enmi-conf.org: comparison wp/wp-includes/http.php

equal deleted inserted replaced

-:346c88efed21
+:5e2f62d02dcd
 /**
 * Simple and uniform HTTP request API.
 *
 * Will eventually replace and standardize the WordPress HTTP requests made.
 *
-* @link http://trac.wordpress.org/ticket/4779 HTTP API Proposal
+* @link https://core.trac.wordpress.org/ticket/4779 HTTP API Proposal
 *
 * @package WordPress
 * @subpackage HTTP
 * @since 2.7.0
 */
 * Retrieve the raw response from a safe HTTP request.
 *
 * This function is ideal when the HTTP request is being made to an arbitrary
 * URL. The URL is validated to avoid redirection and request forgery attacks.
 *
-* @see wp_remote_request() For more information on the response array format
-* 	and default arguments.
-*
 * @since 3.6.0
 *
-* @param string $url Site URL to retrieve.
+* @see wp_remote_request() For more information on the response array format.
-* @param array $args Optional. Override the defaults.
+* @see WP_Http::request() For default arguments information.
+*
+* @param string $url  Site URL to retrieve.
+* @param array  $args Optional. Request arguments. Default empty array.
 * @return WP_Error|array The response or WP_Error on failure.
 */
 function wp_safe_remote_request( $url, $args = array() ) {
 	$args['reject_unsafe_urls'] = true;
 	$http = _wp_http_get_object();
 * Retrieve the raw response from a safe HTTP request using the GET method.
 *
 * This function is ideal when the HTTP request is being made to an arbitrary
 * URL. The URL is validated to avoid redirection and request forgery attacks.
 *
-* @see wp_remote_request() For more information on the response array format
-* 	and default arguments.
-*
 * @since 3.6.0
 *
-* @param string $url Site URL to retrieve.
+* @see wp_remote_request() For more information on the response array format.
-* @param array $args Optional. Override the defaults.
+* @see WP_Http::request() For default arguments information.
+*
+* @param string $url  Site URL to retrieve.
+* @param array  $args Optional. Request arguments. Default empty array.
 * @return WP_Error|array The response or WP_Error on failure.
 */
 function wp_safe_remote_get( $url, $args = array() ) {
 	$args['reject_unsafe_urls'] = true;
 	$http = _wp_http_get_object();
 * Retrieve the raw response from a safe HTTP request using the POST method.
 *
 * This function is ideal when the HTTP request is being made to an arbitrary
 * URL. The URL is validated to avoid redirection and request forgery attacks.
 *
-* @see wp_remote_request() For more information on the response array format
-* 	and default arguments.
-*
 * @since 3.6.0
 *
-* @param string $url Site URL to retrieve.
+* @see wp_remote_request() For more information on the response array format.
-* @param array $args Optional. Override the defaults.
+* @see WP_Http::request() For default arguments information.
+*
+* @param string $url  Site URL to retrieve.
+* @param array  $args Optional. Request arguments. Default empty array.
 * @return WP_Error|array The response or WP_Error on failure.
 */
 function wp_safe_remote_post( $url, $args = array() ) {
 	$args['reject_unsafe_urls'] = true;
 	$http = _wp_http_get_object();
 * Retrieve the raw response from a safe HTTP request using the HEAD method.
 *
 * This function is ideal when the HTTP request is being made to an arbitrary
 * URL. The URL is validated to avoid redirection and request forgery attacks.
 *
-* @see wp_remote_request() For more information on the response array format
-* 	and default arguments.
-*
 * @since 3.6.0
 *
+* @see wp_remote_request() For more information on the response array format.
+* @see WP_Http::request() For default arguments information.
+*
 * @param string $url Site URL to retrieve.
-* @param array $args Optional. Override the defaults.
+* @param array $args Optional. Request arguments. Default empty array.
 * @return WP_Error|array The response or WP_Error on failure.
 */
 function wp_safe_remote_head( $url, $args = array() ) {
 	$args['reject_unsafe_urls'] = true;
 	$http = _wp_http_get_object();
 }
 /**
 * Retrieve the raw response from the HTTP request.
 *
-* The array structure is a little complex.
+* The array structure is a little complex:
 *
-* <code>
+*     $res = array(
-* $res = array( 'headers' => array(), 'response' => array('code' => int, 'message' => string) );
+*         'headers'  => array(),
-* </code>
+*         'response' => array(
+*             'code'    => int,
+*             'message' => string
+*         )
+*     );
 *
 * All of the headers in $res['headers'] are with the name as the key and the
 * value as the value. So to get the User-Agent, you would do the following.
 *
-* <code>
+*     $user_agent = $res['headers']['user-agent'];
-* $user_agent = $res['headers']['user-agent'];
-* </code>
 *
 * The body is the raw response content and can be retrieved from $res['body'].
 *
 * This function is called first to make the request and there are other API
 * functions to abstract out the above convoluted setup.
 *
-* List of default arguments:
+* Request method defaults for helper functions:
-* 'method'      => 'GET'
 *  - Default 'GET'  for wp_remote_get()
 *  - Default 'POST' for wp_remote_post()
 *  - Default 'HEAD' for wp_remote_head()
-* 'timeout'     => 5
+*
-* 'redirection' => 5
+* @since 2.7.0
-* 'httpversion' => '1.0'
+*
-* 'user-agent'  => 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' )
+* @see WP_Http::request() For additional information on default arguments.
-* 'blocking'    => true
+*
-* 'headers'     => array()
+* @param string $url  Site URL to retrieve.
-* 'cookies'     => array()
+* @param array  $args Optional. Request arguments. Default empty array.
-* 'body'        => null
-* 'compress'    => false,
-* 'decompress'  => true,
-* 'sslverify'   => true,
-* 'stream'      => false,
-* 'filename'    => null
-*
-* @since 2.7.0
-*
-* @param string $url Site URL to retrieve.
-* @param array $args Optional. Override the defaults.
 * @return WP_Error|array The response or WP_Error on failure.
 */
 function wp_remote_request($url, $args = array()) {
 	$objFetchSite = _wp_http_get_object();
 	return $objFetchSite->request($url, $args);
 }
 /**
 * Retrieve the raw response from the HTTP request using the GET method.
 *
-* @see wp_remote_request() For more information on the response array format and default arguments.
+* @since 2.7.0
 *
-* @since 2.7.0
+* @see wp_remote_request() For more information on the response array format.
-*
+* @see WP_Http::request() For default arguments information.
-* @param string $url Site URL to retrieve.
+*
-* @param array $args Optional. Override the defaults.
+* @param string $url  Site URL to retrieve.
+* @param array  $args Optional. Request arguments. Default empty array.
 * @return WP_Error|array The response or WP_Error on failure.
 */
 function wp_remote_get($url, $args = array()) {
 	$objFetchSite = _wp_http_get_object();
 	return $objFetchSite->get($url, $args);
 }
 /**
 * Retrieve the raw response from the HTTP request using the POST method.
 *
-* @see wp_remote_request() For more information on the response array format and default arguments.
+* @since 2.7.0
 *
-* @since 2.7.0
+* @see wp_remote_request() For more information on the response array format.
-*
+* @see WP_Http::request() For default arguments information.
-* @param string $url Site URL to retrieve.
+*
-* @param array $args Optional. Override the defaults.
+* @param string $url  Site URL to retrieve.
+* @param array  $args Optional. Request arguments. Default empty array.
 * @return WP_Error|array The response or WP_Error on failure.
 */
 function wp_remote_post($url, $args = array()) {
 	$objFetchSite = _wp_http_get_object();
 	return $objFetchSite->post($url, $args);
 }
 /**
 * Retrieve the raw response from the HTTP request using the HEAD method.
 *
-* @see wp_remote_request() For more information on the response array format and default arguments.
+* @since 2.7.0
 *
-* @since 2.7.0
+* @see wp_remote_request() For more information on the response array format.
-*
+* @see WP_Http::request() For default arguments information.
-* @param string $url Site URL to retrieve.
+*
-* @param array $args Optional. Override the defaults.
+* @param string $url  Site URL to retrieve.
+* @param array  $args Optional. Request arguments. Default empty array.
 * @return WP_Error|array The response or WP_Error on failure.
 */
 function wp_remote_head($url, $args = array()) {
 	$objFetchSite = _wp_http_get_object();
 	return $objFetchSite->head($url, $args);
 * @since 2.7.0
 *
 * @param array $response HTTP response.
 * @return array The headers of the response. Empty array if incorrect parameter given.
 */
-function wp_remote_retrieve_headers(&$response) {
+function wp_remote_retrieve_headers( $response ) {
 	if ( is_wp_error($response) || ! isset($response['headers']) || ! is_array($response['headers']))
 		return array();
 	return $response['headers'];
 }
 *
 * @param array $response
 * @param string $header Header name to retrieve value from.
 * @return string The header value. Empty string on if incorrect parameter given, or if the header doesn't exist.
 */
-function wp_remote_retrieve_header(&$response, $header) {
+function wp_remote_retrieve_header( $response, $header ) {
 	if ( is_wp_error($response) || ! isset($response['headers']) || ! is_array($response['headers']))
 		return '';
 	if ( array_key_exists($header, $response['headers']) )
 		return $response['headers'][$header];
 * Will return an empty array if incorrect parameter value is given.
 *
 * @since 2.7.0
 *
 * @param array $response HTTP response.
-* @return string the response code. Empty string on incorrect parameter given.
+* @return int|string The response code as an integer. Empty string on incorrect parameter given.
 */
-function wp_remote_retrieve_response_code(&$response) {
+function wp_remote_retrieve_response_code( $response ) {
 	if ( is_wp_error($response) || ! isset($response['response']) || ! is_array($response['response']))
 		return '';
 	return $response['response']['code'];
 }
 * @since 2.7.0
 *
 * @param array $response HTTP response.
 * @return string The response message. Empty string on incorrect parameter given.
 */
-function wp_remote_retrieve_response_message(&$response) {
+function wp_remote_retrieve_response_message( $response ) {
 	if ( is_wp_error($response) || ! isset($response['response']) || ! is_array($response['response']))
 		return '';
 	return $response['response']['message'];
 }
 * @since 2.7.0
 *
 * @param array $response HTTP response.
 * @return string The body of the response. Empty string if no body or incorrect parameter given.
 */
-function wp_remote_retrieve_body(&$response) {
+function wp_remote_retrieve_body( $response ) {
 	if ( is_wp_error($response) || ! isset($response['body']) )
 		return '';
 	return $response['body'];
 }
 /**
 * Determines if the HTTP origin is an authorized one.
 *
 * @since 3.4.0
 *
-* @param string Origin URL. If not provided, the value of get_http_origin() is used.
+* @param null|string $origin Origin URL. If not provided, the value of get_http_origin() is used.
-* @return bool True if the origin is allowed. False otherwise.
+* @return bool|null True if the origin is allowed. False otherwise.
 */
 function is_allowed_http_origin( $origin = null ) {
 	$origin_arg = $origin;
 	if ( null === $origin )
 /**
 * Validate a URL for safe use in the HTTP API.
 *
 * @since 3.5.2
 *
-* @return mixed URL or false on failure.
+* @param string $url
+* @return false|string URL or false on failure.
 */
 function wp_http_validate_url( $url ) {
+	$original_url = $url;
 	$url = wp_kses_bad_protocol( $url, array( 'http', 'https' ) );
-	if ( ! $url )
+	if ( ! $url || strtolower( $url ) !== strtolower( $original_url ) )
 		return false;
 	$parsed_url = @parse_url( $url );
 	if ( ! $parsed_url || empty( $parsed_url['host'] ) )
 		return false;
 	if ( isset( $parsed_url['user'] ) || isset( $parsed_url['pass'] ) )
 		return false;
-	if ( false !== strpos( $parsed_url['host'], ':' ) )
+	if ( false !== strpbrk( $parsed_url['host'], ':#?[]' ) )
 		return false;
 	$parsed_home = @parse_url( get_option( 'home' ) );
 	$same_host = strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );
 			if ( $ip === $host ) // Error condition for gethostbyname()
 				$ip = false;
 		}
 		if ( $ip ) {
 			$parts = array_map( 'intval', explode( '.', $ip ) );
-			if ( '127.0.0.1' === $ip
+			if ( 127 === $parts[0] || 10 === $parts[0]
-				|| ( 10 === $parts[0] )
 				|| ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
 				|| ( 192 === $parts[0] && 168 === $parts[1] )
 			) {
 				// If host appears local, reject unless specifically allowed.
 				/**
 	$port = $parsed_url['port'];
 	if ( 80 === $port || 443 === $port || 8080 === $port )
 		return $url;
-	if ( $parsed_home && $same_host && $parsed_home['port'] === $port )
+	if ( $parsed_home && $same_host && isset( $parsed_home['port'] ) && $parsed_home['port'] === $port )
 		return $url;
 	return false;
 }
 * @param bool $is_external
 * @param string $host
 * @return bool
 */
 function ms_allowed_http_request_hosts( $is_external, $host ) {
-	global $wpdb, $current_site;
+	global $wpdb;
 	static $queried = array();
 	if ( $is_external )
 		return $is_external;
-	if ( $host === $current_site->domain )
+	if ( $host === get_current_site()->domain )
 		return true;
 	if ( isset( $queried[ $host ] ) )
 		return $queried[ $host ];
 	$queried[ $host ] = (bool) $wpdb->get_var( $wpdb->prepare( "SELECT domain FROM $wpdb->blogs WHERE domain = %s LIMIT 1", $host ) );
 	return $queried[ $host ];

changeset 5	5e2f62d02dcd
parent 0	d970ebf37754
child 7	cf61fcea0001