+global\Jetpack::internal_verify_xml_rpc_signature()

Complexity

Conditions	42
Paths	10401

Size

Total Lines

141

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
	private function internal_verify_xml_rpc_signature() {
		// It's not for us
		if ( ! isset( $_GET['token'] ) || empty( $_GET['signature'] ) ) {
			return false;
		}

		$signature_details = array(
			'token'     => isset( $_GET['token'] )     ? wp_unslash( $_GET['token'] )     : '',
			'timestamp' => isset( $_GET['timestamp'] ) ? wp_unslash( $_GET['timestamp'] ) : '',
			'nonce'     => isset( $_GET['nonce'] )     ? wp_unslash( $_GET['nonce'] )     : '',
			'body_hash' => isset( $_GET['body-hash'] ) ? wp_unslash( $_GET['body-hash'] ) : '',
			'method'    => wp_unslash( $_SERVER['REQUEST_METHOD'] ),
			'url'       => wp_unslash( $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] ), // Temp - will get real signature URL later.
			'signature' => isset( $_GET['signature'] ) ? wp_unslash( $_GET['signature'] ) : '',
		);

		@list( $token_key, $version, $user_id ) = explode( ':', wp_unslash( $_GET['token'] ) );

It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended.

		if (
			empty( $token_key )
		||
			empty( $version ) || strval( JETPACK__API_VERSION ) !== $version
		) {
			return new WP_Error( 'malformed_token', 'Malformed token in request', compact( 'signature_details' ) );

The call to WP_Error::__construct() has too many arguments starting with 'malformed_token'.

		}

		if ( '0' === $user_id ) {
			$token_type = 'blog';
			$user_id = 0;
		} else {
			$token_type = 'user';
			if ( empty( $user_id ) || ! ctype_digit( $user_id ) ) {
				return new WP_Error( 'malformed_user_id', 'Malformed user_id in request', compact( 'signature_details' ) );

The call to WP_Error::__construct() has too many arguments starting with 'malformed_user_id'.

			}
			$user_id = (int) $user_id;

			$user = new WP_User( $user_id );
			if ( ! $user || ! $user->exists() ) {
				return new WP_Error( 'unknown_user', sprintf( 'User %d does not exist', $user_id ), compact( 'signature_details' ) );

The call to WP_Error::__construct() has too many arguments starting with 'unknown_user'.

			}
		}

		$token = Jetpack_Data::get_access_token( $user_id, $token_key, false );

$user_id is of type integer, but the function expects a boolean.

The method Jetpack_Data::get_access_token() has been deprecated with message: 7.5 Use Connection_Manager instead.

		if ( is_wp_error( $token ) ) {
			$token->add_data( compact( 'signature_details' ) );
			return $token;
		} elseif ( ! $token ) {
			return new WP_Error( 'unknown_token', sprintf( 'Token %s:%s:%d does not exist', $token_key, $version, $user_id ), compact( 'signature_details' ) );

The call to WP_Error::__construct() has too many arguments starting with 'unknown_token'.

		}

		$jetpack_signature = new Jetpack_Signature( $token->secret, (int) Jetpack_Options::get_option( 'time_diff' ) );
		if ( isset( $_POST['_jetpack_is_multipart'] ) ) {
			$post_data   = $_POST;
			$file_hashes = array();
			foreach ( $post_data as $post_data_key => $post_data_value ) {
				if ( 0 !== strpos( $post_data_key, '_jetpack_file_hmac_' ) ) {
					continue;
				}
				$post_data_key = substr( $post_data_key, strlen( '_jetpack_file_hmac_' ) );
				$file_hashes[$post_data_key] = $post_data_value;
			}

			foreach ( $file_hashes as $post_data_key => $post_data_value ) {
				unset( $post_data["_jetpack_file_hmac_{$post_data_key}"] );
				$post_data[$post_data_key] = $post_data_value;
			}

			ksort( $post_data );

			$body = http_build_query( stripslashes_deep( $post_data ) );
		} elseif ( is_null( $this->HTTP_RAW_POST_DATA ) ) {
			$body = file_get_contents( 'php://input' );
		} else {
			$body = null;
		}

		$signature = $jetpack_signature->sign_current_request(
			array( 'body' => is_null( $body ) ? $this->HTTP_RAW_POST_DATA : $body, )
		);

		$signature_details['url'] = $jetpack_signature->current_request_url;

		if ( ! $signature ) {
			return new WP_Error( 'could_not_sign', 'Unknown signature error', compact( 'signature_details' ) );

The call to WP_Error::__construct() has too many arguments starting with 'could_not_sign'.

		} else if ( is_wp_error( $signature ) ) {
			return $signature;
		}

		$timestamp = (int) $_GET['timestamp'];
		$nonce     = stripslashes( (string) $_GET['nonce'] );

		// Use up the nonce regardless of whether the signature matches.
		if ( ! $this->add_nonce( $timestamp, $nonce ) ) {
			return new WP_Error( 'invalid_nonce', 'Could not add nonce', compact( 'signature_details' ) );

The call to WP_Error::__construct() has too many arguments starting with 'invalid_nonce'.

		}

		// Be careful about what you do with this debugging data.
		// If a malicious requester has access to the expected signature,
		// bad things might be possible.
		$signature_details['expected'] = $signature;

		if ( ! hash_equals( $signature, $_GET['signature'] ) ) {
			return new WP_Error( 'signature_mismatch', 'Signature mismatch', compact( 'signature_details' ) );

The call to WP_Error::__construct() has too many arguments starting with 'signature_mismatch'.

		}

		// Let's see if this is onboarding. In such case, use user token type and the provided user id.
		if ( isset( $this->HTTP_RAW_POST_DATA ) || ! empty( $_GET['onboarding'] ) ) {
			if ( ! empty( $_GET['onboarding'] ) ) {
				$jpo = $_GET;
			} else {
				$jpo = json_decode( $this->HTTP_RAW_POST_DATA, true );
			}

			$jpo_token = ! empty( $jpo['onboarding']['token'] ) ? $jpo['onboarding']['token'] : null;
			$jpo_user = ! empty( $jpo['onboarding']['jpUser'] ) ? $jpo['onboarding']['jpUser'] : null;

			if (
				isset( $jpo_user ) && isset( $jpo_token ) &&
				is_email( $jpo_user ) && ctype_alnum( $jpo_token ) &&
				isset( $_GET['rest_route'] ) &&
				self::validate_onboarding_token_action( $jpo_token, $_GET['rest_route'] )
			) {
				$jpUser = get_user_by( 'email', $jpo_user );
				if ( is_a( $jpUser, 'WP_User' ) ) {
					wp_set_current_user( $jpUser->ID );
					$user_can = is_multisite()
						? current_user_can_for_blog( get_current_blog_id(), 'manage_options' )
						: current_user_can( 'manage_options' );
					if ( $user_can ) {
						$token_type = 'user';
						$token->external_user_id = $jpUser->ID;
					}
				}
			}
		}

		return array(
			'type'      => $token_type,
			'token_key' => $token_key,
			'user_id'   => $token->external_user_id,
		);
	}