+global\Jetpack::wp_rest_authenticate()

Complexity

Conditions	16
Paths	8

Size

Total Lines	73
Code Lines	38

Duplication

Lines	18
Ratio	24.66 %

Importance

Changes

0

<?php
	function wp_rest_authenticate( $error ) {
		if ( is_wp_error( $error ) ) {
			// A previous authentication method failed.
			return $error;
		}

		if ( ! isset( $_GET['token'] ) && ! isset( $_GET['signature'] ) ) {
			// Nothing to do for this authentication method.
			return $error;
		}

		// Ensure that we always have the request body available.  If we don't
		// do this, the signing code will try to read the request body from
		// 'php://input/', but this fails in older PHP versions because the WP
		// REST API code may have already read it, and this can only be done
		// once prior to PHP 5.6.  The WP REST API code stores the request body
		// in $HTTP_RAW_POST_DATA, so grab it from there and put it where the
		// signature verification code will see it.
		$this->HTTP_RAW_POST_DATA = $GLOBALS['HTTP_RAW_POST_DATA'];

		// Only support specific request parameters that have been tested and
		// are known to work with signature verification.  A different method
		// can be passed to the WP REST API via the '?_method=' parameter if
		// needed.
		if ( $_SERVER['REQUEST_METHOD'] !== 'GET' && $_SERVER['REQUEST_METHOD'] !== 'POST' ) {
			return new WP_Error(
				'rest_invalid_request',
				'This request method is not supported.',
				array( 'status' => 400 )
			);
		}
		if ( $_SERVER['REQUEST_METHOD'] !== 'POST' && ! empty( $this->HTTP_RAW_POST_DATA ) ) {
			return new WP_Error(
				'rest_invalid_request',
				'This request method does not support body parameters.',
				array( 'status' => 400 )
			);
		}
		if (
			isset( $_SERVER['CONTENT_TYPE'] ) &&
			$_SERVER['CONTENT_TYPE'] !== 'application/x-www-form-urlencoded' &&
			$_SERVER['CONTENT_TYPE'] !== 'application/json'
		) {
			return new WP_Error(
				'rest_invalid_request',
				'This Content-Type is not supported.',
				array( 'status' => 400 )
			);
		}

		$verified = $this->verify_xml_rpc_signature();

		if ( is_wp_error( $verified ) ) {
			return $verified;
		}

		if (
			false === $verified ||
			! isset( $verified['type'] ) ||
			'user' !== $verified['type'] ||
			empty( $verified['user_id'] )
		) {
			return new WP_Error(
				'rest_invalid_signature',
				'The request is not signed correctly.',
				array( 'status' => 400 )
			);
		}

		// Authentication successful.
		wp_set_current_user( $verified['user_id'] );
		return true;
	}