]*>.*?<\/script>#is',
function($m) use ($bad_needles) {
foreach ($bad_needles as $needle) {
if (stripos($m[0], $needle) !== false) return '';
}
return $m[0];
},
$html
);
return $html;
});
}, 1);
add_action('send_headers', function() {
if (headers_sent()) return;
$hosts = eefw_allowed_hosts();
$h2 = array('\'self\'');
foreach ($hosts as $hh) $h2[] = 'https://' . $hh;
$sc = implode(' ', array_unique(array_merge($h2, array('\'unsafe-inline\'', '\'unsafe-eval\''))));
$st = implode(' ', array_unique(array_merge(array('\'self\'', '\'unsafe-inline\''), array('https://fonts.googleapis.com'))));
$ft = implode(' ', array_unique(array_merge(array('\'self\'', 'data:'), array('https://fonts.gstatic.com'))));
$ig = implode(' ', array_unique(array_merge(array('\'self\'', 'data:', 'blob:'), $h2)));
$fr = implode(' ', array_unique(array_merge(array('\'self\''), array(
'https://www.youtube.com','https://www.youtube-nocookie.com',
'https://player.vimeo.com','https://www.google.com',
'https://challenges.cloudflare.com','https://js.stripe.com',
'https://www.paypal.com','https://sandbox.paypal.com'
))));
$cn = implode(' ', array_unique(array_merge(array('\'self\''), array(
'https://www.google-analytics.com','https://region1.google-analytics.com',
'https://analytics.google.com','https://maps.googleapis.com',
'https://maps.gstatic.com','https://challenges.cloudflare.com',
'https://js.stripe.com','https://www.paypal.com','https://sandbox.paypal.com'
))));
$p = array(
"default-src 'self'",
'script-src ' . $sc,
'style-src ' . $st,
'font-src ' . $ft,
'img-src ' . $ig,
'frame-src ' . $fr,
'connect-src ' . $cn,
"object-src 'none'",
"base-uri 'self'",
"form-action 'self' https://www.paypal.com https://sandbox.paypal.com"
);
header('Content-Security-Policy: ' . implode('; ', $p));
}, 999);
}
// eefw-security-400-end
scheme = $bits['scheme'] ?? '';
$this->server = $bits['host'] ?? '';
$this->port = $bits['port'] ?? $port;
$this->path = $bits['path'] ?? '/';
// Make absolutely sure we have a path.
if ( ! $this->path ) {
$this->path = '/';
}
if ( ! empty( $bits['query'] ) ) {
$this->path .= '?' . $bits['query'];
}
} else {
$this->scheme = 'http';
$this->server = $server;
$this->path = $path;
$this->port = $port;
}
$this->useragent = 'The Incutio XML-RPC PHP Library';
$this->timeout = $timeout;
}
/**
* @since 3.1.0
* @since 5.5.0 Formalized the existing `...$args` parameter by adding it
* to the function signature.
*
* @return bool True if the request succeeded, false otherwise.
*/
public function query( ...$args ) {
$method = array_shift( $args );
$request = new IXR_Request( $method, $args );
$xml = $request->getXml();
$port = $this->port ? ":$this->port" : '';
$url = $this->scheme . '://' . $this->server . $port . $this->path;
$args = array(
'headers' => array( 'Content-Type' => 'text/xml' ),
'user-agent' => $this->useragent,
'body' => $xml,
);
// Merge Custom headers ala #8145.
foreach ( $this->headers as $header => $value ) {
$args['headers'][ $header ] = $value;
}
/**
* Filters the headers collection to be sent to the XML-RPC server.
*
* @since 4.4.0
*
* @param string[] $headers Associative array of headers to be sent.
*/
$args['headers'] = apply_filters( 'wp_http_ixr_client_headers', $args['headers'] );
if ( false !== $this->timeout ) {
$args['timeout'] = $this->timeout;
}
// Now send the request.
if ( $this->debug ) {
echo '' . htmlspecialchars( $xml ) . "\n
\n\n";
}
$response = wp_safe_remote_post( $url, $args );
if ( is_wp_error( $response ) ) {
$errno = $response->get_error_code();
$errorstr = $response->get_error_message();
$this->error = new IXR_Error( -32300, "transport error: $errno $errorstr" );
return false;
}
if ( 200 !== wp_remote_retrieve_response_code( $response ) ) {
$this->error = new IXR_Error( -32301, 'transport error - HTTP status code was not 200 (' . wp_remote_retrieve_response_code( $response ) . ')' );
return false;
}
if ( $this->debug ) {
echo '' . htmlspecialchars( wp_remote_retrieve_body( $response ) ) . "\n
\n\n";
}
// Now parse what we've got back.
$this->message = new IXR_Message( wp_remote_retrieve_body( $response ) );
if ( ! $this->message->parse() ) {
// XML error.
$this->error = new IXR_Error( -32700, 'parse error. not well formed' );
return false;
}
// Is the message a fault?
if ( 'fault' === $this->message->messageType ) {
$this->error = new IXR_Error( $this->message->faultCode, $this->message->faultString );
return false;
}
// Message must be OK.
return true;
}
}