Changeset 29229
- Timestamp:
- 07/18/2014 09:46:24 PM (11 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/wp-includes/class-http.php
r29223 r29229 178 178 return new WP_Error( 'http_request_failed', __( 'User has blocked requests through HTTP.' ) ); 179 179 180 // Determine if this is a https call and pass that on to the transport functions 181 // so that we can blacklist the transports that do not support ssl verification 180 /* 181 * Determine if this is a https call and pass that on to the transport functions 182 * so that we can blacklist the transports that do not support ssl verification 183 */ 182 184 $r['ssl'] = $arrURL['scheme'] == 'https' || $arrURL['scheme'] == 'ssl'; 183 185 184 // Determine if this request is to OUR install of WordPress 186 // Determine if this request is to OUR install of WordPress. 185 187 $homeURL = parse_url( get_bloginfo( 'url' ) ); 186 188 if ( isset( $homeURL['host'] ) ) { … … 191 193 unset( $homeURL ); 192 194 193 // If we are streaming to a file but no filename was given drop it in the WP temp dir 194 // and pick its name using the basename of the $url 195 /* 196 * If we are streaming to a file but no filename was given drop it in the WP temp dir 197 * and pick its name using the basename of the $url. 198 */ 195 199 if ( $r['stream'] && empty( $r['filename'] ) ) 196 200 $r['filename'] = get_temp_dir() . basename( $url ); 197 201 198 // Force some settings if we are streaming to a file and check for existence and perms of destination directory 202 /* 203 * Force some settings if we are streaming to a file and check for existence and perms 204 * of destination directory. 205 */ 199 206 if ( $r['stream'] ) { 200 207 $r['blocking'] = true; … … 225 232 } 226 233 227 // Construct Cookie: header if any cookies are set 234 // Construct Cookie: header if any cookies are set. 228 235 WP_Http::buildCookieHeader( $r ); 229 236 230 // Avoid issues where mbstring.func_overload is enabled 237 // Avoid issues where mbstring.func_overload is enabled. 231 238 mbstring_binary_safe_encoding(); 232 239 … … 295 302 $request_order = apply_filters( 'http_api_transports', array( 'curl', 'streams' ), $args, $url ); 296 303 297 // Loop over each transport on each HTTP request looking for one which will serve this request's needs 304 // Loop over each transport on each HTTP request looking for one which will serve this request's needs. 298 305 foreach ( $request_order as $transport ) { 299 306 $class = 'WP_HTTP_' . $transport; 300 307 301 // Check to see if this transport is a possibility, calls the transport statically 308 // Check to see if this transport is a possibility, calls the transport statically. 302 309 if ( !call_user_func( array( $class, 'test' ), $args, $url ) ) 303 310 continue; … … 451 458 */ 452 459 public static function processHeaders( $headers, $url = '' ) { 453 // split headers, one per array element460 // Split headers, one per array element. 454 461 if ( is_string($headers) ) { 455 // tolerate line terminator: CRLF = LF (RFC 2616 19.3)462 // Tolerate line terminator: CRLF = LF (RFC 2616 19.3). 456 463 $headers = str_replace("\r\n", "\n", $headers); 457 // unfold folded header fields. LWS = [CRLF] 1*( SP | HT ) <US-ASCII SP, space (32)>, <US-ASCII HT, horizontal-tab (9)> (RFC 2616 2.2) 464 /* 465 * Unfold folded header fields. LWS = [CRLF] 1*( SP | HT ) <US-ASCII SP, space (32)>, 466 * <US-ASCII HT, horizontal-tab (9)> (RFC 2616 2.2). 467 */ 458 468 $headers = preg_replace('/\n[ \t]/', ' ', $headers); 459 // create the headers array469 // Create the headers array. 460 470 $headers = explode("\n", $headers); 461 471 } … … 463 473 $response = array('code' => 0, 'message' => ''); 464 474 465 // If a redirection has taken place, The headers for each page request may have been passed. 466 // In this case, determine the final HTTP header and parse from there. 475 /* 476 * If a redirection has taken place, The headers for each page request may have been passed. 477 * In this case, determine the final HTTP header and parse from there. 478 */ 467 479 for ( $i = count($headers)-1; $i >= 0; $i-- ) { 468 480 if ( !empty($headers[$i]) && false === strpos($headers[$i], ':') ) { … … 519 531 public static function buildCookieHeader( &$r ) { 520 532 if ( ! empty($r['cookies']) ) { 521 // Upgrade any name => value cookie pairs to WP_HTTP_Cookie instances 533 // Upgrade any name => value cookie pairs to WP_HTTP_Cookie instances. 522 534 foreach ( $r['cookies'] as $name => $value ) { 523 535 if ( ! is_object( $value ) ) … … 555 567 556 568 $parsed_body = ''; 557 $body_original = $body; // We'll be altering $body, so need a backup in case of error 569 570 // We'll be altering $body, so need a backup in case of error. 571 $body_original = $body; 558 572 559 573 while ( true ) { … … 565 579 $chunk_length = strlen( $match[0] ); 566 580 567 // Parse out the chunk of data 581 // Parse out the chunk of data. 568 582 $parsed_body .= substr( $body, $chunk_length, $length ); 569 583 570 // Remove the chunk from the raw data 584 // Remove the chunk from the raw data. 571 585 $body = substr( $body, $length + $chunk_length ); 572 586 573 // End of document587 // End of the document. 574 588 if ( '0' === trim( $body ) ) 575 589 return $parsed_body; … … 607 621 $home = parse_url( get_option('siteurl') ); 608 622 609 // Don't block requests back to ourselves by default 623 // Don't block requests back to ourselves by default. 610 624 if ( $check['host'] == 'localhost' || $check['host'] == $home['host'] ) { 611 625 /** … … 647 661 return $maybe_relative_path; 648 662 649 // Check for a scheme 663 // Check for a scheme. 650 664 if ( false !== strpos( $maybe_relative_path, '://' ) ) 651 665 return $maybe_relative_path; … … 661 675 $absolute_path .= ':' . $url_parts['port']; 662 676 663 // Start off with the Absolute URL path 677 // Start off with the Absolute URL path. 664 678 $path = ! empty( $url_parts['path'] ) ? $url_parts['path'] : '/'; 665 679 666 // If it's a root-relative path, then great 680 // If it's a root-relative path, then great. 667 681 if ( ! empty( $relative_url_parts['path'] ) && '/' == $relative_url_parts['path'][0] ) { 668 682 $path = $relative_url_parts['path']; 669 683 670 // Else it's a relative path 684 // Else it's a relative path. 671 685 } elseif ( ! empty( $relative_url_parts['path'] ) ) { 672 // Strip off any file components from the absolute path 686 // Strip off any file components from the absolute path. 673 687 $path = substr( $path, 0, strrpos( $path, '/' ) + 1 ); 674 688 675 // Build the new path 689 // Build the new path. 676 690 $path .= $relative_url_parts['path']; 677 691 678 // Strip all /path/../ out of the path 692 // Strip all /path/../ out of the path. 679 693 while ( strpos( $path, '../' ) > 1 ) { 680 694 $path = preg_replace( '![^/]+/\.\./!', '', $path ); 681 695 } 682 696 683 // Strip any final leading ../ from the path 697 // Strip any final leading ../ from the path. 684 698 $path = preg_replace( '!^/(\.\./)+!', '', $path ); 685 699 } 686 700 687 // Add the Query string 701 // Add the Query string. 688 702 if ( ! empty( $relative_url_parts['query'] ) ) 689 703 $path .= '?' . $relative_url_parts['query']; … … 707 721 return false; 708 722 709 // Only perform redirections on redirection http codes 723 // Only perform redirections on redirection http codes. 710 724 if ( $response['response']['code'] > 399 || $response['response']['code'] < 300 ) 711 725 return false; 712 726 713 // Don't redirect if we've run out of redirects 727 // Don't redirect if we've run out of redirects. 714 728 if ( $args['redirection']-- <= 0 ) 715 729 return new WP_Error( 'http_request_failed', __('Too many redirects.') ); … … 717 731 $redirect_location = $response['headers']['location']; 718 732 719 // If there were multiple Location headers, use the last header specified 733 // If there were multiple Location headers, use the last header specified. 720 734 if ( is_array( $redirect_location ) ) 721 735 $redirect_location = array_pop( $redirect_location ); … … 723 737 $redirect_location = WP_HTTP::make_absolute_url( $redirect_location, $url ); 724 738 725 // POST requests should not POST to a redirected location 739 // POST requests should not POST to a redirected location. 726 740 if ( 'POST' == $args['method'] ) { 727 741 if ( in_array( $response['response']['code'], array( 302, 303 ) ) ) … … 729 743 } 730 744 731 // Include valid cookies in the redirect process 745 // Include valid cookies in the redirect process. 732 746 if ( ! empty( $response['cookies'] ) ) { 733 747 foreach ( $response['cookies'] as $cookie ) { … … 806 820 } 807 821 808 // Construct Cookie: header if any cookies are set 822 // Construct Cookie: header if any cookies are set. 809 823 WP_Http::buildCookieHeader( $r ); 810 824 … … 831 845 } 832 846 833 // Certain versions of PHP have issues with 'localhost' and IPv6, It attempts to connect to ::1, 834 // which fails when the server is not set up for it. For compatibility, always connect to the IPv4 address. 847 /* 848 * Certain versions of PHP have issues with 'localhost' and IPv6, It attempts to connect 849 * to ::1, which fails when the server is not set up for it. For compatibility, always 850 * connect to the IPv4 address. 851 */ 835 852 if ( 'localhost' == strtolower( $connect_host ) ) 836 853 $connect_host = '127.0.0.1'; … … 877 894 $connect_timeout = max( $timeout, 1 ); 878 895 879 $connection_error = null; // Store error number 880 $connection_error_str = null; // Store error string 896 // Store error number. 897 $connection_error = null; 898 899 // Store error string. 900 $connection_error_str = null; 881 901 882 902 if ( !WP_DEBUG ) { 883 // In the event that the SSL connection fails, silence the many PHP Warnings 903 // In the event that the SSL connection fails, silence the many PHP Warnings. 884 904 if ( $secure_transport ) 885 905 $error_reporting = error_reporting(0); … … 901 921 902 922 if ( false === $handle ) { 903 // SSL connection failed due to expired/invalid cert, or, OpenSSL configuration is broken 923 // SSL connection failed due to expired/invalid cert, or, OpenSSL configuration is broken. 904 924 if ( $secure_transport && 0 === $connection_error && '' === $connection_error_str ) 905 925 return new WP_Error( 'http_request_failed', __( 'The SSL certificate for the host could not be verified.' ) ); … … 908 928 } 909 929 910 // Verify that the SSL certificate is valid for this request 930 // Verify that the SSL certificate is valid for this request. 911 931 if ( $secure_transport && $ssl_verify && ! $proxy->is_enabled() ) { 912 932 if ( ! self::verify_ssl_certificate( $handle, $arrURL['host'] ) ) … … 964 984 $block_size = min( $block_size, $r['limit_response_size'] ); 965 985 966 // If streaming to a file setup the file handle 986 // If streaming to a file setup the file handle. 967 987 if ( $r['stream'] ) { 968 988 if ( ! WP_DEBUG ) … … 1030 1050 $response = array( 1031 1051 'headers' => $arrHeaders['headers'], 1032 'body' => null, // Not yet processed 1052 // Not yet processed. 1053 'body' => null, 1033 1054 'response' => $arrHeaders['response'], 1034 1055 'cookies' => $arrHeaders['cookies'], … … 1036 1057 ); 1037 1058 1038 // Handle redirects 1059 // Handle redirects. 1039 1060 if ( false !== ( $redirect_response = WP_HTTP::handle_redirects( $url, $r, $response ) ) ) 1040 1061 return $redirect_response; … … 1082 1103 return false; 1083 1104 1084 // If the request is being made to an IP address, we'll validate against IP fields in the cert (if they exist) 1105 /* 1106 * If the request is being made to an IP address, we'll validate against IP fields 1107 * in the cert (if they exist) 1108 */ 1085 1109 $host_type = ( WP_HTTP::is_ip_address( $host ) ? 'ip' : 'dns' ); 1086 1110 … … 1094 1118 } 1095 1119 } elseif ( !empty( $cert['subject']['CN'] ) ) { 1096 // Only use the CN when the certificate includes no subjectAltName extension 1120 // Only use the CN when the certificate includes no subjectAltName extension. 1097 1121 $certificate_hostnames[] = strtolower( $cert['subject']['CN'] ); 1098 1122 } 1099 1123 1100 // Exact hostname/IP matches 1124 // Exact hostname/IP matches. 1101 1125 if ( in_array( strtolower( $host ), $certificate_hostnames ) ) 1102 1126 return true; 1103 1127 1104 // IP's can't be wildcards, Stop processing 1128 // IP's can't be wildcards, Stop processing. 1105 1129 if ( 'ip' == $host_type ) 1106 1130 return false; 1107 1131 1108 // Test to see if the domain is at least 2 deep for wildcard support 1132 // Test to see if the domain is at least 2 deep for wildcard support. 1109 1133 if ( substr_count( $host, '.' ) < 2 ) 1110 1134 return false; 1111 1135 1112 // Wildcard subdomains certs (*.example.com) are valid for a.example.com but not a.b.example.com 1136 // Wildcard subdomains certs (*.example.com) are valid for a.example.com but not a.b.example.com. 1113 1137 $wildcard_host = preg_replace( '/^[^.]+\./', '*.', $host ); 1114 1138 … … 1163 1187 */ 1164 1188 class WP_HTTP_Fsockopen extends WP_HTTP_Streams { 1165 // For backwards compatibility for users who are using the class directly 1189 // For backwards compatibility for users who are using the class directly. 1166 1190 } 1167 1191 … … 1271 1295 } 1272 1296 1273 // CURLOPT_TIMEOUT and CURLOPT_CONNECTTIMEOUT expect integers. Have to use ceil since 1274 // a value of 0 will allow an unlimited timeout. 1297 /* 1298 * CURLOPT_TIMEOUT and CURLOPT_CONNECTTIMEOUT expect integers. Have to use ceil since. 1299 * a value of 0 will allow an unlimited timeout. 1300 */ 1275 1301 $timeout = (int) ceil( $r['timeout'] ); 1276 1302 curl_setopt( $handle, CURLOPT_CONNECTTIMEOUT, $timeout ); … … 1283 1309 curl_setopt( $handle, CURLOPT_CAINFO, $r['sslcertificates'] ); 1284 1310 curl_setopt( $handle, CURLOPT_USERAGENT, $r['user-agent'] ); 1285 // The option doesn't work with safe mode or when open_basedir is set, and there's a 1286 // bug #17490 with redirected POST requests, so handle redirections outside Curl. 1311 1312 /* 1313 * The option doesn't work with safe mode or when open_basedir is set, and there's 1314 * a bug #17490 with redirected POST requests, so handle redirections outside Curl. 1315 */ 1287 1316 curl_setopt( $handle, CURLOPT_FOLLOWLOCATION, false ); 1288 1317 if ( defined( 'CURLOPT_PROTOCOLS' ) ) // PHP 5.2.10 / cURL 7.19.4 … … 1320 1349 $this->max_body_length = false; 1321 1350 1322 // If streaming to a file open a file handle, and setup our curl streaming handler 1351 // If streaming to a file open a file handle, and setup our curl streaming handler. 1323 1352 if ( $r['stream'] ) { 1324 1353 if ( ! WP_DEBUG ) … … 1333 1362 1334 1363 if ( !empty( $r['headers'] ) ) { 1335 // cURL expects full header strings in each element 1364 // cURL expects full header strings in each element. 1336 1365 $headers = array(); 1337 1366 foreach ( $r['headers'] as $name => $value ) { … … 1386 1415 $curl_error = curl_errno( $handle ); 1387 1416 1388 // If an error occured, or, no response 1417 // If an error occured, or, no response. 1389 1418 if ( $curl_error || ( 0 == strlen( $theBody ) && empty( $theHeaders['headers'] ) ) ) { 1390 1419 if ( CURLE_WRITE_ERROR /* 23 */ == $curl_error && $r['stream'] ) { … … 1419 1448 ); 1420 1449 1421 // Handle redirects 1450 // Handle redirects. 1422 1451 if ( false !== ( $redirect_response = WP_HTTP::handle_redirects( $url, $r, $response ) ) ) 1423 1452 return $redirect_response; … … 1468 1497 } 1469 1498 1470 // Upon event of this function returning less than strlen( $data ) curl will error with CURLE_WRITE_ERROR 1499 // Upon event of this function returning less than strlen( $data ) curl will error with CURLE_WRITE_ERROR. 1471 1500 return $bytes_written; 1472 1501 } … … 1488 1517 if ( $is_ssl ) { 1489 1518 $curl_version = curl_version(); 1490 if ( ! (CURL_VERSION_SSL & $curl_version['features']) ) // Does this cURL version support SSL requests? 1519 // Check whether this cURL version support SSL requests. 1520 if ( ! (CURL_VERSION_SSL & $curl_version['features']) ) 1491 1521 return false; 1492 1522 } … … 1658 1688 */ 1659 1689 public function send_through_proxy( $uri ) { 1660 // parse_url() only handles http, https type URLs, and will emit E_WARNING on failure. 1661 // This will be displayed on blogs, which is not reasonable. 1690 /* 1691 * parse_url() only handles http, https type URLs, and will emit E_WARNING on failure. 1692 * This will be displayed on blogs, which is not reasonable. 1693 */ 1662 1694 $check = @parse_url($uri); 1663 1695 … … 1797 1829 1798 1830 if ( is_string( $data ) ) { 1799 // Assume it's a header string direct from a previous request 1831 // Assume it's a header string direct from a previous request. 1800 1832 $pairs = explode( ';', $data ); 1801 1833 1802 // Special handling for first pair; name=value. Also be careful of "=" in value 1834 // Special handling for first pair; name=value. Also be careful of "=" in value. 1803 1835 $name = trim( substr( $pairs[0], 0, strpos( $pairs[0], '=' ) ) ); 1804 1836 $value = substr( $pairs[0], strpos( $pairs[0], '=' ) + 1 ); 1805 1837 $this->name = $name; 1806 1838 $this->value = urldecode( $value ); 1807 array_shift( $pairs ); //Removes name=value from items. 1808 1809 // Set everything else as a property 1839 1840 // Removes name=value from items. 1841 array_shift( $pairs ); 1842 1843 // Set everything else as a property. 1810 1844 foreach ( $pairs as $pair ) { 1811 1845 $pair = rtrim($pair); 1812 if ( empty($pair) ) //Handles the cookie ending in ; which results in a empty final pair 1846 1847 // Handle the cookie ending in ; which results in a empty final pair. 1848 if ( empty($pair) ) 1813 1849 continue; 1814 1850 … … 1823 1859 return false; 1824 1860 1825 // Set properties based directly on parameters 1861 // Set properties based directly on parameters. 1826 1862 foreach ( array( 'name', 'value', 'path', 'domain', 'port' ) as $field ) { 1827 1863 if ( isset( $data[ $field ] ) ) … … 1851 1887 return false; 1852 1888 1853 // Expires - if expired then nothing else matters 1889 // Expires - if expired then nothing else matters. 1854 1890 if ( isset( $this->expires ) && time() > $this->expires ) 1855 1891 return false; 1856 1892 1857 // Get details on the URL we're thinking about sending to 1893 // Get details on the URL we're thinking about sending to. 1858 1894 $url = parse_url( $url ); 1859 1895 $url['port'] = isset( $url['port'] ) ? $url['port'] : ( 'https' == $url['scheme'] ? 443 : 80 ); 1860 1896 $url['path'] = isset( $url['path'] ) ? $url['path'] : '/'; 1861 1897 1862 // Values to use for comparison against the URL 1898 // Values to use for comparison against the URL. 1863 1899 $path = isset( $this->path ) ? $this->path : '/'; 1864 1900 $port = isset( $this->port ) ? $this->port : null; … … 1867 1903 $domain .= '.local'; 1868 1904 1869 // Host - very basic check that the request URL ends with the domain restriction (minus leading dot) 1905 // Host - very basic check that the request URL ends with the domain restriction (minus leading dot). 1870 1906 $domain = substr( $domain, 0, 1 ) == '.' ? substr( $domain, 1 ) : $domain; 1871 1907 if ( substr( $url['host'], -strlen( $domain ) ) != $domain ) 1872 1908 return false; 1873 1909 1874 // Port - supports "port-lists" in the format: "80,8000,8080" 1910 // Port - supports "port-lists" in the format: "80,8000,8080". 1875 1911 if ( !empty( $port ) && !in_array( $url['port'], explode( ',', $port) ) ) 1876 1912 return false; 1877 1913 1878 // Path - request path must start with path restriction 1914 // Path - request path must start with path restriction. 1879 1915 if ( substr( $url['path'], 0, strlen( $path ) ) != $path ) 1880 1916 return false; … … 2006 2042 public static function compatible_gzinflate($gzData) { 2007 2043 2008 // Compressed data might contain a full header, if so strip it for gzinflate() 2044 // Compressed data might contain a full header, if so strip it for gzinflate(). 2009 2045 if ( substr($gzData, 0, 3) == "\x1f\x8b\x08" ) { 2010 2046 $i = 10; … … 2046 2082 $compression_enabled = WP_Http_Encoding::is_available(); 2047 2083 2048 if ( ! $args['decompress'] ) // decompression specifically disabled2084 if ( ! $args['decompress'] ) // Decompression specifically disabled. 2049 2085 $compression_enabled = false; 2050 elseif ( $args['stream'] ) // disable when streaming to file2086 elseif ( $args['stream'] ) // Disable when streaming to file. 2051 2087 $compression_enabled = false; 2052 elseif ( isset( $args['limit_response_size'] ) ) // If only partial content is being requested, we won't be able to decompress it 2088 elseif ( isset( $args['limit_response_size'] ) ) // If only partial content is being requested, we won't be able to decompress it. 2053 2089 $compression_enabled = false; 2054 2090
Note: See TracChangeset
for help on using the changeset viewer.