Changeset 2784613
- Timestamp:
- 09/14/2022 01:03:35 PM (4 years ago)
- Location:
- integromat-connector
- Files:
-
- 6 edited
-
tags/1.5.3/api/authentication.php (modified) (1 diff)
-
tags/1.5.3/class/class-guard.php (modified) (1 diff)
-
tags/1.5.3/class/class-logger.php (modified) (3 diffs)
-
trunk/api/authentication.php (modified) (1 diff)
-
trunk/class/class-guard.php (modified) (1 diff)
-
trunk/class/class-logger.php (modified) (3 diffs)
Legend:
- Unmodified
- Added
- Removed
-
integromat-connector/tags/1.5.3/api/authentication.php
r2783423 r2784613 32 32 if ( isset( $_SERVER['HTTP_IWC_API_KEY'] ) && ! empty( $_SERVER['HTTP_IWC_API_KEY'] ) ) { 33 33 34 $token = $_SERVER['HTTP_IWC_API_KEY'];34 $token = sanitize_text_field( $_SERVER['HTTP_IWC_API_KEY'] ); 35 35 36 36 if ( strlen( $token ) !== \Integromat\Api_Token::API_TOKEN_LENGTH || ! \Integromat\Api_Token::is_valid( $token ) ) { -
integromat-connector/tags/1.5.3/class/class-guard.php
r2783423 r2784613 11 11 $entities = array( 'posts', 'users', 'comments', 'tags', 'categories', 'media' ); 12 12 $json_ase = str_replace( get_site_url(), '', get_rest_url( null, 'wp/v2/' ) ); 13 $endpoint = str_replace( $json_base, '', esc_url( $_SERVER['REQUEST_URI'] ) );13 $endpoint = str_replace( $json_base, '', sanitize_url( $_SERVER['REQUEST_URI'] ) ); 14 14 $f = explode( '/', $endpoint ); 15 15 return in_array( $f[0], $entities, true ) && in_array( $_SERVER['REQUEST_METHOD'], array( 'POST', 'PUT', 'DELETE' ) ); -
integromat-connector/tags/1.5.3/class/class-logger.php
r2783423 r2784613 25 25 $init = 'Log file initiated @ ' . date( 'Y-m-d G:i:s' ) . "\n=SERVER INFO START="; 26 26 $server_data = $_SERVER; 27 $server_data['REQUEST_URI'] = self::strip_request_query( esc_url_raw( $_SERVER['REQUEST_URI'] ) ); 28 $server_data['HTTP_IWC_API_KEY'] = ( isset( $server_data['HTTP_IWC_API_KEY'] ) ? substr( $_SERVER['HTTP_IWC_API_KEY'], 0, 5 ) . '...' : 'Not Provided' ); 27 $server_data['REQUEST_URI'] = self::strip_request_query( sanitize_url( $_SERVER['REQUEST_URI'] ) ); 28 $server_data['HTTP_IWC_API_KEY'] = ( isset( $server_data['HTTP_IWC_API_KEY'] ) ? substr( sanitize_text_field( $_SERVER['HTTP_IWC_API_KEY'] ), 0, 5 ) . '...' : 'Not Provided' ); 29 30 $server_data['SERVER_SOFTWARE'] = sanitize_text_field( $_SERVER['SERVER_SOFTWARE'] ); 31 $server_data['REQUEST_URI'] = sanitize_url( $_SERVER['REQUEST_URI'] ); 32 $server_data['REDIRECT_UNIQUE_ID'] = sanitize_text_field( $_SERVER['REDIRECT_UNIQUE_ID'] ); 33 34 $server_data['REDIRECT_STATUS'] = sanitize_text_field( $_SERVER['REDIRECT_STATUS'] ); 35 $server_data['UNIQUE_ID'] = sanitize_text_field( $_SERVER['UNIQUE_ID'] ); 36 $server_data['HTTP_X_DATADOG_SAMPLING_PRIORITY'] = sanitize_text_field( $_SERVER['HTTP_X_DATADOG_SAMPLING_PRIORITY'] ); 37 $server_data['HTTP_X_DATADOG_SAMPLED'] = sanitize_text_field( $_SERVER['HTTP_X_DATADOG_SAMPLED'] ); 38 $server_data['HTTP_X_DATADOG_PARENT_ID'] = sanitize_text_field( $_SERVER['HTTP_X_DATADOG_PARENT_ID'] ); 39 40 $server_data['HTTP_X_DATADOG_TRACE_ID'] = sanitize_text_field( $_SERVER['HTTP_X_DATADOG_TRACE_ID'] ); 41 $server_data['CONTENT_TYPE'] = sanitize_text_field( $_SERVER['CONTENT_TYPE'] ); 42 $server_data['HTTP_USER_AGENT'] = sanitize_text_field( $_SERVER['HTTP_USER_AGENT'] ); 43 $server_data['HTTP_X_FORWARDED_PORT'] = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_PORT'] ); 44 45 $server_data['HTTP_X_FORWARDED_SSL'] = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_SSL'] ); 46 $server_data['HTTP_X_FORWARDED_PROTO'] = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_PROTO'] ); 47 $server_data['HTTP_X_FORWARDED_FOR'] = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_FOR'] ); 48 $server_data['HTTP_X_REAL_IP'] = sanitize_text_field( $_SERVER['HTTP_X_REAL_IP'] ); 49 $server_data['HTTP_CONNECTION'] = sanitize_text_field( $_SERVER['HTTP_CONNECTION'] ); 50 $server_data['HTTP_HOST'] = sanitize_text_field( $_SERVER['HTTP_HOST'] ); 51 $server_data['HTTP_X_FORWARDED_HOST'] = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_HOST'] ); 52 $server_data['PATH'] = sanitize_text_field( $_SERVER['PATH'] ); 53 $server_data['DYLD_LIBRARY_PATH'] = sanitize_text_field( $_SERVER['DYLD_LIBRARY_PATH'] ); 54 $server_data['SERVER_SIGNATURE'] = sanitize_text_field( $_SERVER['SERVER_SIGNATURE'] ); 55 $server_data['SERVER_NAME'] = sanitize_text_field( $_SERVER['SERVER_NAME'] ); 56 $server_data['SERVER_ADDR'] = sanitize_text_field( $_SERVER['SERVER_ADDR'] ); 57 $server_data['SERVER_PORT'] = sanitize_text_field( $_SERVER['SERVER_PORT'] ); 58 $server_data['REMOTE_ADDR'] = sanitize_text_field( $_SERVER['REMOTE_ADDR'] ); 59 $server_data['DOCUMENT_ROOT'] = sanitize_text_field( $_SERVER['DOCUMENT_ROOT'] ); 60 $server_data['REQUEST_SCHEME'] = sanitize_text_field( $_SERVER['REQUEST_SCHEME'] ); 61 $server_data['CONTEXT_PREFIX'] = sanitize_text_field( $_SERVER['CONTEXT_PREFIX'] ); 62 $server_data['CONTEXT_DOCUMENT_ROOT'] = sanitize_text_field( $_SERVER['CONTEXT_DOCUMENT_ROOT'] ); 63 $server_data['SERVER_ADMIN'] = sanitize_email( $_SERVER['SERVER_ADMIN'] ); 64 $server_data['SCRIPT_FILENAME'] = sanitize_text_field( $_SERVER['SCRIPT_FILENAME'] ); 65 $server_data['REMOTE_PORT'] = sanitize_text_field( $_SERVER['REMOTE_PORT'] ); 66 $server_data['REDIRECT_URL'] = sanitize_text_field( $_SERVER['REDIRECT_URL'] ); 67 $server_data['GATEWAY_INTERFACE'] = sanitize_text_field( $_SERVER['GATEWAY_INTERFACE'] ); 68 $server_data['SERVER_PROTOCOL'] = sanitize_text_field( $_SERVER['SERVER_PROTOCOL'] ); 69 $server_data['REQUEST_METHOD'] = sanitize_text_field( $_SERVER['REQUEST_METHOD'] ); 70 $server_data['SCRIPT_NAME'] = sanitize_text_field( $_SERVER['SCRIPT_NAME'] ); 71 $server_data['PHP_SELF'] = sanitize_text_field( $_SERVER['PHP_SELF'] ); 72 $server_data['REQUEST_TIME_FLOAT'] = sanitize_text_field( $_SERVER['REQUEST_TIME_FLOAT'] ); 73 $server_data['REQUEST_TIME'] = sanitize_text_field( $_SERVER['REQUEST_TIME'] ); 74 75 /* 29 76 unset( $server_data['QUERY_STRING'] ); 30 77 unset( $server_data['REDIRECT_QUERY_STRING'] ); … … 38 85 $server_data['PHP_AUTH_PW'] = '*******'; 39 86 } 87 */ 40 88 $init .= str_replace( 'Array', '', print_r( $server_data, true ) ) . "=SERVER INFO END=\n\n"; 41 89 file_put_contents( self::get_file_location(), self::encrypt( $init ) ); … … 64 112 private static function get_record( $codes ) { 65 113 $r = array( 66 'request' => $_SERVER['REQUEST_METHOD'] . ' ' . self::strip_request_query( esc_url_raw( $_SERVER['REQUEST_URI'] ) ),67 'ip' => esc_url( $_SERVER['REMOTE_ADDR'] ),114 'request' => sanitize_text_field( $_SERVER['REQUEST_METHOD'] ) . ' ' . self::strip_request_query( sanitize_url( $_SERVER['REQUEST_URI'] ) ), 115 'ip' => sanitize_url( $_SERVER['REMOTE_ADDR'] ), 68 116 'codes' => $codes . '(' . (string) is_user_logged_in() . ')', 69 117 ); -
integromat-connector/trunk/api/authentication.php
r2783423 r2784613 32 32 if ( isset( $_SERVER['HTTP_IWC_API_KEY'] ) && ! empty( $_SERVER['HTTP_IWC_API_KEY'] ) ) { 33 33 34 $token = $_SERVER['HTTP_IWC_API_KEY'];34 $token = sanitize_text_field( $_SERVER['HTTP_IWC_API_KEY'] ); 35 35 36 36 if ( strlen( $token ) !== \Integromat\Api_Token::API_TOKEN_LENGTH || ! \Integromat\Api_Token::is_valid( $token ) ) { -
integromat-connector/trunk/class/class-guard.php
r2783423 r2784613 11 11 $entities = array( 'posts', 'users', 'comments', 'tags', 'categories', 'media' ); 12 12 $json_ase = str_replace( get_site_url(), '', get_rest_url( null, 'wp/v2/' ) ); 13 $endpoint = str_replace( $json_base, '', esc_url( $_SERVER['REQUEST_URI'] ) );13 $endpoint = str_replace( $json_base, '', sanitize_url( $_SERVER['REQUEST_URI'] ) ); 14 14 $f = explode( '/', $endpoint ); 15 15 return in_array( $f[0], $entities, true ) && in_array( $_SERVER['REQUEST_METHOD'], array( 'POST', 'PUT', 'DELETE' ) ); -
integromat-connector/trunk/class/class-logger.php
r2783423 r2784613 25 25 $init = 'Log file initiated @ ' . date( 'Y-m-d G:i:s' ) . "\n=SERVER INFO START="; 26 26 $server_data = $_SERVER; 27 $server_data['REQUEST_URI'] = self::strip_request_query( esc_url_raw( $_SERVER['REQUEST_URI'] ) ); 28 $server_data['HTTP_IWC_API_KEY'] = ( isset( $server_data['HTTP_IWC_API_KEY'] ) ? substr( $_SERVER['HTTP_IWC_API_KEY'], 0, 5 ) . '...' : 'Not Provided' ); 27 $server_data['REQUEST_URI'] = self::strip_request_query( sanitize_url( $_SERVER['REQUEST_URI'] ) ); 28 $server_data['HTTP_IWC_API_KEY'] = ( isset( $server_data['HTTP_IWC_API_KEY'] ) ? substr( sanitize_text_field( $_SERVER['HTTP_IWC_API_KEY'] ), 0, 5 ) . '...' : 'Not Provided' ); 29 30 $server_data['SERVER_SOFTWARE'] = sanitize_text_field( $_SERVER['SERVER_SOFTWARE'] ); 31 $server_data['REQUEST_URI'] = sanitize_url( $_SERVER['REQUEST_URI'] ); 32 $server_data['REDIRECT_UNIQUE_ID'] = sanitize_text_field( $_SERVER['REDIRECT_UNIQUE_ID'] ); 33 34 $server_data['REDIRECT_STATUS'] = sanitize_text_field( $_SERVER['REDIRECT_STATUS'] ); 35 $server_data['UNIQUE_ID'] = sanitize_text_field( $_SERVER['UNIQUE_ID'] ); 36 $server_data['HTTP_X_DATADOG_SAMPLING_PRIORITY'] = sanitize_text_field( $_SERVER['HTTP_X_DATADOG_SAMPLING_PRIORITY'] ); 37 $server_data['HTTP_X_DATADOG_SAMPLED'] = sanitize_text_field( $_SERVER['HTTP_X_DATADOG_SAMPLED'] ); 38 $server_data['HTTP_X_DATADOG_PARENT_ID'] = sanitize_text_field( $_SERVER['HTTP_X_DATADOG_PARENT_ID'] ); 39 40 $server_data['HTTP_X_DATADOG_TRACE_ID'] = sanitize_text_field( $_SERVER['HTTP_X_DATADOG_TRACE_ID'] ); 41 $server_data['CONTENT_TYPE'] = sanitize_text_field( $_SERVER['CONTENT_TYPE'] ); 42 $server_data['HTTP_USER_AGENT'] = sanitize_text_field( $_SERVER['HTTP_USER_AGENT'] ); 43 $server_data['HTTP_X_FORWARDED_PORT'] = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_PORT'] ); 44 45 $server_data['HTTP_X_FORWARDED_SSL'] = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_SSL'] ); 46 $server_data['HTTP_X_FORWARDED_PROTO'] = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_PROTO'] ); 47 $server_data['HTTP_X_FORWARDED_FOR'] = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_FOR'] ); 48 $server_data['HTTP_X_REAL_IP'] = sanitize_text_field( $_SERVER['HTTP_X_REAL_IP'] ); 49 $server_data['HTTP_CONNECTION'] = sanitize_text_field( $_SERVER['HTTP_CONNECTION'] ); 50 $server_data['HTTP_HOST'] = sanitize_text_field( $_SERVER['HTTP_HOST'] ); 51 $server_data['HTTP_X_FORWARDED_HOST'] = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_HOST'] ); 52 $server_data['PATH'] = sanitize_text_field( $_SERVER['PATH'] ); 53 $server_data['DYLD_LIBRARY_PATH'] = sanitize_text_field( $_SERVER['DYLD_LIBRARY_PATH'] ); 54 $server_data['SERVER_SIGNATURE'] = sanitize_text_field( $_SERVER['SERVER_SIGNATURE'] ); 55 $server_data['SERVER_NAME'] = sanitize_text_field( $_SERVER['SERVER_NAME'] ); 56 $server_data['SERVER_ADDR'] = sanitize_text_field( $_SERVER['SERVER_ADDR'] ); 57 $server_data['SERVER_PORT'] = sanitize_text_field( $_SERVER['SERVER_PORT'] ); 58 $server_data['REMOTE_ADDR'] = sanitize_text_field( $_SERVER['REMOTE_ADDR'] ); 59 $server_data['DOCUMENT_ROOT'] = sanitize_text_field( $_SERVER['DOCUMENT_ROOT'] ); 60 $server_data['REQUEST_SCHEME'] = sanitize_text_field( $_SERVER['REQUEST_SCHEME'] ); 61 $server_data['CONTEXT_PREFIX'] = sanitize_text_field( $_SERVER['CONTEXT_PREFIX'] ); 62 $server_data['CONTEXT_DOCUMENT_ROOT'] = sanitize_text_field( $_SERVER['CONTEXT_DOCUMENT_ROOT'] ); 63 $server_data['SERVER_ADMIN'] = sanitize_email( $_SERVER['SERVER_ADMIN'] ); 64 $server_data['SCRIPT_FILENAME'] = sanitize_text_field( $_SERVER['SCRIPT_FILENAME'] ); 65 $server_data['REMOTE_PORT'] = sanitize_text_field( $_SERVER['REMOTE_PORT'] ); 66 $server_data['REDIRECT_URL'] = sanitize_text_field( $_SERVER['REDIRECT_URL'] ); 67 $server_data['GATEWAY_INTERFACE'] = sanitize_text_field( $_SERVER['GATEWAY_INTERFACE'] ); 68 $server_data['SERVER_PROTOCOL'] = sanitize_text_field( $_SERVER['SERVER_PROTOCOL'] ); 69 $server_data['REQUEST_METHOD'] = sanitize_text_field( $_SERVER['REQUEST_METHOD'] ); 70 $server_data['SCRIPT_NAME'] = sanitize_text_field( $_SERVER['SCRIPT_NAME'] ); 71 $server_data['PHP_SELF'] = sanitize_text_field( $_SERVER['PHP_SELF'] ); 72 $server_data['REQUEST_TIME_FLOAT'] = sanitize_text_field( $_SERVER['REQUEST_TIME_FLOAT'] ); 73 $server_data['REQUEST_TIME'] = sanitize_text_field( $_SERVER['REQUEST_TIME'] ); 74 75 /* 29 76 unset( $server_data['QUERY_STRING'] ); 30 77 unset( $server_data['REDIRECT_QUERY_STRING'] ); … … 38 85 $server_data['PHP_AUTH_PW'] = '*******'; 39 86 } 87 */ 40 88 $init .= str_replace( 'Array', '', print_r( $server_data, true ) ) . "=SERVER INFO END=\n\n"; 41 89 file_put_contents( self::get_file_location(), self::encrypt( $init ) ); … … 64 112 private static function get_record( $codes ) { 65 113 $r = array( 66 'request' => $_SERVER['REQUEST_METHOD'] . ' ' . self::strip_request_query( esc_url_raw( $_SERVER['REQUEST_URI'] ) ),67 'ip' => esc_url( $_SERVER['REMOTE_ADDR'] ),114 'request' => sanitize_text_field( $_SERVER['REQUEST_METHOD'] ) . ' ' . self::strip_request_query( sanitize_url( $_SERVER['REQUEST_URI'] ) ), 115 'ip' => sanitize_url( $_SERVER['REMOTE_ADDR'] ), 68 116 'codes' => $codes . '(' . (string) is_user_logged_in() . ')', 69 117 );
Note: See TracChangeset
for help on using the changeset viewer.