mac-requires.php

<?php
/**
 * mac-requires.php
 *
 * This file contains the functions and constants required by mac.php.
 * It is intended to be included by mac.php, but not by any other file.
 *
 * Heavily inspired by https://gist.github.com/hakre/1552239
 */

define( 'mac\REDIRECT_NOAUTH_FALLBACK', '/index.php' );

define( 'mac\REDIRECT_404', '/404.php');

define( 'mac\CONTROLLED_SLUGS', array(
	'_auth',
	)
);

/* [DS] Plugins add their own types to the 'posts' table. Make sure we're only messing with WP's native
 * posts and pages, plus any custom post types (CPTs) created by admin users. Ignore all others.
 */
define( 'mac\CONTROLLED_PARENT_TYPES',  array(
	'page',
	'post',
	'mycpt', // User-generated CPT
	) 
);

define( 'mac\PW_SOURCES', array(
        'wp-postpass',
        'passster',  // https://wordpress.org/plugins/content-protector/
    )
);

/**
 * Use output buffering to handle bugs caused by large files and WP core.
 */
function prep_output_buffer() {

	// Handle large files without exhausting PHP memory
	if (ob_get_level()) {
    	ob_end_clean();
	}

	// Use output buffering to flush linefeeds generated by WP core includes
	// If you don't, binary files will appear corrupted to the browser
	ob_start();
	require_once('wp-load.php');
	require_once ABSPATH . WPINC . '/formatting.php';
	require_once ABSPATH . WPINC . '/capabilities.php';
	require_once ABSPATH . WPINC . '/user.php';
	require_once ABSPATH . WPINC . '/meta.php';
	require_once ABSPATH . WPINC . '/post.php';
	require_once ABSPATH . WPINC . '/pluggable.php';
	wp_cookie_constants();
	ob_get_clean();
	ob_end_flush();
}

function is_controlled_slug( string $url ): bool {
	return in_array( true, array_map(
		function( $slug ) use( &$url ) {
			return strpos( $url, $slug ) ? true : false;
		},
		mac\CONTROLLED_SLUGS,
	) );
}

function is_controlled_type( WP_Post $post ): bool {
	return in_array( get_post_type( $post ), mac\CONTROLLED_PARENT_TYPES ) ? true : false;
}

/**
 * Get several pieces of information about the file being requested.
 * Calls into WP to find post and post-meta proprerties.
 *
 * @see mac\CONTROLLED_POST_TYPES
 *
 * @param string $url Full URL to the hosted file
 * @param array $upload_dir_info Output of the wp_upload_dir function
 * @return array Associative array of properties
 */
function get_file_info( string $url, array $upload_dir_info ): array {
	$ret = array(
		'path' => '',
		'wp_attachment' => false,
		'wp_id' => attachment_url_to_postid( $url ),
	);

	// If file is in posts db, make sure it's of type attachment
	if ( $ret['wp_id'] ) {
		$file_post = get_post( $ret['wp_id'], output:OBJECT );

		if ( $file_post ) {
			$ret['wp_attachment'] = ( 'attachment' === $file_post->post_type );
		}

	}

	if ( $ret['wp_attachment'] ) {
		$ret['path'] = get_attached_file( $ret['wp_id'], unfiltered:true );
	} else {
		$ret['path'] = $upload_dir_info['basedir'] . '/' . $_GET['file'];
	}

	return $ret;
}

/**
 * Sends HTTP response header Content-Type. "Private" function, called by others.
 * NB: This should always be sent!
 *
 * @param string $file_path Path on server's filesystem to the requested file
 */
function _send_header_content_type( string $file_path ) {
	$mime = wp_check_filetype( $file_path );
	
	if ( false === $mime['type'] && function_exists( 'mime_content_type' ) ) {
		$mime['type'] = mime_content_type( $file_path );
	}
	
	$mimetype = $mime['type'] ? $mime['type'] : 'image/' . substr( $file_path, strrpos( $file_path, '.' ) + 1 );
	header( 'Content-Type: ' . $mimetype );
}

/**
 * Sends HTTP response header Content-Length. "Private" function, called by others.
 *
 * @param string $file_path Path on server's filesystem to the requested file
 */
function _send_header_content_length( string $file_path ) {
	if ( false === strpos( $_SERVER['SERVER_SOFTWARE'], 'Microsoft-IIS' ) ) {
		header( 'Content-Length: ' . filesize( $file_path ) );
	}
}

/**
 * Sends HTTP response headers for cacheable files. "Private" function, called by others.
 *
 * @param string $file_path Path on server's filesystem to the requested file
 */
function _send_headers_for_caching( string $file_path ) {
	$last_modified = gmdate( 'D, d M Y H:i:s', filemtime( $file_path ) );
	$etag = '"' . md5( $last_modified ) . '"';
	header( "Last-Modified: $last_modified GMT" );
	header( 'ETag: ' . $etag );
	header( 'Expires: ' . gmdate( 'D, d M Y H:i:s', time() + 100000000 ) . ' GMT' );

	/*
	 * Conditional GET support
	 */
	$client_etag = isset( $_SERVER['HTTP_IF_NONE_MATCH'] ) ? stripslashes( $_SERVER['HTTP_IF_NONE_MATCH'] ) : false;

	if( ! isset( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) ) {
		$_SERVER['HTTP_IF_MODIFIED_SINCE'] = false;
	}
	$client_last_modified = trim( $_SERVER['HTTP_IF_MODIFIED_SINCE'] );
	$client_modified_timestamp = $client_last_modified ? strtotime( $client_last_modified ) : 0;

	$modified_timestamp = strtotime($last_modified);

	if ( ( $client_last_modified && $client_etag )
			? ( ( $client_modified_timestamp >= $modified_timestamp) && ( $client_etag == $etag ) )
			: ( ( $client_modified_timestamp >= $modified_timestamp) || ( $client_etag == $etag ) )
			) {
			status_header( 304 );
			exit;
	}
	/* end */
}

/**
 * Sends HTTP response headers for uncacheable files. "Private" function, called by others.
 *
 * @param string $file_path Path on server's filesystem to the requested file
 */
function _send_headers_for_no_caching() {
	// [ds] I'm not using WP's nocache_headers() because it's out of date with MDN recommendations:
	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching
	header( 'Cache-Control: no-store, no-cache, max-age=0, must-revalidate, proxy-revalidate');
}

/**
 * Serves a file that is not under media access control.
 *
 * @param string $file_path Path on server's filesystem to the requested file
 */
function serve_uncontrolled_file( string $file_path ) {
	_send_header_content_type( $file_path );
	_send_header_content_length( $file_path );
	_send_headers_for_caching( $file_path );
	readfile( $file_path ); // NB: May not execute if conditional_get exits with status 304
	exit;
}

/**
 * Serves a file under media access control. Takes measures to prevent caching.
 *
 * @param string $file_path Path on server's filesystem to the requested file
 */
function serve_controlled_file( string $file_path ) {
	_send_header_content_type( $file_path );
	_send_header_content_length( $file_path );
	_send_headers_for_no_caching();
	readfile( $file_path );
	exit;
}

function deny( string $redirect_target, string $file_url ) {
	error_log( 'mac.php: 401 Unauthorized request for controlled attachment ' . $file_url );
	// Send them to the parent post so they can enter the password
	// ...or if there is no parent, to the fallback URL
	wp_redirect( $redirect_target ? $redirect_target : mac\REDIRECT_NOAUTH_FALLBACK );
	exit;
}

function isset_password_cookie(): bool {
	$ret = false;
	foreach ( mac\PW_SOURCES as $method ) {	
				
		switch ( $method ) {
			case 'wp-postpass':
				$ret = $ret || isset( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] ) ? true : false;
				break;
			case 'passster':
				$ret = $ret || isset( $_COOKIE['passster'] ) ? true : false;
				break;
			default:
				error_log("mac.php: 500 No logic for handling DEFINED password method '" . $method . "'");
				status_header( 500 );
				die;
			}
	}
	return $ret;
}

function eval_password_control( WP_Post $parent_post ): string {
	$ret = 'normal'; // Default behavior

	// Check for a password using declared methods.
	$found = false;
	foreach ( mac\PW_SOURCES as $method ) {

		switch ( $method ) {
			case 'wp-postpass':

				if ( ! empty( $parent_post->post_password ) ) {
					$found = true;

					if ( ! post_password_required( $parent_post ) ) {
						$ret = 'control';
					} else {
						$ret = 'deny';
					}

				} else {
					$ret = 'normal';
				}

				break;
			case 'passster':
				
				if ( isset( $_COOKIE['passster'] ) ) {
					$found = true;
					$atts = array( 'password' => 'original-password' );
		
					if ( passster\PS_Conditional::is_valid_password( $_COOKIE['passster'], $atts ) ) {
						$ret = 'control';
					} else {
						$ret = 'deny';
					}
		
				} else {
					$ret = 'normal';
				}

				break;
			default:
                error_log("mac.php: 500 No logic for handling DEFINED password method '" . $method . "'");
				status_header( 500 );
				die;
		}

		if ( $found ) {
			break;
		}
	}

	return $ret;
}