class-wc-https.php 4.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138
  1. <?php
  2. if ( ! defined( 'ABSPATH' ) ) {
  3. exit; // Exit if accessed directly
  4. }
  5. /**
  6. * WC_HTTPS class.
  7. *
  8. * @class WC_HTTPS
  9. * @version 2.2.0
  10. * @package WooCommerce/Classes
  11. * @category Class
  12. * @author WooThemes
  13. */
  14. class WC_HTTPS {
  15. /**
  16. * Hook in our HTTPS functions if we're on the frontend. This will ensure any links output to a page (when viewing via HTTPS) are also served over HTTPS.
  17. */
  18. public static function init() {
  19. if ( 'yes' === get_option( 'woocommerce_force_ssl_checkout' ) && ! is_admin() ) {
  20. // HTTPS urls with SSL on
  21. $filters = array(
  22. 'post_thumbnail_html',
  23. 'wp_get_attachment_image_attributes',
  24. 'wp_get_attachment_url',
  25. 'option_stylesheet_url',
  26. 'option_template_url',
  27. 'script_loader_src',
  28. 'style_loader_src',
  29. 'template_directory_uri',
  30. 'stylesheet_directory_uri',
  31. 'site_url',
  32. );
  33. foreach ( $filters as $filter ) {
  34. add_filter( $filter, array( __CLASS__, 'force_https_url' ), 999 );
  35. }
  36. add_filter( 'page_link', array( __CLASS__, 'force_https_page_link' ), 10, 2 );
  37. add_action( 'template_redirect', array( __CLASS__, 'force_https_template_redirect' ) );
  38. if ( 'yes' == get_option( 'woocommerce_unforce_ssl_checkout' ) ) {
  39. add_action( 'template_redirect', array( __CLASS__, 'unforce_https_template_redirect' ) );
  40. }
  41. }
  42. add_action( 'http_api_curl', array( __CLASS__, 'http_api_curl' ), 10, 3 );
  43. }
  44. /**
  45. * Force https for urls.
  46. *
  47. * @param mixed $content
  48. * @return string
  49. */
  50. public static function force_https_url( $content ) {
  51. if ( is_ssl() ) {
  52. if ( is_array( $content ) ) {
  53. $content = array_map( 'WC_HTTPS::force_https_url', $content );
  54. } else {
  55. $content = str_replace( 'http:', 'https:', $content );
  56. }
  57. }
  58. return $content;
  59. }
  60. /**
  61. * Force a post link to be SSL if needed.
  62. *
  63. * @param string $link
  64. * @param int $page_id
  65. *
  66. * @return string
  67. */
  68. public static function force_https_page_link( $link, $page_id ) {
  69. if ( in_array( $page_id, array( get_option( 'woocommerce_checkout_page_id' ), get_option( 'woocommerce_myaccount_page_id' ) ) ) ) {
  70. $link = str_replace( 'http:', 'https:', $link );
  71. } elseif ( 'yes' === get_option( 'woocommerce_unforce_ssl_checkout' ) && ! wc_site_is_https() ) {
  72. $link = str_replace( 'https:', 'http:', $link );
  73. }
  74. return $link;
  75. }
  76. /**
  77. * Template redirect - if we end up on a page ensure it has the correct http/https url.
  78. */
  79. public static function force_https_template_redirect() {
  80. if ( ! is_ssl() && ( is_checkout() || is_account_page() || apply_filters( 'woocommerce_force_ssl_checkout', false ) ) ) {
  81. if ( 0 === strpos( $_SERVER['REQUEST_URI'], 'http' ) ) {
  82. wp_safe_redirect( preg_replace( '|^http://|', 'https://', $_SERVER['REQUEST_URI'] ) );
  83. exit;
  84. } else {
  85. wp_safe_redirect( 'https://' . ( ! empty( $_SERVER['HTTP_X_FORWARDED_HOST'] ) ? $_SERVER['HTTP_X_FORWARDED_HOST'] : $_SERVER['HTTP_HOST'] ) . $_SERVER['REQUEST_URI'] );
  86. exit;
  87. }
  88. }
  89. }
  90. /**
  91. * Template redirect - if we end up on a page ensure it has the correct http/https url.
  92. */
  93. public static function unforce_https_template_redirect() {
  94. if ( function_exists( 'is_customize_preview' ) && is_customize_preview() ) {
  95. return;
  96. }
  97. if ( ! wc_site_is_https() && is_ssl() && $_SERVER['REQUEST_URI'] && ! is_checkout() && ! is_ajax() && ! is_account_page() && apply_filters( 'woocommerce_unforce_ssl_checkout', true ) ) {
  98. if ( 0 === strpos( $_SERVER['REQUEST_URI'], 'http' ) ) {
  99. wp_safe_redirect( preg_replace( '|^https://|', 'http://', $_SERVER['REQUEST_URI'] ) );
  100. exit;
  101. } else {
  102. wp_safe_redirect( 'http://' . ( ! empty( $_SERVER['HTTP_X_FORWARDED_HOST'] ) ? $_SERVER['HTTP_X_FORWARDED_HOST'] : $_SERVER['HTTP_HOST'] ) . $_SERVER['REQUEST_URI'] );
  103. exit;
  104. }
  105. }
  106. }
  107. /**
  108. * Force posts to PayPal to use TLS v1.2. See:
  109. * https://core.trac.wordpress.org/ticket/36320
  110. * https://core.trac.wordpress.org/ticket/34924#comment:13
  111. * https://www.paypal-knowledge.com/infocenter/index?page=content&widgetview=true&id=FAQ1914&viewlocale=en_US
  112. *
  113. * @param string $handle
  114. * @param mixed $r
  115. * @param string $url
  116. */
  117. public static function http_api_curl( $handle, $r, $url ) {
  118. if ( strstr( $url, 'https://' ) && ( strstr( $url, '.paypal.com/nvp' ) || strstr( $url, '.paypal.com/cgi-bin/webscr' ) ) ) {
  119. curl_setopt( $handle, CURLOPT_SSLVERSION, 6 );
  120. }
  121. }
  122. }
  123. WC_HTTPS::init();