Changeset 10625

Timestamp:

02/22/2009 09:58:47 AM (16 years ago)

Author:

westi

Message:

Add support for blocking all outbound HTTP requests. Improve HTTP Api phpdoc. Tidy up the poetry. Fixes #8927 props jacobsantos.

File:

• trunk/wp-includes/http.php (modified) (29 diffs)

trunk/wp-includes/http.php

@@ -229 +229 @@
 
         if ( is_null($working_transport) ) {
-            if ( true === WP_Http_ExtHttp::test() && apply_filters('use_http_extension_transport', true) ) {
+            if ( true === WP_Http_ExtHttp::test() ) {
                 $working_transport['exthttp'] = new WP_Http_ExtHttp();
                 $blocking_transport[] = &$working_transport['exthttp'];
-            } else if ( true === WP_Http_Curl::test() && apply_filters('use_curl_transport', true) ) {
+            } else if ( true === WP_Http_Curl::test() ) {
                 $working_transport['curl'] = new WP_Http_Curl();
                 $blocking_transport[] = &$working_transport['curl'];
-            } else if ( true === WP_Http_Streams::test() && apply_filters('use_streams_transport', true) ) {
+            } else if ( true === WP_Http_Streams::test() ) {
                 $working_transport['streams'] = new WP_Http_Streams();
                 $blocking_transport[] = &$working_transport['streams'];
-            } else if ( true === WP_Http_Fopen::test() && apply_filters('use_fopen_transport', true) && ( isset($args['ssl']) && !$args['ssl'] ) ) {
+            } else if ( true === WP_Http_Fopen::test() && ( isset($args['ssl']) && !$args['ssl'] ) ) {
                 $working_transport['fopen'] = new WP_Http_Fopen();
                 $blocking_transport[] = &$working_transport['fopen'];
-            } else if ( true === WP_Http_Fsockopen::test() && apply_filters('use_fsockopen_transport', true) && ( isset($args['ssl']) && !$args['ssl'] ) ) {
+            } else if ( true === WP_Http_Fsockopen::test() && ( isset($args['ssl']) && !$args['ssl'] ) ) {
                 $working_transport['fsockopen'] = new WP_Http_Fsockopen();
                 $blocking_transport[] = &$working_transport['fsockopen'];
@@ -280 +280 @@
 
         if ( is_null($working_transport) ) {
-            if ( true === WP_Http_ExtHttp::test() && apply_filters('use_http_extension_transport', true) ) {
+            if ( true === WP_Http_ExtHttp::test() ) {
                 $working_transport['exthttp'] = new WP_Http_ExtHttp();
                 $blocking_transport[] = &$working_transport['exthttp'];
-            } else if ( true === WP_Http_Curl::test() && apply_filters('use_curl_transport', true) ) {
+            } else if ( true === WP_Http_Curl::test() ) {
                 $working_transport['curl'] = new WP_Http_Curl();
                 $blocking_transport[] = &$working_transport['curl'];
-            } else if ( true === WP_Http_Streams::test() && apply_filters('use_streams_transport', true) ) {
+            } else if ( true === WP_Http_Streams::test() ) {
                 $working_transport['streams'] = new WP_Http_Streams();
                 $blocking_transport[] = &$working_transport['streams'];
-            } else if ( true === WP_Http_Fsockopen::test() && apply_filters('use_fsockopen_transport', true) && ( isset($args['ssl']) && !$args['ssl'] ) ) {
+            } else if ( true === WP_Http_Fsockopen::test() && ( isset($args['ssl']) && !$args['ssl'] ) ) {
                 $working_transport['fsockopen'] = new WP_Http_Fsockopen();
                 $blocking_transport[] = &$working_transport['fsockopen'];
@@ -377 +377 @@
         $arrURL = parse_url($url);
 
+        if ( $this->block_request( $url ) )
+            return new WP_Error('http_request_failed', 'User has blocked requests through HTTP.');
+
         // Determine if this is a https call and pass that on to the transport functions
         // so that we can blacklist the transports that do not support ssl verification
@@ -401 +404 @@
             unset($r['headers']['user-agent']);
         }
-        
+
         // Construct Cookie: header if any cookies are set
         WP_Http::buildCookieHeader( $r );
@@ -515 +518 @@
      * Transform header string into an array.
      *
-     * If an array is given then it is assumed to be raw header data with
-     * numeric keys with the headers as the values. No headers must be passed
-     * that were already processed.
+     * If an array is given then it is assumed to be raw header data with numeric keys with the
+     * headers as the values. No headers must be passed that were already processed.
      *
      * @access public
@@ -565 +567 @@
     /**
      * Takes the arguments for a ::request() and checks for the cookie array.
-     * If it's found, then it's assumed to contain WP_Http_Cookie objects, which
-     * are each parsed into strings and added to the Cookie: header (within the
-     * arguments array). Edits the array by reference.
-     *
-     * @access public
+     *
+     * If it's found, then it's assumed to contain WP_Http_Cookie objects, which are each parsed
+     * into strings and added to the Cookie: header (within the arguments array). Edits the array by
+     * reference.
+     *
+     * @access public
+     * @version 2.8.0
      * @static
      *
@@ -584 +588 @@
         }
     }
-    
+
     /**
      * Decodes chunk transfer-encoding, based off the HTTP 1.1 specification.
@@ -630 +634 @@
             }
         }
+    }
+
+    /**
+     * Block requests through the proxy.
+     *
+     * Those who are behind a proxy and want to prevent access to certain hosts may do so. This will
+     * prevent plugins from working and core functionality, if you don't include api.wordpress.org.
+     *
+     * You block external URL requests by defining WP_HTTP_BLOCK_EXTERNAL in your wp-config.php file
+     * and this will only allow localhost and your blog to make requests. The constant
+     * WP_ACCESSABLE_HOSTS will allow additional hosts to go through for requests.
+     *
+     * @since unknown
+     * @link http://core.trac.wordpress.org/ticket/8927 Allow preventing external requests.
+     *
+     * @param string $uri URI of url.
+     * @return bool True to block, false to allow.
+     */
+    function block_request($uri) {
+        // We don't need to block requests, because nothing is blocked.
+        if ( ! defined('WP_HTTP_BLOCK_EXTERNAL') || ( defined('WP_HTTP_BLOCK_EXTERNAL') && WP_HTTP_BLOCK_EXTERNAL == false ) )
+            return false;
+
+        // parse_url() only handles http, https type URLs, and will emit E_WARNING on failure.
+        // This will be displayed on blogs, which is not reasonable.
+        $check = @parse_url($uri);
+
+        /* Malformed URL, can not process, but this could mean ssl, so let through anyway.
+         *
+         * This isn't very security sound. There are instances where a hacker might attempt
+         * to bypass the proxy and this check. However, the reason for this behavior is that
+         * WordPress does not do any checking currently for non-proxy requests, so it is keeps with
+         * the default unsecure nature of the HTTP request.
+         */
+        if ( $check === false )
+            return false;
+
+        $home = parse_url( get_bloginfo('site_url') );
+        
+        // Don't block requests back to ourselves by default
+        if ( $uri == 'localhost' || $uri == $home['host'] )
+            return apply_filters('block_local_requests', false);
+
+        if ( defined('WP_ACCESSABLE_HOSTS') && is_array( WP_ACCESSABLE_HOSTS ) && in_array( $check['host'], WP_ACCESSABLE_HOSTS ) ) {
+                return false;
+        }
+
+        return true;
     }
 }
@@ -800 +852 @@
 
         if ( function_exists( 'fsockopen' ) )
-            return true;
+            return apply_filters('use_fsockopen_transport', true);
 
         return false;
@@ -912 +964 @@
             return false;
 
-        return true;
+        return apply_filters('use_fopen_transport', true);
     }
 }
@@ -956 +1008 @@
             unset($r['headers']['user-agent']);
         }
-        
+
         // Construct Cookie: header if any cookies are set
         WP_Http::buildCookieHeader( $r );
@@ -985 +1037 @@
                 'timeout' => $r['timeout'],
                 'ssl' => array(
-                                    'verify_peer' => apply_filters('https_ssl_verify', $r['sslverify']),
-                                    'verify_host' => apply_filters('https_ssl_verify', $r['sslverify'])
-                            )
+                        'verify_peer' => apply_filters('https_ssl_verify', $r['sslverify']),
+                        'verify_host' => apply_filters('https_ssl_verify', $r['sslverify'])
+                )
             )
         );
@@ -1050 +1102 @@
             return false;
 
-        return true;
+        return apply_filters('use_streams_transport', true);
     }
 }
@@ -1134 +1186 @@
             $strResponse = http_request($r['method'], $url, $r['body'], $options, $info); //Emits warning level notices for max redirects and timeouts
 
-        if ( false === $strResponse || ! empty($info['error']) ) //Error may still be set, Response may return headers or partial document, and error contains a reason the request was aborted, eg, timeout expired or max-redirects reached
+        // Error may still be set, Response may return headers or partial document, and error
+        // contains a reason the request was aborted, eg, timeout expired or max-redirects reached.
+        if ( false === $strResponse || ! empty($info['error']) )
             return new WP_Error('http_request_failed', $info['response_code'] . ': ' . $info['error']);
 
@@ -1170 +1224 @@
     function test() {
         if ( function_exists('http_request') )
-            return true;
+            return apply_filters('use_http_extension_transport', true);
 
         return false;
@@ -1186 +1240 @@
  */
 class WP_Http_Curl {
+
     /**
      * Send a HTTP request to a URI using cURL extension.
@@ -1213 +1268 @@
             unset($r['headers']['user-agent']);
         }
-        
+
         // Construct Cookie: header if any cookies are set
         WP_Http::buildCookieHeader( $r );
@@ -1322 +1377 @@
     function test() {
         if ( function_exists('curl_init') && function_exists('curl_exec') )
-            return true;
+            return  apply_filters('use_curl_transport', true);
 
         return false;
@@ -1330 +1385 @@
 
 /**
- * Internal representation of a cookie.
+ * Internal representation of a single cookie.
  *
  * Returned cookies are represented using this class, and when cookies are
@@ -1336 +1391 @@
  * into one.
  *
+ * @todo The WordPress convention is to use underscores instead of camelCase for function and method
+ * names. Need to switch to use underscores instead for the methods.
+ *
  * @package WordPress
  * @subpackage HTTP
+ * @since 2.8.0
+ * @author Beau Lebens
  */
 class WP_Http_Cookie {
-    var $name,
-        $value,
-        $expires,
-        $path,
-        $domain;
-    
-    /**
-     * PHP4 style Constructor - Calls PHP5 Style Constructor
+
+    /**
+     * Cookie name.
+     *
+     * @since 2.8.0
+     * @var string
+     */
+    var $name;
+
+    /**
+     * Cookie value.
+     *
+     * @since 2.8.0
+     * @var string
+     */
+    var $value;
+
+    /**
+     * When the cookie expires.
+     *
+     * @since 2.8.0
+     * @var string
+     */
+    var $expires;
+
+    /**
+     * Cookie URL path.
+     *
+     * @since 2.8.0
+     * @var string
+     */
+    var $path;
+
+    /**
+     * Cookie Domain.
+     *
+     * @since 2.8.0
+     * @var string
+     */
+    var $domain;
+
+    /**
+     * PHP4 style Constructor - Calls PHP5 Style Constructor.
+     *
+     * @access public
+     * @since 2.8.0
+     * @param string|array $data Raw cookie data.
      */
     function WP_Http_Cookie( $data ) {
-        return $this->__construct( $data );
-    }
-    
+        $this->__construct( $data );
+    }
+
     /**
      * Sets up this cookie object.
      *
-     * @access public
-     *
-     * @param mixed $data Either an associative array describing the cookie, or a header-string detailing it.
-     *      If it's an array, it should include the following elements:
-     *          - name
-     *          - value [should NOT be urlencoded already]
-     *          - expires (optional) String or int (UNIX timestamp)
-     *          - path (optional)
-     *          - domain (optional)
+     * The parameter $data should be either an associative array containing the indices names below
+     * or a header string detailing it.
+     *
+     * If it's an array, it should include the following elements:
+     * <ol>
+     * <li>Name</li>
+     * <li>Value - should NOT be urlencoded already.</li>
+     * <li>Expires - (optional) String or int (UNIX timestamp).</li>
+     * <li>Path (optional)</li>
+     * <li>Domain (optional)</li>
+     * </ol>
+     *
+     * @access public
+     * @since 2.8.0
+     *
+     * @param string|array $data Raw cookie data.
      */
     function __construct( $data ) {
@@ -1370 +1476 @@
             // Assume it's a header string direct from a previous request
             $pairs = explode( ';', $data );
-            
+
             // Special handling for first pair; name=value. Also be careful of "=" in value
             $name  = trim( substr( $pairs[0], 0, strpos( $pairs[0], '=' ) ) );
@@ -1377 +1483 @@
             $this->value = urldecode( $value );
             array_shift( $pairs ); //Removes name=value from items.
-            
+
             // Set everything else as a property
             foreach ( $pairs as $pair ) {
                 if ( empty($pair) ) //Handles the cookie ending in ; which results in a empty final pair
                     continue;
+
                 list( $key, $val ) = explode( '=', $pair );
                 $key = strtolower( trim( $key ) );
@@ -1391 +1498 @@
             if ( !isset( $data['name'] ) )
                 return false;
-            
+
             // Set properties based directly on parameters
             $this->name   = $data['name'];
@@ -1397 +1504 @@
             $this->path   = isset( $data['path'] ) ? $data['path'] : '';
             $this->domain = isset( $data['domain'] ) ? $data['domain'] : '';
+
             if ( isset( $data['expires'] ) )
                 $this->expires = is_int( $data['expires'] ) ? $data['expires'] : strtotime( $data['expires'] );
@@ -1403 +1511 @@
         }
     }
-    
+
     /**
      * Confirms that it's OK to send this cookie to the URL checked against.
@@ -1410 +1518 @@
      *
      * @access public
+     * @since 2.8.0
      *
      * @param string $url URL you intend to send this cookie to
@@ -1418 +1527 @@
         if ( time() > $this->expires )
             return false;
-        
+
         // Get details on the URL we're thinking about sending to
         $url = parse_url( $url );
         $url['port'] = isset( $url['port'] ) ? $url['port'] : 80;
         $url['path'] = isset( $url['path'] ) ? $url['path'] : '/';
-        
-         // Values to use for comparison against the URL
+
+        // Values to use for comparison against the URL
         $path   = isset( $this->path )   ? $this->path   : '/';
         $port   = isset( $this->port )   ? $this->port   : 80;
@@ -1430 +1539 @@
         if ( false === stripos( $domain, '.' ) )
             $domain .= '.local';
-        
+
         // Host - very basic check that the request URL ends with the domain restriction (minus leading dot)
         $domain = substr( $domain, 0, 1 ) == '.' ? substr( $domain, 1 ) : $domain;
         if ( substr( $url['host'], -strlen( $domain ) ) != $domain )
             return false;
-        
+
         // Port - supports "port-lists" in the format: "80,8000,8080"
         if ( !in_array( $url['port'], explode( ',', $port) ) )
             return false;
-        
+
         // Path - request path must start with path restriction
         if ( substr( $url['path'], 0, strlen( $path ) ) != $path )
             return false;
-        
+
         return true;
     }
-    
+
+    /**
+     * Convert cookie name and value back to header string.
+     *
+     * @access public
+     * @since 2.8.0
+     *
+     * @return string Header encoded cookie name and value.
+     */
     function getHeaderValue() {
         if ( empty( $this->name ) || empty( $this->value ) )
@@ -1453 +1570 @@
         return $this->name . '=' . urlencode( $this->value );
     }
-    
+
+    /**
+     * Retrieve cookie header for usage in the rest of the WordPress HTTP API.
+     *
+     * @access public
+     * @since 2.8.0
+     *
+     * @return string
+     */
     function getFullHeader() {
         return 'Cookie: ' . $this->getHeaderValue();