JezK

Edit File: rest.cls.php

<?php
/**
 * REST endpoints and helpers for LiteSpeed.
 *
 * @since   2.9.4
 * @package LiteSpeed
 */

namespace LiteSpeed;

defined( 'WPINC' ) || exit();

/**
 * Class REST
 *
 * Registers plugin REST endpoints and exposes helpers for REST detection.
 */
class REST extends Root {

const LOG_TAG = '☎️';

/**
	 * Whether current request is an internal REST call.
	 *
	 * @var bool
	 */
	private $_internal_rest_status = false;

/**
	 * Constructor.
	 *
	 * @since 2.9.4
	 */
	public function __construct() {
		// Hook to internal REST call.
		add_filter( 'rest_request_before_callbacks', [ $this, 'set_internal_rest_on' ] );
		add_filter( 'rest_request_after_callbacks', [ $this, 'set_internal_rest_off' ] );

add_action( 'rest_api_init', [ $this, 'rest_api_init' ] );
	}

/**
	 * Register REST routes.
	 *
	 * @since 3.0
	 * @return void
	 */
	public function rest_api_init() {
		// Activate or deactivate a specific crawler callback
		register_rest_route( 'litespeed/v1', '/toggle_crawler_state', [
			'methods'             => 'POST',
			'callback'            => [ $this, 'toggle_crawler_state' ],
			'permission_callback' => function () {
				return current_user_can( 'manage_network_options' ) || current_user_can( 'manage_options' );
			},
		] );

register_rest_route( 'litespeed/v1', '/tool/check_ip', [
			'methods'             => 'GET',
			'callback'            => [ $this, 'check_ip' ],
			'permission_callback' => function () {
				return current_user_can( 'manage_network_options' ) || current_user_can( 'manage_options' );
			},
		] );

register_rest_route( 'litespeed/v1', '/guest/sync', [
			'methods'             => 'GET',
			'callback'            => [ $this, 'guest_sync' ],
			'permission_callback' => function () {
				return current_user_can( 'manage_network_options' ) || current_user_can( 'manage_options' );
			},
		] );

// IP callback validate
		register_rest_route( 'litespeed/v3', '/ip_validate', [
			'methods'             => 'POST',
			'callback'            => [ $this, 'ip_validate' ],
			'permission_callback' => function ( $request ) {
				return $this->cls( 'Cloud' )->validate_signed_callback( $request, Cloud::SIGN_ACTION_IP_VALIDATE );
			},
		] );

// 1.2. WP REST Dryrun Callback
		register_rest_route( 'litespeed/v3', '/wp_rest_echo', [
			'methods'             => 'POST',
			'callback'            => [ $this, 'wp_rest_echo' ],
			'permission_callback' => '__return_true',
		] );
		register_rest_route( 'litespeed/v3', '/ping', [
			'methods'             => 'POST',
			'callback'            => [ $this, 'ping' ],
			'permission_callback' => function ( $request ) {
				return $this->cls( 'Cloud' )->validate_signed_callback( $request, Cloud::SIGN_ACTION_PING );
			},
		] );

// CDN setup callback notification
		register_rest_route( 'litespeed/v3', '/cdn_status', [
			'methods'             => 'POST',
			'callback'            => [ $this, 'cdn_status' ],
			'permission_callback' => function ( $request ) {
				return $this->cls( 'Cloud' )->validate_signed_callback( $request, Cloud::SIGN_ACTION_CDN_STATUS );
			},
		] );

// Image optm notify_img
		register_rest_route( 'litespeed/v1', '/notify_img', [
			'methods'             => 'POST',
			'callback'            => [ $this, 'notify_img' ],
			'permission_callback' => function ( $request ) {
				return $this->cls( 'Cloud' )->validate_signed_callback( $request, Cloud::SIGN_ACTION_NOTIFY_IMG );
			},
		] );

register_rest_route( 'litespeed/v3', '/err_domains', [
			'methods'             => 'POST',
			'callback'            => [ $this, 'err_domains' ],
			'permission_callback' => function ( $request ) {
				return $this->cls( 'Cloud' )->validate_signed_callback( $request, Cloud::SIGN_ACTION_ERR_DOMAINS );
			},
		] );
	}

/**
	 * Call to freeze or melt the crawler clicked
	 *
	 * @since  4.3
	 */
	public function toggle_crawler_state() {
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- REST API nonce verified by WordPress
		$crawler_id = isset( $_POST['crawler_id'] ) ? sanitize_text_field( wp_unslash( $_POST['crawler_id'] ) ) : '';

if ( '' !== $crawler_id ) {
			return $this->cls( 'Crawler' )->toggle_activeness( $crawler_id ) ? 1 : 0;
		}
	}

/**
	 * Ping pong.
	 *
	 * @since 3.0.4
	 * @param \WP_REST_Request $request REST request.
	 * @return mixed
	 */
	public function ping( $request ) {
		return $this->cls( 'Cloud' )->ping( $request->get_body() );
	}

/**
	 * Launch IP check.
	 *
	 * @since 3.0
	 * @return mixed
	 */
	public function check_ip() {
		return Tool::cls()->check_ip();
	}

/**
	 * Sync Guest Mode IP/UA lists.
	 *
	 * @since 7.7
	 * @return array
	 */
	public function guest_sync() {
		return Guest::cls()->sync_lists();
	}

/**
	 * Validate IPs from cloud.
	 *
	 * @since 3.0
	 * @param \WP_REST_Request $request REST request.
	 * @return mixed
	 */
	public function ip_validate( $request ) {
		return $this->cls( 'Cloud' )->ip_validate();
	}

/**
	 * REST echo helper.
	 *
	 * @since 3.0
	 * @return mixed
	 */
	public function wp_rest_echo() {
		return $this->cls( 'Cloud' )->wp_rest_echo();
	}

/**
	 * Endpoint to notify plugin of CDN status updates.
	 *
	 * @since 7.0
	 * @since 7.9.1 Forwards the exact raw body the signature was verified over.
	 *
	 * @param \WP_REST_Request $request REST request.
	 * @return mixed
	 */
	public function cdn_status( $request ) {
		return $this->cls( 'Cloud' )->update_cdn_status( $request->get_body() );
	}

/**
	 * Image optimization notification.
	 *
	 * @since 3.0
	 * @since 7.9.1 Accepts the REST request and forwards its exact raw body.
	 * @param \WP_REST_Request $request REST request.
	 * @return mixed
	 */
	public function notify_img( $request ) {
		return Img_Optm::cls()->notify_img( $request->get_body() );
	}

/**
	 * Error domain report from cloud.
	 *
	 * @since 4.7
	 * @param \WP_REST_Request $request REST request.
	 * @return mixed
	 */
	public function err_domains( $request ) {
		self::debug( 'err_domains' );
		return $this->cls( 'Cloud' )->rest_err_domains( $request->get_body() );
	}

/**
	 * Return a standardized error payload.
	 *
	 * @since 5.7.0.1
	 * @param string|int $code Error code.
	 * @return array
	 */
	public static function err( $code ) {
		return [
			'_res' => 'err',
			'_msg' => $code,
		];
	}

/**
	 * Set internal REST tag to ON.
	 *
	 * @since 2.9.4
	 * @param mixed $not_used Passthrough value from the filter.
	 * @return mixed
	 */
	public function set_internal_rest_on( $not_used = null ) {
		$this->_internal_rest_status = true;
		Debug2::debug2( '[REST] ✅ Internal REST ON [filter] rest_request_before_callbacks' );

return $not_used;
	}

/**
	 * Set internal REST tag to OFF.
	 *
	 * @since 2.9.4
	 * @param mixed $not_used Passthrough value from the filter.
	 * @return mixed
	 */
	public function set_internal_rest_off( $not_used = null ) {
		$this->_internal_rest_status = false;
		Debug2::debug2( '[REST] ❎ Internal REST OFF [filter] rest_request_after_callbacks' );

return $not_used;
	}

/**
	 * Whether current request is an internal REST call.
	 *
	 * @since 2.9.4
	 * @return bool
	 */
	public function is_internal_rest() {
		return $this->_internal_rest_status;
	}

/**
	 * Match URI rules against pretty and rest_route spellings.
	 *
	 * @since 7.9.1
	 * @param string $req_uri  Raw request URI.
	 * @param array  $rules    URI rules.
	 * @param bool   $has_ttl  Whether rules include a TTL.
	 * @return bool|string|array
	 */
	public static function str_hit_uri( $req_uri, $rules, $has_ttl = false ) {
		$uris = [ $req_uri ];
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Type is checked before sanitization.
		$route = isset( $_GET['rest_route'] ) ? wp_unslash( $_GET['rest_route'] ) : '';
		$route = is_string( $route ) ? sanitize_text_field( $route ) : '';
		if ( '' !== $route && function_exists( 'rest_get_url_prefix' ) ) {
			$prefix = wp_parse_url( home_url( rest_get_url_prefix() ), PHP_URL_PATH );
			if ( $prefix ) {
				$equivalent = '/' . ltrim( $prefix, '/' ) . '/' . ltrim( $route, '/' );
				// Carry the other arguments over byte for byte: rules compare exactly, so parse_str() would break them.
				$query = wp_parse_url( $req_uri, PHP_URL_QUERY );
				$kept  = [];
				if ( is_string( $query ) && '' !== $query ) {
					foreach ( explode( '&', $query ) as $segment ) {
						// Empty segments are kept too — dropping `&&` would itself be a rewrite.
						$name = urldecode( explode( '=', $segment, 2 )[0] );
						if ( 'rest_route' === $name || 0 === strpos( $name, 'rest_route[' ) ) {
							continue;
						}
						$kept[] = $segment;
					}
				}
				if ( $kept ) {
					$equivalent .= '?' . implode( '&', $kept );
				}
				$uris[] = $equivalent;
			}
		}

foreach ( $uris as $uri ) {
			$hit = Utility::str_hit_array( $uri, $rules, $has_ttl );
			if ( $hit ) {
				return $hit;
			}
		}
		return false;
	}

/**
	 * Check whether a URL or current page is a REST request.
	 *
	 * @since 2.9.3
	 * @since 2.9.4 Moved here from Utility, dropped static.
	 * @param string|false $url URL to check; when false checks current request.
	 * @return bool
	 */
	public function is_rest( $url = false ) {
		// For WP 4.4.0- compatibility.
		if ( ! function_exists( 'rest_get_url_prefix' ) ) {
			return ( defined( 'REST_REQUEST' ) && REST_REQUEST );
		}

$prefix = rest_get_url_prefix();

// Case #1: After WP_REST_Request initialization.
		if ( defined( 'REST_REQUEST' ) && REST_REQUEST ) {
			return true;
		}

// Case #2: Support the rest_route query used by plain permalinks.
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Type is checked before sanitization.
		$route = isset( $_GET['rest_route'] ) ? wp_unslash( $_GET['rest_route'] ) : '';
		$route = is_string( $route ) ? sanitize_text_field( $route ) : '';

if ( false === $url && '' !== $route ) {
			return true;
		}

if ( !$url ) {
			return false;
		}

// Case #3: Match the home-based REST path, including subfolder installs.
		$rest_url    = wp_parse_url( home_url( $prefix ) );
		$current_url = wp_parse_url( $url );

if ( false !== $current_url && ! empty( $current_url['path'] ) && false !== $rest_url && ! empty( $rest_url['path'] ) ) {
			return 0 === strpos( $current_url['path'], $rest_url['path'] );
		}

return false;
	}
}