class-statifyblacklist.php

<?php
/**
 * Statify Filter: StatifyBlacklist class
 *
 * This file contains the plugin's base class.
 *
 * @package Statify_Blacklist
 * @since   1.0.0
 */

// Quit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Statify Filter.
 */
class StatifyBlacklist {

	/**
	 * Plugin major version.
	 *
	 * @since 1.4.0
	 * @var float VERSION_MAIN
	 */
	const VERSION_MAIN = 1.7;

	/**
	 * Operation mode "normal".
	 *
	 * @var integer MODE_NORMAL
	 */
	const MODE_NORMAL = 0;

	/**
	 * Operation mode "regular expression".
	 *
	 * @var integer MODE_REGEX
	 */
	const MODE_REGEX = 1;

	/**
	 * Operation mode "regular expression case insensitive".
	 *
	 * @var integer MODE_REGEX_CI
	 */
	const MODE_REGEX_CI = 2;

	/**
	 * Operation mode "keyword".
	 *
	 * @since 1.5.0
	 * @var integer MODE_KEYWORD
	 */
	const MODE_KEYWORD = 3;

	/**
	 * Plugin options.
	 *
	 * @since 1.0.0
	 * @var array $options
	 */
	public static $options;

	/**
	 * Multisite Status.
	 *
	 * @since 1.0.0
	 * @var bool $multisite
	 */
	public static $multisite;

	/**
	 * Plugin initialization.
	 *
	 * @since 1.4.2
	 *
	 * @return void
	 */
	public static function init(): void {
		// Skip on autosave.
		if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
			return;
		}

		// Get multisite status.
		self::$multisite = ( is_multisite() && array_key_exists( STATIFYBLACKLIST_BASE, (array) get_site_option( 'active_sitewide_plugins' ) ) );

		// Plugin options.
		self::update_options();

		// Add Filter to statify hook if enabled.
		if ( 0 !== self::$options['referer']['active'] ||
			0 !== self::$options['target']['active'] ||
			0 !== self::$options['ip']['active'] ||
			0 !== self::$options['ua']['active'] ) {
			add_filter( 'statify__skip_tracking', array( 'StatifyBlacklist', 'apply_blacklist_filter' ) );
		}

		// Statify uses WP AJAX as of 1.7, so we need to reach this point. But there are no further admin/cron actions.
		if ( wp_doing_ajax() ) {
			return;
		}

		// Admin only filters.
		if ( is_admin() ) {
			StatifyBlacklist_Admin::init();
		}

		// CronJob to clean up database.
		if ( wp_doing_cron() &&
			( 1 === self::$options['referer']['cron'] || 1 === self::$options['target']['cron'] ) ) {
			add_action( 'statify_cleanup', array( 'StatifyBlacklist_Admin', 'cleanup_database' ) );
		}
	}

	/**
	 * Update options.
	 *
	 * @since 1.0.0
	 * @since 1.2.1 update_options($options = null) Parameter with default value introduced.
	 *
	 * @param array|null $options Optional. New options to save.
	 *
	 * @return void
	 */
	public static function update_options( ?array $options = null ): void {
		if ( self::$multisite ) {
			$o = get_site_option( 'statify-blacklist' );
		} else {
			$o = get_option( 'statify-blacklist' );
		}
		self::$options = wp_parse_args( $o, self::default_options() );
	}

	/**
	 * Create default plugin configuration.
	 *
	 * @since 1.4.0
	 *
	 * @return array The options array.
	 */
	protected static function default_options(): array {
		return array(
			'referer' => array(
				'active'    => 0,
				'cron'      => 0,
				'regexp'    => 0,
				'blacklist' => array(),
			),
			'target'  => array(
				'active'    => 0,
				'cron'      => 0,
				'regexp'    => 0,
				'blacklist' => array(),
			),
			'ip'      => array(
				'active'    => 0,
				'blacklist' => array(),
			),
			'ua'      => array(
				'active'    => 0,
				'regexp'    => 0,
				'blacklist' => array(),
			),
			'version' => self::VERSION_MAIN,
		);
	}

	/**
	 * Apply the filter if active
	 *
	 * @since 1.0.0
	 *
	 * @return bool|null TRUE if referer matches filter.
	 */
	public static function apply_blacklist_filter(): ?bool {
		// Referer filter.
		if (
		self::apply_single_filter(
			self::$options['referer'],
			array(
				__CLASS__,
				( ! isset( self::$options['referer']['regexp'] ) || self::MODE_NORMAL === self::$options['referer']['regexp'] ) ? 'get_referer_domain' : 'get_referer',
			)
		)
		) {
			return true;
		}

		// Target filter (since 1.4.0).
		if ( self::apply_single_filter( self::$options['target'], array( __CLASS__, 'get_target' ) ) ) {
			return true;
		}

		// IP filter (since 1.4.0).
		if ( isset( self::$options['ip']['active'] ) && 0 !== self::$options['ip']['active'] ) {
			$ip = self::get_ip();
			if ( false !== ( $ip ) ) {
				foreach ( self::$options['ip']['blacklist'] as $net ) {
					if ( self::cidr_match( $ip, $net ) ) {
						return true;
					}
				}
			}
		}

		// User agent filter (since 1.6).
		if ( self::apply_single_filter( self::$options['ua'], array( __CLASS__, 'get_user_agent' ) ) ) {
			return true;
		}

		// Skip and continue (return NULL), if all filters are inactive.
		return null;
	}

	/**
	 * Apply a single filter, if active.
	 *
	 * @param array    $config   Configuration array from plugin options.
	 * @param callable $value_fn Extractor function for filterable value.
	 *
	 * @return bool TRUE if referer matches filter.
	 *
	 * @since 1.6 Extracted from "apply_blacklist_filter" to reduce redundancies.
	 */
	private static function apply_single_filter( array $config, callable $value_fn ): bool {
		// Is the filter active?
		if ( ! isset( $config['active'] ) || 0 === $config['active'] ) {
			return false;
		}

		// Extract the filterable value.
		$value = call_user_func( $value_fn );

		$mode = isset( $config['regexp'] ) ? intval( $config['regexp'] ) : self::MODE_NORMAL;

		switch ( $mode ) {
			case self::MODE_REGEX:
			case self::MODE_REGEX_CI:
				// Regular Expression filtering since 1.3.0.

				// Merge given regular expressions into one.
				$regexp = self::regex(
					array_keys( $config['blacklist'] ),
					self::MODE_REGEX_CI === $config['regexp']
				);

				// Check filter (no return to continue filtering #12).
				if ( 1 === preg_match( $regexp, $value ) ) {
					return true;
				}
				break;

			case self::MODE_KEYWORD:
				// Keyword filter since 1.5.0 (#15).
				foreach ( array_keys( $config['blacklist'] ) as $keyword ) {
					if ( false !== strpos( strtolower( $value ), strtolower( $keyword ) ) ) {
						return true;
					}
				}

				break;

			default:
				// Standard exact filter.
				if ( isset( $config['blacklist'][ $value ] ) ) {
					return true;
				}
		}

		return false;
	}

	/**
	 * Preprocess regular expression provided by the user, i.e. add delimiters and optional ci flag.
	 *
	 * @param string|array $expression       Original expression string or array of expressions.
	 * @param string|array $case_insensitive Make expression match case-insensitive.
	 *
	 * @return string Preprocessed expression ready for preg_match().
	 */
	protected static function regex( $expression, $case_insensitive ): string {
		$res = '/';
		if ( is_string( $expression ) ) {
			$res .= str_replace( '/', '\/', $expression );
		} elseif ( is_array( $expression ) ) {
			$res .= implode(
				'|',
				array_map(
					function ( $e ) {
						return str_replace( '/', '\/', $e );
					},
					$expression
				)
			);
		}
		$res .= '/';
		if ( $case_insensitive ) {
			$res .= 'i';
		}

		return $res;
	}

	/**
	 * Helper method to determine the client's referer.
	 *
	 * @return string The referer.
	 */
	private static function get_referer(): string {
		$referer = wp_get_raw_referer();
		if ( ! $referer ) {
			$referer = '';
		}

		return $referer;
	}

	/**
	 * Helper method to determine the host part of the client's referer.
	 *
	 * @return string Referer domain.
	 */
	private static function get_referer_domain(): string {
		$referer = wp_parse_url( self::get_referer() );

		return strtolower( ( isset( $referer['host'] ) ? $referer['host'] : '' ) );
	}

	/**
	 * Helper method to determine the client's referer.
	 *
	 * @return string The referer.
	 */
	private static function get_target(): string {
		if ( isset( $_SERVER['REQUEST_URI'] ) ) {
			$target = filter_var( wp_unslash( $_SERVER['REQUEST_URI'] ), FILTER_SANITIZE_URL );
			if ( $target ) {
				return $target;
			}
		}

		return '';
	}

	/**
	 * Helper method to determine the client's IP address.
	 *
	 * If a proxy is used, the X-Real-IP or X-Forwarded-For header is checked, otherwise the default remote address.
	 * For performance reasons only the most common flags are checked. This might be even reduce by user configuration.
	 * Maybe some community feedback will ease the decision on that.
	 *
	 * @return string|bool the client's IP address or FALSE, if none could be determined.
	 */
	private static function get_ip() {
		foreach (

			/*
			 * There are more fields, that could possibly be checked, but we only consider the most common for now:
			 * HTTP_CLIENT_IP, HTTP_X_REAL_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED,
			 * HTTP_X_CLUSTER_CLIENT_IP, HTTP_FORWARDED_FOR, HTTP_FORWARDED, REMOTE_ADDR
			 */
			array(
				'HTTP_X_REAL_IP',
				'HTTP_X_FORWARDED_FOR',
				'REMOTE_ADDR',
			) as $k
		) {
			if ( isset( $_SERVER[ $k ] ) ) {
				// phpcs:ignore
				foreach ( explode( ',', $_SERVER[ $k ] ) as $ip ) {
					if ( false !== filter_var( $ip, FILTER_VALIDATE_IP ) ) {
						return $ip;
					}
				}
			}
		}

		return false;
	}

	/**
	 * Helper method to determine the user agent.
	 *
	 * @return string The user agent string.
	 */
	private static function get_user_agent(): string {
		if ( ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
			$user_agent = filter_var( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) );
			if ( $user_agent ) {
				return $user_agent;
			}
		}

		return '';
	}

	/**
	 * Helper function to check if an IP address matches a given subnet.
	 *
	 * @param string $ip  IP address to check.
	 * @param string $net IP address or subnet in CIDR notation.
	 *
	 * @return bool TRUE, if the given IP addresses matches the given subnet.
	 */
	private static function cidr_match( string $ip, string $net ): bool {
		if ( substr_count( $net, ':' ) > 1 ) {  // Check for IPv6.
			if ( ! ( ( extension_loaded( 'sockets' ) && defined( 'AF_INET6' ) ) || inet_pton( '::1' ) ) ) {
				return false;
			}

			if ( false !== strpos( $net, '/' ) ) {   // Parse CIDR subnet.
				list( $base, $mask ) = explode( '/', trim( $net ), 2 );

				if ( ! is_numeric( $mask ) ) {
					return false;
				} else {
					$mask = (int) $mask;
				}

				if ( $mask < 1 || $mask > 128 ) {
					return false;
				}
			} else {
				$base = $net;
				$mask = 128;
			}

			$bytes_addr = unpack( 'n*', inet_pton( $base ) );
			$bytes_est  = unpack( 'n*', inet_pton( $ip ) );

			if ( ! $bytes_addr || ! $bytes_est ) {
				return false;
			}

			$ceil = ceil( $mask / 16 );
			for ( $i = 1; $i <= $ceil; ++$i ) {
				$left   = $mask - 16 * ( $i - 1 );
				$left   = ( $left <= 16 ) ? $left : 16;
				$mask_b = ~( 0xffff >> $left ) & 0xffff;
				if ( ( $bytes_addr[ $i ] & $mask_b ) !== ( $bytes_est[ $i ] & $mask_b ) ) {
					return false;
				}
			}

			return true;
		} else {    // Check for IPv4.
			if ( ! filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) ) {
				return false;
			}

			if ( false !== strpos( $net, '/' ) ) {  // Parse CIDR subnet.
				list( $base, $mask ) = explode( '/', $net, 2 );

				if ( '0' === $mask ) {
					return filter_var( $base, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 );
				}

				if ( $mask < 0 || $mask > 32 ) {
					return false;
				}
			} else {    // Use single address.
				$base = $net;
				$mask = 32;
			}

			return ( 0 === substr_compare( sprintf( '%032b', ip2long( $ip ) ), sprintf( '%032b', ip2long( $base ) ), 0, $mask ) );
		}
	}
}