1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
/** |
4
|
|
|
* Simple (by no means complete) input sanitizer. |
5
|
|
|
* |
6
|
|
|
* @since 1.0.0 |
7
|
|
|
* |
8
|
|
|
* @package WordPress_Security_Txt |
9
|
|
|
* @subpackage WordPress_Security_Txt/admin |
10
|
|
|
* @author Austin Heap <[email protected]> |
11
|
|
|
*/ |
12
|
|
|
|
13
|
|
|
class WordPress_Security_Txt_Sanitizer |
14
|
|
|
{ |
15
|
|
|
/** |
16
|
|
|
* Value for default attributes which should be ignored. |
17
|
|
|
*/ |
18
|
|
|
const NO_VALUE_SET = -3.14159265359; |
19
|
|
|
|
20
|
|
|
/** |
21
|
|
|
* The ID of this plugin. |
22
|
|
|
* |
23
|
|
|
* @since 1.0.0 |
24
|
|
|
* @access private |
25
|
|
|
* @var string $plugin_name The ID of this plugin. |
26
|
|
|
*/ |
27
|
|
|
private $plugin_name; |
28
|
|
|
|
29
|
|
|
/** |
30
|
|
|
* The version of this plugin. |
31
|
|
|
* |
32
|
|
|
* @since 1.0.0 |
33
|
|
|
* @access private |
34
|
|
|
* @var string $version The current version of this plugin. |
35
|
|
|
*/ |
36
|
|
|
private $version; |
37
|
|
|
|
38
|
|
|
/** |
39
|
|
|
* The data to be sanitized |
40
|
|
|
* |
41
|
|
|
* @var mixed $data |
42
|
|
|
*/ |
43
|
|
|
private $data; |
44
|
|
|
|
45
|
|
|
/** |
46
|
|
|
* The type of data |
47
|
|
|
* |
48
|
|
|
* @var string $type |
49
|
|
|
*/ |
50
|
|
|
private $type; |
51
|
|
|
|
52
|
|
|
/** |
53
|
|
|
* Constructor |
54
|
|
|
* |
55
|
|
|
* @param mixed $data |
56
|
|
|
* @param string $type |
57
|
|
|
*/ |
58
|
|
|
public function __construct($plugin_name, $version, $data = self::NO_VALUE_SET, $type = self::NO_VALUE_SET) |
59
|
|
|
{ |
60
|
|
|
$this->plugin_name = $plugin_name; |
61
|
|
|
$this->version = $version; |
62
|
|
|
$this->data = $data == self::NO_VALUE_SET ? '' : $data; |
63
|
|
|
$this->type = $type == self::NO_VALUE_SET ? '' : $type; |
64
|
|
|
|
65
|
|
|
if ($this->version != WORDPRESS_SECURITY_TXT_VERSION) { |
66
|
|
|
throw new Exception('Internal version mismatch in plugin wordpress-security-txt; it needs to be reinstalled.'); |
67
|
|
|
} |
68
|
|
|
} |
69
|
|
|
|
70
|
|
|
/** |
71
|
|
|
* Cleans the data |
72
|
|
|
* |
73
|
|
|
* @return mixed The sanitized data |
74
|
|
|
*/ |
75
|
|
|
public function clean() |
76
|
|
|
{ |
77
|
|
|
$sanitized = ''; |
78
|
|
|
|
79
|
|
|
if (in_array($this->type, ['color', 'radio', 'select'], true)) { |
80
|
|
|
$sanitized = $this->sanitize_random($this->data); |
81
|
|
|
} elseif (in_array($this->type, ['date', 'datetime', 'datetime-local', 'time', 'week'], true)) { |
82
|
|
|
$sanitized = $this->sanitize_wrapper($this->data, 'strtotime'); |
83
|
|
|
} elseif (in_array($this->type, ['number', 'range'], true)) { |
84
|
|
|
$sanitized = $this->sanitize_wrapper($this->data, 'intval'); |
85
|
|
|
} elseif (in_array($this->type, ['hidden', 'month', 'text'], true)) { |
86
|
|
|
$sanitized = $this->sanitize_wrapper($this->data, 'sanitize_text_field'); |
87
|
|
|
} elseif ($this->type == 'checkbox') { |
88
|
|
|
$sanitized = (isset($this->data) && ! is_null($this->data) ? true : false); |
89
|
|
|
} elseif ($this->type == 'editor') { |
90
|
|
|
$sanitized = wp_kses_post($this->data); |
|
|
|
|
91
|
|
|
} elseif ($this->type == 'email') { |
92
|
|
|
$sanitized = $this->sanitize_wrapper($this->data, 'sanitize_email'); |
93
|
|
|
} elseif ($this->type == 'file') { |
94
|
|
|
$sanitized = $this->sanitize_wrapper($this->data, 'sanitize_file_name'); |
95
|
|
|
} elseif ($this->type == 'tel') { |
96
|
|
|
$sanitized = $this->sanitize_phone($this->data); |
97
|
|
|
} elseif ($this->type == 'textarea') { |
98
|
|
|
$sanitized = $this->sanitize_wrapper($this->data, 'esc_textarea'); |
99
|
|
|
} elseif ($this->type == 'url') { |
100
|
|
|
$sanitized = $this->sanitize_wrapper($this->data, 'esc_url'); |
101
|
|
|
} |
102
|
|
|
|
103
|
|
|
return $sanitized; |
104
|
|
|
} |
105
|
|
|
|
106
|
|
|
/** |
107
|
|
|
* Performs general cleaning functions on data |
108
|
|
|
* |
109
|
|
|
* @param mixed $input Data to be cleaned |
110
|
|
|
* |
111
|
|
|
* @return mixed $return The cleaned data |
112
|
|
|
*/ |
113
|
|
|
private function sanitize_random($input) |
114
|
|
|
{ |
115
|
|
|
$one = trim($input); |
116
|
|
|
$two = stripslashes($one); |
117
|
|
|
$return = htmlspecialchars($two); |
118
|
|
|
|
119
|
|
|
return $return; |
120
|
|
|
} |
121
|
|
|
|
122
|
|
|
private function sanitize_wrapper($data, $function) |
123
|
|
|
{ |
124
|
|
|
if (empty($data)) { |
125
|
|
|
return null; |
126
|
|
|
} |
127
|
|
|
|
128
|
|
|
return $function($data); |
129
|
|
|
} |
130
|
|
|
|
131
|
|
|
/** |
132
|
|
|
* Validates a phone number |
133
|
|
|
* |
134
|
|
|
* @param string $phone A phone number string |
135
|
|
|
* |
136
|
|
|
* @return string|bool $phone|FALSE Returns the valid phone number, FALSE if not |
137
|
|
|
*/ |
138
|
|
|
private function sanitize_phone($phone) |
139
|
|
|
{ |
140
|
|
|
if (empty($phone)) { |
141
|
|
|
return false; |
142
|
|
|
} |
143
|
|
|
|
144
|
|
|
if (preg_match('/^[+]?([0-9]?)[(|s|-|.]?([0-9]{3})[)|s|-|.]*([0-9]{3})[s|-|.]*([0-9]{4})$/', $phone)) { |
145
|
|
|
return trim($phone); |
146
|
|
|
} |
147
|
|
|
|
148
|
|
|
return false; |
149
|
|
|
} |
150
|
|
|
|
151
|
|
|
/** |
152
|
|
|
* Sets the data class variable |
153
|
|
|
* |
154
|
|
|
* @param mixed $data The data to sanitize |
155
|
|
|
*/ |
156
|
|
|
public function set_data($data) |
157
|
|
|
{ |
158
|
|
|
$this->data = $data; |
159
|
|
|
} |
160
|
|
|
|
161
|
|
|
/** |
162
|
|
|
* Sets the type class variable |
163
|
|
|
* |
164
|
|
|
* @param string $type The field type for this data |
165
|
|
|
*/ |
166
|
|
|
public function set_type($type) |
167
|
|
|
{ |
168
|
|
|
$check = ''; |
169
|
|
|
|
170
|
|
|
if (empty($type)) { |
171
|
|
|
$check = new WP_Error('forgot_type', |
|
|
|
|
172
|
|
|
__('Specify the data type to sanitize.', $this->plugin_name)); |
|
|
|
|
173
|
|
|
} |
174
|
|
|
|
175
|
|
|
if (is_wp_error($check)) { |
|
|
|
|
176
|
|
|
wp_die($check->get_error_message(), __('Forgot data type.', $this->plugin_name)); |
|
|
|
|
177
|
|
|
} |
178
|
|
|
|
179
|
|
|
$this->type = $type; |
180
|
|
|
} |
181
|
|
|
} |
182
|
|
|
|