+global\Jetpack::wp_rest_authenticate()

Complexity

Conditions	21
Paths	31

Size

Total Lines	93
Code Lines	51

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
	function wp_rest_authenticate( $user ) {
		if ( ! empty( $user ) ) {
			// Another authentication method is in effect.
			return $user;
		}

		if ( ! isset( $_GET['_for'] ) || $_GET['_for'] !== 'jetpack' ) {
			// Nothing to do for this authentication method.
			return null;
		}

		if ( ! isset( $_GET['token'] ) && ! isset( $_GET['signature'] ) ) {
			// Nothing to do for this authentication method.
			return null;
		}

		// Ensure that we always have the request body available.  At this
		// point, the WP REST API code to determine the request body has not
		// run yet.  That code may try to read from 'php://input' later, but
		// this can only be done once per request in PHP versions prior to 5.6.
		// So we will go ahead and perform this read now if needed, and save
		// the request body where both the Jetpack signature verification code
		// and the WP REST API code can see it.
		if ( ! isset( $GLOBALS['HTTP_RAW_POST_DATA'] ) ) {
			$GLOBALS['HTTP_RAW_POST_DATA'] = file_get_contents( 'php://input' );
		}
		$this->HTTP_RAW_POST_DATA = $GLOBALS['HTTP_RAW_POST_DATA'];

		// Only support specific request parameters that have been tested and
		// are known to work with signature verification.  A different method
		// can be passed to the WP REST API via the '?_method=' parameter if
		// needed.
		if ( $_SERVER['REQUEST_METHOD'] !== 'GET' && $_SERVER['REQUEST_METHOD'] !== 'POST' ) {
			$this->rest_authentication_status = new WP_Error(
				'rest_invalid_request',
				__( 'This request method is not supported.', 'jetpack' ),
				array( 'status' => 400 )
			);
			return null;
		}
		if ( $_SERVER['REQUEST_METHOD'] !== 'POST' && ! empty( $this->HTTP_RAW_POST_DATA ) ) {
			$this->rest_authentication_status = new WP_Error(
				'rest_invalid_request',
				__( 'This request method does not support body parameters.', 'jetpack' ),
				array( 'status' => 400 )
			);
			return null;
		}

		if ( ! empty( $_SERVER['CONTENT_TYPE'] ) ) {
			$content_type = $_SERVER['CONTENT_TYPE'];
		} elseif ( ! empty( $_SERVER['HTTP_CONTENT_TYPE'] ) ) {
			$content_type = $_SERVER['HTTP_CONTENT_TYPE'];
		}

		if (
			isset( $content_type ) &&
			$content_type !== 'application/x-www-form-urlencoded' &&
			$content_type !== 'application/json'
		) {
			$this->rest_authentication_status = new WP_Error(
				'rest_invalid_request',
				__( 'This Content-Type is not supported.', 'jetpack' ),
				array( 'status' => 400 )
			);
			return null;
		}

		$verified = $this->verify_xml_rpc_signature();

		if ( is_wp_error( $verified ) ) {
			$this->rest_authentication_status = $verified;
			return null;
		}

		if (
			false === $verified ||
			! isset( $verified['type'] ) ||
			'user' !== $verified['type'] ||
			empty( $verified['user_id'] )
		) {
			$this->rest_authentication_status = new WP_Error(
				'rest_invalid_signature',
				__( 'The request is not signed correctly.', 'jetpack' ),
				array( 'status' => 400 )
			);
			return null;
		}

		// Authentication successful.
		$this->rest_authentication_status = true;
		return $verified['user_id'];
	}