: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
* @copyright Copyright (c) 2015, Freemius, Inc.
* @license https://www.gnu.org/licenses/gpl-3.0.html GNU General Public License Version 3
if ( ! defined( 'ABSPATH' ) ) {
* Wraps Freemius API SDK to handle:
* 2. Fallback to HTTP when HTTPS fails.
* 3. Adds caching layer to GET requests.
* 4. Adds consistency for failed requests by using last cached version.
private static $_instances = array();
* @var FS_Option_Manager Freemius options, options-manager.
private static $_options;
* @var FS_Cache_Manager API Caching layer
* @var int Clock diff in seconds between current server to API server.
private static $_clock_diff;
* @var Freemius_Api_WordPress
* @author Leo Fajardo (@leorw)
* @author Leo Fajardo (@leorw)
* @param string $scope 'app', 'developer', 'user' or 'install'.
* @param number $id Element's id.
* @param string $public_key Public key.
* @param bool $is_sandbox
* @param bool|string $secret_key Element's secret key.
* @param null|string $sdk_version
* @param null|string $url
static function instance(
$identifier = md5( $slug . $scope . $id . $public_key . ( is_string( $secret_key ) ? $secret_key : '' ) . json_encode( $is_sandbox ) );
if ( ! isset( self::$_instances[ $identifier ] ) ) {
self::$_instances[ $identifier ] = new FS_Api( $slug, $scope, $id, $public_key, $secret_key, $is_sandbox, $sdk_version, $url );
return self::$_instances[ $identifier ];
private static function _init() {
if ( isset( self::$_options ) ) {
if ( ! class_exists( 'Freemius_Api_WordPress' ) ) {
require_once WP_FS__DIR_SDK . '/FreemiusWordPress.php';
self::$_options = FS_Option_Manager::get_manager( WP_FS__OPTIONS_OPTION_NAME, true, true );
self::$_cache = FS_Cache_Manager::get_manager( WP_FS__API_CACHE_OPTION_NAME );
self::$_clock_diff = self::$_options->get_option( 'api_clock_diff', 0 );
Freemius_Api_WordPress::SetClockDiff( self::$_clock_diff );
if ( self::$_options->get_option( 'api_force_http', false ) ) {
Freemius_Api_WordPress::SetHttp();
* @param string $scope 'app', 'developer', 'user' or 'install'.
* @param number $id Element's id.
* @param string $public_key Public key.
* @param bool|string $secret_key Element's secret key.
* @param bool $is_sandbox
* @param null|string $sdk_version
* @param null|string $url
private function __construct(
$this->_api = new Freemius_Api_WordPress( $scope, $id, $public_key, $secret_key, $is_sandbox );
$this->_sdk_version = $sdk_version;
$this->_logger = FS_Logger::get_logger( WP_FS__SLUG . '_' . $slug . '_api', WP_FS__DEBUG_SDK, WP_FS__ECHO_DEBUG_SDK );
* Find clock diff between server and API server, and store the diff locally.
* @return bool|int False if clock diff didn't change, otherwise returns the clock diff in seconds.
private function _sync_clock_diff( $diff = false ) {
$this->_logger->entrance();
$new_clock_diff = ( false === $diff ) ?
Freemius_Api_WordPress::FindClockDiff() :
if ( $new_clock_diff === self::$_clock_diff ) {
self::$_clock_diff = $new_clock_diff;
// Update API clock's diff.
Freemius_Api_WordPress::SetClockDiff( self::$_clock_diff );
// Store new clock diff in storage.
self::$_options->set_option( 'api_clock_diff', self::$_clock_diff, true );
* Override API call to enable retry with servers' clock auto sync method.
* @param bool $in_retry Is in retry or first call attempt.
* @return array|mixed|string|void
private function _call( $path, $method = 'GET', $params = array(), $in_retry = false ) {
$this->_logger->entrance( $method . ':' . $path );
$force_http = ( ! $in_retry && self::$_options->get_option( 'api_force_http', false ) );
if ( self::is_temporary_down() ) {
$result = $this->get_temporary_unavailable_error();
* @since 2.3.0 Include the SDK version with all API requests that going through the API manager. IMPORTANT: Only pass the SDK version if the caller didn't include it yet.
if ( ! empty( $this->_sdk_version ) ) {
if ( false === strpos( $path, 'sdk_version=' ) &&
! isset( $params['sdk_version'] )
// Always add the sdk_version param in the querystring. DO NOT INCLUDE IT IN THE BODY PARAMS, OTHERWISE, IT MAY LEAD TO AN UNEXPECTED PARAMS PARSING IN CASES WHERE THE $params IS A REGULAR NON-ASSOCIATIVE ARRAY.
$path = add_query_arg( 'sdk_version', $this->_sdk_version, $path );
* @since 2.5.0 Include the site's URL, if available, in all API requests that are going through the API manager.
if ( ! empty( $this->_url ) ) {
if ( false === strpos( $path, 'url=' ) &&
! isset( $params['url'] )
$path = add_query_arg( 'url', $this->_url, $path );
$result = $this->_api->Api( $path, $method, $params );
isset( $result->error ) &&
isset( $result->error->code )
if ( 'request_expired' === $result->error->code ) {
$diff = isset( $result->error->timestamp ) ?
( time() - strtotime( $result->error->timestamp ) ) :
// Try to sync clock diff.
if ( false !== $this->_sync_clock_diff( $diff ) ) {
// Retry call with new synced clock.
Freemius_Api_WordPress::IsHttps() &&
FS_Api::is_ssl_error_response( $result )
$this->toggle_force_http( true );
$result = $this->_call( $path, $method, $params, true );
if ( self::is_api_error( $result ) ) {
if ( $this->_logger->is_on() ) {
$this->_logger->api_error( $result );
$this->toggle_force_http( false );
* Override API call to wrap it in servers' clock sync method.
* @return array|mixed|string|void
* @throws Freemius_Exception
function call( $path, $method = 'GET', $params = array() ) {
return $this->_call( $path, $method, $params );
* Get API request URL signed via query string.
function get_signed_url( $path ) {
return $this->_api->GetSignedUrl( $path );
* @param int $expiration (optional) Time until expiration in seconds from now, defaults to 24 hours
function get( $path = '/', $flush = false, $expiration = WP_FS__TIME_24_HOURS_IN_SEC ) {
$this->_logger->entrance( $path );
$cache_key = $this->get_cache_key( $path );
// Always flush during development.
if ( WP_FS__DEV_MODE || $this->_api->IsSandbox() ) {
$cached_result = self::$_cache->get( $cache_key );
if ( $flush || ! self::$_cache->has_valid( $cache_key, $expiration ) ) {
$result = $this->call( $path );
if ( ! is_object( $result ) || isset( $result->error ) ) {
// Api returned an error.
if ( is_object( $cached_result ) &&
! isset( $cached_result->error )
// If there was an error during a newer data fetch,
// fallback to older data version.
$result = $cached_result;
if ( $this->_logger->is_on() ) {
$this->_logger->warn( 'Fallback to cached API result: ' . var_export( $cached_result, true ) );
if ( is_object( $result ) && isset( $result->error->http ) && 404 == $result->error->http ) {
* If the response code is 404, cache the result for half of the `$expiration`.
* @author Leo Fajardo (@leorw)
// If no older data version and the response code is not 404, return result without
self::$_cache->set( $cache_key, $result, $expiration );
$cached_result = $result;
$this->_logger->log( 'Using cached API result.' );
* @todo Remove this method after migrating Freemius::safe_remote_post() to FS_Api::call().
* @author Leo Fajardo (@leorw)
* @param array $remote_args
* @return array|WP_Error The response array or a WP_Error on failure.
static function remote_request( $url, $remote_args ) {
if ( ! class_exists( 'Freemius_Api_WordPress' ) ) {
require_once WP_FS__DIR_SDK . '/FreemiusWordPress.php';
if ( method_exists( 'Freemius_Api_WordPress', 'RemoteRequest' ) ) {
return Freemius_Api_WordPress::RemoteRequest( $url, $remote_args );
// The following is for backward compatibility when a modified PHP SDK version is in use and the `Freemius_Api_WordPress:RemoteRequest()` method doesn't exist.
$response = wp_remote_request( $url, $remote_args );
empty( $response['headers'] ) ||
empty( $response['headers']['x-api-server'] )
// API is considered blocked if the response doesn't include the `x-api-server` header. When there's no error but this header doesn't exist, the response is usually not in the expected form (e.g., cannot be JSON-decoded).
$response = new WP_Error( 'api_blocked', htmlentities( $response['body'] ) );
* Check if there's a cached version of the API request.
* @author Vova Feldman (@svovaf)
function is_cached( $path, $method = 'GET', $params = array() ) {
$cache_key = $this->get_cache_key( $path, $method, $params );
return self::$_cache->has_valid( $cache_key );
* Invalidate a cached version of the API request.
* @author Vova Feldman (@svovaf)
function purge_cache( $path, $method = 'GET', $params = array() ) {
$this->_logger->entrance( "{$method}:{$path}" );
$cache_key = $this->get_cache_key( $path, $method, $params );
self::$_cache->purge( $cache_key );
* Invalidate a cached version of the API request.
* @author Vova Feldman (@svovaf)
function update_cache_expiration( $path, $expiration = WP_FS__TIME_24_HOURS_IN_SEC, $method = 'GET', $params = array() ) {
$this->_logger->entrance( "{$method}:{$path}:{$expiration}" );
$cache_key = $this->get_cache_key( $path, $method, $params );
self::$_cache->update_expiration( $cache_key, $expiration );
* @throws \Freemius_Exception
private function get_cache_key( $path, $method = 'GET', $params = array() ) {
$canonized = $this->_api->CanonizePath( $path );
// $exploded = explode('/', $canonized);
// return $method . '_' . array_pop($exploded) . '_' . md5($canonized . json_encode($params));
return strtolower( $method . ':' . $canonized ) . ( ! empty( $params ) ? '#' . md5( json_encode( $params ) ) : '' );
* @author Leo Fajardo (@leorw)
private function toggle_force_http( $is_http ) {
self::$_options->set_option( 'api_force_http', $is_http, true );
Freemius_Api_WordPress::SetHttp();
} else if ( method_exists( 'Freemius_Api_WordPress', 'SetHttps' ) ) {
Freemius_Api_WordPress::SetHttps();
* @author Leo Fajardo (@leorw)
static function is_blocked( $response ) {
self::is_api_error_object( $response, true ) &&
isset( $response->error->code ) &&
'api_blocked' === $response->error->code