[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * Simple and uniform HTTP request API.
   4   *
   5   * Will eventually replace and standardize the WordPress HTTP requests made.
   6   *
   7   * @link http://trac.wordpress.org/ticket/4779 HTTP API Proposal
   8   *
   9   * @package WordPress
  10   * @subpackage HTTP
  11   * @since 2.7.0
  12   */
  13  
  14  /**
  15   * Returns the initialized WP_Http Object
  16   *
  17   * @since 2.7.0
  18   * @access private
  19   *
  20   * @return WP_Http HTTP Transport object.
  21   */
  22  function _wp_http_get_object() {
  23      static $http;
  24  
  25      if ( is_null($http) )
  26          $http = new WP_Http();
  27  
  28      return $http;
  29  }
  30  
  31  /**
  32   * Retrieve the raw response from a safe HTTP request.
  33   *
  34   * This function is ideal when the HTTP request is being made to an arbitrary
  35   * URL. The URL is validated to avoid redirection and request forgery attacks.
  36   *
  37   * @see wp_remote_request() For more information on the response array format
  38   *     and default arguments.
  39   *
  40   * @since 3.6.0
  41   *
  42   * @param string $url Site URL to retrieve.
  43   * @param array $args Optional. Override the defaults.
  44   * @return WP_Error|array The response or WP_Error on failure.
  45   */
  46  function wp_safe_remote_request( $url, $args = array() ) {
  47      $args['reject_unsafe_urls'] = true;
  48      $http = _wp_http_get_object();
  49      return $http->request( $url, $args );
  50  }
  51  
  52  /**
  53   * Retrieve the raw response from a safe HTTP request using the GET method.
  54   *
  55   * This function is ideal when the HTTP request is being made to an arbitrary
  56   * URL. The URL is validated to avoid redirection and request forgery attacks.
  57   *
  58   * @see wp_remote_request() For more information on the response array format
  59   *     and default arguments.
  60   *
  61   * @since 3.6.0
  62   *
  63   * @param string $url Site URL to retrieve.
  64   * @param array $args Optional. Override the defaults.
  65   * @return WP_Error|array The response or WP_Error on failure.
  66   */
  67  function wp_safe_remote_get( $url, $args = array() ) {
  68      $args['reject_unsafe_urls'] = true;
  69      $http = _wp_http_get_object();
  70      return $http->get( $url, $args );
  71  }
  72  
  73  /**
  74   * Retrieve the raw response from a safe HTTP request using the POST method.
  75   *
  76   * This function is ideal when the HTTP request is being made to an arbitrary
  77   * URL. The URL is validated to avoid redirection and request forgery attacks.
  78   *
  79   * @see wp_remote_request() For more information on the response array format
  80   *     and default arguments.
  81   *
  82   * @since 3.6.0
  83   *
  84   * @param string $url Site URL to retrieve.
  85   * @param array $args Optional. Override the defaults.
  86   * @return WP_Error|array The response or WP_Error on failure.
  87   */
  88  function wp_safe_remote_post( $url, $args = array() ) {
  89      $args['reject_unsafe_urls'] = true;
  90      $http = _wp_http_get_object();
  91      return $http->post( $url, $args );
  92  }
  93  
  94  /**
  95   * Retrieve the raw response from a safe HTTP request using the HEAD method.
  96   *
  97   * This function is ideal when the HTTP request is being made to an arbitrary
  98   * URL. The URL is validated to avoid redirection and request forgery attacks.
  99   *
 100   * @see wp_remote_request() For more information on the response array format
 101   *     and default arguments.
 102   *
 103   * @since 3.6.0
 104   *
 105   * @param string $url Site URL to retrieve.
 106   * @param array $args Optional. Override the defaults.
 107   * @return WP_Error|array The response or WP_Error on failure.
 108   */
 109  function wp_safe_remote_head( $url, $args = array() ) {
 110      $args['reject_unsafe_urls'] = true;
 111      $http = _wp_http_get_object();
 112      return $http->head( $url, $args );
 113  }
 114  
 115  /**
 116   * Retrieve the raw response from the HTTP request.
 117   *
 118   * The array structure is a little complex.
 119   *
 120   * <code>
 121   * $res = array( 'headers' => array(), 'response' => array('code' => int, 'message' => string) );
 122   * </code>
 123   *
 124   * All of the headers in $res['headers'] are with the name as the key and the
 125   * value as the value. So to get the User-Agent, you would do the following.
 126   *
 127   * <code>
 128   * $user_agent = $res['headers']['user-agent'];
 129   * </code>
 130   *
 131   * The body is the raw response content and can be retrieved from $res['body'].
 132   *
 133   * This function is called first to make the request and there are other API
 134   * functions to abstract out the above convoluted setup.
 135   *
 136   * List of default arguments:
 137   * 'method'      => 'GET'
 138   *  - Default 'GET'  for wp_remote_get()
 139   *  - Default 'POST' for wp_remote_post()
 140   *  - Default 'HEAD' for wp_remote_head()
 141   * 'timeout'     => 5
 142   * 'redirection' => 5
 143   * 'httpversion' => '1.0'
 144   * 'user-agent'  => 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' )
 145   * 'blocking'    => true
 146   * 'headers'     => array()
 147   * 'cookies'     => array()
 148   * 'body'        => null
 149   * 'compress'    => false,
 150   * 'decompress'  => true,
 151   * 'sslverify'   => true,
 152   * 'stream'      => false,
 153   * 'filename'    => null
 154   *
 155   * @since 2.7.0
 156   *
 157   * @param string $url Site URL to retrieve.
 158   * @param array $args Optional. Override the defaults.
 159   * @return WP_Error|array The response or WP_Error on failure.
 160   */
 161  function wp_remote_request($url, $args = array()) {
 162      $objFetchSite = _wp_http_get_object();
 163      return $objFetchSite->request($url, $args);
 164  }
 165  
 166  /**
 167   * Retrieve the raw response from the HTTP request using the GET method.
 168   *
 169   * @see wp_remote_request() For more information on the response array format and default arguments.
 170   *
 171   * @since 2.7.0
 172   *
 173   * @param string $url Site URL to retrieve.
 174   * @param array $args Optional. Override the defaults.
 175   * @return WP_Error|array The response or WP_Error on failure.
 176   */
 177  function wp_remote_get($url, $args = array()) {
 178      $objFetchSite = _wp_http_get_object();
 179      return $objFetchSite->get($url, $args);
 180  }
 181  
 182  /**
 183   * Retrieve the raw response from the HTTP request using the POST method.
 184   *
 185   * @see wp_remote_request() For more information on the response array format and default arguments.
 186   *
 187   * @since 2.7.0
 188   *
 189   * @param string $url Site URL to retrieve.
 190   * @param array $args Optional. Override the defaults.
 191   * @return WP_Error|array The response or WP_Error on failure.
 192   */
 193  function wp_remote_post($url, $args = array()) {
 194      $objFetchSite = _wp_http_get_object();
 195      return $objFetchSite->post($url, $args);
 196  }
 197  
 198  /**
 199   * Retrieve the raw response from the HTTP request using the HEAD method.
 200   *
 201   * @see wp_remote_request() For more information on the response array format and default arguments.
 202   *
 203   * @since 2.7.0
 204   *
 205   * @param string $url Site URL to retrieve.
 206   * @param array $args Optional. Override the defaults.
 207   * @return WP_Error|array The response or WP_Error on failure.
 208   */
 209  function wp_remote_head($url, $args = array()) {
 210      $objFetchSite = _wp_http_get_object();
 211      return $objFetchSite->head($url, $args);
 212  }
 213  
 214  /**
 215   * Retrieve only the headers from the raw response.
 216   *
 217   * @since 2.7.0
 218   *
 219   * @param array $response HTTP response.
 220   * @return array The headers of the response. Empty array if incorrect parameter given.
 221   */
 222  function wp_remote_retrieve_headers(&$response) {
 223      if ( is_wp_error($response) || ! isset($response['headers']) || ! is_array($response['headers']))
 224          return array();
 225  
 226      return $response['headers'];
 227  }
 228  
 229  /**
 230   * Retrieve a single header by name from the raw response.
 231   *
 232   * @since 2.7.0
 233   *
 234   * @param array $response
 235   * @param string $header Header name to retrieve value from.
 236   * @return string The header value. Empty string on if incorrect parameter given, or if the header doesn't exist.
 237   */
 238  function wp_remote_retrieve_header(&$response, $header) {
 239      if ( is_wp_error($response) || ! isset($response['headers']) || ! is_array($response['headers']))
 240          return '';
 241  
 242      if ( array_key_exists($header, $response['headers']) )
 243          return $response['headers'][$header];
 244  
 245      return '';
 246  }
 247  
 248  /**
 249   * Retrieve only the response code from the raw response.
 250   *
 251   * Will return an empty array if incorrect parameter value is given.
 252   *
 253   * @since 2.7.0
 254   *
 255   * @param array $response HTTP response.
 256   * @return string the response code. Empty string on incorrect parameter given.
 257   */
 258  function wp_remote_retrieve_response_code(&$response) {
 259      if ( is_wp_error($response) || ! isset($response['response']) || ! is_array($response['response']))
 260          return '';
 261  
 262      return $response['response']['code'];
 263  }
 264  
 265  /**
 266   * Retrieve only the response message from the raw response.
 267   *
 268   * Will return an empty array if incorrect parameter value is given.
 269   *
 270   * @since 2.7.0
 271   *
 272   * @param array $response HTTP response.
 273   * @return string The response message. Empty string on incorrect parameter given.
 274   */
 275  function wp_remote_retrieve_response_message(&$response) {
 276      if ( is_wp_error($response) || ! isset($response['response']) || ! is_array($response['response']))
 277          return '';
 278  
 279      return $response['response']['message'];
 280  }
 281  
 282  /**
 283   * Retrieve only the body from the raw response.
 284   *
 285   * @since 2.7.0
 286   *
 287   * @param array $response HTTP response.
 288   * @return string The body of the response. Empty string if no body or incorrect parameter given.
 289   */
 290  function wp_remote_retrieve_body(&$response) {
 291      if ( is_wp_error($response) || ! isset($response['body']) )
 292          return '';
 293  
 294      return $response['body'];
 295  }
 296  
 297  /**
 298   * Determines if there is an HTTP Transport that can process this request.
 299   *
 300   * @since 3.2.0
 301   *
 302   * @param array  $capabilities Array of capabilities to test or a wp_remote_request() $args array.
 303   * @param string $url Optional. If given, will check if the URL requires SSL and adds that requirement to the capabilities array.
 304   *
 305   * @return bool
 306   */
 307  function wp_http_supports( $capabilities = array(), $url = null ) {
 308      $objFetchSite = _wp_http_get_object();
 309  
 310      $capabilities = wp_parse_args( $capabilities );
 311  
 312      $count = count( $capabilities );
 313  
 314      // If we have a numeric $capabilities array, spoof a wp_remote_request() associative $args array
 315      if ( $count && count( array_filter( array_keys( $capabilities ), 'is_numeric' ) ) == $count ) {
 316          $capabilities = array_combine( array_values( $capabilities ), array_fill( 0, $count, true ) );
 317      }
 318  
 319      if ( $url && !isset( $capabilities['ssl'] ) ) {
 320          $scheme = parse_url( $url, PHP_URL_SCHEME );
 321          if ( 'https' == $scheme || 'ssl' == $scheme ) {
 322              $capabilities['ssl'] = true;
 323          }
 324      }
 325  
 326      return (bool) $objFetchSite->_get_first_available_transport( $capabilities );
 327  }
 328  
 329  /**
 330   * Get the HTTP Origin of the current request.
 331   *
 332   * @since 3.4.0
 333   *
 334   * @return string URL of the origin. Empty string if no origin.
 335   */
 336  function get_http_origin() {
 337      $origin = '';
 338      if ( ! empty ( $_SERVER[ 'HTTP_ORIGIN' ] ) )
 339          $origin = $_SERVER[ 'HTTP_ORIGIN' ];
 340  
 341      /**
 342       * Change the origin of an HTTP request.
 343       *
 344       * @since 3.4.0
 345       *
 346       * @param string $origin The original origin for the request.
 347       */
 348      return apply_filters( 'http_origin', $origin );
 349  }
 350  
 351  /**
 352   * Retrieve list of allowed HTTP origins.
 353   *
 354   * @since 3.4.0
 355   *
 356   * @return array Array of origin URLs.
 357   */
 358  function get_allowed_http_origins() {
 359      $admin_origin = parse_url( admin_url() );
 360      $home_origin = parse_url( home_url() );
 361  
 362      // @todo preserve port?
 363      $allowed_origins = array_unique( array(
 364          'http://' . $admin_origin[ 'host' ],
 365          'https://' . $admin_origin[ 'host' ],
 366          'http://' . $home_origin[ 'host' ],
 367          'https://' . $home_origin[ 'host' ],
 368      ) );
 369  
 370      /**
 371       * Change the origin types allowed for HTTP requests.
 372       *
 373       * @since 3.4.0
 374       *
 375       * @param array $allowed_origins {
 376       *     Default allowed HTTP origins.
 377       *     @type string Non-secure URL for admin origin.
 378       *     @type string Secure URL for admin origin.
 379       *     @type string Non-secure URL for home origin.
 380       *     @type string Secure URL for home origin.
 381       * }
 382       */
 383      return apply_filters( 'allowed_http_origins' , $allowed_origins );
 384  }
 385  
 386  /**
 387   * Determines if the HTTP origin is an authorized one.
 388   *
 389   * @since 3.4.0
 390   *
 391   * @param string Origin URL. If not provided, the value of get_http_origin() is used.
 392   * @return bool True if the origin is allowed. False otherwise.
 393   */
 394  function is_allowed_http_origin( $origin = null ) {
 395      $origin_arg = $origin;
 396  
 397      if ( null === $origin )
 398          $origin = get_http_origin();
 399  
 400      if ( $origin && ! in_array( $origin, get_allowed_http_origins() ) )
 401          $origin = '';
 402  
 403      /**
 404       * Change the allowed HTTP origin result.
 405       *
 406       * @since 3.4.0
 407       *
 408       * @param string $origin Result of check for allowed origin.
 409       * @param string $origin_arg original origin string passed into is_allowed_http_origin function.
 410       */
 411      return apply_filters( 'allowed_http_origin', $origin, $origin_arg );
 412  }
 413  
 414  /**
 415   * Send Access-Control-Allow-Origin and related headers if the current request
 416   * is from an allowed origin.
 417   *
 418   * If the request is an OPTIONS request, the script exits with either access
 419   * control headers sent, or a 403 response if the origin is not allowed. For
 420   * other request methods, you will receive a return value.
 421   *
 422   * @since 3.4.0
 423   *
 424   * @return bool|string Returns the origin URL if headers are sent. Returns false
 425   * if headers are not sent.
 426   */
 427  function send_origin_headers() {
 428      $origin = get_http_origin();
 429  
 430      if ( is_allowed_http_origin( $origin ) ) {
 431          @header( 'Access-Control-Allow-Origin: ' .  $origin );
 432          @header( 'Access-Control-Allow-Credentials: true' );
 433          if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] )
 434              exit;
 435          return $origin;
 436      }
 437  
 438      if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] ) {
 439          status_header( 403 );
 440          exit;
 441      }
 442  
 443      return false;
 444  }
 445  
 446  /**
 447   * Validate a URL for safe use in the HTTP API.
 448   *
 449   * @since 3.5.2
 450   *
 451   * @return mixed URL or false on failure.
 452   */
 453  function wp_http_validate_url( $url ) {
 454      $url = wp_kses_bad_protocol( $url, array( 'http', 'https' ) );
 455      if ( ! $url )
 456          return false;
 457  
 458      $parsed_url = @parse_url( $url );
 459      if ( ! $parsed_url || empty( $parsed_url['host'] ) )
 460          return false;
 461  
 462      if ( isset( $parsed_url['user'] ) || isset( $parsed_url['pass'] ) )
 463          return false;
 464  
 465      if ( false !== strpos( $parsed_url['host'], ':' ) )
 466          return false;
 467  
 468      $parsed_home = @parse_url( get_option( 'home' ) );
 469  
 470      $same_host = strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );
 471  
 472      if ( ! $same_host ) {
 473          $host = trim( $parsed_url['host'], '.' );
 474          if ( preg_match( '#^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$#', $host ) ) {
 475              $ip = $host;
 476          } else {
 477              $ip = gethostbyname( $host );
 478              if ( $ip === $host ) // Error condition for gethostbyname()
 479                  $ip = false;
 480          }
 481          if ( $ip ) {
 482              $parts = array_map( 'intval', explode( '.', $ip ) );
 483              if ( '127.0.0.1' === $ip
 484                  || ( 10 === $parts[0] )
 485                  || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
 486                  || ( 192 === $parts[0] && 168 === $parts[1] )
 487              ) {
 488                  // If host appears local, reject unless specifically allowed.
 489                  /**
 490                   * Check if HTTP request is external or not.
 491                   *
 492                   * Allows to change and allow external requests for the HTTP request.
 493                   *
 494                   * @since 3.6.0
 495                   *
 496                   * @param bool false Whether HTTP request is external or not.
 497                   * @param string $host IP of the requested host.
 498                   * @param string $url URL of the requested host.
 499                   */
 500                  if ( ! apply_filters( 'http_request_host_is_external', false, $host, $url ) )
 501                      return false;
 502              }
 503          }
 504      }
 505  
 506      if ( empty( $parsed_url['port'] ) )
 507          return $url;
 508  
 509      $port = $parsed_url['port'];
 510      if ( 80 === $port || 443 === $port || 8080 === $port )
 511          return $url;
 512  
 513      if ( $parsed_home && $same_host && $parsed_home['port'] === $port )
 514          return $url;
 515  
 516      return false;
 517  }
 518  
 519  /**
 520   * Whitelists allowed redirect hosts for safe HTTP requests as well.
 521   *
 522   * Attached to the http_request_host_is_external filter.
 523   *
 524   * @since 3.6.0
 525   *
 526   * @param bool $is_external
 527   * @param string $host
 528   * @return bool
 529   */
 530  function allowed_http_request_hosts( $is_external, $host ) {
 531      if ( ! $is_external && wp_validate_redirect( 'http://' . $host ) )
 532          $is_external = true;
 533      return $is_external;
 534  }
 535  
 536  /**
 537   * Whitelists any domain in a multisite installation for safe HTTP requests.
 538   *
 539   * Attached to the http_request_host_is_external filter.
 540   *
 541   * @since 3.6.0
 542   *
 543   * @param bool $is_external
 544   * @param string $host
 545   * @return bool
 546   */
 547  function ms_allowed_http_request_hosts( $is_external, $host ) {
 548      global $wpdb;
 549      static $queried = array();
 550      if ( $is_external )
 551          return $is_external;
 552      if ( $host === get_current_site()->domain )
 553          return true;
 554      if ( isset( $queried[ $host ] ) )
 555          return $queried[ $host ];
 556      $queried[ $host ] = (bool) $wpdb->get_var( $wpdb->prepare( "SELECT domain FROM $wpdb->blogs WHERE domain = %s LIMIT 1", $host ) );
 557      return $queried[ $host ];
 558  }