1 <?php

     2 /**

     3  * Simple and uniform HTTP request API.

     4  *

     5  * Will eventually replace and standardize the WordPress HTTP requests made.

     6  *

     7  * @link http://trac.wordpress.org/ticket/4779 HTTP API Proposal

     8  *

     9  * @package WordPress

    10  * @subpackage HTTP

    11  * @since 2.7.0

    12  */

    13 

    14 /**

    15  * Returns the initialized WP_Http Object

    16  *

    17  * @since 2.7.0

    18  * @access private

    19  *

    20  * @return WP_Http HTTP Transport object.

    21  */

    22 function _wp_http_get_object() {

    23 	static $http;

    24 

    25 	if ( is_null($http) )

    26 		$http = new WP_Http();

    27 

    28 	return $http;

    29 }

    30 

    31 /**

    32  * Retrieve the raw response from a safe HTTP request.

    33  *

    34  * This function is ideal when the HTTP request is being made to an arbitrary

    35  * URL. The URL is validated to avoid redirection and request forgery attacks.

    36  *

    37  * @see wp_remote_request() For more information on the response array format

    38  * 	and default arguments.

    39  *

    40  * @since 3.6.0

    41  *

    42  * @param string $url Site URL to retrieve.

    43  * @param array $args Optional. Override the defaults.

    44  * @return WP_Error|array The response or WP_Error on failure.

    45  */

    46 function wp_safe_remote_request( $url, $args = array() ) {

    47 	$args['reject_unsafe_urls'] = true;

    48 	$http = _wp_http_get_object();

    49 	return $http->request( $url, $args );

    50 }

    51 

    52 /**

    53  * Retrieve the raw response from a safe HTTP request using the GET method.

    54  *

    55  * This function is ideal when the HTTP request is being made to an arbitrary

    56  * URL. The URL is validated to avoid redirection and request forgery attacks.

    57  *

    58  * @see wp_remote_request() For more information on the response array format

    59  * 	and default arguments.

    60  *

    61  * @since 3.6.0

    62  *

    63  * @param string $url Site URL to retrieve.

    64  * @param array $args Optional. Override the defaults.

    65  * @return WP_Error|array The response or WP_Error on failure.

    66  */

    67 function wp_safe_remote_get( $url, $args = array() ) {

    68 	$args['reject_unsafe_urls'] = true;

    69 	$http = _wp_http_get_object();

    70 	return $http->get( $url, $args );

    71 }

    72 

    73 /**

    74  * Retrieve the raw response from a safe HTTP request using the POST method.

    75  *

    76  * This function is ideal when the HTTP request is being made to an arbitrary

    77  * URL. The URL is validated to avoid redirection and request forgery attacks.

    78  *

    79  * @see wp_remote_request() For more information on the response array format

    80  * 	and default arguments.

    81  *

    82  * @since 3.6.0

    83  *

    84  * @param string $url Site URL to retrieve.

    85  * @param array $args Optional. Override the defaults.

    86  * @return WP_Error|array The response or WP_Error on failure.

    87  */

    88 function wp_safe_remote_post( $url, $args = array() ) {

    89 	$args['reject_unsafe_urls'] = true;

    90 	$http = _wp_http_get_object();

    91 	return $http->post( $url, $args );

    92 }

    93 

    94 /**

    95  * Retrieve the raw response from a safe HTTP request using the HEAD method.

    96  *

    97  * This function is ideal when the HTTP request is being made to an arbitrary

    98  * URL. The URL is validated to avoid redirection and request forgery attacks.

    99  *

   100  * @see wp_remote_request() For more information on the response array format

   101  * 	and default arguments.

   102  *

   103  * @since 3.6.0

   104  *

   105  * @param string $url Site URL to retrieve.

   106  * @param array $args Optional. Override the defaults.

   107  * @return WP_Error|array The response or WP_Error on failure.

   108  */

   109 function wp_safe_remote_head( $url, $args = array() ) {

   110 	$args['reject_unsafe_urls'] = true;

   111 	$http = _wp_http_get_object();

   112 	return $http->head( $url, $args );

   113 }

   114 

   115 /**

   116  * Retrieve the raw response from the HTTP request.

   117  *

   118  * The array structure is a little complex.

   119  *

   120  * <code>

   121  * $res = array( 'headers' => array(), 'response' => array('code' => int, 'message' => string) );

   122  * </code>

   123  *

   124  * All of the headers in $res['headers'] are with the name as the key and the

   125  * value as the value. So to get the User-Agent, you would do the following.

   126  *

   127  * <code>

   128  * $user_agent = $res['headers']['user-agent'];

   129  * </code>

   130  *

   131  * The body is the raw response content and can be retrieved from $res['body'].

   132  *

   133  * This function is called first to make the request and there are other API

   134  * functions to abstract out the above convoluted setup.

   135  *

   136  * List of default arguments:

   137  * 'method'      => 'GET'

   138  *  - Default 'GET'  for wp_remote_get()

   139  *  - Default 'POST' for wp_remote_post()

   140  *  - Default 'HEAD' for wp_remote_head()

   141  * 'timeout'     => 5

   142  * 'redirection' => 5

   143  * 'httpversion' => '1.0'

   144  * 'user-agent'  => 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' )

   145  * 'blocking'    => true

   146  * 'headers'     => array()

   147  * 'cookies'     => array()

   148  * 'body'        => null

   149  * 'compress'    => false,

   150  * 'decompress'  => true,

   151  * 'sslverify'   => true,

   152  * 'stream'      => false,

   153  * 'filename'    => null

   154  *

   155  * @since 2.7.0

   156  *

   157  * @param string $url Site URL to retrieve.

   158  * @param array $args Optional. Override the defaults.

   159  * @return WP_Error|array The response or WP_Error on failure.

   160  */

   161 function wp_remote_request($url, $args = array()) {

   162 	$objFetchSite = _wp_http_get_object();

   163 	return $objFetchSite->request($url, $args);

   164 }

   165 

   166 /**

   167  * Retrieve the raw response from the HTTP request using the GET method.

   168  *

   169  * @see wp_remote_request() For more information on the response array format and default arguments.

   170  *

   171  * @since 2.7.0

   172  *

   173  * @param string $url Site URL to retrieve.

   174  * @param array $args Optional. Override the defaults.

   175  * @return WP_Error|array The response or WP_Error on failure.

   176  */

   177 function wp_remote_get($url, $args = array()) {

   178 	$objFetchSite = _wp_http_get_object();

   179 	return $objFetchSite->get($url, $args);

   180 }

   181 

   182 /**

   183  * Retrieve the raw response from the HTTP request using the POST method.

   184  *

   185  * @see wp_remote_request() For more information on the response array format and default arguments.

   186  *

   187  * @since 2.7.0

   188  *

   189  * @param string $url Site URL to retrieve.

   190  * @param array $args Optional. Override the defaults.

   191  * @return WP_Error|array The response or WP_Error on failure.

   192  */

   193 function wp_remote_post($url, $args = array()) {

   194 	$objFetchSite = _wp_http_get_object();

   195 	return $objFetchSite->post($url, $args);

   196 }

   197 

   198 /**

   199  * Retrieve the raw response from the HTTP request using the HEAD method.

   200  *

   201  * @see wp_remote_request() For more information on the response array format and default arguments.

   202  *

   203  * @since 2.7.0

   204  *

   205  * @param string $url Site URL to retrieve.

   206  * @param array $args Optional. Override the defaults.

   207  * @return WP_Error|array The response or WP_Error on failure.

   208  */

   209 function wp_remote_head($url, $args = array()) {

   210 	$objFetchSite = _wp_http_get_object();

   211 	return $objFetchSite->head($url, $args);

   212 }

   213 

   214 /**

   215  * Retrieve only the headers from the raw response.

   216  *

   217  * @since 2.7.0

   218  *

   219  * @param array $response HTTP response.

   220  * @return array The headers of the response. Empty array if incorrect parameter given.

   221  */

   222 function wp_remote_retrieve_headers(&$response) {

   223 	if ( is_wp_error($response) || ! isset($response['headers']) || ! is_array($response['headers']))

   224 		return array();

   225 

   226 	return $response['headers'];

   227 }

   228 

   229 /**

   230  * Retrieve a single header by name from the raw response.

   231  *

   232  * @since 2.7.0

   233  *

   234  * @param array $response

   235  * @param string $header Header name to retrieve value from.

   236  * @return string The header value. Empty string on if incorrect parameter given, or if the header doesn't exist.

   237  */

   238 function wp_remote_retrieve_header(&$response, $header) {

   239 	if ( is_wp_error($response) || ! isset($response['headers']) || ! is_array($response['headers']))

   240 		return '';

   241 

   242 	if ( array_key_exists($header, $response['headers']) )

   243 		return $response['headers'][$header];

   244 

   245 	return '';

   246 }

   247 

   248 /**

   249  * Retrieve only the response code from the raw response.

   250  *

   251  * Will return an empty array if incorrect parameter value is given.

   252  *

   253  * @since 2.7.0

   254  *

   255  * @param array $response HTTP response.

   256  * @return string the response code. Empty string on incorrect parameter given.

   257  */

   258 function wp_remote_retrieve_response_code(&$response) {

   259 	if ( is_wp_error($response) || ! isset($response['response']) || ! is_array($response['response']))

   260 		return '';

   261 

   262 	return $response['response']['code'];

   263 }

   264 

   265 /**

   266  * Retrieve only the response message from the raw response.

   267  *

   268  * Will return an empty array if incorrect parameter value is given.

   269  *

   270  * @since 2.7.0

   271  *

   272  * @param array $response HTTP response.

   273  * @return string The response message. Empty string on incorrect parameter given.

   274  */

   275 function wp_remote_retrieve_response_message(&$response) {

   276 	if ( is_wp_error($response) || ! isset($response['response']) || ! is_array($response['response']))

   277 		return '';

   278 

   279 	return $response['response']['message'];

   280 }

   281 

   282 /**

   283  * Retrieve only the body from the raw response.

   284  *

   285  * @since 2.7.0

   286  *

   287  * @param array $response HTTP response.

   288  * @return string The body of the response. Empty string if no body or incorrect parameter given.

   289  */

   290 function wp_remote_retrieve_body(&$response) {

   291 	if ( is_wp_error($response) || ! isset($response['body']) )

   292 		return '';

   293 

   294 	return $response['body'];

   295 }

   296 

   297 /**

   298  * Determines if there is an HTTP Transport that can process this request.

   299  *

   300  * @since 3.2.0

   301  *

   302  * @param array  $capabilities Array of capabilities to test or a wp_remote_request() $args array.

   303  * @param string $url Optional. If given, will check if the URL requires SSL and adds that requirement to the capabilities array.

   304  *

   305  * @return bool

   306  */

   307 function wp_http_supports( $capabilities = array(), $url = null ) {

   308 	$objFetchSite = _wp_http_get_object();

   309 

   310 	$capabilities = wp_parse_args( $capabilities );

   311 

   312 	$count = count( $capabilities );

   313 

   314 	// If we have a numeric $capabilities array, spoof a wp_remote_request() associative $args array

   315 	if ( $count && count( array_filter( array_keys( $capabilities ), 'is_numeric' ) ) == $count ) {

   316 		$capabilities = array_combine( array_values( $capabilities ), array_fill( 0, $count, true ) );

   317 	}

   318 

   319 	if ( $url && !isset( $capabilities['ssl'] ) ) {

   320 		$scheme = parse_url( $url, PHP_URL_SCHEME );

   321 		if ( 'https' == $scheme || 'ssl' == $scheme ) {

   322 			$capabilities['ssl'] = true;

   323 		}

   324 	}

   325 

   326 	return (bool) $objFetchSite->_get_first_available_transport( $capabilities );

   327 }

   328 

   329 /**

   330  * Get the HTTP Origin of the current request.

   331  *

   332  * @since 3.4.0

   333  *

   334  * @return string URL of the origin. Empty string if no origin.

   335  */

   336 function get_http_origin() {

   337 	$origin = '';

   338 	if ( ! empty ( $_SERVER[ 'HTTP_ORIGIN' ] ) )

   339 		$origin = $_SERVER[ 'HTTP_ORIGIN' ];

   340 

   341 	/**

   342 	 * Change the origin of an HTTP request.

   343 	 *

   344 	 * @since 3.4.0

   345 	 *

   346 	 * @param string $origin The original origin for the request.

   347 	 */

   348 	return apply_filters( 'http_origin', $origin );

   349 }

   350 

   351 /**

   352  * Retrieve list of allowed HTTP origins.

   353  *

   354  * @since 3.4.0

   355  *

   356  * @return array Array of origin URLs.

   357  */

   358 function get_allowed_http_origins() {

   359 	$admin_origin = parse_url( admin_url() );

   360 	$home_origin = parse_url( home_url() );

   361 

   362 	// @todo preserve port?

   363 	$allowed_origins = array_unique( array(

   364 		'http://' . $admin_origin[ 'host' ],

   365 		'https://' . $admin_origin[ 'host' ],

   366 		'http://' . $home_origin[ 'host' ],

   367 		'https://' . $home_origin[ 'host' ],

   368 	) );

   369 

   370 	/**

   371 	 * Change the origin types allowed for HTTP requests.

   372 	 *

   373 	 * @since 3.4.0

   374 	 *

   375 	 * @param array $allowed_origins {

   376 	 *     Default allowed HTTP origins.

   377 	 *     @type string Non-secure URL for admin origin.

   378 	 *     @type string Secure URL for admin origin.

   379 	 *     @type string Non-secure URL for home origin.

   380 	 *     @type string Secure URL for home origin.

   381 	 * }

   382 	 */

   383 	return apply_filters( 'allowed_http_origins' , $allowed_origins );

   384 }

   385 

   386 /**

   387  * Determines if the HTTP origin is an authorized one.

   388  *

   389  * @since 3.4.0

   390  *

   391  * @param string Origin URL. If not provided, the value of get_http_origin() is used.

   392  * @return bool True if the origin is allowed. False otherwise.

   393  */

   394 function is_allowed_http_origin( $origin = null ) {

   395 	$origin_arg = $origin;

   396 

   397 	if ( null === $origin )

   398 		$origin = get_http_origin();

   399 

   400 	if ( $origin && ! in_array( $origin, get_allowed_http_origins() ) )

   401 		$origin = '';

   402 

   403 	/**

   404 	 * Change the allowed HTTP origin result.

   405 	 *

   406 	 * @since 3.4.0

   407 	 *

   408 	 * @param string $origin Result of check for allowed origin.

   409 	 * @param string $origin_arg original origin string passed into is_allowed_http_origin function.

   410 	 */

   411 	return apply_filters( 'allowed_http_origin', $origin, $origin_arg );

   412 }

   413 

   414 /**

   415  * Send Access-Control-Allow-Origin and related headers if the current request

   416  * is from an allowed origin.

   417  *

   418  * If the request is an OPTIONS request, the script exits with either access

   419  * control headers sent, or a 403 response if the origin is not allowed. For

   420  * other request methods, you will receive a return value.

   421  *

   422  * @since 3.4.0

   423  *

   424  * @return bool|string Returns the origin URL if headers are sent. Returns false

   425  * if headers are not sent.

   426  */

   427 function send_origin_headers() {

   428 	$origin = get_http_origin();

   429 

   430 	if ( is_allowed_http_origin( $origin ) ) {

   431 		@header( 'Access-Control-Allow-Origin: ' .  $origin );

   432 		@header( 'Access-Control-Allow-Credentials: true' );

   433 		if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] )

   434 			exit;

   435 		return $origin;

   436 	}

   437 

   438 	if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] ) {

   439 		status_header( 403 );

   440 		exit;

   441 	}

   442 

   443 	return false;

   444 }

   445 

   446 /**

   447  * Validate a URL for safe use in the HTTP API.

   448  *

   449  * @since 3.5.2

   450  *

   451  * @return mixed URL or false on failure.

   452  */

   453 function wp_http_validate_url( $url ) {

   454 	$url = wp_kses_bad_protocol( $url, array( 'http', 'https' ) );

   455 	if ( ! $url )

   456 		return false;

   457 

   458 	$parsed_url = @parse_url( $url );

   459 	if ( ! $parsed_url || empty( $parsed_url['host'] ) )

   460 		return false;

   461 

   462 	if ( isset( $parsed_url['user'] ) || isset( $parsed_url['pass'] ) )

   463 		return false;

   464 

   465 	if ( false !== strpos( $parsed_url['host'], ':' ) )

   466 		return false;

   467 

   468 	$parsed_home = @parse_url( get_option( 'home' ) );

   469 

   470 	$same_host = strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );

   471 

   472 	if ( ! $same_host ) {

   473 		$host = trim( $parsed_url['host'], '.' );

   474 		if ( preg_match( '#^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$#', $host ) ) {

   475 			$ip = $host;

   476 		} else {

   477 			$ip = gethostbyname( $host );

   478 			if ( $ip === $host ) // Error condition for gethostbyname()

   479 				$ip = false;

   480 		}

   481 		if ( $ip ) {

   482 			$parts = array_map( 'intval', explode( '.', $ip ) );

   483 			if ( '127.0.0.1' === $ip

   484 				|| ( 10 === $parts[0] )

   485 				|| ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )

   486 				|| ( 192 === $parts[0] && 168 === $parts[1] )

   487 			) {

   488 				// If host appears local, reject unless specifically allowed.

   489 				/**

   490 				 * Check if HTTP request is external or not.

   491 				 *

   492 				 * Allows to change and allow external requests for the HTTP request.

   493 				 *

   494 				 * @since 3.6.0

   495 				 *

   496 				 * @param bool false Whether HTTP request is external or not.

   497 				 * @param string $host IP of the requested host.

   498 				 * @param string $url URL of the requested host.

   499 				 */

   500 				if ( ! apply_filters( 'http_request_host_is_external', false, $host, $url ) )

   501 					return false;

   502 			}

   503 		}

   504 	}

   505 

   506 	if ( empty( $parsed_url['port'] ) )

   507 		return $url;

   508 

   509 	$port = $parsed_url['port'];

   510 	if ( 80 === $port || 443 === $port || 8080 === $port )

   511 		return $url;

   512 

   513 	if ( $parsed_home && $same_host && $parsed_home['port'] === $port )

   514 		return $url;

   515 

   516 	return false;

   517 }

   518 

   519 /**

   520  * Whitelists allowed redirect hosts for safe HTTP requests as well.

   521  *

   522  * Attached to the http_request_host_is_external filter.

   523  *

   524  * @since 3.6.0

   525  *

   526  * @param bool $is_external

   527  * @param string $host

   528  * @return bool

   529  */

   530 function allowed_http_request_hosts( $is_external, $host ) {

   531 	if ( ! $is_external && wp_validate_redirect( 'http://' . $host ) )

   532 		$is_external = true;

   533 	return $is_external;

   534 }

   535 

   536 /**

   537  * Whitelists any domain in a multisite installation for safe HTTP requests.

   538  *

   539  * Attached to the http_request_host_is_external filter.

   540  *

   541  * @since 3.6.0

   542  *

   543  * @param bool $is_external

   544  * @param string $host

   545  * @return bool

   546  */

   547 function ms_allowed_http_request_hosts( $is_external, $host ) {

   548 	global $wpdb, $current_site;

   549 	static $queried = array();

   550 	if ( $is_external )

   551 		return $is_external;

   552 	if ( $host === $current_site->domain )

   553 		return true;

   554 	if ( isset( $queried[ $host ] ) )

   555 		return $queried[ $host ];

   556 	$queried[ $host ] = (bool) $wpdb->get_var( $wpdb->prepare( "SELECT domain FROM $wpdb->blogs WHERE domain = %s LIMIT 1", $host ) );

   557 	return $queried[ $host ];

   558 }