/class.jetpack-client.php

  1. <?php 
  2.  
  3. class Jetpack_Client { 
  4. const WPCOM_JSON_API_HOST = 'public-api.wordpress.com'; 
  5. const WPCOM_JSON_API_VERSION = '1.1'; 
  6.  
  7. /** 
  8. * Makes an authorized remote request using Jetpack_Signature 
  9. * 
  10. * @return array|WP_Error WP HTTP response on success 
  11. */ 
  12. public static function remote_request( $args, $body = null ) { 
  13. $defaults = array( 
  14. 'url' => '',  
  15. 'user_id' => 0,  
  16. 'blog_id' => 0,  
  17. 'auth_location' => JETPACK_CLIENT__AUTH_LOCATION,  
  18. 'method' => 'POST',  
  19. 'timeout' => 10,  
  20. 'redirection' => 0,  
  21. ); 
  22.  
  23. $args = wp_parse_args( $args, $defaults ); 
  24.  
  25. $args['blog_id'] = (int) $args['blog_id']; 
  26.  
  27. if ( 'header' != $args['auth_location'] ) { 
  28. $args['auth_location'] = 'query_string'; 
  29.  
  30. $token = Jetpack_Data::get_access_token( $args['user_id'] ); 
  31. if ( !$token ) { 
  32. return new Jetpack_Error( 'missing_token' ); 
  33.  
  34. $method = strtoupper( $args['method'] ); 
  35.  
  36. $timeout = intval( $args['timeout'] ); 
  37.  
  38. $redirection = $args['redirection']; 
  39.  
  40. $request = compact( 'method', 'body', 'timeout', 'redirection' ); 
  41.  
  42. @list( $token_key, $secret ) = explode( '.', $token->secret ); 
  43. if ( empty( $token ) || empty( $secret ) ) { 
  44. return new Jetpack_Error( 'malformed_token' ); 
  45.  
  46. $token_key = sprintf( '%s:%d:%d', $token_key, JETPACK__API_VERSION, $token->external_user_id ); 
  47.  
  48. require_once JETPACK__PLUGIN_DIR . 'class.jetpack-signature.php'; 
  49.  
  50. $time_diff = (int) Jetpack_Options::get_option( 'time_diff' ); 
  51. $jetpack_signature = new Jetpack_Signature( $token->secret, $time_diff ); 
  52.  
  53. $timestamp = time() + $time_diff; 
  54.  
  55. if( function_exists( 'wp_generate_password' ) ) { 
  56. $nonce = wp_generate_password( 10, false ); 
  57. } else { 
  58. $nonce = substr( sha1( rand( 0, 1000000 ) ), 0, 10); 
  59.  
  60. // Kind of annoying. Maybe refactor Jetpack_Signature to handle body-hashing 
  61. if ( is_null( $body ) ) { 
  62. $body_hash = ''; 
  63. } else { 
  64. if ( !is_string( $body ) ) { 
  65. return new Jetpack_Error( 'invalid_body', 'Body is malformed.' ); 
  66. $body_hash = jetpack_sha1_base64( $body ); 
  67.  
  68. $auth = array( 
  69. 'token' => $token_key,  
  70. 'timestamp' => $timestamp,  
  71. 'nonce' => $nonce,  
  72. 'body-hash' => $body_hash,  
  73. ); 
  74.  
  75. if ( false !== strpos( $args['url'], 'xmlrpc.php' ) ) { 
  76. $url_args = array( 
  77. 'for' => 'jetpack',  
  78. 'wpcom_blog_id' => Jetpack_Options::get_option( 'id' ),  
  79. ); 
  80. } else { 
  81. $url_args = array(); 
  82.  
  83. if ( 'header' != $args['auth_location'] ) { 
  84. $url_args += $auth; 
  85.  
  86. $url = add_query_arg( urlencode_deep( $url_args ), $args['url'] ); 
  87. $url = Jetpack::fix_url_for_bad_hosts( $url ); 
  88.  
  89. $signature = $jetpack_signature->sign_request( $token_key, $timestamp, $nonce, $body_hash, $method, $url, $body, false ); 
  90.  
  91. if ( !$signature || is_wp_error( $signature ) ) { 
  92. return $signature; 
  93.  
  94. // Send an Authorization header so various caches/proxies do the right thing 
  95. $auth['signature'] = $signature; 
  96. $auth['version'] = JETPACK__VERSION; 
  97. $header_pieces = array(); 
  98. foreach ( $auth as $key => $value ) { 
  99. $header_pieces[] = sprintf( '%s="%s"', $key, $value ); 
  100. $request['headers'] = array( 
  101. 'Authorization' => "X_JETPACK " . join( ' ', $header_pieces ),  
  102. ); 
  103.  
  104. if ( 'header' != $args['auth_location'] ) { 
  105. $url = add_query_arg( 'signature', urlencode( $signature ), $url ); 
  106.  
  107. return Jetpack_Client::_wp_remote_request( $url, $request ); 
  108.  
  109. /** 
  110. * Wrapper for wp_remote_request(). Turns off SSL verification for certain SSL errors. 
  111. * This is lame, but many, many, many hosts have misconfigured SSL. 
  112. * 
  113. * When Jetpack is registered, the jetpack_fallback_no_verify_ssl_certs option is set to the current time if: 
  114. * 1. a certificate error is found AND 
  115. * 2. not verifying the certificate works around the problem. 
  116. * 
  117. * The option is checked on each request. 
  118. * 
  119. * @internal 
  120. * @see Jetpack::fix_url_for_bad_hosts() 
  121. * 
  122. * @return array|WP_Error WP HTTP response on success 
  123. */ 
  124. public static function _wp_remote_request( $url, $args, $set_fallback = false ) { 
  125. /** 
  126. * SSL verification (`sslverify`) for the JetpackClient remote request 
  127. * defaults to off, use this filter to force it on. 
  128. * 
  129. * Return `true` to ENABLE SSL verification, return `false` 
  130. * to DISABLE SSL verification. 
  131. * 
  132. * @since 3.6.0 
  133. * 
  134. * @param bool Whether to force `sslverify` or not. 
  135. */ 
  136. if ( apply_filters( 'jetpack_client_verify_ssl_certs', false ) ) { 
  137. return wp_remote_request( $url, $args ); 
  138.  
  139. $fallback = Jetpack_Options::get_option( 'fallback_no_verify_ssl_certs' ); 
  140. if ( false === $fallback ) { 
  141. Jetpack_Options::update_option( 'fallback_no_verify_ssl_certs', 0 ); 
  142.  
  143. if ( (int) $fallback ) { 
  144. // We're flagged to fallback 
  145. $args['sslverify'] = false; 
  146.  
  147. $response = wp_remote_request( $url, $args ); 
  148.  
  149. if ( 
  150. !$set_fallback // We're not allowed to set the flag on this request, so whatever happens happens 
  151. || 
  152. isset( $args['sslverify'] ) && !$args['sslverify'] // No verification - no point in doing it again 
  153. || 
  154. !is_wp_error( $response ) // Let it ride 
  155. ) { 
  156. Jetpack_Client::set_time_diff( $response, $set_fallback ); 
  157. return $response; 
  158.  
  159. // At this point, we're not flagged to fallback and we are allowed to set the flag on this request. 
  160.  
  161. $message = $response->get_error_message(); 
  162.  
  163. // Is it an SSL Certificate verification error? 
  164. if ( 
  165. false === strpos( $message, '14090086' ) // OpenSSL SSL3 certificate error 
  166. && 
  167. false === strpos( $message, '1407E086' ) // OpenSSL SSL2 certificate error 
  168. && 
  169. false === strpos( $message, 'error setting certificate verify locations' ) // cURL CA bundle not found 
  170. && 
  171. false === strpos( $message, 'Peer certificate cannot be authenticated with' ) // cURL CURLE_SSL_CACERT: CA bundle found, but not helpful 
  172. // different versions of curl have different error messages 
  173. // this string should catch them all 
  174. && 
  175. false === strpos( $message, 'Problem with the SSL CA cert' ) // cURL CURLE_SSL_CACERT_BADFILE: probably access rights 
  176. ) { 
  177. // No, it is not. 
  178. return $response; 
  179.  
  180. // Redo the request without SSL certificate verification. 
  181. $args['sslverify'] = false; 
  182. $response = wp_remote_request( $url, $args ); 
  183.  
  184. if ( !is_wp_error( $response ) ) { 
  185. // The request went through this time, flag for future fallbacks 
  186. Jetpack_Options::update_option( 'fallback_no_verify_ssl_certs', time() ); 
  187. Jetpack_Client::set_time_diff( $response, $set_fallback ); 
  188.  
  189. return $response; 
  190.  
  191. public static function set_time_diff( &$response, $force_set = false ) { 
  192. $code = wp_remote_retrieve_response_code( $response ); 
  193.  
  194. // Only trust the Date header on some responses 
  195. if ( 200 != $code && 304 != $code && 400 != $code && 401 != $code ) { 
  196. return; 
  197.  
  198. if ( !$date = wp_remote_retrieve_header( $response, 'date' ) ) { 
  199. return; 
  200.  
  201. if ( 0 >= $time = (int) strtotime( $date ) ) { 
  202. return; 
  203.  
  204. $time_diff = $time - time(); 
  205.  
  206. if ( $force_set ) { // during register 
  207. Jetpack_Options::update_option( 'time_diff', $time_diff ); 
  208. } else { // otherwise 
  209. $old_diff = Jetpack_Options::get_option( 'time_diff' ); 
  210. if ( false === $old_diff || abs( $time_diff - (int) $old_diff ) > 10 ) { 
  211. Jetpack_Options::update_option( 'time_diff', $time_diff ); 
  212.  
  213. /** 
  214. * Query the WordPress.com REST API using the blog token 
  215. * 
  216. * @param string $path 
  217. * @param string $version 
  218. * @param array $args 
  219. * @param string $body 
  220. * @return array|WP_Error $response Data. 
  221. */ 
  222. static function wpcom_json_api_request_as_blog( $path, $version = self::WPCOM_JSON_API_VERSION, $args = array(), $body = null ) { 
  223. $filtered_args = array_intersect_key( $args, array( 
  224. 'method' => 'string',  
  225. 'timeout' => 'int',  
  226. 'redirection' => 'int',  
  227. ) ); 
  228.  
  229. /** 
  230. * Determines whether Jetpack can send outbound https requests to the WPCOM api. 
  231. * 
  232. * @since 3.6.0 
  233. * 
  234. * @param bool $proto Defaults to true. 
  235. */ 
  236. $proto = apply_filters( 'jetpack_can_make_outbound_https', true ) ? 'https' : 'http'; 
  237.  
  238. // unprecedingslashit 
  239. $_path = preg_replace( '/^\//', '', $path ); 
  240.  
  241. // Use GET by default whereas `remote_request` uses POST 
  242. if ( isset( $filtered_args['method'] ) && strtoupper( $filtered_args['method'] === 'POST' ) ) { 
  243. $request_method = 'POST'; 
  244. } else { 
  245. $request_method = 'GET'; 
  246.  
  247. $validated_args = array_merge( $filtered_args, array( 
  248. 'url' => sprintf( '%s://%s/rest/v%s/%s', $proto, self::WPCOM_JSON_API_HOST, $version, $_path ),  
  249. 'blog_id' => (int) Jetpack_Options::get_option( 'id' ),  
  250. 'method' => $request_method,  
  251. ) ); 
  252.  
  253. return Jetpack_Client::remote_request( $validated_args, $body ); 
  254.  
.