Skip to content

Commit 683ce02

Browse files
author
Hai Zheng
committed
v7.1-b6: Enhanced URL fetch validation to avoid possible local info expose
1 parent bef8a82 commit 683ce02

11 files changed

+24
-16
lines changed

‎litespeed-cache.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* Plugin Name: LiteSpeed Cache
55
* Plugin URI: https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration
66
* Description: High-performance page caching and site optimization from LiteSpeed
7-
* Version: 7.1-b1
7+
* Version: 7.1-b6
88
* Author: LiteSpeed Technologies
99
* Author URI: https://www.litespeedtech.com
1010
* License: GPLv3
@@ -34,7 +34,7 @@
3434
return;
3535
}
3636

37-
!defined('LSCWP_V') && define('LSCWP_V', '7.1-b1');
37+
!defined('LSCWP_V') && define('LSCWP_V', '7.1-b6');
3838

3939
!defined('LSCWP_CONTENT_DIR') && define('LSCWP_CONTENT_DIR', WP_CONTENT_DIR);
4040
!defined('LSCWP_DIR') && define('LSCWP_DIR', __DIR__ . '/'); // Full absolute path '/var/www/html/***/wp-content/plugins/litespeed-cache/' or MU

‎src/avatar.cls.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
<?php
2+
23
/**
34
* The avatar cache class
45
*
@@ -7,6 +8,7 @@
78
* @subpackage LiteSpeed/inc
89
* @author LiteSpeed Technologies <[email protected]>
910
*/
11+
1012
namespace LiteSpeed;
1113

1214
defined('WPINC') || exit();
@@ -242,7 +244,7 @@ private function _generate($url)
242244
// Generate
243245
$this->_maybe_mk_cache_folder('avatar');
244246

245-
$response = wp_remote_get($url, array('timeout' => 180, 'stream' => true, 'filename' => $file));
247+
$response = wp_safe_remote_get($url, array('timeout' => 180, 'stream' => true, 'filename' => $file));
246248

247249
Debug2::debug('[Avatar] _generate [url] ' . $url);
248250

‎src/cloud.cls.php

+5-5
Original file line numberDiff line numberDiff line change
@@ -473,7 +473,7 @@ private function _load_server_pk($from_wpapi = false)
473473
if ($from_wpapi) {
474474
$server_key_url = self::CLOUD_SERVER_WP . '/' . self::API_SERVER_KEY_SIGN;
475475
}
476-
$resp = wp_remote_get($server_key_url);
476+
$resp = wp_safe_remote_get($server_key_url);
477477
if (is_wp_error($resp)) {
478478
self::debugErr('Failed to load key: ' . $resp->get_error_message());
479479
return false;
@@ -1036,7 +1036,7 @@ public function detect_cloud($service, $force = false)
10361036
// TODO
10371037
$valid_cloud_loads = array();
10381038
foreach ($valid_clouds as $k => $v) {
1039-
$response = wp_remote_get($v, array('timeout' => 5));
1039+
$response = wp_safe_remote_get($v, array('timeout' => 5));
10401040
if (is_wp_error($response)) {
10411041
$error_message = $response->get_error_message();
10421042
self::debug('failed to do load checker: ' . $error_message);
@@ -1188,7 +1188,7 @@ private function _get($service, $data = false)
11881188

11891189
self::save_summary(array('curr_request.' . $service_tag => time()));
11901190

1191-
$response = wp_remote_get($url, array(
1191+
$response = wp_safe_remote_get($url, array(
11921192
'timeout' => 15,
11931193
'headers' => array('Accept' => 'application/json'),
11941194
));
@@ -1361,7 +1361,7 @@ private function _post($service, $data = false, $time_out = false)
13611361

13621362
self::save_summary(array('curr_request.' . $service_tag => time()));
13631363

1364-
$response = wp_remote_post($url, array(
1364+
$response = wp_safe_remote_post($url, array(
13651365
'body' => $param,
13661366
'timeout' => $time_out ?: 15,
13671367
'headers' => array('Accept' => 'application/json', 'Expect' => ''),
@@ -1844,7 +1844,7 @@ private function _update_ips()
18441844
// Prevent multiple call in a short period
18451845
self::save_summary(array('ips_ts' => time(), 'ips_ts_runner' => time()));
18461846

1847-
$response = wp_remote_get(self::CLOUD_IPS . '?json');
1847+
$response = wp_safe_remote_get(self::CLOUD_IPS . '?json');
18481848
if (is_wp_error($response)) {
18491849
$error_message = $response->get_error_message();
18501850
self::debug('failed to get ip whitelist: ' . $error_message);

‎src/core.cls.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -677,7 +677,7 @@ public function send_headers($is_forced = false)
677677
self::debug('[Core] Purge Queue found, issue a HTTP req to purge: ' . $purge_queue);
678678
// Kick off HTTP req
679679
$url = admin_url('admin-ajax.php');
680-
$resp = wp_remote_get($url);
680+
$resp = wp_safe_remote_get($url);
681681
if (is_wp_error($resp)) {
682682
$error_message = $resp->get_error_message();
683683
self::debug('[URL]' . $url);

‎src/crawler-map.cls.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -525,7 +525,7 @@ private function _parse($sitemap)
525525
* Read via wp func to avoid allow_url_fopen = off
526526
* @since 2.2.7
527527
*/
528-
$response = wp_remote_get($sitemap, array('timeout' => $this->_conf_map_timeout, 'sslverify' => false));
528+
$response = wp_safe_remote_get($sitemap, array('timeout' => $this->_conf_map_timeout, 'sslverify' => false));
529529
if (is_wp_error($response)) {
530530
$error_message = $response->get_error_message();
531531
self::debug('failed to read sitemap: ' . $error_message);

‎src/file.cls.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ class File
2222
*/
2323
public static function is_404($url)
2424
{
25-
$response = wp_remote_get($url);
25+
$response = wp_safe_remote_get($url);
2626
$code = wp_remote_retrieve_response_code($response);
2727
if ($code == 404) {
2828
return true;

‎src/img-optm.cls.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -1235,7 +1235,7 @@ public function pull($manual = false)
12351235
));
12361236
} else {
12371237
foreach ($requests as $cnt => $req) {
1238-
$wp_response = wp_remote_get($req['url'], array('timeout' => 60));
1238+
$wp_response = wp_safe_remote_get($req['url'], array('timeout' => 60));
12391239
$request_response = array(
12401240
'success' => false,
12411241
'status_code' => 0,

‎src/localization.cls.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
<?php
2+
23
/**
34
* The localization class.
45
*
56
* @since 3.3
67
*/
8+
79
namespace LiteSpeed;
810

911
defined('WPINC') || exit();
@@ -90,7 +92,7 @@ public function serve_static($uri)
9092
$file = $this->_realpath($url);
9193

9294
self::debug('localize [url] ' . $url);
93-
$response = wp_remote_get($url, array('timeout' => 180, 'stream' => true, 'filename' => $file));
95+
$response = wp_safe_remote_get($url, array('timeout' => 180, 'stream' => true, 'filename' => $file));
9496

9597
// Parse response data
9698
if (is_wp_error($response)) {

‎src/optimizer.cls.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
<?php
2+
23
/**
34
* The optimize4 class.
45
*
@@ -7,6 +8,7 @@
78
* @subpackage LiteSpeed/inc
89
* @author LiteSpeed Technologies <[email protected]>
910
*/
11+
1012
namespace LiteSpeed;
1113

1214
defined('WPINC') || exit();
@@ -229,7 +231,7 @@ private function load_cached_file($url, $file_type)
229231
}
230232

231233
// Write file
232-
$res = wp_remote_get($url);
234+
$res = wp_safe_remote_get($url);
233235
$res_code = wp_remote_retrieve_response_code($res);
234236
if (is_wp_error($res) || $res_code != 200) {
235237
Debug2::debug2('[Optimizer] ❌ Load Remote error [code] ' . $res_code);

‎src/task.cls.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ public static function async_call($type)
131131
);
132132
$url = add_query_arg($qs, admin_url('admin-ajax.php'));
133133
self::debug('async call to ' . $url);
134-
wp_remote_post(esc_url_raw($url), $args);
134+
wp_safe_remote_post(esc_url_raw($url), $args);
135135
}
136136

137137
/**

‎src/tool.cls.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
<?php
2+
23
/**
34
* The tools
45
*
@@ -7,6 +8,7 @@
78
* @subpackage LiteSpeed/inc
89
* @author LiteSpeed Technologies <[email protected]>
910
*/
11+
1012
namespace LiteSpeed;
1113

1214
defined('WPINC') || exit();
@@ -23,7 +25,7 @@ public function check_ip()
2325
{
2426
Debug2::debug('[Tool] ✅ check_ip');
2527

26-
$response = wp_remote_get('https://www.doapi.us/ip');
28+
$response = wp_safe_remote_get('https://www.doapi.us/ip');
2729

2830
if (is_wp_error($response)) {
2931
return new \WP_Error('remote_get_fail', 'Failed to fetch from https://www.doapi.us/ip', array('status' => 404));

0 commit comments

Comments
 (0)