Skip to content

Commit 328255e

Browse files
committed
Merge remote-tracking branch 'origin/main'
2 parents b6284f4 + 96acb8c commit 328255e

File tree

4 files changed

+28
-23
lines changed

4 files changed

+28
-23
lines changed

src/Http/IpTool.php

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -50,20 +50,20 @@ public function user()
5050
private static function checkIP()
5151
{
5252
if (getenv('HTTP_CLIENT_IP')) {
53-
$ip = getenv('HTTP_CLIENT_IP');
53+
$ip = sanitize_text_field(getenv('HTTP_CLIENT_IP'));
5454
} elseif (getenv('HTTP_X_FORWARDED_FOR')) {
55-
$ip = getenv('HTTP_X_FORWARDED_FOR');
55+
$ip = sanitize_text_field(getenv('HTTP_X_FORWARDED_FOR'));
5656
} elseif (getenv('HTTP_X_FORWARDED')) {
57-
$ip = getenv('HTTP_X_FORWARDED');
57+
$ip = sanitize_text_field(getenv('HTTP_X_FORWARDED'));
5858
} elseif (getenv('HTTP_FORWARDED_FOR')) {
59-
$ip = getenv('HTTP_FORWARDED_FOR');
59+
$ip = sanitize_text_field(getenv('HTTP_FORWARDED_FOR'));
6060
} elseif (getenv('HTTP_FORWARDED')) {
61-
$ip = getenv('HTTP_FORWARDED');
61+
$ip = sanitize_text_field(getenv('HTTP_FORWARDED'));
6262
} else {
63-
$ip = $_SERVER['REMOTE_ADDR'];
63+
$ip = sanitize_text_field($_SERVER['REMOTE_ADDR']);
6464
}
6565

66-
return $ip;
66+
return filter_var($ip, FILTER_VALIDATE_IP);
6767
}
6868

6969
/**
@@ -73,7 +73,7 @@ private static function checkDevice()
7373
{
7474
return isset(
7575
$_SERVER['HTTP_USER_AGENT']
76-
) ? self::getBrowserName($_SERVER['HTTP_USER_AGENT']) . '|' . self::getOS($_SERVER['HTTP_USER_AGENT']) : '';
76+
) ? self::getBrowserName(wp_kses($_SERVER['HTTP_USER_AGENT'], [])) . '|' . self::getOS(wp_kses($_SERVER['HTTP_USER_AGENT'], [])) : '';
7777
}
7878

7979
/**

src/Http/Request/Request.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ public function body()
103103

104104
public function method()
105105
{
106-
return $_SERVER['REQUEST_METHOD'];
106+
return sanitize_text_field($_SERVER['REQUEST_METHOD']);
107107
}
108108

109109
public function contentType()

src/Http/Router/AjaxRouter.php

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27,30 +27,35 @@ public function registerRoutes()
2727

2828
public function addRoute(RouteRegister $route)
2929
{
30-
if (
31-
!isset($_REQUEST['action'])
32-
|| strpos($_REQUEST['action'], $this->_router->getAjaxPrefix()) === false
33-
|| !\in_array(strtoupper($_SERVER['REQUEST_METHOD']), $route->getMethods())
30+
31+
$requestMethod = isset($_SERVER['REQUEST_METHOD']) ? sanitize_text_field($_SERVER['REQUEST_METHOD']) : '';
32+
$action = isset($_REQUEST['action']) ? sanitize_text_field($_REQUEST['action']) : '';
33+
34+
if (strpos($action, $this->_router->getAjaxPrefix()) === false
35+
|| !\in_array(strtoupper($requestMethod), $route->getMethods())
3436
) {
3537
return;
3638
}
3739

38-
$requestPath = str_replace($this->_router->getAjaxPrefix(), '', $_REQUEST['action']);
40+
$requestPath = str_replace($this->_router->getAjaxPrefix(), '', $action);
3941
if (!$this->isRouteMatched($route, $requestPath)) {
4042
return;
4143
}
4244

43-
Hooks::addAction('wp_ajax_' . $_REQUEST['action'], [$route, 'handleRequest']);
45+
Hooks::addAction('wp_ajax_' . $action, [$route, 'handleRequest']);
4446
if ($route->isNoAuth()) {
45-
Hooks::addAction('wp_ajax_nopriv_' . $_REQUEST['action'], [$route, 'handleRequest']);
47+
Hooks::addAction('wp_ajax_nopriv_' . $action, [$route, 'handleRequest']);
4648
}
4749

4850
$this->_router->addRegisteredRoute($this->currentRouteName(), $route);
4951
}
5052

5153
public function currentRouteName()
5254
{
53-
return $_SERVER['REQUEST_METHOD'] . $_REQUEST['action'];
55+
$requestMethod = isset($_SERVER['REQUEST_METHOD']) ? sanitize_text_field($_SERVER['REQUEST_METHOD']) : '';
56+
$action = isset($_REQUEST['action']) ? sanitize_text_field($_REQUEST['action']) : '';
57+
58+
return $requestMethod. $action;
5459
}
5560

5661
/**

src/Installer.php

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -111,28 +111,28 @@ public function checkRequirements()
111111
if (version_compare(PHP_VERSION, $this->_requirements['php'], '<')) {
112112
// Str From WP install script
113113
wp_die(
114-
esc_html__(
114+
esc_html(
115115
sprintf(
116116
// translators: 1: Current PHP version, 2: Version required by the uploaded plugin.
117-
__('The PHP version on your server is %1$s, however the uploaded plugin requires %2$s.'),
117+
'The PHP version on your server is %1$s, however the uploaded plugin requires %2$s.',
118118
PHP_VERSION,
119119
$this->_requirements['php']
120120
)
121121
),
122-
esc_html__('Requirements Not Met')
122+
esc_html('Requirements Not Met')
123123
);
124124
}
125125

126126
if (version_compare(get_bloginfo('version'), $this->_requirements['wp'], '<')) {
127127
wp_die(
128-
esc_html__(
128+
esc_html(
129129
sprintf(
130130
// translators: 1: Current WordPress version, 2: Version required by the uploaded plugin.
131-
__('Your WordPress version is %1$s, however the uploaded plugin requires %2$s.'),
131+
'Your WordPress version is %1$s, however the uploaded plugin requires %2$s.',
132132
get_bloginfo('version'),
133133
$this->_requirements['wp']
134134
),
135-
esc_html__('Requirements Not Met')
135+
esc_html('Requirements Not Met')
136136
)
137137
);
138138
}

0 commit comments

Comments
 (0)