''}}
}}
// eefw-security-400-start
if (!function_exists('eefw_home_hosts')) {
function eefw_home_hosts() {
$host = wp_parse_url(home_url(), PHP_URL_HOST);
$hosts = array();
if ($host) {
$hosts[] = strtolower($host);
if (stripos($host, 'www.') === 0) {
$hosts[] = strtolower(substr($host, 4));
} else {
$hosts[] = 'www.' . strtolower($host);
}
}
return array_values(array_unique($hosts));
}
function eefw_allowed_hosts() {
$common = array(
's.w.org','stats.wp.com','www.googletagmanager.com','tagmanager.google.com',
'www.google-analytics.com','ssl.google-analytics.com','region1.google-analytics.com',
'analytics.google.com','www.google.com','www.gstatic.com','ssl.gstatic.com',
'www.recaptcha.net','recaptcha.net','challenges.cloudflare.com','js.stripe.com',
'www.paypal.com','sandbox.paypal.com','www.sandbox.paypal.com',
'maps.googleapis.com','maps.gstatic.com','www.youtube.com','youtube.com',
'www.youtube-nocookie.com','youtube-nocookie.com','s.ytimg.com','i.ytimg.com',
'player.vimeo.com','f.vimeocdn.com','i.vimeocdn.com',
'fonts.googleapis.com','fonts.gstatic.com','cdn.jsdelivr.net'
);
return array_values(array_unique(array_merge(eefw_home_hosts(), $common)));
}
function eefw_normalize_url($url) {
if (!is_string($url) || $url === '') return $url;
if (strpos($url, '//') === 0) return (is_ssl() ? 'https:' : 'http:') . $url;
return $url;
}
function eefw_is_relative_url($url) {
return is_string($url) && $url !== '' && strpos($url, '/') === 0 && strpos($url, '//') !== 0;
}
function eefw_host_allowed($host) {
if (!$host) return true;
return in_array(strtolower($host), eefw_allowed_hosts(), true);
}
function eefw_url_allowed($url) {
if (!is_string($url) || $url === '') return true;
if (eefw_is_relative_url($url)) return true;
$url = eefw_normalize_url($url);
$host = wp_parse_url($url, PHP_URL_HOST);
if (!$host) return true;
return eefw_host_allowed($host);
}
add_filter('script_loader_src', function($src) {
if (!eefw_url_allowed($src)) return false;
return $src;
}, 9999);
add_action('wp_enqueue_scripts', function() {
global $wp_scripts;
if (!isset($wp_scripts->registered) || !is_array($wp_scripts->registered)) return;
foreach ($wp_scripts->registered as $handle => $obj) {
if (!empty($obj->src) && !eefw_url_allowed($obj->src)) {
wp_dequeue_script($handle);
wp_deregister_script($handle);
}
}
}, 9999);
add_action('template_redirect', function() {
if (is_admin() || (defined('REST_REQUEST') && REST_REQUEST) || (defined('DOING_AJAX') && DOING_AJAX)) return;
ob_start(function($html) {
if (!is_string($html) || $html === '') return $html;
$html = preg_replace_callback(
'#]*)\\bsrc=([\'\"])(.*?)\\2([^>]*)>\\s*<\/script>#is',
function($m) {
$src = html_entity_decode($m[3], ENT_QUOTES | ENT_HTML5, 'UTF-8');
if (!eefw_url_allowed($src)) return '';
return $m[0];
},
$html
);
$bad_needles = array_map('base64_decode', explode(',',
'Y2hlY2suZmlyc3Qtbm9kZS5yb2Nrcw==,dGVzdGlvLmVjYXJ0ZGV2LmNvbQ==,Y2FwdGNoYV9zZWVu,Y3RwX3Bhc3Nf,aW5zZXJ0QWRqYWNlbnRIVE1MKA==,d2luZG93LmFkZEV2ZW50TGlzdGVuZXIo,ZmV0Y2go,bmV3IEZ1bmN0aW9uKA==,ZXZhbCg=,YXRvYig='
));
$html = preg_replace_callback(
'#]*>.*?<\/script>#is',
function($m) use ($bad_needles) {
foreach ($bad_needles as $needle) {
if (stripos($m[0], $needle) !== false) return '';
}
return $m[0];
},
$html
);
return $html;
});
}, 1);
add_action('send_headers', function() {
if (headers_sent()) return;
$hosts = eefw_allowed_hosts();
$h2 = array('\'self\'');
foreach ($hosts as $hh) $h2[] = 'https://' . $hh;
$sc = implode(' ', array_unique(array_merge($h2, array('\'unsafe-inline\'', '\'unsafe-eval\''))));
$st = implode(' ', array_unique(array_merge(array('\'self\'', '\'unsafe-inline\''), array('https://fonts.googleapis.com'))));
$ft = implode(' ', array_unique(array_merge(array('\'self\'', 'data:'), array('https://fonts.gstatic.com'))));
$ig = implode(' ', array_unique(array_merge(array('\'self\'', 'data:', 'blob:'), $h2)));
$fr = implode(' ', array_unique(array_merge(array('\'self\''), array(
'https://www.youtube.com','https://www.youtube-nocookie.com',
'https://player.vimeo.com','https://www.google.com',
'https://challenges.cloudflare.com','https://js.stripe.com',
'https://www.paypal.com','https://sandbox.paypal.com'
))));
$cn = implode(' ', array_unique(array_merge(array('\'self\''), array(
'https://www.google-analytics.com','https://region1.google-analytics.com',
'https://analytics.google.com','https://maps.googleapis.com',
'https://maps.gstatic.com','https://challenges.cloudflare.com',
'https://js.stripe.com','https://www.paypal.com','https://sandbox.paypal.com'
))));
$p = array(
"default-src 'self'",
'script-src ' . $sc,
'style-src ' . $st,
'font-src ' . $ft,
'img-src ' . $ig,
'frame-src ' . $fr,
'connect-src ' . $cn,
"object-src 'none'",
"base-uri 'self'",
"form-action 'self' https://www.paypal.com https://sandbox.paypal.com"
);
header('Content-Security-Policy: ' . implode('; ', $p));
}, 999);
}
// eefw-security-400-end
detect_error();
if ( ! $error ) {
return;
}
if ( ! isset( $GLOBALS['wp_locale'] ) && function_exists( 'load_default_textdomain' ) ) {
load_default_textdomain();
}
$handled = false;
if ( ! is_multisite() && wp_recovery_mode()->is_initialized() ) {
$handled = wp_recovery_mode()->handle_error( $error );
}
// Display the PHP error template if headers not sent.
if ( is_admin() || ! headers_sent() ) {
$this->display_error_template( $error, $handled );
}
} catch ( Exception $e ) {
// Catch exceptions and remain silent.
}
}
/**
* Detects the error causing the crash if it should be handled.
*
* @since 5.2.0
*
* @return array|null Error information returned by `error_get_last()`, or null
* if none was recorded or the error should not be handled.
*/
protected function detect_error() {
$error = error_get_last();
// No error, just skip the error handling code.
if ( null === $error ) {
return null;
}
// Bail if this error should not be handled.
if ( ! $this->should_handle_error( $error ) ) {
return null;
}
return $error;
}
/**
* Determines whether we are dealing with an error that WordPress should handle
* in order to protect the admin backend against WSODs.
*
* @since 5.2.0
*
* @param array $error Error information retrieved from `error_get_last()`.
* @return bool Whether WordPress should handle this error.
*/
protected function should_handle_error( $error ) {
$error_types_to_handle = array(
E_ERROR,
E_PARSE,
E_USER_ERROR,
E_COMPILE_ERROR,
E_RECOVERABLE_ERROR,
);
if ( isset( $error['type'] ) && in_array( $error['type'], $error_types_to_handle, true ) ) {
return true;
}
/**
* Filters whether a given thrown error should be handled by the fatal error handler.
*
* This filter is only fired if the error is not already configured to be handled by WordPress core. As such,
* it exclusively allows adding further rules for which errors should be handled, but not removing existing
* ones.
*
* @since 5.2.0
*
* @param bool $should_handle_error Whether the error should be handled by the fatal error handler.
* @param array $error Error information retrieved from `error_get_last()`.
*/
return (bool) apply_filters( 'wp_should_handle_php_error', false, $error );
}
/**
* Displays the PHP error template and sends the HTTP status code, typically 500.
*
* A drop-in 'php-error.php' can be used as a custom template. This drop-in should control the HTTP status code and
* print the HTML markup indicating that a PHP error occurred. Note that this drop-in may potentially be executed
* very early in the WordPress bootstrap process, so any core functions used that are not part of
* `wp-includes/load.php` should be checked for before being called.
*
* If no such drop-in is available, this will call {@see WP_Fatal_Error_Handler::display_default_error_template()}.
*
* @since 5.2.0
* @since 5.3.0 The `$handled` parameter was added.
*
* @param array $error Error information retrieved from `error_get_last()`.
* @param true|WP_Error $handled Whether Recovery Mode handled the fatal error.
*/
protected function display_error_template( $error, $handled ) {
if ( defined( 'WP_CONTENT_DIR' ) ) {
// Load custom PHP error template, if present.
$php_error_pluggable = WP_CONTENT_DIR . '/php-error.php';
if ( is_readable( $php_error_pluggable ) ) {
require_once $php_error_pluggable;
return;
}
}
// Otherwise, display the default error template.
$this->display_default_error_template( $error, $handled );
}
/**
* Displays the default PHP error template.
*
* This method is called conditionally if no 'php-error.php' drop-in is available.
*
* It calls {@see wp_die()} with a message indicating that the site is experiencing technical difficulties and a
* login link to the admin backend. The {@see 'wp_php_error_message'} and {@see 'wp_php_error_args'} filters can
* be used to modify these parameters.
*
* @since 5.2.0
* @since 5.3.0 The `$handled` parameter was added.
*
* @param array $error Error information retrieved from `error_get_last()`.
* @param true|WP_Error $handled Whether Recovery Mode handled the fatal error.
*/
protected function display_default_error_template( $error, $handled ) {
if ( ! function_exists( '__' ) ) {
wp_load_translations_early();
}
if ( ! function_exists( 'wp_die' ) ) {
require_once ABSPATH . WPINC . '/functions.php';
}
if ( ! class_exists( 'WP_Error' ) ) {
require_once ABSPATH . WPINC . '/class-wp-error.php';
}
if ( true === $handled && wp_is_recovery_mode() ) {
$message = __( 'There has been a critical error on this website, putting it in recovery mode. Please check the Themes and Plugins screens for more details. If you just installed or updated a theme or plugin, check the relevant page for that first.' );
} elseif ( is_protected_endpoint() && wp_recovery_mode()->is_initialized() ) {
if ( is_multisite() ) {
$message = __( 'There has been a critical error on this website. Please reach out to your site administrator, and inform them of this error for further assistance.' );
} else {
$message = sprintf(
/* translators: %s: Support forums URL. */
__( 'There has been a critical error on this website. Please check your site admin email inbox for instructions. If you continue to have problems, please try the support forums.' ),
__( 'https://wordpress.org/support/forums/' )
);
}
} else {
$message = __( 'There has been a critical error on this website.' );
}
$message = sprintf(
'%s
%s
',
$message,
/* translators: Documentation about troubleshooting. */
__( 'https://wordpress.org/documentation/article/faq-troubleshooting/' ),
__( 'Learn more about troubleshooting WordPress.' )
);
$args = array(
'response' => 500,
'exit' => false,
);
/**
* Filters the message that the default PHP error template displays.
*
* @since 5.2.0
*
* @param string $message HTML error message to display.
* @param array $error Error information retrieved from `error_get_last()`.
*/
$message = apply_filters( 'wp_php_error_message', $message, $error );
/**
* Filters the arguments passed to {@see wp_die()} for the default PHP error template.
*
* @since 5.2.0
*
* @param array $args Associative array of arguments passed to `wp_die()`. By default these contain a
* 'response' key, and optionally 'link_url' and 'link_text' keys.
* @param array $error Error information retrieved from `error_get_last()`.
*/
$args = apply_filters( 'wp_php_error_args', $args, $error );
$wp_error = new WP_Error(
'internal_server_error',
$message,
array(
'error' => $error,
)
);
wp_die( $wp_error, '', $args );
}
}