_transport, $nonblocking_transport; if ( is_null($working_transport) ) { - if ( true === WP_Http_ExtHttp::test() && apply_filters('use_http_extension_transport', true) ) { + if ( true === WP_Http_ExtHttp::test() ) { $working_transport['exthttp'] = new WP_Http_ExtHttp(); $blocking_transport[] = &$working_transport['exthttp']; - } else if ( true === WP_Http_Curl::test() && apply_filters('use_curl_transport', true) ) { + } else if ( true === WP_Http_Curl::test() ) { $working_transport['curl'] = new WP_Http_Curl(); $blocking_transport[] = &$working_transport['curl']; - } else if ( true === WP_Http_Streams::test() && apply_filters('use_streams_transport', true) ) { + } else if ( true === WP_Http_Streams::test() ) { $working_transport['streams'] = new WP_Http_Streams(); $blocking_transport[] = &$working_transport['streams']; - } else if ( true === WP_Http_Fsockopen::test() && apply_filters('use_fsockopen_transport', true) && ( isset($args['ssl']) && !$args['ssl'] ) ) { + } else if ( true === WP_Http_Fsockopen::test() && ( isset($args['ssl']) && !$args['ssl'] ) ) { $working_transport['fsockopen'] = new WP_Http_Fsockopen(); $blocking_transport[] = &$working_transport['fsockopen']; } @@ -311,40 +178,35 @@ /** * Send a HTTP request to a URI. * - * The body and headers are part of the arguments. The 'body' argument is - * for the body and will accept either a string or an array. The 'headers' - * argument should be an array, but a string is acceptable. If the 'body' - * argument is an array, then it will automatically be escaped using - * http_build_query(). + * The body and headers are part of the arguments. The 'body' argument is for the body and will + * accept either a string or an array. The 'headers' argument should be an array, but a string + * is acceptable. If the 'body' argument is an array, then it will automatically be escaped + * using http_build_query(). * - * The only URI that are supported in the HTTP Transport implementation are - * the HTTP and HTTPS protocols. HTTP and HTTPS are assumed so the server - * might not know how to handle the send headers. Other protocols are - * unsupported and most likely will fail. + * The only URI that are supported in the HTTP Transport implementation are the HTTP and HTTPS + * protocols. HTTP and HTTPS are assumed so the server might not know how to handle the send + * headers. Other protocols are unsupported and most likely will fail. * - * The defaults are 'method', 'timeout', 'redirection', 'httpversion', - * 'blocking' and 'user-agent'. + * The defaults are 'method', 'timeout', 'redirection', 'httpversion', 'blocking' and + * 'user-agent'. * - * Accepted 'method' values are 'GET', 'POST', and 'HEAD', some transports - * technically allow others, but should not be assumed. The 'timeout' is - * used to sent how long the connection should stay open before failing when - * no response. 'redirection' is used to track how many redirects were taken - * and used to sent the amount for other transports, but not all transports + * Accepted 'method' values are 'GET', 'POST', and 'HEAD', some transports technically allow + * others, but should not be assumed. The 'timeout' is used to sent how long the connection + * should stay open before failing when no response. 'redirection' is used to track how many + * redirects were taken and used to sent the amount for other transports, but not all transports * accept setting that value. * - * The 'httpversion' option is used to sent the HTTP version and accepted - * values are '1.0', and '1.1' and should be a string. Version 1.1 is not - * supported, because of chunk response. The 'user-agent' option is the - * user-agent and is used to replace the default user-agent, which is + * The 'httpversion' option is used to sent the HTTP version and accepted values are '1.0', and + * '1.1' and should be a string. Version 1.1 is not supported, because of chunk response. The + * 'user-agent' option is the user-agent and is used to replace the default user-agent, which is * 'WordPress/WP_Version', where WP_Version is the value from $wp_version. * - * 'blocking' is the default, which is used to tell the transport, whether - * it should halt PHP while it performs the request or continue regardless. - * Actually, that isn't entirely correct. Blocking mode really just means - * whether the fread should just pull what it can whenever it gets bytes or - * if it should wait until it has enough in the buffer to read or finishes - * reading the entire content. It doesn't actually always mean that PHP will - * continue going after making the request. + * 'blocking' is the default, which is used to tell the transport, whether it should halt PHP + * while it performs the request or continue regardless. Actually, that isn't entirely correct. + * Blocking mode really just means whether the fread should just pull what it can whenever it + * gets bytes or if it should wait until it has enough in the buffer to read or finishes reading + * the entire content. It doesn't actually always mean that PHP will continue going after making + * the request. * * @access public * @since 2.7.0 @@ -376,6 +238,9 @@ $arrURL = parse_url($url); + if ( $this->block_request( $url ) ) + return new WP_Error('http_request_failed', 'User has blocked requests through HTTP.'); + // Determine if this is a https call and pass that on to the transport functions // so that we can blacklist the transports that do not support ssl verification if ( $arrURL['scheme'] == 'https' || $arrURL['scheme'] == 'ssl' ) @@ -400,7 +265,7 @@ $r['user-agent'] = $r['headers']['user-agent']; unset($r['headers']['user-agent']); } - + // Construct Cookie: header if any cookies are set WP_Http::buildCookieHeader( $r ); @@ -514,9 +379,8 @@ /** * Transform header string into an array. * - * If an array is given then it is assumed to be raw header data with - * numeric keys with the headers as the values. No headers must be passed - * that were already processed. + * If an array is given then it is assumed to be raw header data with numeric keys with the + * headers as the values. No headers must be passed that were already processed. * * @access public * @static @@ -561,14 +425,16 @@ return array('response' => $response, 'headers' => $newheaders, 'cookies' => $cookies); } - + /** * Takes the arguments for a ::request() and checks for the cookie array. - * If it's found, then it's assumed to contain WP_Http_Cookie objects, which - * are each parsed into strings and added to the Cookie: header (within the - * arguments array). Edits the array by reference. * + * If it's found, then it's assumed to contain WP_Http_Cookie objects, which are each parsed + * into strings and added to the Cookie: header (within the arguments array). Edits the array by + * reference. + * * @access public + * @version 2.8.0 * @static * * @param array $r Full array of args passed into ::request() @@ -583,13 +449,12 @@ $r['headers']['cookie'] = $cookies_header; } } - + /** * Decodes chunk transfer-encoding, based off the HTTP 1.1 specification. * - * Based off the HTTP http_encoding_dechunk function. Does not support - * UTF-8. Does not support returning footer headers. Shouldn't be too - * difficult to support it though. + * Based off the HTTP http_encoding_dechunk function. Does not support UTF-8. Does not support + * returning footer headers. Shouldn't be too difficult to support it though. * * @todo Add support for footer chunked headers. * @access public @@ -630,13 +495,60 @@ } } } + + /** + * Block requests through the proxy. + * + * Those who are behind a proxy and want to prevent access to certain hosts may do so. This will + * prevent plugins from working and core functionality, if you don't include api.wordpress.org. + * + * You block external URL requests by defining WP_HTTP_BLOCK_EXTERNAL in your wp-config.php file + * and this will only allow localhost and your blog to make requests. The constant + * WP_ACCESSABLE_HOSTS will allow additional hosts to go through for requests. + * + * @since unknown + * @link http://core.trac.wordpress.org/ticket/8927 Allow preventing external requests. + * + * @param string $uri URI of url. + * @return bool True to block, false to allow. + */ + function block_request($uri) { + // We don't need to block requests, because nothing is blocked. + if ( ! defined('WP_HTTP_BLOCK_EXTERNAL') || ( defined('WP_HTTP_BLOCK_EXTERNAL') && WP_HTTP_BLOCK_EXTERNAL == false ) ) + return false; + + // parse_url() only handles http, https type URLs, and will emit E_WARNING on failure. + // This will be displayed on blogs, which is not reasonable. + $check = @parse_url($uri); + + /* Malformed URL, can not process, but this could mean ssl, so let through anyway. + * + * This isn't very security sound. There are instances where a hacker might attempt + * to bypass the proxy and this check. However, the reason for this behavior is that + * WordPress does not do any checking currently for non-proxy requests, so it is keeps with + * the default unsecure nature of the HTTP request. + */ + if ( $check === false ) + return false; + + $home = parse_url( get_bloginfo('site_url') ); + + if ( $uri == 'localhost' || $uri == $home['host'] ) + return false; + + if ( defined('WP_ACCESSABLE_HOSTS') && is_array( WP_ACCESSABLE_HOSTS ) && in_array( $check['host'], WP_ACCESSABLE_HOSTS ) ) { + return false; + } + + return true; + } } /** * HTTP request method uses fsockopen function to retrieve the url. * - * This would be the preferred method, but the fsockopen implementation has the - * most overhead of all the HTTP transport implementations. + * This would be the preferred method, but the fsockopen implementation has the most overhead of all + * the HTTP transport implementations. * * @package WordPress * @subpackage HTTP @@ -696,8 +608,8 @@ $arrURL['port'] = apply_filters('http_request_port', $arrURL['port']); } - // There are issues with the HTTPS and SSL protocols that cause errors - // that can be safely ignored and should be ignored. + // There are issues with the HTTPS and SSL protocols that cause errors that can be safely + // ignored and should be ignored. if ( true === $secure_transport ) $error_reporting = error_reporting(0); @@ -710,8 +622,8 @@ $endDelay = time(); - // If the delay is greater than the timeout then fsockopen should't be - // used, because it will cause a long delay. + // If the delay is greater than the timeout then fsockopen should't be used, because it will + // cause a long delay. $elapseDelay = ($endDelay-$startDelay) > $r['timeout']; if ( true === $elapseDelay ) add_option( 'disable_fsockopen', $endDelay, null, true ); @@ -719,8 +631,8 @@ if ( false === $handle ) return new WP_Error('http_request_failed', $iError . ': ' . $strError); - // WordPress supports PHP 4.3, which has this function. Removed sanity - // checking for performance reasons. + // WordPress supports PHP 4.3, which has this function. Removed sanity checking for + // performance reasons. stream_set_timeout($handle, $r['timeout'] ); $requestPath = $arrURL['path'] . ( isset($arrURL['query']) ? '?' . $arrURL['query'] : '' ); @@ -798,7 +710,7 @@ if ( false !== ($option = get_option( 'disable_fsockopen' )) && time()-$option < 43200 ) // 12 hours return false; - if ( function_exists( 'fsockopen' ) ) + if ( function_exists( 'fsockopen' ) && apply_filters('use_fsockopen_transport', true) ) return true; return false; @@ -808,9 +720,9 @@ /** * HTTP request method uses fopen function to retrieve the url. * - * Requires PHP version greater than 4.3.0 for stream support. Does not allow - * for $context support, but should still be okay, to write the headers, before - * getting the response. Also requires that 'allow_url_fopen' to be enabled. + * Requires PHP version greater than 4.3.0 for stream support. Does not allow for $context support, + * but should still be okay, to write the headers, before getting the response. Also requires that + * 'allow_url_fopen' to be enabled. * * @package WordPress * @subpackage HTTP @@ -820,8 +732,8 @@ /** * Send a HTTP request to a URI using fopen(). * - * This transport does not support sending of headers and body, therefore - * should not be used in the instances, where there is a body and headers. + * This transport does not support sending of headers and body, therefore should not be used in + * the instances, where there is a body and headers. * * Notes: Does not support non-blocking mode. Ignores 'redirection' option. * @@ -911,15 +823,15 @@ if ( ! function_exists('fopen') || (function_exists('ini_get') && true != ini_get('allow_url_fopen')) ) return false; - return true; + return apply_filters('use_fopen_transport', true); } } /** * HTTP request method uses Streams to retrieve the url. * - * Requires PHP 5.0+ and uses fopen with stream context. Requires that - * 'allow_url_fopen' PHP setting to be enabled. + * Requires PHP 5.0+ and uses fopen with stream context. Requires that 'allow_url_fopen' PHP setting + * to be enabled. * * Second preferred method for getting the URL, for PHP 5. * @@ -955,7 +867,7 @@ $r['user-agent'] = $r['headers']['user-agent']; unset($r['headers']['user-agent']); } - + // Construct Cookie: header if any cookies are set WP_Http::buildCookieHeader( $r ); @@ -984,12 +896,35 @@ 'header' => $strHeaders, 'timeout' => $r['timeout'], 'ssl' => array( - 'verify_peer' => apply_filters('https_ssl_verify', $r['sslverify']), - 'verify_host' => apply_filters('https_ssl_verify', $r['sslverify']) - ) + 'verify_peer' => apply_filters('https_ssl_verify', $r['sslverify']), + 'verify_host' => apply_filters('https_ssl_verify', $r['sslverify']) + ) ) ); + $proxy = new WP_HTTP_Proxy(); + + if ( $proxy->is_enabled() && $proxy->send_through_proxy( $url ) ) { + // WTF happens when the user stupidly puts http:// in the host? Bad things. Really, + // really bad things happen. Not exactly unleashing demons from hell, but you know. + // Just as bad probably. Actually, none of the other transports should work in that case + // so no sanitization is done. If there is, it should be done in the + // WP_HTTP_Proxy::host(). + // + // On second thought, why is it tcp protocol? Why not http? What if the proxy is http + // and not tcp? Even though, technically, http is tcp, but just a specialized form of + // tcp. Behavior is undefined, so it is probably good that not a lot of users will be + // affected by FUBAR behavior. + // + // Is it another WTF? that this multiline comment isn't using multiline comment syntax? + $arrContext['http']['proxy'] = 'tcp://'.$proxy->host().':'$proxy->port(); + + // Yeah, this may or may not work. Good luck. + if ( $proxy->use_authentication() ) { + $arrContext['http']['header'] .= $proxy->authentication_header() . "\r\n"; + } + } + if ( ! is_null($r['body']) && ! empty($r['body'] ) ) $arrContext['http']['content'] = $r['body']; @@ -1003,8 +938,8 @@ if ( ! $handle) return new WP_Error('http_request_failed', sprintf(__('Could not open handle for fopen() to %s'), $url)); - // WordPress supports PHP 4.3, which has this function. Removed sanity - // checking for performance reasons. + // WordPress supports PHP 4.3, which has this function. Removed sanity checking for + // performance reasons. stream_set_timeout($handle, $r['timeout'] ); if ( ! $r['blocking'] ) { @@ -1049,17 +984,16 @@ if ( version_compare(PHP_VERSION, '5.0', '<') ) return false; - return true; + return apply_filters('use_streams_transport', true); } } /** * HTTP request method uses HTTP extension to retrieve the url. * - * Requires the HTTP extension to be installed. This would be the preferred - * transport since it can handle a lot of the problems that forces the others to - * use the HTTP version 1.0. Even if PHP 5.2+ is being used, it doesn't mean - * that the HTTP extension will be enabled. + * Requires the HTTP extension to be installed. This would be the preferred transport since it can + * handle a lot of the problems that forces the others to use the HTTP version 1.0. Even if PHP 5.2+ + * is being used, it doesn't mean that the HTTP extension will be enabled. * * @package WordPress * @subpackage HTTP @@ -1095,7 +1029,7 @@ $r['user-agent'] = $r['headers']['user-agent']; unset($r['headers']['user-agent']); } - + // Construct Cookie: header if any cookies are set WP_Http::buildCookieHeader( $r ); @@ -1128,12 +1062,28 @@ ) ); + // The HTTP extensions offers really easy proxy support. + $proxy = new WP_HTTP_Proxy(); + + if ( $proxy->is_enabled() && $proxy->send_through_proxy( $url ) ) { + $options['proxyhost'] = $proxy->host(); + $options['proxyport'] = $proxy->port(); + $options['proxytype'] = HTTP_PROXY_HTTP; + + if ( $proxy->use_authentication() ) { + $options['proxyauth'] = $proxy->authentication(); + $options['proxyauthtype'] = HTTP_AUTH_BASIC; + } + } + if ( !defined('WP_DEBUG') || ( defined('WP_DEBUG') && false === WP_DEBUG ) ) //Emits warning level notices for max redirects and timeouts $strResponse = @http_request($r['method'], $url, $r['body'], $options, $info); else $strResponse = http_request($r['method'], $url, $r['body'], $options, $info); //Emits warning level notices for max redirects and timeouts - if ( false === $strResponse || ! empty($info['error']) ) //Error may still be set, Response may return headers or partial document, and error contains a reason the request was aborted, eg, timeout expired or max-redirects reached + // Error may still be set, Response may return headers or partial document, and error + // contains a reason the request was aborted, eg, timeout expired or max-redirects reached. + if ( false === $strResponse || ! empty($info['error']) ) return new WP_Error('http_request_failed', $info['response_code'] . ': ' . $info['error']); if ( ! $r['blocking'] ) @@ -1168,7 +1118,7 @@ * @return boolean False means this class can not be used, true means it can. */ function test() { - if ( function_exists('http_request') ) + if ( function_exists('http_request') && apply_filters('use_http_extension_transport', true) ) return true; return false; @@ -1185,6 +1135,7 @@ * @since 2.7 */ class WP_Http_Curl { + /** * Send a HTTP request to a URI using cURL extension. * @@ -1212,17 +1163,41 @@ $r['user-agent'] = $r['headers']['user-agent']; unset($r['headers']['user-agent']); } - - // Construct Cookie: header if any cookies are set + + // Construct Cookie: header if any cookies are set. WP_Http::buildCookieHeader( $r ); - // cURL extension will sometimes fail when the timeout is less than 1 as - // it may round down to 0, which gives it unlimited timeout. + // cURL extension will sometimes fail when the timeout is less than 1 as it may round down + // to 0, which gives it unlimited timeout. if ( $r['timeout'] > 0 && $r['timeout'] < 1 ) $r['timeout'] = 1; $handle = curl_init(); + // cURL offers really easy proxy support. + $proxy = new WP_HTTP_Proxy(); + + if ( $proxy->is_enabled() && $proxy->send_through_proxy( $url ) ) { + curl_setopt( $handle, CURLOPT_HTTPPROXYTUNNEL, true ); + + $isPHP5 = version_compare(PHP_VERSION, '5.0.0', '>='); + + if ( $isPHP5 ) { + curl_setopt( $handle, CURLOPT_PROXYTYPE, CURLPROXY_HTTP ); + curl_setopt( $handle, CURLOPT_PROXY, $proxy->host() ); + curl_setopt( $handle, CURLOPT_PROXYPORT, $proxy->port() ); + } else { + curl_setopt( $handle, CURLOPT_PROXY, $proxy->host() .':'. $proxy->port() ); + } + + if ( $proxy->use_authentication() ) { + if ( $isPHP5 ) + curl_setopt( $handle, CURLOPT_PROXYAUTH, CURLAUTH_BASIC ); + + curl_setopt( $handle, CURLOPT_PROXYUSERPWD, $proxy->authentication() ); + } + } + curl_setopt( $handle, CURLOPT_URL, $url); curl_setopt( $handle, CURLOPT_RETURNTRANSFER, true ); curl_setopt( $handle, CURLOPT_SSL_VERIFYHOST, apply_filters('https_ssl_verify', $r['sslverify']) ); @@ -1265,13 +1240,11 @@ else curl_setopt( $handle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1 ); - // Cookies are not handled by the HTTP API currently. Allow for plugin - // authors to handle it themselves... Although, it is somewhat pointless - // without some reference. + // Cookies are not handled by the HTTP API currently. Allow for plugin authors to handle it + // themselves... Although, it is somewhat pointless without some reference. do_action_ref_array( 'http_api_curl', array(&$handle) ); - // We don't need to return the body, so don't. Just execute request - // and return. + // We don't need to return the body, so don't. Just execute request and return. if ( ! $r['blocking'] ) { curl_exec( $handle ); curl_close( $handle ); @@ -1320,67 +1293,303 @@ * @return boolean False means this class can not be used, true means it can. */ function test() { - if ( function_exists('curl_init') && function_exists('curl_exec') ) + if ( function_exists('curl_init') && function_exists('curl_exec') && apply_filters('use_curl_transport', true) ) return true; return false; } } +/** + * Adds Proxy support to the WordPress HTTP API. + * + * Proxy support is fringe enough that it isn't support in WordPress by default, meaning no plans + * were made to implement it. Most WordPress users are not going to benefit with its support, but + * enough people have made a stink out of the lack of it that it should be supported. + * + * There are caveats to proxy support. It requires that defines be made in the wp-config.php file to + * enable proxy support. There are also a few filters that plugins can hook into for some of the + * constants. + * + * The constants are as follows: + *
    + *
  1. WP_PROXY_HOST - Enable proxy support and host for connecting.
    2. + *
  2. WP_PROXY_PORT - Proxy port for connection. No default, must be defined.
    3. + *
  3. WP_PROXY_USERNAME - Proxy username, if it requires authentication.
    4. + *
  4. WP_PROXY_PASSWORD - Proxy password, if it requires authentication.
    5. + *
  5. WP_PROXY_BYPASS_HOSTS - Will prevent the hosts in this list from going through the proxy. + * You do not need to have localhost and the blog host in this list, because they will not be passed + * through the proxy.
    6. + *
+ * + * An example can be as seen below. + * + * define('WP_PROXY_HOST', '192.168.84.101'); + * define('WP_PROXY_PORT', '8080'); + * define('WP_PROXY_BYPASS_HOSTS', array('localhost', 'www.example.com')); + * + * + * @link http://core.trac.wordpress.org/ticket/4011 Proxy support ticket in WordPress. + * @since unknown + */ +class WP_HTTP_Proxy { + function WP_HTTP_Proxy() { + $this->__construct(); + } + + function __construct() { + + } + + /** + * Whether proxy connection should be used. + * + * @since unknown + * @use WP_PROXY_HOST + * @use WP_PROXY_PORT + * + * @return bool + */ + function is_enabled() { + return ( defined('WP_PROXY_HOST') && defined('WP_PROXY_PORT') ); + } + + /** + * Whether authentication should be used. + * + * @since unknown + * @use WP_PROXY_USERNAME + * @use WP_PROXY_PASSWORD + * + * @return bool + */ + function use_authentication() { + return ( defined('WP_PROXY_USERNAME') && defined('WP_PROXY_PASSWORD') ); + } + + /** + * Retrieve the host for the proxy server. + * + * @since unknown + * + * @return string + */ + function host() + { + if( defined('WP_PROXY_HOST') ) + return WP_PROXY_HOST; + + return ''; + } + + /** + * Retrieve the port for the proxy server. + * + * @since unknown + * + * @return string + */ + function port() + { + if( defined('WP_PROXY_PORT') ) + return WP_PROXY_PORT; + + return ''; + } + + /** + * Retrieve the username for proxy authentication. + * + * @since unknown + * + * @return string + */ + function username() + { + if( defined('WP_PROXY_USERNAME') ) + return WP_PROXY_USERNAME; + + return ''; + } + + /** + * Retrieve the password for proxy authentication. + * + * @since unknown + * + * @return string + */ + function password() + { + if( defined('WP_PROXY_PASSWORD') ) + return WP_PROXY_PASSWORD; + + return ''; + } + + /** + * Retrieve authentication string for proxy authentication. + * + * @since unknown + * + * @return string + */ + function authentication() { + return $this->username() .':'. $this->password(); + } + + /** + * Retrieve header string for proxy authentication. + * + * @since unknown + * + * @return string + */ + function authentication_header() { + return 'Proxy-Authentication: Basic '. base64_encode( $this->authentication() ); + } + + /** + * Whether URL should be sent through the proxy server. + * + * We want to keep localhost and the blog URL from being sent through the proxy server, because + * some proxies can not handle this. We also have the constant available for defining other + * hosts that won't be sent through the proxy. + * + * @uses WP_PROXY_BYPASS_HOSTS + * @since unknown + * + * @param string $uri URI to check. + * @return bool True, to send through the proxy and false if, the proxy should not be used. + */ + function send_through_proxy( $uri ) { + // parse_url() only handles http, https type URLs, and will emit E_WARNING on failure. + // This will be displayed on blogs, which is not reasonable. + $check = @parse_url($uri); + + // Malformed URL, can not process, but this could mean ssl, so let through anyway. + if( $check === false ) + return true; + + $home = parse_url( get_bloginfo('site_url') ); + + if ( $uri == 'localhost' || $uri == $home['host'] ) + return false; + + if ( defined('WP_PROXY_BYPASS_HOSTS') && is_array( WP_PROXY_BYPASS_HOSTS ) && in_array( $check['host'], WP_PROXY_BYPASS_HOSTS ) ) { + return false; + } + + return true; + } +} + + /** - * Internal representation of a cookie. + * Internal representation of a single cookie. * - * Returned cookies are represented using this class, and when cookies are - * set, if they are not already a WP_Http_Cookie() object, then they are turned - * into one. + * Returned cookies are represented using this class, and when cookies are set, if they are not + * already a WP_Http_Cookie() object, then they are turned into one. * + * @todo The WordPress convention is to use underscores instead of camelCase for function and method + * names. Need to switch to use underscores instead for the methods. + * * @package WordPress * @subpackage HTTP + * @since 2.8.0 + * @author Beau Lebens */ class WP_Http_Cookie { - var $name, - $value, - $expires, - $path, - $domain; - + /** - * PHP4 style Constructor - Calls PHP5 Style Constructor + * Cookie name. + * + * @since 2.8.0 + * @var string */ + var $name; + + /** + * Cookie value. + * + * @since 2.8.0 + * @var string + */ + var $value; + + /** + * When the cookie expires. + * + * @since 2.8.0 + * @var string + */ + var $expires; + + /** + * Cookie URL path. + * + * @since 2.8.0 + * @var string + */ + var $path; + + /** + * Cookie Domain. + * + * @since 2.8.0 + * @var string + */ + var $domain; + + /** + * PHP4 style Constructor - Calls PHP5 Style Constructor. + * + * @access public + * @since 2.8.0 + * @param string|array $data Raw cookie data. + */ function WP_Http_Cookie( $data ) { - return $this->__construct( $data ); + $this->__construct( $data ); } - + /** * Sets up this cookie object. * + * The parameter $data should be either an associative array containing the indices names below + * or a header string detailing it. + * + * If it's an array, it should include the following elements: + *
    + *
  1. Name
    2. + *
  2. Value - should NOT be urlencoded already.
    3. + *
  3. Expires - (optional) String or int (UNIX timestamp).
    4. + *
  4. Path (optional)
    5. + *
  5. Domain (optional)
    6. + *
+ * * @access public + * @since 2.8.0 * - * @param mixed $data Either an associative array describing the cookie, or a header-string detailing it. - * If it's an array, it should include the following elements: - * - name - * - value [should NOT be urlencoded already] - * - expires (optional) String or int (UNIX timestamp) - * - path (optional) - * - domain (optional) + * @param string|array $data Raw cookie data. */ function __construct( $data ) { if ( is_string( $data ) ) { // Assume it's a header string direct from a previous request $pairs = explode( ';', $data ); - + // Special handling for first pair; name=value. Also be careful of "=" in value $name = trim( substr( $pairs[0], 0, strpos( $pairs[0], '=' ) ) ); $value = substr( $pairs[0], strpos( $pairs[0], '=' ) + 1 ); $this->name = $name; $this->value = urldecode( $value ); array_shift( $pairs ); //Removes name=value from items. - + // Set everything else as a property foreach ( $pairs as $pair ) { if ( empty($pair) ) //Handles the cookie ending in ; which results in a empty final pair continue; + list( $key, $val ) = explode( '=', $pair ); $key = strtolower( trim( $key ) ); if ( 'expires' == $key ) @@ -1390,25 +1599,27 @@ } else { if ( !isset( $data['name'] ) ) return false; - + // Set properties based directly on parameters $this->name = $data['name']; $this->value = isset( $data['value'] ) ? $data['value'] : ''; $this->path = isset( $data['path'] ) ? $data['path'] : ''; $this->domain = isset( $data['domain'] ) ? $data['domain'] : ''; + if ( isset( $data['expires'] ) ) $this->expires = is_int( $data['expires'] ) ? $data['expires'] : strtotime( $data['expires'] ); else $this->expires = null; } } - + /** * Confirms that it's OK to send this cookie to the URL checked against. * * Decision is based on RFC 2109/2965, so look there for details on validity. * * @access public + * @since 2.8.0 * * @param string $url URL you intend to send this cookie to * @return boolean TRUE if allowed, FALSE otherwise. @@ -1417,48 +1628,192 @@ // Expires - if expired then nothing else matters if ( time() > $this->expires ) return false; - + // Get details on the URL we're thinking about sending to $url = parse_url( $url ); $url['port'] = isset( $url['port'] ) ? $url['port'] : 80; $url['path'] = isset( $url['path'] ) ? $url['path'] : '/'; - - // Values to use for comparison against the URL + + // Values to use for comparison against the URL $path = isset( $this->path ) ? $this->path : '/'; $port = isset( $this->port ) ? $this->port : 80; $domain = isset( $this->domain ) ? strtolower( $this->domain ) : strtolower( $url['host'] ); if ( false === stripos( $domain, '.' ) ) $domain .= '.local'; - + // Host - very basic check that the request URL ends with the domain restriction (minus leading dot) $domain = substr( $domain, 0, 1 ) == '.' ? substr( $domain, 1 ) : $domain; if ( substr( $url['host'], -strlen( $domain ) ) != $domain ) return false; - + // Port - supports "port-lists" in the format: "80,8000,8080" if ( !in_array( $url['port'], explode( ',', $port) ) ) return false; - + // Path - request path must start with path restriction if ( substr( $url['path'], 0, strlen( $path ) ) != $path ) return false; - + return true; } - + + /** + * Convert cookie name and value back to header string. + * + * @access public + * @since 2.8.0 + * + * @return string Header encoded cookie name and value. + */ function getHeaderValue() { if ( empty( $this->name ) || empty( $this->value ) ) return ''; return $this->name . '=' . urlencode( $this->value ); } - + + /** + * Retrieve cookie header for usage in the rest of the WordPress HTTP API. + * + * @access public + * @since 2.8.0 + * + * @return string + */ function getFullHeader() { return 'Cookie: ' . $this->getHeaderValue(); } } /** + * Implementation for deflate and gzip transfer encodings. + * + * Includes RFC 1950, RFC 1951, and RFC 1952. + * + * @since 2.8 + * @package WordPress + * @subpackage HTTP + */ +class WP_Http_Encoding { + + /** + * Compress raw string using the deflate format. + * + * Supports the RFC 1951 standard. + * + * @since 2.8 + * + * @param string $raw String to compress. + * @param int $level Optional, default is 9. Compression level, 9 is highest. + * @param string $supports Optional, not used. When implemented it will choose the right compression based on what the server supports. + * @return string|bool False on failure. + */ + function compress( $raw, $level = 9, $supports = null ) { + return gzdeflate( $raw, $level ); + } + + /** + * Decompression of deflated string. + * + * Will attempt to decompress using the RFC 1950 standard, and if that fails + * then the RFC 1951 standard deflate will be attempted. Finally, the RFC + * 1952 standard gzip decode will be attempted. If all fail, then the + * original compressed string will be returned. + * + * @since 2.8 + * + * @param string $compressed String to decompress. + * @param int $length The optional length of the compressed data. + * @return string|bool False on failure. + */ + function decompress( $compressed, $length = null ) { + $decompressed = gzinflate( $compressed ); + + if( false !== $decompressed ) + return $decompressed; + + $decompressed = gzuncompress( $compressed ); + + if( false !== $decompressed ) + return $decompressed; + + $decompressed = gzdecode( $compressed ); + + if( false !== $decompressed ) + return $decompressed; + + return $compressed; + } + + /** + * What encoding types to accept and their priority values. + * + * @since 2.8 + * + * @return string Types of encoding to accept. + */ + function accept_encoding() { + $type = array(); + if( function_exists( 'gzinflate' ) ) + $type[] = 'deflate;q=1.0'; + + if( function_exists( 'gzuncompress' ) ) + $type[] = 'compress;q=0.5'; + + if( function_exists( 'gzdecode' ) ) + $type[] = 'gzip;q=0.5'; + + return implode(', ', $type); + } + + /** + * What enconding the content used when it was compressed to send in the headers. + * + * @since 2.8 + * + * @return string Content-Encoding string to send in the header. + */ + function content_encoding() { + return 'deflate'; + } + + /** + * Whether the content be decoded based on the headers. + * + * @since 2.8 + * + * @param array|string $headers All of the available headers. + * @return bool + */ + function should_decode($headers) { + if( is_array( $headers ) ) { + if( array_key_exists('content-encoding', $headers) && ! empty( $headers['content-encoding'] ) ) + return true; + } else if( is_string( $headers ) ) { + return ( stripos($headers, 'content-encoding:') !== false ); + } + + return false; + } + + /** + * Whether decompression and compression are supported by the PHP version. + * + * Each function is tested instead of checking for the zlib extension, to + * ensure that the functions all exist in the PHP version and aren't + * disabled. + * + * @since 2.8 + * + * @return bool + */ + function is_available() { + return ( function_exists('gzuncompress') || function_exists('gzdeflate') || + function_exists('gzinflate') ); + } +} + +/** * Returns the initialized WP_Http Object * * @since 2.7.0