X-Git-Url: https://scripts.mit.edu/gitweb/autoinstallsdev/wordpress.git/blobdiff_plain/5aa86a9053fb0fa15846bb60aac2fb8fdfff524a..c55863f11e8589bf8d4a5698bf15752406654f1c:/wp-includes/class-http.php diff --git a/wp-includes/class-http.php b/wp-includes/class-http.php index a68711c8..c75b47e2 100644 --- a/wp-includes/class-http.php +++ b/wp-includes/class-http.php @@ -15,15 +15,9 @@ /** * WordPress HTTP Class for managing HTTP Transports and making HTTP requests. * - * This class is called for the functionality of making HTTP requests and replaces Snoopy - * functionality. There is no available functionality to add HTTP transport implementations, since - * most of the HTTP transports are added and available for use. - * - * There are no properties, because none are needed and for performance reasons. Some of the - * functions are static and while they do have some overhead over functions in PHP4, the purpose is - * maintainability. When PHP5 is finally the requirement, it will be easy to add the static keyword - * to the code. It is not as easy to convert a function to a method after enough code uses the old - * way. + * This class is used to consistently make outgoing HTTP requests easy for developers + * while still being compatible with the many PHP configurations under which + * WordPress runs. * * Debugging includes several actions, which pass different variables for debugging the HTTP API. * @@ -42,8 +36,7 @@ class WP_Http { * using http_build_query(). * * The only URI that are supported in the HTTP Transport implementation are the HTTP and HTTPS - * protocols. HTTP and HTTPS are assumed so the server might not know how to handle the send - * headers. Other protocols are unsupported and most likely will fail. + * protocols. * * The defaults are 'method', 'timeout', 'redirection', 'httpversion', 'blocking' and * 'user-agent'. @@ -55,24 +48,17 @@ class WP_Http { * accept setting that value. * * The 'httpversion' option is used to sent the HTTP version and accepted values are '1.0', and - * '1.1' and should be a string. Version 1.1 is not supported, because of chunk response. The - * 'user-agent' option is the user-agent and is used to replace the default user-agent, which is - * 'WordPress/WP_Version', where WP_Version is the value from $wp_version. + * '1.1' and should be a string. The 'user-agent' option is the user-agent and is used to + * replace the default user-agent, which is 'WordPress/WP_Version', where WP_Version is the + * value from $wp_version. * - * 'blocking' is the default, which is used to tell the transport, whether it should halt PHP - * while it performs the request or continue regardless. Actually, that isn't entirely correct. - * Blocking mode really just means whether the fread should just pull what it can whenever it - * gets bytes or if it should wait until it has enough in the buffer to read or finishes reading - * the entire content. It doesn't actually always mean that PHP will continue going after making - * the request. + * The 'blocking' parameter can be used to specify if the calling code requires the result of + * the HTTP request. If set to false, the request will be sent to the remote server, and + * processing returned to the calling code immediately, the caller will know if the request + * suceeded or failed, but will not receive any response from the remote server. * * @access public * @since 2.7.0 - * @todo Refactor this code. The code in this method extends the scope of its original purpose - * and should be refactored to allow for cleaner abstraction and reduce duplication of the - * code. One suggestion is to create a class specifically for the arguments, however - * preliminary refactoring to this affect has affect more than just the scope of the - * arguments. Something to ponder at least. * * @param string $url URI resource. * @param str|array $args Optional. Override the defaults. @@ -86,7 +72,8 @@ class WP_Http { 'timeout' => apply_filters( 'http_request_timeout', 5), 'redirection' => apply_filters( 'http_request_redirection_count', 5), 'httpversion' => apply_filters( 'http_request_version', '1.0'), - 'user-agent' => apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' ) ), + 'user-agent' => apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' ) ), + 'reject_unsafe_urls' => apply_filters( 'http_request_reject_unsafe_urls', false ), 'blocking' => true, 'headers' => array(), 'cookies' => array(), @@ -94,11 +81,12 @@ class WP_Http { 'compress' => false, 'decompress' => true, 'sslverify' => true, + 'sslcertificates' => ABSPATH . WPINC . '/certificates/ca-bundle.crt', 'stream' => false, - 'filename' => null + 'filename' => null, + 'limit_response_size' => null, ); - // Pre-parse for the HEAD checks. $args = wp_parse_args( $args ); @@ -109,15 +97,22 @@ class WP_Http { $r = wp_parse_args( $args, $defaults ); $r = apply_filters( 'http_request_args', $r, $url ); - // Certain classes decrement this, store a copy of the original value for loop purposes. - $r['_redirection'] = $r['redirection']; + // The transports decrement this, store a copy of the original value for loop purposes. + if ( ! isset( $r['_redirection'] ) ) + $r['_redirection'] = $r['redirection']; // Allow plugins to short-circuit the request $pre = apply_filters( 'pre_http_request', false, $r, $url ); if ( false !== $pre ) return $pre; - $arrURL = parse_url( $url ); + if ( function_exists( 'wp_kses_bad_protocol' ) ) { + if ( $r['reject_unsafe_urls'] ) + $url = wp_http_validate_url( $url ); + $url = wp_kses_bad_protocol( $url, array( 'http', 'https', 'ssl' ) ); + } + + $arrURL = @parse_url( $url ); if ( empty( $url ) || empty( $arrURL['scheme'] ) ) return new WP_Error('http_request_failed', __('A valid URL was not provided.')); @@ -135,14 +130,14 @@ class WP_Http { unset( $homeURL ); // If we are streaming to a file but no filename was given drop it in the WP temp dir - // and pick it's name using the basename of the $url + // and pick its name using the basename of the $url if ( $r['stream'] && empty( $r['filename'] ) ) $r['filename'] = get_temp_dir() . basename( $url ); // Force some settings if we are streaming to a file and check for existence and perms of destination directory if ( $r['stream'] ) { $r['blocking'] = true; - if ( ! is_writable( dirname( $r['filename'] ) ) ) + if ( ! wp_is_writable( dirname( $r['filename'] ) ) ) return new WP_Error( 'http_request_failed', __( 'Destination directory for file streaming does not exist or is not writable.' ) ); } @@ -150,7 +145,7 @@ class WP_Http { $r['headers'] = array(); if ( ! is_array( $r['headers'] ) ) { - $processedHeaders = WP_Http::processHeaders( $r['headers'] ); + $processedHeaders = WP_Http::processHeaders( $r['headers'], $url ); $r['headers'] = $processedHeaders['headers']; } @@ -164,32 +159,54 @@ class WP_Http { unset( $r['headers']['user-agent'] ); } + if ( '1.1' == $r['httpversion'] && !isset( $r['headers']['connection'] ) ) { + $r['headers']['connection'] = 'close'; + } + // Construct Cookie: header if any cookies are set WP_Http::buildCookieHeader( $r ); - if ( WP_Http_Encoding::is_available() ) - $r['headers']['Accept-Encoding'] = WP_Http_Encoding::accept_encoding(); + // Avoid issues where mbstring.func_overload is enabled + mbstring_binary_safe_encoding(); - if ( empty($r['body']) ) { - $r['body'] = null; - // Some servers fail when sending content without the content-length header being set. - // Also, to fix another bug, we only send when doing POST and PUT and the content-length - // header isn't already set. - if ( ($r['method'] == 'POST' || $r['method'] == 'PUT') && ! isset( $r['headers']['Content-Length'] ) ) - $r['headers']['Content-Length'] = 0; - } else { + if ( ! isset( $r['headers']['Accept-Encoding'] ) ) { + if ( $encoding = WP_Http_Encoding::accept_encoding( $url, $r ) ) + $r['headers']['Accept-Encoding'] = $encoding; + } + + if ( ( ! is_null( $r['body'] ) && '' != $r['body'] ) || 'POST' == $r['method'] || 'PUT' == $r['method'] ) { if ( is_array( $r['body'] ) || is_object( $r['body'] ) ) { $r['body'] = http_build_query( $r['body'], null, '&' ); + if ( ! isset( $r['headers']['Content-Type'] ) ) $r['headers']['Content-Type'] = 'application/x-www-form-urlencoded; charset=' . get_option( 'blog_charset' ); - $r['headers']['Content-Length'] = strlen( $r['body'] ); } + if ( '' === $r['body'] ) + $r['body'] = null; + if ( ! isset( $r['headers']['Content-Length'] ) && ! isset( $r['headers']['content-length'] ) ) $r['headers']['Content-Length'] = strlen( $r['body'] ); } - return $this->_dispatch_request($url, $r); + $response = $this->_dispatch_request( $url, $r ); + + reset_mbstring_encoding(); + + if ( is_wp_error( $response ) ) + return $response; + + // Append cookies that were used in this request to the response + if ( ! empty( $r['cookies'] ) ) { + $cookies_set = wp_list_pluck( $response['cookies'], 'name' ); + foreach ( $r['cookies'] as $cookie ) { + if ( ! in_array( $cookie->name, $cookies_set ) && $cookie->test( $url ) ) { + $response['cookies'][] = $cookie; + } + } + } + + return $response; } /** @@ -201,10 +218,10 @@ class WP_Http { * @param array $args Request arguments * @param string $url URL to Request * - * @return string|false Class name for the first transport that claims to support the request. False if no transport claims to support the request. + * @return string|bool Class name for the first transport that claims to support the request. False if no transport claims to support the request. */ public function _get_first_available_transport( $args, $url = null ) { - $request_order = array( 'curl', 'streams', 'fsockopen' ); + $request_order = apply_filters( 'http_api_transports', array( 'curl', 'streams' ), $args, $url ); // Loop over each transport on each HTTP request looking for one which will serve this request's needs foreach ( $request_order as $transport ) { @@ -226,13 +243,7 @@ class WP_Http { * Tests each transport in order to find a transport which matches the request arguments. * Also caches the transport instance to be used later. * - * The order for blocking requests is cURL, Streams, and finally Fsockopen. - * The order for non-blocking requests is cURL, Streams and Fsockopen(). - * - * There are currently issues with "localhost" not resolving correctly with DNS. This may cause - * an error "failed to open stream: A connection attempt failed because the connected party did - * not properly respond after a period of time, or established connection failed because [the] - * connected host has failed to respond." + * The order for requests is cURL, and then PHP Streams. * * @since 3.2.0 * @access private @@ -326,7 +337,7 @@ class WP_Http { * @param string $strResponse The full response string * @return array Array with 'headers' and 'body' keys. */ - function processResponse($strResponse) { + public static function processResponse($strResponse) { $res = explode("\r\n\r\n", $strResponse, 2); return array('headers' => $res[0], 'body' => isset($res[1]) ? $res[1] : ''); @@ -343,10 +354,11 @@ class WP_Http { * @since 2.7.0 * * @param string|array $headers + * @param string $url The URL that was requested * @return array Processed string headers. If duplicate headers are encountered, * Then a numbered array is returned as the value of that header-key. */ - public static function processHeaders($headers) { + public static function processHeaders( $headers, $url = '' ) { // split headers, one per array element if ( is_string($headers) ) { // tolerate line terminator: CRLF = LF (RFC 2616 19.3) @@ -383,18 +395,18 @@ class WP_Http { list($key, $value) = explode(':', $tempheader, 2); - if ( !empty( $value ) ) { - $key = strtolower( $key ); - if ( isset( $newheaders[$key] ) ) { - if ( !is_array($newheaders[$key]) ) - $newheaders[$key] = array($newheaders[$key]); - $newheaders[$key][] = trim( $value ); - } else { - $newheaders[$key] = trim( $value ); - } - if ( 'set-cookie' == $key ) - $cookies[] = new WP_Http_Cookie( $value ); + $key = strtolower( $key ); + $value = trim( $value ); + + if ( isset( $newheaders[ $key ] ) ) { + if ( ! is_array( $newheaders[ $key ] ) ) + $newheaders[$key] = array( $newheaders[ $key ] ); + $newheaders[ $key ][] = $value; + } else { + $newheaders[ $key ] = $value; } + if ( 'set-cookie' == $key ) + $cookies[] = new WP_Http_Cookie( $value, $url ); } return array('response' => $response, 'headers' => $newheaders, 'cookies' => $cookies); @@ -403,9 +415,9 @@ class WP_Http { /** * Takes the arguments for a ::request() and checks for the cookie array. * - * If it's found, then it's assumed to contain WP_Http_Cookie objects, which are each parsed - * into strings and added to the Cookie: header (within the arguments array). Edits the array by - * reference. + * If it's found, then it upgrades any basic name => value pairs to WP_Http_Cookie instances, + * which are each parsed into strings and added to the Cookie: header (within the arguments array). + * Edits the array by reference. * * @access public * @version 2.8.0 @@ -415,10 +427,17 @@ class WP_Http { */ public static function buildCookieHeader( &$r ) { if ( ! empty($r['cookies']) ) { + // Upgrade any name => value cookie pairs to WP_HTTP_Cookie instances + foreach ( $r['cookies'] as $name => $value ) { + if ( ! is_object( $value ) ) + $r['cookies'][ $name ] = new WP_HTTP_Cookie( array( 'name' => $name, 'value' => $value ) ); + } + $cookies_header = ''; foreach ( (array) $r['cookies'] as $cookie ) { $cookies_header .= $cookie->getHeaderValue() . '; '; } + $cookies_header = substr( $cookies_header, 0, -2 ); $r['headers']['cookie'] = $cookies_header; } @@ -427,10 +446,10 @@ class WP_Http { /** * Decodes chunk transfer-encoding, based off the HTTP 1.1 specification. * - * Based off the HTTP http_encoding_dechunk function. Does not support UTF-8. Does not support - * returning footer headers. Shouldn't be too difficult to support it though. + * Based off the HTTP http_encoding_dechunk function. + * + * @link http://tools.ietf.org/html/rfc2616#section-19.4.6 Process for chunked decoding. * - * @todo Add support for footer chunked headers. * @access public * @since 2.7.0 * @static @@ -438,35 +457,31 @@ class WP_Http { * @param string $body Body content * @return string Chunked decoded body on success or raw body on failure. */ - function chunkTransferDecode($body) { - $body = str_replace(array("\r\n", "\r"), "\n", $body); - // The body is not chunked encoding or is malformed. - if ( ! preg_match( '/^[0-9a-f]+(\s|\n)+/mi', trim($body) ) ) + public static function chunkTransferDecode( $body ) { + // The body is not chunked encoded or is malformed. + if ( ! preg_match( '/^([0-9a-f]+)[^\r\n]*\r\n/i', trim( $body ) ) ) return $body; - $parsedBody = ''; - //$parsedHeaders = array(); Unsupported + $parsed_body = ''; + $body_original = $body; // We'll be altering $body, so need a backup in case of error while ( true ) { - $hasChunk = (bool) preg_match( '/^([0-9a-f]+)(\s|\n)+/mi', $body, $match ); - - if ( $hasChunk ) { - if ( empty( $match[1] ) ) - return $body; + $has_chunk = (bool) preg_match( '/^([0-9a-f]+)[^\r\n]*\r\n/i', $body, $match ); + if ( ! $has_chunk || empty( $match[1] ) ) + return $body_original; - $length = hexdec( $match[1] ); - $chunkLength = strlen( $match[0] ); + $length = hexdec( $match[1] ); + $chunk_length = strlen( $match[0] ); - $strBody = substr($body, $chunkLength, $length); - $parsedBody .= $strBody; + // Parse out the chunk of data + $parsed_body .= substr( $body, $chunk_length, $length ); - $body = ltrim(str_replace(array($match[0], $strBody), '', $body), "\n"); + // Remove the chunk from the raw data + $body = substr( $body, $length + $chunk_length ); - if ( "0" == trim($body) ) - return $parsedBody; // Ignore footer headers. - } else { - return $body; - } + // End of document + if ( '0' === trim( $body ) ) + return $parsed_body; } } @@ -494,19 +509,9 @@ class WP_Http { if ( ! defined( 'WP_HTTP_BLOCK_EXTERNAL' ) || ! WP_HTTP_BLOCK_EXTERNAL ) return false; - // parse_url() only handles http, https type URLs, and will emit E_WARNING on failure. - // This will be displayed on blogs, which is not reasonable. - $check = @parse_url($uri); - - /* Malformed URL, can not process, but this could mean ssl, so let through anyway. - * - * This isn't very security sound. There are instances where a hacker might attempt - * to bypass the proxy and this check. However, the reason for this behavior is that - * WordPress does not do any checking currently for non-proxy requests, so it is keeps with - * the default unsecure nature of the HTTP request. - */ - if ( $check === false ) - return false; + $check = parse_url($uri); + if ( ! $check ) + return true; $home = parse_url( get_option('siteurl') ); @@ -525,7 +530,7 @@ class WP_Http { if ( false !== strpos(WP_ACCESSIBLE_HOSTS, '*') ) { $wildcard_regex = array(); foreach ( $accessible_hosts as $host ) - $wildcard_regex[] = str_replace('\*', '[\w.]+?', preg_quote($host, '/')); + $wildcard_regex[] = str_replace( '\*', '.+', preg_quote( $host, '/' ) ); $wildcard_regex = '/^(' . implode('|', $wildcard_regex) . ')$/i'; } } @@ -533,35 +538,156 @@ class WP_Http { if ( !empty($wildcard_regex) ) return !preg_match($wildcard_regex, $check['host']); else - return !in_array( $check['host'], $accessible_hosts ); //Inverse logic, If its in the array, then we can't access it. + return !in_array( $check['host'], $accessible_hosts ); //Inverse logic, If it's in the array, then we can't access it. + + } + + static function make_absolute_url( $maybe_relative_path, $url ) { + if ( empty( $url ) ) + return $maybe_relative_path; + + // Check for a scheme + if ( false !== strpos( $maybe_relative_path, '://' ) ) + return $maybe_relative_path; + + if ( ! $url_parts = @parse_url( $url ) ) + return $maybe_relative_path; + + if ( ! $relative_url_parts = @parse_url( $maybe_relative_path ) ) + return $maybe_relative_path; + + $absolute_path = $url_parts['scheme'] . '://' . $url_parts['host']; + if ( isset( $url_parts['port'] ) ) + $absolute_path .= ':' . $url_parts['port']; + + // Start off with the Absolute URL path + $path = ! empty( $url_parts['path'] ) ? $url_parts['path'] : '/'; + + // If it's a root-relative path, then great + if ( ! empty( $relative_url_parts['path'] ) && '/' == $relative_url_parts['path'][0] ) { + $path = $relative_url_parts['path']; + + // Else it's a relative path + } elseif ( ! empty( $relative_url_parts['path'] ) ) { + // Strip off any file components from the absolute path + $path = substr( $path, 0, strrpos( $path, '/' ) + 1 ); + + // Build the new path + $path .= $relative_url_parts['path']; + + // Strip all /path/../ out of the path + while ( strpos( $path, '../' ) > 1 ) { + $path = preg_replace( '![^/]+/\.\./!', '', $path ); + } + + // Strip any final leading ../ from the path + $path = preg_replace( '!^/(\.\./)+!', '', $path ); + } + + // Add the Query string + if ( ! empty( $relative_url_parts['query'] ) ) + $path .= '?' . $relative_url_parts['query']; + + return $absolute_path . '/' . ltrim( $path, '/' ); + } + + /** + * Handles HTTP Redirects and follows them if appropriate. + * + * @since 3.7.0 + * + * @param string $url The URL which was requested. + * @param array $args The Arguements which were used to make the request. + * @param array $response The Response of the HTTP request. + * @return false|object False if no redirect is present, a WP_HTTP or WP_Error result otherwise. + */ + static function handle_redirects( $url, $args, $response ) { + // If no redirects are present, or, redirects were not requested, perform no action. + if ( ! isset( $response['headers']['location'] ) || 0 === $args['_redirection'] ) + return false; + + // Only perform redirections on redirection http codes + if ( $response['response']['code'] > 399 || $response['response']['code'] < 300 ) + return false; + + // Don't redirect if we've run out of redirects + if ( $args['redirection']-- <= 0 ) + return new WP_Error( 'http_request_failed', __('Too many redirects.') ); + + $redirect_location = $response['headers']['location']; + + // If there were multiple Location headers, use the last header specified + if ( is_array( $redirect_location ) ) + $redirect_location = array_pop( $redirect_location ); + + $redirect_location = WP_HTTP::make_absolute_url( $redirect_location, $url ); + + // POST requests should not POST to a redirected location + if ( 'POST' == $args['method'] ) { + if ( in_array( $response['response']['code'], array( 302, 303 ) ) ) + $args['method'] = 'GET'; + } + + // Include valid cookies in the redirect process + if ( ! empty( $response['cookies'] ) ) { + foreach ( $response['cookies'] as $cookie ) { + if ( $cookie->test( $redirect_location ) ) + $args['cookies'][] = $cookie; + } + } + + return wp_remote_request( $redirect_location, $args ); + } + /** + * Determines if a specified string represents an IP address or not. + * + * This function also detects the type of the IP address, returning either + * '4' or '6' to represent a IPv4 and IPv6 address respectively. + * This does not verify if the IP is a valid IP, only that it appears to be + * an IP address. + * + * @see http://home.deds.nl/~aeron/regex/ for IPv6 regex + * + * @since 3.7.0 + * @static + * + * @param string $maybe_ip A suspected IP address + * @return integer|bool Upon success, '4' or '6' to represent a IPv4 or IPv6 address, false upon failure + */ + static function is_ip_address( $maybe_ip ) { + if ( preg_match( '/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/', $maybe_ip ) ) + return 4; + if ( false !== strpos( $maybe_ip, ':' ) && preg_match( '/^(((?=.*(::))(?!.*\3.+\3))\3?|([\dA-F]{1,4}(\3|:\b|$)|\2))(?4){5}((?4){2}|(((2[0-4]|1\d|[1-9])?\d|25[0-5])\.?\b){4})$/i', trim( $maybe_ip, ' []' ) ) ) + return 6; + return false; } + } /** - * HTTP request method uses fsockopen function to retrieve the url. - * - * This would be the preferred method, but the fsockopen implementation has the most overhead of all - * the HTTP transport implementations. + * HTTP request method uses PHP Streams to retrieve the url. * * @package WordPress * @subpackage HTTP + * * @since 2.7.0 + * @since 3.7.0 Combined with the fsockopen transport and switched to stream_socket_client(). */ -class WP_Http_Fsockopen { +class WP_Http_Streams { /** - * Send a HTTP request to a URI using fsockopen(). - * - * Does not support non-blocking mode. + * Send a HTTP request to a URI using PHP Streams. * * @see WP_Http::request For default options descriptions. * - * @since 2.7 + * @since 2.7.0 + * @since 3.7.0 Combined with the fsockopen transport and switched to stream_socket_client(). + * * @access public * @param string $url URI resource. - * @param str|array $args Optional. Override the defaults. + * @param string|array $args Optional. Override the defaults. * @return array 'headers', 'body', 'response', 'cookies' and 'filename' keys. */ function request($url, $args = array()) { @@ -585,18 +711,13 @@ class WP_Http_Fsockopen { // Construct Cookie: header if any cookies are set WP_Http::buildCookieHeader( $r ); - $iError = null; // Store error number - $strError = null; // Store error string - $arrURL = parse_url($url); - $fsockopen_host = $arrURL['host']; - - $secure_transport = false; + $connect_host = $arrURL['host']; + $secure_transport = ( $arrURL['scheme'] == 'ssl' || $arrURL['scheme'] == 'https' ); if ( ! isset( $arrURL['port'] ) ) { - if ( ( $arrURL['scheme'] == 'ssl' || $arrURL['scheme'] == 'https' ) && extension_loaded('openssl') ) { - $fsockopen_host = "ssl://$fsockopen_host"; + if ( $arrURL['scheme'] == 'ssl' || $arrURL['scheme'] == 'https' ) { $arrURL['port'] = 443; $secure_transport = true; } else { @@ -604,45 +725,82 @@ class WP_Http_Fsockopen { } } - //fsockopen has issues with 'localhost' with IPv6 with certain versions of PHP, It attempts to connect to ::1, + if ( isset( $r['headers']['Host'] ) || isset( $r['headers']['host'] ) ) { + if ( isset( $r['headers']['Host'] ) ) + $arrURL['host'] = $r['headers']['Host']; + else + $arrURL['host'] = $r['headers']['host']; + unset( $r['headers']['Host'], $r['headers']['host'] ); + } + + // Certain versions of PHP have issues with 'localhost' and IPv6, It attempts to connect to ::1, // which fails when the server is not set up for it. For compatibility, always connect to the IPv4 address. - if ( 'localhost' == strtolower($fsockopen_host) ) - $fsockopen_host = '127.0.0.1'; + if ( 'localhost' == strtolower( $connect_host ) ) + $connect_host = '127.0.0.1'; - // There are issues with the HTTPS and SSL protocols that cause errors that can be safely - // ignored and should be ignored. - if ( true === $secure_transport ) - $error_reporting = error_reporting(0); + $connect_host = $secure_transport ? 'ssl://' . $connect_host : 'tcp://' . $connect_host; - $startDelay = time(); + $is_local = isset( $r['local'] ) && $r['local']; + $ssl_verify = isset( $r['sslverify'] ) && $r['sslverify']; + if ( $is_local ) + $ssl_verify = apply_filters( 'https_local_ssl_verify', $ssl_verify ); + elseif ( ! $is_local ) + $ssl_verify = apply_filters( 'https_ssl_verify', $ssl_verify ); $proxy = new WP_HTTP_Proxy(); + $context = stream_context_create( array( + 'ssl' => array( + 'verify_peer' => $ssl_verify, + //'CN_match' => $arrURL['host'], // This is handled by self::verify_ssl_certificate() + 'capture_peer_cert' => $ssl_verify, + 'SNI_enabled' => true, + 'cafile' => $r['sslcertificates'], + 'allow_self_signed' => ! $ssl_verify, + ) + ) ); + + $timeout = (int) floor( $r['timeout'] ); + $utimeout = $timeout == $r['timeout'] ? 0 : 1000000 * $r['timeout'] % 1000000; + $connect_timeout = max( $timeout, 1 ); + + $connection_error = null; // Store error number + $connection_error_str = null; // Store error string + if ( !WP_DEBUG ) { + // In the event that the SSL connection fails, silence the many PHP Warnings + if ( $secure_transport ) + $error_reporting = error_reporting(0); + if ( $proxy->is_enabled() && $proxy->send_through_proxy( $url ) ) - $handle = @fsockopen( $proxy->host(), $proxy->port(), $iError, $strError, $r['timeout'] ); + $handle = @stream_socket_client( 'tcp://' . $proxy->host() . ':' . $proxy->port(), $connection_error, $connection_error_str, $connect_timeout, STREAM_CLIENT_CONNECT, $context ); else - $handle = @fsockopen( $fsockopen_host, $arrURL['port'], $iError, $strError, $r['timeout'] ); + $handle = @stream_socket_client( $connect_host . ':' . $arrURL['port'], $connection_error, $connection_error_str, $connect_timeout, STREAM_CLIENT_CONNECT, $context ); + + if ( $secure_transport ) + error_reporting( $error_reporting ); + } else { if ( $proxy->is_enabled() && $proxy->send_through_proxy( $url ) ) - $handle = fsockopen( $proxy->host(), $proxy->port(), $iError, $strError, $r['timeout'] ); + $handle = stream_socket_client( 'tcp://' . $proxy->host() . ':' . $proxy->port(), $connection_error, $connection_error_str, $connect_timeout, STREAM_CLIENT_CONNECT, $context ); else - $handle = fsockopen( $fsockopen_host, $arrURL['port'], $iError, $strError, $r['timeout'] ); + $handle = stream_socket_client( $connect_host . ':' . $arrURL['port'], $connection_error, $connection_error_str, $connect_timeout, STREAM_CLIENT_CONNECT, $context ); } - $endDelay = time(); + if ( false === $handle ) { + // SSL connection failed due to expired/invalid cert, or, OpenSSL configuration is broken + if ( $secure_transport && 0 === $connection_error && '' === $connection_error_str ) + return new WP_Error( 'http_request_failed', __( 'The SSL certificate for the host could not be verified.' ) ); - // If the delay is greater than the timeout then fsockopen shouldn't be used, because it will - // cause a long delay. - $elapseDelay = ($endDelay-$startDelay) > $r['timeout']; - if ( true === $elapseDelay ) - add_option( 'disable_fsockopen', $endDelay, null, true ); + return new WP_Error('http_request_failed', $connection_error . ': ' . $connection_error_str ); + } - if ( false === $handle ) - return new WP_Error('http_request_failed', $iError . ': ' . $strError); + // Verify that the SSL certificate is valid for this request + if ( $secure_transport && $ssl_verify && ! $proxy->is_enabled() ) { + if ( ! self::verify_ssl_certificate( $handle, $arrURL['host'] ) ) + return new WP_Error( 'http_request_failed', __( 'The SSL certificate for the host could not be verified.' ) ); + } - $timeout = (int) floor( $r['timeout'] ); - $utimeout = $timeout == $r['timeout'] ? 0 : 1000000 * $r['timeout'] % 1000000; stream_set_timeout( $handle, $timeout, $utimeout ); if ( $proxy->is_enabled() && $proxy->send_through_proxy( $url ) ) //Some proxies require full URL in this field. @@ -681,12 +839,17 @@ class WP_Http_Fsockopen { fwrite($handle, $strHeaders); if ( ! $r['blocking'] ) { - fclose($handle); + stream_set_blocking( $handle, 0 ); + fclose( $handle ); return array( 'headers' => array(), 'body' => '', 'response' => array('code' => false, 'message' => false), 'cookies' => array() ); } $strResponse = ''; $bodyStarted = false; + $keep_reading = true; + $block_size = 4096; + if ( isset( $r['limit_response_size'] ) ) + $block_size = min( $block_size, $r['limit_response_size'] ); // If streaming to a file setup the file handle if ( $r['stream'] ) { @@ -697,47 +860,72 @@ class WP_Http_Fsockopen { if ( ! $stream_handle ) return new WP_Error( 'http_request_failed', sprintf( __( 'Could not open handle for fopen() to %s' ), $r['filename'] ) ); - while ( ! feof($handle) ) { - $block = fread( $handle, 4096 ); - if ( $bodyStarted ) { - fwrite( $stream_handle, $block ); - } else { + $bytes_written = 0; + while ( ! feof($handle) && $keep_reading ) { + $block = fread( $handle, $block_size ); + if ( ! $bodyStarted ) { $strResponse .= $block; if ( strpos( $strResponse, "\r\n\r\n" ) ) { $process = WP_Http::processResponse( $strResponse ); $bodyStarted = true; - fwrite( $stream_handle, $process['body'] ); + $block = $process['body']; unset( $strResponse ); $process['body'] = ''; } } + + $this_block_size = strlen( $block ); + + if ( isset( $r['limit_response_size'] ) && ( $bytes_written + $this_block_size ) > $r['limit_response_size'] ) + $block = substr( $block, 0, ( $r['limit_response_size'] - $bytes_written ) ); + + $bytes_written_to_file = fwrite( $stream_handle, $block ); + + if ( $bytes_written_to_file != $this_block_size ) { + fclose( $handle ); + fclose( $stream_handle ); + return new WP_Error( 'http_request_failed', __( 'Failed to write request to temporary file.' ) ); + } + + $bytes_written += $bytes_written_to_file; + + $keep_reading = !isset( $r['limit_response_size'] ) || $bytes_written < $r['limit_response_size']; } fclose( $stream_handle ); } else { - while ( ! feof($handle) ) - $strResponse .= fread( $handle, 4096 ); + $header_length = 0; + while ( ! feof( $handle ) && $keep_reading ) { + $block = fread( $handle, $block_size ); + $strResponse .= $block; + if ( ! $bodyStarted && strpos( $strResponse, "\r\n\r\n" ) ) { + $header_length = strpos( $strResponse, "\r\n\r\n" ) + 4; + $bodyStarted = true; + } + $keep_reading = ( ! $bodyStarted || !isset( $r['limit_response_size'] ) || strlen( $strResponse ) < ( $header_length + $r['limit_response_size'] ) ); + } $process = WP_Http::processResponse( $strResponse ); unset( $strResponse ); + } fclose( $handle ); - if ( true === $secure_transport ) - error_reporting($error_reporting); + $arrHeaders = WP_Http::processHeaders( $process['headers'], $url ); - $arrHeaders = WP_Http::processHeaders( $process['headers'] ); + $response = array( + 'headers' => $arrHeaders['headers'], + 'body' => null, // Not yet processed + 'response' => $arrHeaders['response'], + 'cookies' => $arrHeaders['cookies'], + 'filename' => $r['filename'] + ); - // If location is found, then assume redirect and redirect to location. - if ( isset($arrHeaders['headers']['location']) && 0 !== $r['_redirection'] ) { - if ( $r['redirection']-- > 0 ) { - return $this->request($arrHeaders['headers']['location'], $r); - } else { - return new WP_Error('http_request_failed', __('Too many redirects.')); - } - } + // Handle redirects + if ( false !== ( $redirect_response = WP_HTTP::handle_redirects( $url, $r, $response ) ) ) + return $redirect_response; // If the body was chunk encoded, then decode it. if ( ! empty( $process['body'] ) && isset( $arrHeaders['headers']['transfer-encoding'] ) && 'chunked' == $arrHeaders['headers']['transfer-encoding'] ) @@ -746,188 +934,73 @@ class WP_Http_Fsockopen { if ( true === $r['decompress'] && true === WP_Http_Encoding::should_decode($arrHeaders['headers']) ) $process['body'] = WP_Http_Encoding::decompress( $process['body'] ); - return array( 'headers' => $arrHeaders['headers'], 'body' => $process['body'], 'response' => $arrHeaders['response'], 'cookies' => $arrHeaders['cookies'], 'filename' => $r['filename'] ); - } - - /** - * Whether this class can be used for retrieving an URL. - * - * @since 2.7.0 - * @static - * @return boolean False means this class can not be used, true means it can. - */ - public static function test( $args = array() ) { - if ( ! function_exists( 'fsockopen' ) ) - return false; - - if ( false !== ($option = get_option( 'disable_fsockopen' )) && time()-$option < 43200 ) // 12 hours - return false; - - $is_ssl = isset( $args['ssl'] ) && $args['ssl']; + if ( isset( $r['limit_response_size'] ) && strlen( $process['body'] ) > $r['limit_response_size'] ) + $process['body'] = substr( $process['body'], 0, $r['limit_response_size'] ); - if ( $is_ssl && ! extension_loaded( 'openssl' ) ) - return false; + $response['body'] = $process['body']; - return apply_filters( 'use_fsockopen_transport', true, $args ); + return $response; } -} -/** - * HTTP request method uses Streams to retrieve the url. - * - * Requires PHP 5.0+ and uses fopen with stream context. Requires that 'allow_url_fopen' PHP setting - * to be enabled. - * - * Second preferred method for getting the URL, for PHP 5. - * - * @package WordPress - * @subpackage HTTP - * @since 2.7.0 - */ -class WP_Http_Streams { /** - * Send a HTTP request to a URI using streams with fopen(). + * Verifies the received SSL certificate against it's Common Names and subjectAltName fields * - * @access public - * @since 2.7.0 + * PHP's SSL verifications only verify that it's a valid Certificate, it doesn't verify if + * the certificate is valid for the hostname which was requested. + * This function verifies the requested hostname against certificate's subjectAltName field, + * if that is empty, or contains no DNS entries, a fallback to the Common Name field is used. * - * @param string $url - * @param str|array $args Optional. Override the defaults. - * @return array 'headers', 'body', 'response', 'cookies' and 'filename' keys. + * IP Address support is included if the request is being made to an IP address. + * + * @since 3.7.0 + * @static + * + * @param stream $stream The PHP Stream which the SSL request is being made over + * @param string $host The hostname being requested + * @return bool If the cerficiate presented in $stream is valid for $host */ - function request($url, $args = array()) { - $defaults = array( - 'method' => 'GET', 'timeout' => 5, - 'redirection' => 5, 'httpversion' => '1.0', - 'blocking' => true, - 'headers' => array(), 'body' => null, 'cookies' => array() - ); - - $r = wp_parse_args( $args, $defaults ); - - if ( isset($r['headers']['User-Agent']) ) { - $r['user-agent'] = $r['headers']['User-Agent']; - unset($r['headers']['User-Agent']); - } else if ( isset($r['headers']['user-agent']) ) { - $r['user-agent'] = $r['headers']['user-agent']; - unset($r['headers']['user-agent']); - } - - // Construct Cookie: header if any cookies are set - WP_Http::buildCookieHeader( $r ); - - $arrURL = parse_url($url); - - if ( false === $arrURL ) - return new WP_Error('http_request_failed', sprintf(__('Malformed URL: %s'), $url)); - - if ( 'http' != $arrURL['scheme'] && 'https' != $arrURL['scheme'] ) - $url = preg_replace('|^' . preg_quote($arrURL['scheme'], '|') . '|', 'http', $url); - - // Convert Header array to string. - $strHeaders = ''; - if ( is_array( $r['headers'] ) ) - foreach ( $r['headers'] as $name => $value ) - $strHeaders .= "{$name}: $value\r\n"; - else if ( is_string( $r['headers'] ) ) - $strHeaders = $r['headers']; - - $is_local = isset($args['local']) && $args['local']; - $ssl_verify = isset($args['sslverify']) && $args['sslverify']; - if ( $is_local ) - $ssl_verify = apply_filters('https_local_ssl_verify', $ssl_verify); - elseif ( ! $is_local ) - $ssl_verify = apply_filters('https_ssl_verify', $ssl_verify); - - $arrContext = array('http' => - array( - 'method' => strtoupper($r['method']), - 'user_agent' => $r['user-agent'], - 'max_redirects' => $r['redirection'] + 1, // See #11557 - 'protocol_version' => (float) $r['httpversion'], - 'header' => $strHeaders, - 'ignore_errors' => true, // Return non-200 requests. - 'timeout' => $r['timeout'], - 'ssl' => array( - 'verify_peer' => $ssl_verify, - 'verify_host' => $ssl_verify - ) - ) - ); - - $proxy = new WP_HTTP_Proxy(); - - if ( $proxy->is_enabled() && $proxy->send_through_proxy( $url ) ) { - $arrContext['http']['proxy'] = 'tcp://' . $proxy->host() . ':' . $proxy->port(); - $arrContext['http']['request_fulluri'] = true; - - // We only support Basic authentication so this will only work if that is what your proxy supports. - if ( $proxy->use_authentication() ) - $arrContext['http']['header'] .= $proxy->authentication_header() . "\r\n"; - } - - if ( ! empty($r['body'] ) ) - $arrContext['http']['content'] = $r['body']; + static function verify_ssl_certificate( $stream, $host ) { + $context_options = stream_context_get_options( $stream ); - $context = stream_context_create($arrContext); - - if ( !WP_DEBUG ) - $handle = @fopen($url, 'r', false, $context); - else - $handle = fopen($url, 'r', false, $context); - - if ( ! $handle ) - return new WP_Error('http_request_failed', sprintf(__('Could not open handle for fopen() to %s'), $url)); - - $timeout = (int) floor( $r['timeout'] ); - $utimeout = $timeout == $r['timeout'] ? 0 : 1000000 * $r['timeout'] % 1000000; - stream_set_timeout( $handle, $timeout, $utimeout ); - - if ( ! $r['blocking'] ) { - stream_set_blocking($handle, 0); - fclose($handle); - return array( 'headers' => array(), 'body' => '', 'response' => array('code' => false, 'message' => false), 'cookies' => array() ); - } - - if ( $r['stream'] ) { - if ( ! WP_DEBUG ) - $stream_handle = @fopen( $r['filename'], 'w+' ); - else - $stream_handle = fopen( $r['filename'], 'w+' ); + if ( empty( $context_options['ssl']['peer_certificate'] ) ) + return false; - if ( ! $stream_handle ) - return new WP_Error( 'http_request_failed', sprintf( __( 'Could not open handle for fopen() to %s' ), $r['filename'] ) ); + $cert = openssl_x509_parse( $context_options['ssl']['peer_certificate'] ); + if ( ! $cert ) + return false; - stream_copy_to_stream( $handle, $stream_handle ); + // If the request is being made to an IP address, we'll validate against IP fields in the cert (if they exist) + $host_type = ( WP_HTTP::is_ip_address( $host ) ? 'ip' : 'dns' ); - fclose( $stream_handle ); - $strResponse = ''; - } else { - $strResponse = stream_get_contents( $handle ); + $certificate_hostnames = array(); + if ( ! empty( $cert['extensions']['subjectAltName'] ) ) { + $match_against = preg_split( '/,\s*/', $cert['extensions']['subjectAltName'] ); + foreach ( $match_against as $match ) { + list( $match_type, $match_host ) = explode( ':', $match ); + if ( $host_type == strtolower( trim( $match_type ) ) ) // IP: or DNS: + $certificate_hostnames[] = strtolower( trim( $match_host ) ); + } + } elseif ( !empty( $cert['subject']['CN'] ) ) { + // Only use the CN when the certificate includes no subjectAltName extension + $certificate_hostnames[] = strtolower( $cert['subject']['CN'] ); } - $meta = stream_get_meta_data( $handle ); - - fclose( $handle ); - - $processedHeaders = array(); - if ( isset( $meta['wrapper_data']['headers'] ) ) - $processedHeaders = WP_Http::processHeaders($meta['wrapper_data']['headers']); - else - $processedHeaders = WP_Http::processHeaders($meta['wrapper_data']); + // Exact hostname/IP matches + if ( in_array( strtolower( $host ), $certificate_hostnames ) ) + return true; - // Streams does not provide an error code which we can use to see why the request stream stopped. - // We can however test to see if a location header is present and return based on that. - if ( isset($processedHeaders['headers']['location']) && 0 !== $args['_redirection'] ) - return new WP_Error('http_request_failed', __('Too many redirects.')); + // IP's can't be wildcards, Stop processing + if ( 'ip' == $host_type ) + return false; - if ( ! empty( $strResponse ) && isset( $processedHeaders['headers']['transfer-encoding'] ) && 'chunked' == $processedHeaders['headers']['transfer-encoding'] ) - $strResponse = WP_Http::chunkTransferDecode($strResponse); + // Test to see if the domain is at least 2 deep for wildcard support + if ( substr_count( $host, '.' ) < 2 ) + return false; - if ( true === $r['decompress'] && true === WP_Http_Encoding::should_decode($processedHeaders['headers']) ) - $strResponse = WP_Http_Encoding::decompress( $strResponse ); + // Wildcard subdomains certs (*.example.com) are valid for a.example.com but not a.b.example.com + $wildcard_host = preg_replace( '/^[^.]+\./', '*.', $host ); - return array( 'headers' => $processedHeaders['headers'], 'body' => $strResponse, 'response' => $processedHeaders['response'], 'cookies' => $processedHeaders['cookies'], 'filename' => $r['filename'] ); + return in_array( strtolower( $wildcard_host ), $certificate_hostnames ); } /** @@ -936,25 +1009,45 @@ class WP_Http_Streams { * @static * @access public * @since 2.7.0 + * @since 3.7.0 Combined with the fsockopen transport and switched to stream_socket_client(). * * @return boolean False means this class can not be used, true means it can. */ public static function test( $args = array() ) { - if ( ! function_exists( 'fopen' ) ) - return false; - - if ( ! function_exists( 'ini_get' ) || true != ini_get( 'allow_url_fopen' ) ) + if ( ! function_exists( 'stream_socket_client' ) ) return false; $is_ssl = isset( $args['ssl'] ) && $args['ssl']; - if ( $is_ssl && ! extension_loaded( 'openssl' ) ) - return false; + if ( $is_ssl ) { + if ( ! extension_loaded( 'openssl' ) ) + return false; + if ( ! function_exists( 'openssl_x509_parse' ) ) + return false; + } return apply_filters( 'use_streams_transport', true, $args ); } } +/** + * Deprecated HTTP Transport method which used fsockopen. + * + * This class is not used, and is included for backwards compatibility only. + * All code should make use of WP_HTTP directly through it's API. + * + * @see WP_HTTP::request + * + * @package WordPress + * @subpackage HTTP + * + * @since 2.7.0 + * @deprecated 3.7.0 Please use WP_HTTP::request() directly + */ +class WP_HTTP_Fsockopen extends WP_HTTP_Streams { + // For backwards compatibility for users who are using the class directly +} + /** * HTTP request method uses Curl extension to retrieve the url. * @@ -962,12 +1055,12 @@ class WP_Http_Streams { * * @package WordPress * @subpackage HTTP - * @since 2.7 + * @since 2.7.0 */ class WP_Http_Curl { /** - * Temporary header storage for use with streaming to a file. + * Temporary header storage for during requests. * * @since 3.2.0 * @access private @@ -975,6 +1068,33 @@ class WP_Http_Curl { */ private $headers = ''; + /** + * Temporary body storage for during requests. + * + * @since 3.6.0 + * @access private + * @var string + */ + private $body = ''; + + /** + * The maximum amount of data to recieve from the remote server + * + * @since 3.6.0 + * @access private + * @var int + */ + private $max_body_length = false; + + /** + * The file resource used for streaming to file. + * + * @since 3.6.0 + * @access private + * @var resource + */ + private $stream_handle = false; + /** * Send a HTTP request to a URI using cURL extension. * @@ -1023,15 +1143,14 @@ class WP_Http_Curl { } } - $is_local = isset($args['local']) && $args['local']; - $ssl_verify = isset($args['sslverify']) && $args['sslverify']; + $is_local = isset($r['local']) && $r['local']; + $ssl_verify = isset($r['sslverify']) && $r['sslverify']; if ( $is_local ) $ssl_verify = apply_filters('https_local_ssl_verify', $ssl_verify); elseif ( ! $is_local ) $ssl_verify = apply_filters('https_ssl_verify', $ssl_verify); - - // CURLOPT_TIMEOUT and CURLOPT_CONNECTTIMEOUT expect integers. Have to use ceil since + // CURLOPT_TIMEOUT and CURLOPT_CONNECTTIMEOUT expect integers. Have to use ceil since // a value of 0 will allow an unlimited timeout. $timeout = (int) ceil( $r['timeout'] ); curl_setopt( $handle, CURLOPT_CONNECTTIMEOUT, $timeout ); @@ -1041,8 +1160,13 @@ class WP_Http_Curl { curl_setopt( $handle, CURLOPT_RETURNTRANSFER, true ); curl_setopt( $handle, CURLOPT_SSL_VERIFYHOST, ( $ssl_verify === true ) ? 2 : false ); curl_setopt( $handle, CURLOPT_SSL_VERIFYPEER, $ssl_verify ); + curl_setopt( $handle, CURLOPT_CAINFO, $r['sslcertificates'] ); curl_setopt( $handle, CURLOPT_USERAGENT, $r['user-agent'] ); - curl_setopt( $handle, CURLOPT_MAXREDIRS, $r['redirection'] ); + // The option doesn't work with safe mode or when open_basedir is set, and there's a + // bug #17490 with redirected POST requests, so handle redirections outside Curl. + curl_setopt( $handle, CURLOPT_FOLLOWLOCATION, false ); + if ( defined( 'CURLOPT_PROTOCOLS' ) ) // PHP 5.2.10 / cURL 7.19.4 + curl_setopt( $handle, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS ); switch ( $r['method'] ) { case 'HEAD': @@ -1056,28 +1180,37 @@ class WP_Http_Curl { curl_setopt( $handle, CURLOPT_CUSTOMREQUEST, 'PUT' ); curl_setopt( $handle, CURLOPT_POSTFIELDS, $r['body'] ); break; + default: + curl_setopt( $handle, CURLOPT_CUSTOMREQUEST, $r['method'] ); + if ( ! is_null( $r['body'] ) ) + curl_setopt( $handle, CURLOPT_POSTFIELDS, $r['body'] ); + break; } - if ( true === $r['blocking'] ) - curl_setopt( $handle, CURLOPT_HEADERFUNCTION, array( &$this, 'stream_headers' ) ); + if ( true === $r['blocking'] ) { + curl_setopt( $handle, CURLOPT_HEADERFUNCTION, array( $this, 'stream_headers' ) ); + curl_setopt( $handle, CURLOPT_WRITEFUNCTION, array( $this, 'stream_body' ) ); + } curl_setopt( $handle, CURLOPT_HEADER, false ); + if ( isset( $r['limit_response_size'] ) ) + $this->max_body_length = intval( $r['limit_response_size'] ); + else + $this->max_body_length = false; + // If streaming to a file open a file handle, and setup our curl streaming handler if ( $r['stream'] ) { if ( ! WP_DEBUG ) - $stream_handle = @fopen( $r['filename'], 'w+' ); + $this->stream_handle = @fopen( $r['filename'], 'w+' ); else - $stream_handle = fopen( $r['filename'], 'w+' ); - if ( ! $stream_handle ) + $this->stream_handle = fopen( $r['filename'], 'w+' ); + if ( ! $this->stream_handle ) return new WP_Error( 'http_request_failed', sprintf( __( 'Could not open handle for fopen() to %s' ), $r['filename'] ) ); - curl_setopt( $handle, CURLOPT_FILE, $stream_handle ); + } else { + $this->stream_handle = false; } - // The option doesn't work with safe mode or when open_basedir is set. - if ( !ini_get('safe_mode') && !ini_get('open_basedir') && 0 !== $r['_redirection'] ) - curl_setopt( $handle, CURLOPT_FOLLOWLOCATION, true ); - if ( !empty( $r['headers'] ) ) { // cURL expects full header strings in each element $headers = array(); @@ -1099,26 +1232,44 @@ class WP_Http_Curl { // We don't need to return the body, so don't. Just execute request and return. if ( ! $r['blocking'] ) { curl_exec( $handle ); + + if ( $curl_error = curl_error( $handle ) ) { + curl_close( $handle ); + return new WP_Error( 'http_request_failed', $curl_error ); + } + if ( in_array( curl_getinfo( $handle, CURLINFO_HTTP_CODE ), array( 301, 302 ) ) ) { + curl_close( $handle ); + return new WP_Error( 'http_request_failed', __( 'Too many redirects.' ) ); + } + curl_close( $handle ); return array( 'headers' => array(), 'body' => '', 'response' => array('code' => false, 'message' => false), 'cookies' => array() ); } $theResponse = curl_exec( $handle ); - $theBody = ''; - $theHeaders = WP_Http::processHeaders( $this->headers ); - - if ( strlen($theResponse) > 0 && ! is_bool( $theResponse ) ) // is_bool: when using $args['stream'], curl_exec will return (bool)true - $theBody = $theResponse; - - // If no response, and It's not a HEAD request with valid headers returned - if ( 0 == strlen($theResponse) && ('HEAD' != $args['method'] || empty($this->headers)) ) { - if ( $curl_error = curl_error($handle) ) - return new WP_Error('http_request_failed', $curl_error); - if ( in_array( curl_getinfo( $handle, CURLINFO_HTTP_CODE ), array(301, 302) ) ) - return new WP_Error('http_request_failed', __('Too many redirects.')); - } + $theHeaders = WP_Http::processHeaders( $this->headers, $url ); + $theBody = $this->body; $this->headers = ''; + $this->body = ''; + + $curl_error = curl_errno( $handle ); + + // If an error occured, or, no response + if ( $curl_error || ( 0 == strlen( $theBody ) && empty( $theHeaders['headers'] ) ) ) { + if ( CURLE_WRITE_ERROR /* 23 */ == $curl_error && $r['stream'] ) { + fclose( $this->stream_handle ); + return new WP_Error( 'http_request_failed', __( 'Failed to write request to temporary file.' ) ); + } + if ( $curl_error = curl_error( $handle ) ) { + curl_close( $handle ); + return new WP_Error( 'http_request_failed', $curl_error ); + } + if ( in_array( curl_getinfo( $handle, CURLINFO_HTTP_CODE ), array( 301, 302 ) ) ) { + curl_close( $handle ); + return new WP_Error( 'http_request_failed', __( 'Too many redirects.' ) ); + } + } $response = array(); $response['code'] = curl_getinfo( $handle, CURLINFO_HTTP_CODE ); @@ -1127,21 +1278,26 @@ class WP_Http_Curl { curl_close( $handle ); if ( $r['stream'] ) - fclose( $stream_handle ); + fclose( $this->stream_handle ); - // See #11305 - When running under safe mode, redirection is disabled above. Handle it manually. - if ( ! empty( $theHeaders['headers']['location'] ) && ( ini_get( 'safe_mode' ) || ini_get( 'open_basedir' ) ) && 0 !== $r['_redirection'] ) { - if ( $r['redirection']-- > 0 ) { - return $this->request( $theHeaders['headers']['location'], $r ); - } else { - return new WP_Error( 'http_request_failed', __( 'Too many redirects.' ) ); - } - } + $response = array( + 'headers' => $theHeaders['headers'], + 'body' => null, + 'response' => $response, + 'cookies' => $theHeaders['cookies'], + 'filename' => $r['filename'] + ); + + // Handle redirects + if ( false !== ( $redirect_response = WP_HTTP::handle_redirects( $url, $r, $response ) ) ) + return $redirect_response; if ( true === $r['decompress'] && true === WP_Http_Encoding::should_decode($theHeaders['headers']) ) $theBody = WP_Http_Encoding::decompress( $theBody ); - return array( 'headers' => $theHeaders['headers'], 'body' => $theBody, 'response' => $response, 'cookies' => $theHeaders['cookies'], 'filename' => $r['filename'] ); + $response['body'] = $theBody; + + return $response; } /** @@ -1158,6 +1314,33 @@ class WP_Http_Curl { return strlen( $headers ); } + /** + * Grab the body of the cURL request + * + * The contents of the document are passed in chunks, so we append to the $body property for temporary storage. + * Returning a length shorter than the length of $data passed in will cause cURL to abort the request as "completed" + * + * @since 3.6.0 + * @access private + * @return int + */ + private function stream_body( $handle, $data ) { + $data_length = strlen( $data ); + + if ( $this->max_body_length && ( strlen( $this->body ) + $data_length ) > $this->max_body_length ) + $data = substr( $data, 0, ( $this->max_body_length - $data_length ) ); + + if ( $this->stream_handle ) { + $bytes_written = fwrite( $this->stream_handle, $data ); + } else { + $this->body .= $data; + $bytes_written = $data_length; + } + + // Upon event of this function returning less than strlen( $data ) curl will error with CURLE_WRITE_ERROR + return $bytes_written; + } + /** * Whether this class can be used for retrieving an URL. * @@ -1344,6 +1527,10 @@ class WP_HTTP_Proxy { $home = parse_url( get_option('siteurl') ); + $result = apply_filters( 'pre_http_send_through_proxy', null, $uri, $check, $home ); + if ( ! is_null( $result ) ) + return $result; + if ( $check['host'] == 'localhost' || $check['host'] == $home['host'] ) return false; @@ -1358,7 +1545,7 @@ class WP_HTTP_Proxy { if ( false !== strpos(WP_PROXY_BYPASS_HOSTS, '*') ) { $wildcard_regex = array(); foreach ( $bypass_hosts as $host ) - $wildcard_regex[] = str_replace('\*', '[\w.]+?', preg_quote($host, '/')); + $wildcard_regex[] = str_replace( '\*', '.+', preg_quote( $host, '/' ) ); $wildcard_regex = '/^(' . implode('|', $wildcard_regex) . ')$/i'; } } @@ -1437,14 +1624,24 @@ class WP_Http_Cookie { *