Changeset 2125581

Timestamp:

07/19/2019 04:29:19 AM (7 years ago)

Author:

drew010

Message:

Test up to Wordpress 5.2.3
Add backup update URL
Fix issue with Ajax list update for when wp-cron is broken; may have used URL with WP_Http that resulted in a redirect and was not followed

Location:

vigilantor/trunk

Files:

• readme.txt (modified) (1 diff)
• vigilantor.php (modified) (10 diffs)

vigilantor/trunk/readme.txt

@@ -4 +4 @@
 Tags: tor, tor blocker, comments, spam, proxy, security, block, registration, captcha
 Requires at least: 4.0
-Tested up to: 5.0.1
-Stable tag: 1.3.3
+Tested up to: 5.2.3
+Stable tag: 1.3.4
 License: GPLv3
 License URI: http://www.gnu.org/licenses/gpl.txt

vigilantor/trunk/vigilantor.php

@@ -4 +4 @@
 Plugin URI: https://drew-phillips.com/
 Description: Provides protections from Tor users visiting your site
-Version: 1.3.3
+Version: 1.3.4
 Author: Drew Phillips
 Author URI: https://drew-phillips.com
@@ -10 +10 @@
 */
 
-/*  Copyright (C) 2018 Drew Phillips
+/*  Copyright (C) 2019 Drew Phillips
 
 This program is free software; you can redistribute it and/or modify
@@ -27 +27 @@
 */
 
-defined('VIGILANTOR_VERSION') || define('VIGILANTOR_VERSION', '1.3.3');
+defined('VIGILANTOR_VERSION') || define('VIGILANTOR_VERSION', '1.3.4');
 
 if (class_exists('VigilanTorWP')) {
@@ -55 +55 @@
     private static $_instance = null;
 
-    const EXIT_LIST_UPDATE_URL = '//openinternet.io/tor/tor-ip-list.txt';
+    const EXIT_LIST_UPDATE_URLS = [
+        //'//www2.openinternet.io/tor/tor-ip-list.txt',
+        //'//openinternet.io/tor/tor-ip-list.txt',
+    ];
 
     private function __construct()
@@ -229 +232 @@
             );
         } else {
-            header('HTTP/1.1 403 Forbidden');
+            header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
 
             // some themes reference $id in page templates
@@ -391 +394 @@
                 // this prevents the update from slowing down the page load for the visitor
                 // if wp-cron is working properly, the update will never need to be forced like this
-                add_action('wp_footer', array(&$this, 'enqueueUpdateScript'));
+                if (mt_rand(0, 100000) % 10 == 0) {
+                    // ~ 10% chance to enqueue the update script
+                    add_action('wp_footer', array(&$this, 'enqueueUpdateScript'));
+                }
             }
         }
@@ -617 +623 @@
     public function enqueueUpdateScript()
     {
-        $url = addslashes(get_site_url() . '?_vitor_action=update');
+        $url = addslashes(get_site_url(null, '?_vitor_action=update'));
         echo "<script type='text/javascript'>jQuery.ajax({ url: '{$url}' });</script>\n";
     }
@@ -843 +849 @@
         }
 
-        $url = ($use_ssl ? 'https:' : 'http:') . self::EXIT_LIST_UPDATE_URL;
-
         add_filter('http_headers_useragent', array(&$this, 'filterUserAgent'), 99, 1);
 
-        $try     = true;
         $success = false;
+        $i       = 0;
 
         do {
-            $req = new WP_Http();
+            $req = new WP_Http(); // NB: default timeout is 5 seconds
+            $url = ($use_ssl ? 'https:' : 'http:') . self::EXIT_LIST_UPDATE_URLS[$i];
             $res = $req->request($url, array('httpversion' => '1.1'));
 
-            if (is_wp_error($res)) {
-                if ($use_ssl) {
-                    $use_ssl = false;
-                    $url = 'http:' . self::EXIT_LIST_UPDATE_URL;
-                    continue; // try again with http
-                }
-                $try = false;
-            } else {
+            if (!is_wp_error($res)) {
                 $res     = $res['body'];
-                $try     = false;
                 $success = true;
-            }
-        } while($try);
+                break;
+            }
+        } while(++$i < sizeof(self::EXIT_LIST_UPDATE_URLS));
 
         if (!$success && is_wp_error($res)) {
@@ -880 +878 @@
     private function getClientIpAddress()
     {
-        // TODO: look for IP in other headers (e.g. X-Forwarded-For, X-Proxy-IP)
+        // TODO: look for IP in other headers (e.g. X-Forwarded-For, X-Proxy-IP), but only if trusted
         return $_SERVER['REMOTE_ADDR'];
     }
@@ -932 +930 @@
 
                 // check that a captcha id was submitted with the form
-                if (!empty($_POST['siwp_captcha_id'])) {
-                    $captchaId = trim(stripslashes($_POST['siwp_captcha_id']));
+                if (!empty($_POST['scid'])) {
+                    $captchaId = trim(stripslashes($_POST['scid']));
                     $code      = trim(stripslashes($_POST['siwp_captcha_value']));