+global\WPCOM_JSON_API::output()

Complexity

Conditions	18
Paths	290

Size

Total Lines

92

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
	function output( $status_code, $response = null, $content_type = 'application/json', $extra = array() ) {
		// In case output() was called before the callback returned
		if ( $this->did_output ) {
			if ( $this->exit ) {
				exit;
			}
			return $content_type;
		}
		$this->did_output = true;

		// 400s and 404s are allowed for all origins
		if ( 404 == $status_code || 400 == $status_code ) {
			header( 'Access-Control-Allow-Origin: *' );
		}

		/* Add headers for form submission from <amp-form/> */
		if ( $this->amp_source_origin ) {
			header( 'Access-Control-Allow-Origin: ' . wp_unslash( $this->amp_source_origin ) );
			header( 'Access-Control-Allow-Credentials: true' );
		}


		if ( is_null( $response ) ) {
			$response = new stdClass();
		}

		if ( 'text/plain' === $content_type ) {
			status_header( (int) $status_code );
			header( 'Content-Type: text/plain' );
			foreach ( $extra as $key => $value ) {
				header( "$key: $value" );
			}
			echo $response;
			if ( $this->exit ) {
				exit;
			}

			return $content_type;
		}

		$response = $this->filter_fields( $response );

		if ( isset( $this->query['http_envelope'] ) && self::is_truthy( $this->query['http_envelope'] ) ) {
			$headers = array(
				array(
					'name'  => 'Content-Type',
					'value' => $content_type,
				),
			);

			foreach ( $extra as $key => $value ) {
				$headers[] = array(
					'name'  => $key,
					'value' => $value,
				);
			}

			$response     = array(
				'code'    => (int) $status_code,
				'headers' => $headers,
				'body'    => $response,
			);
			$status_code  = 200;
			$content_type = 'application/json';
		}

		status_header( (int) $status_code );
		header( "Content-Type: $content_type" );
		if ( isset( $this->query['callback'] ) && is_string( $this->query['callback'] ) ) {
			$callback = preg_replace( '/[^a-z0-9_.]/i', '', $this->query['callback'] );
		} else {
			$callback = false;
		}

		if ( $callback ) {

The expression $callback of type string|false is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== false instead.

			// Mitigate Rosetta Flash [1] by setting the Content-Type-Options: nosniff header
			// and by prepending the JSONP response with a JS comment.
			// [1] https://blog.miki.it/2014/7/8/abusing-jsonp-with-rosetta-flash/index.html
			echo "/**/$callback(";

		}
		echo $this->json_encode( $response );
		if ( $callback ) {

The expression $callback of type string|false is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== false instead.

			echo ');';
		}

		if ( $this->exit ) {
			exit;
		}

		return $content_type;
	}