This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | class TimberURLHelper { |
||
4 | |||
5 | /** |
||
6 | * |
||
7 | * |
||
8 | * @return string |
||
9 | */ |
||
10 | public static function get_current_url() { |
||
11 | $pageURL = "http://"; |
||
12 | if ( isset( $_SERVER['HTTPS'] ) && $_SERVER["HTTPS"] == "on" ) { |
||
13 | $pageURL = "https://";; |
||
14 | } |
||
15 | if ( isset($_SERVER["SERVER_PORT"]) && $_SERVER["SERVER_PORT"] && $_SERVER["SERVER_PORT"] != "80" ) { |
||
16 | $pageURL .= self::get_host() . ":" . $_SERVER["SERVER_PORT"] . $_SERVER["REQUEST_URI"]; |
||
17 | } else { |
||
18 | $pageURL .= self::get_host() . $_SERVER["REQUEST_URI"]; |
||
19 | } |
||
20 | return $pageURL; |
||
21 | } |
||
22 | |||
23 | /** |
||
24 | * |
||
25 | * |
||
26 | * @param string $url |
||
27 | * @return bool |
||
28 | */ |
||
29 | public static function is_url( $url ) { |
||
30 | if ( !is_string( $url ) ) { |
||
31 | return false; |
||
32 | } |
||
33 | $url = strtolower( $url ); |
||
34 | if ( strstr( $url, '://' ) ) { |
||
35 | return true; |
||
36 | } |
||
37 | return false; |
||
38 | } |
||
39 | |||
40 | /** |
||
41 | * |
||
42 | * |
||
43 | * @return string |
||
44 | */ |
||
45 | public static function get_path_base() { |
||
46 | $struc = get_option( 'permalink_structure' ); |
||
47 | $struc = explode( '/', $struc ); |
||
48 | $p = '/'; |
||
49 | foreach ( $struc as $s ) { |
||
50 | if ( !strstr( $s, '%' ) && strlen( $s ) ) { |
||
51 | $p .= $s . '/'; |
||
52 | } |
||
53 | } |
||
54 | return $p; |
||
55 | } |
||
56 | |||
57 | /** |
||
58 | * |
||
59 | * |
||
60 | * @param string $url |
||
61 | * @param bool $force |
||
62 | * @return string |
||
63 | */ |
||
64 | public static function get_rel_url( $url, $force = false ) { |
||
65 | $url_info = parse_url( $url ); |
||
66 | if ( isset( $url_info['host'] ) && $url_info['host'] != self::get_host() && !$force ) { |
||
67 | return $url; |
||
68 | } |
||
69 | $link = ''; |
||
70 | if ( isset( $url_info['path'] ) ) { |
||
71 | $link = $url_info['path']; |
||
72 | } |
||
73 | if ( isset( $url_info['query'] ) && strlen( $url_info['query'] ) ) { |
||
74 | $link .= '?' . $url_info['query']; |
||
75 | } |
||
76 | if ( isset( $url_info['fragment'] ) && strlen( $url_info['fragment'] ) ) { |
||
77 | $link .= '#' . $url_info['fragment']; |
||
78 | } |
||
79 | $link = TimberURLHelper::remove_double_slashes( $link ); |
||
80 | return $link; |
||
81 | } |
||
82 | |||
83 | /** |
||
84 | * Some setups like HTTP_HOST, some like SERVER_NAME, it's complicated |
||
85 | * @link http://stackoverflow.com/questions/2297403/http-host-vs-server-name |
||
86 | * @return string the HTTP_HOST or SERVER_NAME |
||
87 | */ |
||
88 | public static function get_host() { |
||
89 | if (isset($_SERVER['HTTP_HOST'])) { |
||
90 | return $_SERVER['HTTP_HOST']; |
||
91 | } |
||
92 | if (isset($_SERVER['SERVER_NAME'])) { |
||
93 | return $_SERVER['SERVER_NAME']; |
||
94 | } |
||
95 | return ''; |
||
96 | } |
||
97 | |||
98 | /** |
||
99 | * |
||
100 | * |
||
101 | * @param string $url |
||
102 | * @return bool |
||
103 | */ |
||
104 | public static function is_local( $url ) { |
||
105 | if ( strstr( $url, self::get_host() ) ) { |
||
106 | return true; |
||
107 | } |
||
108 | return false; |
||
109 | } |
||
110 | |||
111 | /** |
||
112 | * |
||
113 | * |
||
114 | * @param string $src |
||
115 | * @return string |
||
116 | */ |
||
117 | public static function get_full_path( $src ) { |
||
118 | $root = ABSPATH; |
||
119 | $old_root_path = $root . $src; |
||
120 | $old_root_path = str_replace( '//', '/', $old_root_path ); |
||
121 | return $old_root_path; |
||
122 | } |
||
123 | |||
124 | /** |
||
125 | * Takes a url and figures out its place based in the file system based on path |
||
126 | * NOTE: Not fool-proof, makes a lot of assumptions about the file path |
||
127 | * matching the URL path |
||
128 | * |
||
129 | * @param string $url |
||
130 | * @return string |
||
131 | */ |
||
132 | public static function url_to_file_system( $url ) { |
||
133 | $url_parts = parse_url( $url ); |
||
134 | $path = ABSPATH . $url_parts['path']; |
||
135 | $path = str_replace( '//', '/', $path ); |
||
136 | return $path; |
||
137 | } |
||
138 | |||
139 | public static function file_system_to_url( $fs ) { |
||
140 | $relative_path = self::get_rel_path( $fs ); |
||
141 | $home = home_url( '/'.$relative_path ); |
||
142 | return $home; |
||
143 | } |
||
144 | |||
145 | /** |
||
146 | * |
||
147 | * |
||
148 | * @param string $src |
||
149 | * @return string |
||
150 | */ |
||
151 | public static function get_rel_path( $src ) { |
||
152 | if ( strstr( $src, ABSPATH ) ) { |
||
153 | return str_replace( ABSPATH, '', $src ); |
||
154 | } |
||
155 | //its outside the wordpress directory, alternate setups: |
||
156 | $src = str_replace( WP_CONTENT_DIR, '', $src ); |
||
157 | return WP_CONTENT_SUBDIR . $src; |
||
158 | } |
||
159 | |||
160 | /** |
||
161 | * |
||
162 | * |
||
163 | * @param string $url |
||
164 | * @return string |
||
165 | */ |
||
166 | public static function remove_double_slashes( $url ) { |
||
167 | $url = str_replace( '//', '/', $url ); |
||
168 | if ( strstr( $url, 'http:' ) && !strstr( $url, 'http://' ) ) { |
||
169 | $url = str_replace( 'http:/', 'http://', $url ); |
||
170 | } |
||
171 | return $url; |
||
172 | } |
||
173 | |||
174 | /** |
||
175 | * |
||
176 | * |
||
177 | * @param string $url |
||
178 | * @param string $path |
||
179 | * @return string |
||
180 | */ |
||
181 | public static function prepend_to_url( $url, $path ) { |
||
182 | if ( strstr( strtolower( $url ), 'http' ) ) { |
||
183 | $url_parts = parse_url( $url ); |
||
184 | $url = $url_parts['scheme'] . '://' . $url_parts['host'] . $path . $url_parts['path']; |
||
185 | if ( isset( $url_parts['query'] ) ) { |
||
186 | $url .= $url_parts['query']; |
||
187 | } |
||
188 | if ( isset( $url_parts['fragment'] ) ) { |
||
189 | $url .= $url_parts['fragment']; |
||
190 | } |
||
191 | } else { |
||
192 | $url = $url . $path; |
||
193 | } |
||
194 | return self::remove_double_slashes( $url ); |
||
195 | } |
||
196 | |||
197 | /** |
||
198 | * |
||
199 | * |
||
200 | * @param string $path |
||
201 | * @return string |
||
202 | */ |
||
203 | public static function preslashit( $path ) { |
||
204 | if ( strpos( $path, '/' ) != 0 ) { |
||
205 | $path = '/' . $path; |
||
206 | } |
||
207 | return $path; |
||
208 | } |
||
209 | |||
210 | /** |
||
211 | * This will evaluate wheter a URL is at an aboslute location (like http://example.org/whatever) |
||
212 | * |
||
213 | * @return boolean true if $path is an absolute url, false if relative. |
||
214 | */ |
||
215 | public static function is_absolute( $path ) { |
||
216 | return (boolean) ( strstr( $path, 'http' ) ); |
||
217 | } |
||
218 | |||
219 | /** |
||
220 | * This function is slightly different from the one below in the case of: |
||
221 | * an image hosted on the same domain BUT on a different site than the |
||
222 | * Wordpress install will be reported as external content. |
||
223 | * |
||
224 | * @param string $url a URL to evaluate against |
||
225 | * @return boolean if $url points to an external location returns true |
||
226 | */ |
||
227 | public static function is_external_content( $url ) { |
||
228 | $is_external = TimberURLHelper::is_absolute( $url ) && ! TimberURLHelper::is_internal_content( $url ); |
||
229 | |||
230 | return $is_external; |
||
231 | } |
||
232 | |||
233 | private static function is_internal_content($url) { |
||
234 | // using content_url() instead of site_url or home_url is IMPORTANT |
||
235 | // otherwise you run into errors with sites that: |
||
236 | // 1. use WPML plugin |
||
237 | // 2. or redefine content directory |
||
238 | $is_content_url = strstr( $url, content_url() ); |
||
239 | |||
240 | // this case covers when the upload directory has been redefined |
||
241 | $upload_dir = wp_upload_dir(); |
||
242 | $is_upload_url = strstr( $url, $upload_dir['baseurl'] ); |
||
243 | |||
244 | return $is_content_url || $is_upload_url; |
||
245 | } |
||
246 | |||
247 | /** |
||
248 | * |
||
249 | * |
||
250 | * @param string $url |
||
251 | * @return bool true if $path is an external url, false if relative or local. |
||
252 | * true if it's a subdomain (http://cdn.example.org = true) |
||
253 | */ |
||
254 | public static function is_external( $url ) { |
||
255 | $has_http = strstr( strtolower( $url ), 'http' ); |
||
256 | $on_domain = strstr( $url, self::get_host() ); |
||
257 | if ( $has_http && !$on_domain ) { |
||
258 | return true; |
||
259 | } |
||
260 | return false; |
||
261 | } |
||
262 | |||
263 | /** |
||
264 | * Pass links through untrailingslashit unless they are a single / |
||
265 | * |
||
266 | * @param string $link |
||
267 | * @return string |
||
268 | */ |
||
269 | public static function remove_trailing_slash( $link ) { |
||
270 | if ( $link != "/" ) |
||
271 | $link = untrailingslashit( $link ); |
||
272 | return $link; |
||
273 | } |
||
274 | |||
275 | /** |
||
276 | * Download an external file via a URL |
||
277 | * |
||
278 | * @param string $url |
||
279 | * @param int $timeout |
||
280 | * @return string|WP_Error the location of the temporay file name or an error |
||
281 | * @deprecated since 0.20.0 |
||
282 | */ |
||
283 | static function download_url( $url, $timeout = 300 ) { |
||
0 ignored issues
–
show
|
|||
284 | if ( !$url ) { |
||
285 | return new WP_Error( 'http_no_url', __( 'Invalid URL Provided.' ) ); |
||
286 | } |
||
287 | |||
288 | $tmpfname = wp_tempnam( $url ); |
||
289 | if ( !$tmpfname ) { |
||
290 | return new WP_Error( 'http_no_file', __( 'Could not create Temporary file.' ) ); |
||
291 | } |
||
292 | |||
293 | $response = wp_remote_get( $url, array( 'timeout' => $timeout, 'stream' => true, 'filename' => $tmpfname ) ); |
||
294 | |||
295 | if ( is_wp_error( $response ) ) { |
||
296 | unlink( $tmpfname ); |
||
297 | return $response; |
||
298 | } |
||
299 | if ( 200 != wp_remote_retrieve_response_code( $response ) ) { |
||
300 | unlink( $tmpfname ); |
||
301 | return new WP_Error( 'http_404', trim( wp_remote_retrieve_response_message( $response ) ) ); |
||
302 | } |
||
303 | return $tmpfname; |
||
304 | } |
||
305 | |||
306 | /** |
||
307 | * Returns the url parameters, for example for url http://example.org/blog/post/news/2014/whatever |
||
308 | * this will return array('blog', 'post', 'news', '2014', 'whatever'); |
||
309 | * OR if sent an integer like: TimberUrlHelper::get_params(2); this will return 'news'; |
||
310 | * |
||
311 | * @param int $i the position of the parameter to grab. |
||
0 ignored issues
–
show
Should the type for parameter
$i not be false|integer ?
This check looks for It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. ![]() |
|||
312 | * @return array|string |
||
313 | */ |
||
314 | public static function get_params( $i = false ) { |
||
315 | $args = explode( '/', trim( strtolower( $_SERVER['REQUEST_URI'] ) ) ); |
||
316 | $newargs = array(); |
||
317 | foreach ( $args as $arg ) { |
||
318 | if ( strlen( $arg ) ) { |
||
319 | $newargs[] = $arg; |
||
320 | } |
||
321 | } |
||
322 | if ( $i === false ) { |
||
323 | return $newargs; |
||
324 | } |
||
325 | if ( $i < 0 ) { |
||
326 | //count from end |
||
327 | $i = count( $newargs ) + $i; |
||
328 | } |
||
329 | if ( isset( $newargs[$i] ) ) { |
||
330 | return $newargs[$i]; |
||
331 | } |
||
332 | } |
||
333 | |||
334 | } |
||
335 |
Adding explicit visibility (
private
,protected
, orpublic
) is generally recommend to communicate to other developers how, and from where this method is intended to be used.