<?php

/**

 * Core HTTP Request API

 *

 * Standardizes the HTTP requests for WordPress. Handles cookies, gzip encoding and decoding, chunk

 * decoding, if HTTP 1.1 and various other difficult HTTP protocol implementations.

 *

 * @package WordPress

 * @subpackage HTTP

 */

/**

 * Returns the initialized WP_Http Object

 *

 * @since 2.7.0

 * @access private

 *

 * @return WP_Http HTTP Transport object.

 */

function _wp_http_get_object() {

	static $http = null;

	if ( is_null( $http ) ) {

		$http = new WP_Http();

	}

	return $http;

}

/**

 * Retrieves the raw response from a safe HTTP request.

 *

 * This function is ideal when the HTTP request is being made to an arbitrary

 * URL. The URL, and every URL it redirects to, are validated with wp_http_validate_url()

 * to avoid Server Side Request Forgery attacks (SSRF).

 *

 * @since 3.6.0

 *

 * @see wp_remote_request() For more information on the response array format.

 * @see WP_Http::request() For default arguments information.

 * @see wp_http_validate_url() For more information about how the URL is validated.

 *

 * @link https://owasp.org/www-community/attacks/Server_Side_Request_Forgery

 *

 * @param string $url  URL to retrieve.

 * @param array  $args Optional. Request arguments. Default empty array.

 *                     See WP_Http::request() for information on accepted arguments.

 * @return array|WP_Error The response or WP_Error on failure.

 */

function wp_safe_remote_request( $url, $args = array() ) {

	$args['reject_unsafe_urls'] = true;

	$http                       = _wp_http_get_object();

	return $http->request( $url, $args );

}

/**

 * Retrieves the raw response from a safe HTTP request using the GET method.

 *

 * This function is ideal when the HTTP request is being made to an arbitrary

 * URL. The URL, and every URL it redirects to, are validated with wp_http_validate_url()

 * to avoid Server Side Request Forgery attacks (SSRF).

 *

 * @since 3.6.0

 *

 * @see wp_remote_request() For more information on the response array format.

 * @see WP_Http::request() For default arguments information.

 * @see wp_http_validate_url() For more information about how the URL is validated.

 *

 * @link https://owasp.org/www-community/attacks/Server_Side_Request_Forgery

 *

 * @param string $url  URL to retrieve.

 * @param array  $args Optional. Request arguments. Default empty array.

 *                     See WP_Http::request() for information on accepted arguments.

 * @return array|WP_Error The response or WP_Error on failure.

 */

function wp_safe_remote_get( $url, $args = array() ) {

	$args['reject_unsafe_urls'] = true;

	$http                       = _wp_http_get_object();

	return $http->get( $url, $args );

}

/**

 * Retrieves the raw response from a safe HTTP request using the POST method.

 *

 * This function is ideal when the HTTP request is being made to an arbitrary

 * URL. The URL, and every URL it redirects to, are validated with wp_http_validate_url()

 * to avoid Server Side Request Forgery attacks (SSRF).

 *

 * @since 3.6.0

 *

 * @see wp_remote_request() For more information on the response array format.

 * @see WP_Http::request() For default arguments information.

 * @see wp_http_validate_url() For more information about how the URL is validated.

 *

 * @link https://owasp.org/www-community/attacks/Server_Side_Request_Forgery

 *

 * @param string $url  URL to retrieve.

 * @param array  $args Optional. Request arguments. Default empty array.

 *                     See WP_Http::request() for information on accepted arguments.

 * @return array|WP_Error The response or WP_Error on failure.

 */

function wp_safe_remote_post( $url, $args = array() ) {

	$args['reject_unsafe_urls'] = true;

	$http                       = _wp_http_get_object();

	return $http->post( $url, $args );

}

/**

 * Retrieves the raw response from a safe HTTP request using the HEAD method.

 *

 * This function is ideal when the HTTP request is being made to an arbitrary

 * URL. The URL, and every URL it redirects to, are validated with wp_http_validate_url()

 * to avoid Server Side Request Forgery attacks (SSRF).

 *

 * @since 3.6.0

 *

 * @see wp_remote_request() For more information on the response array format.

 * @see WP_Http::request() For default arguments information.

 * @see wp_http_validate_url() For more information about how the URL is validated.

 *

 * @link https://owasp.org/www-community/attacks/Server_Side_Request_Forgery

 *

 * @param string $url  URL to retrieve.

 * @param array  $args Optional. Request arguments. Default empty array.

 *                     See WP_Http::request() for information on accepted arguments.

 * @return array|WP_Error The response or WP_Error on failure.

 */

function wp_safe_remote_head( $url, $args = array() ) {

	$args['reject_unsafe_urls'] = true;

	$http                       = _wp_http_get_object();

	return $http->head( $url, $args );

}

/**

 * Performs an HTTP request and returns its response.

 *

 * There are other API functions available which abstract away the HTTP method:

 *

 *  - Default 'GET'  for wp_remote_get()

 *  - Default 'POST' for wp_remote_post()

 *  - Default 'HEAD' for wp_remote_head()

 *

 * @since 2.7.0

 *

 * @see WP_Http::request() For information on default arguments.

 *

 * @param string $url  URL to retrieve.

 * @param array  $args Optional. Request arguments. Default empty array.

 *                     See WP_Http::request() for information on accepted arguments.

 */

function wp_remote_request( $url, $args = array() ) {

	$http = _wp_http_get_object();

	return $http->request( $url, $args );

}

/**

 * Performs an HTTP request using the GET method and returns its response.

 *

 * @since 2.7.0

 *

 * @see wp_remote_request() For more information on the response array format.

 * @see WP_Http::request() For default arguments information.

 *

 * @param string $url  URL to retrieve.

 * @param array  $args Optional. Request arguments. Default empty array.

 *                     See WP_Http::request() for information on accepted arguments.

 * @return array|WP_Error The response or WP_Error on failure.

 */

function wp_remote_get( $url, $args = array() ) {

	$http = _wp_http_get_object();

	return $http->get( $url, $args );

}

/**

 * Performs an HTTP request using the POST method and returns its response.

 *

 * @since 2.7.0

 *

 * @see wp_remote_request() For more information on the response array format.

 * @see WP_Http::request() For default arguments information.

 *

 * @param string $url  URL to retrieve.

 * @param array  $args Optional. Request arguments. Default empty array.

 *                     See WP_Http::request() for information on accepted arguments.

 * @return array|WP_Error The response or WP_Error on failure.

 */

function wp_remote_post( $url, $args = array() ) {

	$http = _wp_http_get_object();

	return $http->post( $url, $args );

}

/**

 * Performs an HTTP request using the HEAD method and returns its response.

 *

 * @since 2.7.0

 *

 * @see wp_remote_request() For more information on the response array format.

 * @see WP_Http::request() For default arguments information.

 *

 * @param string $url  URL to retrieve.

 * @param array  $args Optional. Request arguments. Default empty array.

 *                     See WP_Http::request() for information on accepted arguments.

 * @return array|WP_Error The response or WP_Error on failure.

 */

function wp_remote_head( $url, $args = array() ) {

	$http = _wp_http_get_object();

	return $http->head( $url, $args );

}

/**

 * Retrieves only the headers from the raw response.

 *

 * @since 2.7.0

 * @since 4.6.0 Return value changed from an array to an WpOrg\Requests\Utility\CaseInsensitiveDictionary instance.

 *

 * @see \WpOrg\Requests\Utility\CaseInsensitiveDictionary

 *

 * @param array|WP_Error $response HTTP response.

 * @return \WpOrg\Requests\Utility\CaseInsensitiveDictionary|array The headers of the response, or empty array

 *                                                                 if incorrect parameter given.

 */

function wp_remote_retrieve_headers( $response ) {

	if ( is_wp_error( $response ) || ! isset( $response['headers'] ) ) {

		return array();

	}

	return $response['headers'];

}

/**

 * Retrieves a single header by name from the raw response.

 *

 * @since 2.7.0

 *

 * @param array|WP_Error $response HTTP response.

 * @param string         $header   Header name to retrieve value from.

 * @return array|string The header(s) value(s). Array if multiple headers with the same name are retrieved.

 *                      Empty string if incorrect parameter given, or if the header doesn't exist.

 */

function wp_remote_retrieve_header( $response, $header ) {

	if ( is_wp_error( $response ) || ! isset( $response['headers'] ) ) {

		return '';

	}

	if ( isset( $response['headers'][ $header ] ) ) {

		return $response['headers'][ $header ];

	}

	return '';

}

/**

 * Retrieves only the response code from the raw response.

 *

 * Will return an empty string if incorrect parameter value is given.

 *

 * @since 2.7.0

 *

 * @param array|WP_Error $response HTTP response.

 * @return int|string The response code as an integer. Empty string if incorrect parameter given.

 */

function wp_remote_retrieve_response_code( $response ) {

	if ( is_wp_error( $response ) || ! isset( $response['response'] ) || ! is_array( $response['response'] ) ) {

		return '';

	}

	return $response['response']['code'];

}

/**

 * Retrieves only the response message from the raw response.

 *

 * Will return an empty string if incorrect parameter value is given.

 *

 * @since 2.7.0

 *

 * @param array|WP_Error $response HTTP response.

 * @return string The response message. Empty string if incorrect parameter given.

 */

function wp_remote_retrieve_response_message( $response ) {

	if ( is_wp_error( $response ) || ! isset( $response['response'] ) || ! is_array( $response['response'] ) ) {

		return '';

	}

	return $response['response']['message'];

}

/**

 * Retrieves only the body from the raw response.

 *

 * @since 2.7.0

 *

 * @param array|WP_Error $response HTTP response.

 * @return string The body of the response. Empty string if no body or incorrect parameter given.

 */

function wp_remote_retrieve_body( $response ) {

	if ( is_wp_error( $response ) || ! isset( $response['body'] ) ) {

		return '';

	}

	return $response['body'];

}

/**

 * Retrieves only the cookies from the raw response.

 *

 * @since 4.4.0

 *

 * @param array|WP_Error $response HTTP response.

 * @return WP_Http_Cookie[] An array of `WP_Http_Cookie` objects from the response.

 *                          Empty array if there are none, or the response is a WP_Error.

 */

function wp_remote_retrieve_cookies( $response ) {

	if ( is_wp_error( $response ) || empty( $response['cookies'] ) ) {

		return array();

	}

	return $response['cookies'];

}

/**

 * Retrieves a single cookie by name from the raw response.

 *

 * @since 4.4.0

 *

 * @param array|WP_Error $response HTTP response.

 * @param string         $name     The name of the cookie to retrieve.

 * @return WP_Http_Cookie|string The `WP_Http_Cookie` object, or empty string

 *                               if the cookie is not present in the response.

 */

function wp_remote_retrieve_cookie( $response, $name ) {

	$cookies = wp_remote_retrieve_cookies( $response );

	if ( empty( $cookies ) ) {

		return '';

	}

	foreach ( $cookies as $cookie ) {

		if ( $cookie->name === $name ) {

			return $cookie;

		}

	}

	return '';

}

/**

 * Retrieves a single cookie's value by name from the raw response.

 *

 * @since 4.4.0

 *

 * @param array|WP_Error $response HTTP response.

 * @param string         $name     The name of the cookie to retrieve.

 * @return string The value of the cookie, or empty string

 *                if the cookie is not present in the response.

 */

function wp_remote_retrieve_cookie_value( $response, $name ) {

	$cookie = wp_remote_retrieve_cookie( $response, $name );

	if ( ! ( $cookie instanceof WP_Http_Cookie ) ) {

		return '';

	}

	return $cookie->value;

}

/**

 * Determines if there is an HTTP Transport that can process this request.

 *

 * @since 3.2.0

 *

 * @param array  $capabilities Array of capabilities to test or a wp_remote_request() $args array.

 * @param string $url          Optional. If given, will check if the URL requires SSL and adds

 *                             that requirement to the capabilities array.

 *

 * @return bool

 */

function wp_http_supports( $capabilities = array(), $url = null ) {

	$capabilities = wp_parse_args( $capabilities );

	$count = count( $capabilities );

	// If we have a numeric $capabilities array, spoof a wp_remote_request() associative $args array.

	if ( $count && count( array_filter( array_keys( $capabilities ), 'is_numeric' ) ) === $count ) {

		$capabilities = array_combine( array_values( $capabilities ), array_fill( 0, $count, true ) );

	}

	if ( $url && ! isset( $capabilities['ssl'] ) ) {

		$scheme = parse_url( $url, PHP_URL_SCHEME );

		if ( 'https' === $scheme || 'ssl' === $scheme ) {

			$capabilities['ssl'] = true;

		}

	}

}

/**

 * Gets the HTTP Origin of the current request.

 *

 * @since 3.4.0

 *

 * @return string URL of the origin. Empty string if no origin.

 */

function get_http_origin() {

	$origin = '';

	if ( ! empty( $_SERVER['HTTP_ORIGIN'] ) ) {

		$origin = $_SERVER['HTTP_ORIGIN'];

	}

	/**

	 * Changes the origin of an HTTP request.

	 *

	 * @since 3.4.0

	 *

	 * @param string $origin The original origin for the request.

	 */

	return apply_filters( 'http_origin', $origin );

}

/**

 * Retrieves list of allowed HTTP origins.

 *

 * @since 3.4.0