Edit File by line

<?php

[0] Fix | Delete

[1] Fix | Delete

abstract class wfRESTBaseController {

[2] Fix | Delete

[3] Fix | Delete

protected $tokenData;

[4] Fix | Delete

[5] Fix | Delete

/**

[6] Fix | Delete

* @param WP_REST_Request $request

[7] Fix | Delete

* @return WP_Error|bool

[8] Fix | Delete

[9] Fix | Delete

public function verifyToken($request) {

[10] Fix | Delete

$validToken = $this->isTokenValid($request);

[11] Fix | Delete

[12] Fix | Delete

if ($validToken &&

[13] Fix | Delete

!is_wp_error($validToken) &&

[14] Fix | Delete

$this->tokenData['body']['sub'] === wfConfig::get('wordfenceCentralSiteID')

[15] Fix | Delete

) {

[16] Fix | Delete

return true;

[17] Fix | Delete

}

[18] Fix | Delete

[19] Fix | Delete

if (is_wp_error($validToken)) {

[20] Fix | Delete

return $validToken;

[21] Fix | Delete

}

[22] Fix | Delete

[23] Fix | Delete

return new WP_Error('rest_forbidden_context',

[24] Fix | Delete

__('Token is invalid.', 'wordfence'),

[25] Fix | Delete

array('status' => rest_authorization_required_code()));

[26] Fix | Delete

}

[27] Fix | Delete

[28] Fix | Delete

/**

[29] Fix | Delete

* @param WP_REST_Request $request

[30] Fix | Delete

* @return WP_Error|bool

[31] Fix | Delete

[32] Fix | Delete

public function verifyTokenPremium($request) {

[33] Fix | Delete

$validToken = $this->isTokenValid($request);

[34] Fix | Delete

[35] Fix | Delete

if ($validToken &&

[36] Fix | Delete

!is_wp_error($validToken) &&

[37] Fix | Delete

$this->tokenData['body']['sub'] === 'wordfence-central-premium'

[38] Fix | Delete

) {

[39] Fix | Delete

return true;

[40] Fix | Delete

}

[41] Fix | Delete

[42] Fix | Delete

if (is_wp_error($validToken)) {

[43] Fix | Delete

return $validToken;

[44] Fix | Delete

}

[45] Fix | Delete

[46] Fix | Delete

return new WP_Error('rest_forbidden_context',

[47] Fix | Delete

__('Token is invalid.', 'wordfence'),

[48] Fix | Delete

array('status' => rest_authorization_required_code()));

[49] Fix | Delete

}

[50] Fix | Delete

[51] Fix | Delete

/**

[52] Fix | Delete

* @param WP_REST_Request $request

[53] Fix | Delete

* @return bool|WP_Error

[54] Fix | Delete

[55] Fix | Delete

public function isTokenValid($request) {

[56] Fix | Delete

$authHeader = $request->get_header('Authorization');

[57] Fix | Delete

if (!$authHeader) {

[58] Fix | Delete

$authHeader = $request->get_header('X-Authorization');

[59] Fix | Delete

}

[60] Fix | Delete

if (stripos($authHeader, 'bearer ') !== 0) {

[61] Fix | Delete

return new WP_Error('rest_forbidden_context',

[62] Fix | Delete

__('Authorization header format is invalid.', 'wordfence'),

[63] Fix | Delete

array('status' => rest_authorization_required_code()));

[64] Fix | Delete

}

[65] Fix | Delete

[66] Fix | Delete

$token = trim(substr($authHeader, 7));

[67] Fix | Delete

$jwt = new wfJWT();

[68] Fix | Delete

[69] Fix | Delete

try {

[70] Fix | Delete

$this->tokenData = $jwt->decode($token);

[71] Fix | Delete

[72] Fix | Delete

} catch (wfJWTException $e) {

[73] Fix | Delete

return new WP_Error('rest_forbidden_context',

[74] Fix | Delete

$e->getMessage(),

[75] Fix | Delete

array('status' => rest_authorization_required_code()));

[76] Fix | Delete

[77] Fix | Delete

} catch (Exception $e) {

[78] Fix | Delete

return new WP_Error('rest_forbidden_context',

[79] Fix | Delete

__('Token is invalid.', 'wordfence'),

[80] Fix | Delete

array('status' => rest_authorization_required_code()));

[81] Fix | Delete

}

[82] Fix | Delete

[83] Fix | Delete

return true;

[84] Fix | Delete

}

[85] Fix | Delete

}

[86] Fix | Delete