Automattic /
jetpack
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 586 | } |
||
| 587 | |||
| 588 | if ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST && isset( $_GET['for'] ) && 'jetpack' == $_GET['for'] ) { |
||
| 589 | @ini_set( 'display_errors', false ); // Display errors can cause the XML to be not well formed. |
||
|
|
|||
| 590 | |||
| 591 | require_once JETPACK__PLUGIN_DIR . 'class.jetpack-xmlrpc-server.php'; |
||
| 592 | $this->xmlrpc_server = new Jetpack_XMLRPC_Server(); |
||
| 5238 | } else { |
||
| 5239 | $token_type = 'user'; |
||
| 5240 | if ( empty( $user_id ) || ! ctype_digit( $user_id ) ) { |
||
| 5241 | return new WP_Error( 'malformed_user_id', 'Malformed user_id in request', compact( 'signature_details' ) ); |
||
| 5242 | } |
||
| 5243 | $user_id = (int) $user_id; |
||
| 5244 | |||
| 5245 | $user = new WP_User( $user_id ); |
||
| 5246 | if ( ! $user || ! $user->exists() ) { |
||
| 5247 | return new WP_Error( 'unknown_user', sprintf( 'User %d does not exist', $user_id ), compact( 'signature_details' ) ); |
||
| 5248 | } |
||
| 5249 | } |
||
| 5250 | |||
| 5251 | $token = Jetpack_Data::get_access_token( $user_id, $token_key, false ); |
||
| 5252 | if ( is_wp_error( $token ) ) { |
||
| 5253 | $token->add_data( compact( 'signature_details' ) ); |
||
| 5254 | return $token; |
||
| 5255 | } elseif ( ! $token ) { |
||
| 5256 | return new WP_Error( 'unknown_token', sprintf( 'Token %s:%s:%d does not exist', $token_key, $version, $user_id ), compact( 'signature_details' ) ); |
||
| 5257 | } |
||
| 5258 | |||
| 5259 | $jetpack_signature = new Jetpack_Signature( $token->secret, (int) Jetpack_Options::get_option( 'time_diff' ) ); |
||
| 5289 | $signature_details['url'] = $jetpack_signature->current_request_url; |
||
| 5290 | |||
| 5291 | if ( ! $signature ) { |
||
| 5292 | return new WP_Error( 'could_not_sign', 'Unknown signature error', compact( 'signature_details' ) ); |
||
| 5293 | } else if ( is_wp_error( $signature ) ) { |
||
| 5294 | return $signature; |
||
| 5295 | } |
||
| 5299 | |||
| 5300 | // Use up the nonce regardless of whether the signature matches. |
||
| 5301 | if ( ! $this->add_nonce( $timestamp, $nonce ) ) { |
||
| 5302 | return new WP_Error( 'invalid_nonce', 'Could not add nonce', compact( 'signature_details' ) ); |
||
| 5303 | } |
||
| 5304 | |||
| 5305 | // Be careful about what you do with this debugging data. |
||
| 5308 | $signature_details['expected'] = $signature; |
||
| 5309 | |||
| 5310 | if ( ! hash_equals( $signature, $_GET['signature'] ) ) { |
||
| 5311 | return new WP_Error( 'signature_mismatch', 'Signature mismatch', compact( 'signature_details' ) ); |
||
| 5312 | } |
||
| 5313 | |||
| 5314 | // Let's see if this is onboarding. In such case, use user token type and the provided user id. |
||
| 7178 |
Michael D Adams
georgestephanis
Loading history...
If you suppress an error, we recommend checking for the error condition explicitly: