�PNG  IHDR22?�� pHYs  �� OiCCPPhotoshop ICC profilexڝSgTS�=���BK���KoR RB���&*! J�!��Q�EEȠ�����Q, � ��!���������{�kּ������>���� �H3Q5� �B�������.@� $p�d!s�#�~<<+"��x� �M��0���B�\���t�8K�@z�B�@F���&S�`�cb�P-`'������{[�!�� e�Dh;��V�EX0fK�9�-0IWfH���� � 0Q��){`�##x��F�W<�+��*x��<�$9E�[-qWW.(�I+6aa�@.�y�2�4���������x����6��_-��"bb���ϫp@�t~��,/��;�m��%�h^ �u��f�@����W�p�~<�5�j>{�-�]c�K'Xt����o��(�h���w��?�G�%�fI�q^D$.Tʳ?�D��*�A��,���� �`6�B$��BB d�r`)��B(�Ͱ*`/�@4�Qh��p.�U�=p�a��(�� A�a!ڈb�X#����!�H�$ ɈQ"K�5H1R�T UH�=r9�\F��;�2����G1���Q=� �C��7�F� �dt1�����r�=�6��Ыhڏ>C�0��3�l0.��B�8, �c˱"� ���V����cϱw�E� 6wB aAHXLXN�H� $4� 7 �Q�'"��K�&���b21�XH,#��/{�C�7$�C2'��I��T��F�nR#�,��4H#���dk�9�, +ȅ����3��!�[ �b@q��S�(R�jJ��4�e�2AU��Rݨ�T5�ZB���R�Q��4u�9̓IK�����hh�i��t�ݕN��W���G���w ��Ljg(�gw��L�Ӌ�T071���oUX*�*|�� �J�&�*/T����ު U�U�T��^S}�FU3S� Ԗ�U��P�SSg�;���g�oT?�~Y��Y�L�OC�Q��_�� c�x,!k ��u�5�&���|v*�����=���9C3J3W�R�f?�q��tN �(���~���)�)�4L�1e\k����X�H�Q�G�6������E�Y��A�J'\'Gg����S�Sݧ �M=:��.�k���Dw�n��^��Lo��y���}/�T�m���G X� $� �<�5qo</���QC]�@C�a�a�ᄑ��<��F�F�i�\�$�m�mƣ&&!&KM�M�RM��)�;L;L���͢�֙5�=1�2��כ߷`ZxZ,����eI��Z�Yn�Z9Y�XUZ]�F���%ֻ�����N�N���gð�ɶ�����ۮ�m�}agbg�Ů��}�}��= ���Z~s�r:V:ޚΜ�?}����/gX���3��)�i�S��Ggg�s�󈋉K��.�>.���Ƚ�Jt�q]�z���������ۯ�6�i�ܟ�4�)�Y3s���C�Q��? ��0k߬~OCO�g��#/c/�W�װ��w��a�>�>r��>�<7�2�Y_�7��ȷ�O�o�_��C#�d�z����%g��A�[��z|!��?:�e����A���AA�������!h�쐭!��Α�i�P~���a�a��~ '���W�?�p�X�1�5w��Cs�D�D�Dޛg1O9�-J5*>�.j<�7�4�?�.fY��X�XIlK9.*�6nl������� �{�/�]py�����.,:�@L�N8��A*��%�w%� y��g"/�6ш�C\*N�H*Mz�쑼5y$�3�,幄'���L Lݛ:��v m2=:�1����qB�!M��g�g�fvˬe����n��/��k���Y- �B��TZ(�*�geWf�͉�9���+��̳�ې7�����ᒶ��KW-X潬j9�������(�x��oʿ�ܔ���Ĺd�f�f���-�[����n �ڴ �V����E�/��(ۻ��C���<��e����;?T�T�T�T6��ݵa��n��{��4���[���>ɾ�UUM�f�e�I���?�������m]�Nmq����#�׹���=TR��+�G�����w- 6 U����#pDy��� �� :�v�{���vg/jB��F�S��[b[�O�>����z�G��499�?r����C�d�&����ˮ/~�����јѡ�򗓿m|������������x31^�V���w�w��O�| (�h���SЧ��������c3-� cHRMz%������u0�`:�o�_�F5IDATx��ytUս�?�;���fN$$��@B�!�k��� -*�gE���j�O�kQ�ʠ`U�B_ �AÐ0%�Ȕ�@r3ޛ;߳��$�@��v����^�s����������$��ߢ !�W��5�̱'-٘������4�>�Rƫ$�G��0U�H}�_ _� #��k�MJ/=�9Du *ڲ�k�PQ;0��j|�*�$�^컂脛y���>�z×� B��� ��(�:$�ʔ_�6��C!B����MVx��a��ζyY����j��ƋY2�9�F�{r��r�딟F��Q��hY6��� x��[l��RC��������nt@��;P��3��� F�w��7��:�P���ɋ'���mj���Bƪ�$�Q�L��y��߷g��\���z����v5�p�v$�v櫻�`6~K �Y�X����,�:��"�o�e0II"(��,������l_�C���/4�+f�E�!q��:����u����c��樼.UE�@� �]K�W���$-�h]�JG���Dz)�`��.�A/ ���mᏣc�3jK� �!�>���$�Q�!�_�? \�C2(E �M$Z I{�U���s�ǣ���=��@Բe ޻��W�����@ �w����}�9v,)��.}*|"�s��di���,���G�]W�AC�������|<����[��ߕ������K�*�G nߴ!��‹��J�!��6(L�a)��Am��������;adf��:�xm��nh�;֦I��(���o�C~ډa?�=��s����h��E������xp����)���_���t��W�����´;8���`dz=(��@@�+,�;�`�fhl��XȌ�3,uI�~z(J����� �ZX�A����H'�À�㜦�82|��a�n�z2��I���� ���EY�h�ε<�0�q�{��C��v�˅��?"@��χ�x�WS+��N�~�KQ�J�8ل�� _.W��� !TU{�����,��"�� �;�������HI S� ��))�o�1�H�D� ���� (� ;����"Ҕ��,���� �F=���O��&�Ph>�`���y��߲ &S��P�<��'��1s�1cĂ�N����2)����@�u��tv��<�+�-&�����h��[!FSG���' � z z0��<����8d&�����E0�,��<��"!P�b4��� �{S�����X����.�囤���T��hEF��X�q0"-<����h���]�Py*����F⩍��@v�˂�Y08�� .q��a��s����(!<̫1�3�L�H��7sYW�`��qtu�\7��?�@�Y�� %Ka�x�GZ�*W�P��y�����N0r9��Z�c�%���q,��k�����!!,��>���IB��� �x1�Xu�Y���v-���ֺ��N������JP��a�2`�e5��w��u;�6�i���̃��(K���ťa��(l51��JL��O'%���]���ٖ뿉!��{*�p+f ���i8��D�ȑ���ܩ�M��V��ӟz��x�7Z�1i}�^͜���6e����x��)u�d�ˏ�V�eG�\�X1�����=n�U'�~Y����L�\,�(d!x ,�:�TW8� M`r���@��r+v�Q0��>^;˴�VbF��('����� �*O��i��j�Ӆ����^�S3&� ���{������.ی�� N;��NU%d0�Ce\r"�C�b��&t7N�7��� �ȪD�[%l�۪�$��'m?�A9tI�9>��NVL ��� 6v~M�����ъ�B���0����9$&=ώm��W�0���L���&��E���f�f��'+�9��hv��7,���M��6�D�&�^� �����8 D֮�����o��k^z��O��hP�8q�5d*��YVq3�{��������#LX4�?��jP=3�~�؅c�ݰ�̱�ұ��8̲��2�G�����j��έ�9��w7���U�X�w�85C��?!I&���o&����L���I#�^�eV�,�^t5�k� �xs˛\��U�8��."���{���ǵ�l4��ݼ�;��r"���G�/~���gJV�N糦��ZZ^k+NN�D��I$�=OE�z����|*�*{��%k���G��>�`9��b;�s���8,�qs��c��.b��q�%�>r��n�R�Ƨ�%�,�A��le#�8���}; 21�0�b�&�QX�f���q�00����$>�h�N�'�a3��A���/�r ��L5�8�GԲ'�����w;��c#�q1���h$*��V^�k��QĽ�b:i������� ����H F#�_���,��]g����Ը����`RUU���� ��"�qD���>-��ϤI�~��3�̴�����NZ[[555�eeek7�m����YF#[��Đ��R��i��L�H�r ��@��J-�Pŝ��_|�-��6y��ks�V�U~��6���w.����(��0A� 4��f��� /���C�xŊ�ٳ����z=6�����rg���mKo��o�/����a�g���?'9%9��P��斓��~���L{�� �H��{AW��B��$����v�1b�&Mb�ر��ر#�0`�`xMBp! )Z�Nmo�mZ�g�}�eذaWTVV ���'99��C5��&�&+5�bT>|8��PUUETT����&���t��~TE%��'������b�tEGG;RSS�S�N�v��ѯ��t����u1@�ޚ"f��͈���r'L�Ph��m��ƌ�74o��`�x�q�P���NRSS�X,�����l&&&��MFFA!-��`��ҷ�n��Yuu�����x<I�LB%����KԒ50�!�3�bz�����ʸKL���;---�l6[��`��������Ȏ;�����egg4��!D�T��jWujyZ��������K����%����p�^���X,6��sV=�ܖ����6�3�X ���4ҿ��A2�&����_k�;d�� �VfOIEND�B`� 0x0x
0x0x
PHP 8.1.34
Preview: ConditionEvaluator.php Size: 22.33 KB
/home2/astrociv/public_html/avitours.in/wp-content/plugins/imunify-security/inc/App/Defender/ConditionEvaluator.php
<?php
/**
 * Copyright (с) Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2025 All Rights Reserved
 *
 * Licensed under CLOUD LINUX LICENSE AGREEMENT
 * https://www.cloudlinux.com/legal/
 */

namespace CloudLinux\Imunify\App\Defender;

use CloudLinux\Imunify\App\Defender\Model\Condition;
use CloudLinux\Imunify\App\Defender\Model\ConditionSource;
use CloudLinux\Imunify\App\Defender\Model\ConditionType;

/**
 * Condition evaluator class.
 *
 * Coordinates value resolution and matching for security rule conditions.
 *
 * @since 2.1.0
 */
class ConditionEvaluator {

	/**
	 * Value resolver instance.
	 *
	 * @var ValueResolver
	 */
	private $valueResolver;

	/**
	 * Condition matcher instance.
	 *
	 * @var ConditionMatcher
	 */
	private $matcher;

	/**
	 * The last failed condition during evaluation.
	 *
	 * @var Condition
	 */
	private $failedCondition = null;

	/**
	 * Constructor.
	 *
	 * @param ValueResolver|null    $valueResolver Optional value resolver (created internally if null).
	 * @param ConditionMatcher|null $matcher       Optional condition matcher (created internally if null).
	 */
	public function __construct( $valueResolver = null, $matcher = null ) {
		$this->valueResolver = $valueResolver ? $valueResolver : new ValueResolver();
		$this->matcher       = $matcher ? $matcher : new ConditionMatcher();
	}

	/**
	 * Evaluate a list of conditions.
	 *
	 * @param Condition[] $conditions Array of Condition objects.
	 * @param Request     $request    Request object.
	 *
	 * @return bool True if all conditions are met, false otherwise.
	 */
	public function evaluateConditions( $conditions, $request ) {
		if ( empty( $conditions ) ) {
			return true;
		}

		foreach ( $conditions as $condition ) {
			if ( ! $this->evaluateCondition( $condition, $request ) ) {
				$this->failedCondition = $condition;
				return false;
			}
		}

		return true;
	}

	/**
	 * Evaluate a single condition.
	 *
	 * @param Condition $condition The condition to evaluate.
	 * @param Request   $request   Request object.
	 *
	 * @return bool True if condition is met, false otherwise.
	 */
	private function evaluateCondition( $condition, $request ) {
		if ( ! $condition->isValidType() ) {
			return false;
		}

		switch ( $condition->getType() ) {
			case ConditionType::EXISTS:
				return $this->evaluateFieldExists( $condition, $request );
			case ConditionType::NOT_EXISTS:
				return $this->evaluateFieldNotExists( $condition, $request );
			case ConditionType::MISSING_CAPABILITY:
				return $this->evaluateMissingCapability( $condition, $request );
			case ConditionType::NOT_CURRENT_USER:
				return $this->evaluateNotCurrentUser( $condition, $request );
			case ConditionType::PROBABILISTIC:
				return $this->evaluateProbabilistic( $condition );
			default:
				return $this->evaluateWithMatcher( $condition, $request );
		}
	}

	/**
	 * Resolve values and test them against the appropriate matcher.
	 *
	 * @param Condition $condition The condition to evaluate.
	 * @param Request   $request   Request object.
	 *
	 * @return bool True if any resolved value satisfies the matcher.
	 */
	private function evaluateWithMatcher( $condition, $request ) {
		if ( ! $condition->hasRequiredFields() ) {
			return false;
		}

		$type = $condition->getType();

		if ( in_array( $type, array( ConditionType::EQUALS, ConditionType::CONTAINS, ConditionType::REGEX ), true )
			&& null === $condition->getValue()
		) {
			return false;
		}

		$values  = $this->valueResolver->resolveValues( $condition, $request );
		$matcher = $this->getMatcherCallback( $condition );

		if ( null === $matcher ) {
			return false;
		}

		if ( empty( $values ) && $condition->matchesAbsent() && self::absenceMatchesEmptyValue( $condition ) ) {
			$values = array( '' );
		}

		foreach ( $values as $value ) {
			if ( call_user_func( $matcher, $value ) ) {
				return true;
			}
		}

		return false;
	}

	/**
	 * Build a matcher callback for the given condition type.
	 *
	 * @param Condition $condition The condition.
	 *
	 * @return callable|null A callable accepting a single value, or null for unknown types.
	 */
	private function getMatcherCallback( $condition ) {
		$matcher = $this->matcher;

		switch ( $condition->getType() ) {
			case ConditionType::EQUALS:
				$expected = $condition->getValue();
				return function ( $value ) use ( $matcher, $expected ) {
					return $matcher->matchEquals( $value, $expected );
				};
			case ConditionType::CONTAINS:
				$needle = $condition->getValue();
				return function ( $value ) use ( $matcher, $needle ) {
					return $matcher->matchContains( $value, $needle );
				};
			case ConditionType::REGEX:
				$pattern = $condition->getValue();
				return function ( $value ) use ( $matcher, $pattern ) {
					return $matcher->matchRegex( $value, $pattern );
				};
			case ConditionType::DETECT_XSS:
				return array( $matcher, 'matchXSS' );
			case ConditionType::DETECT_SQLI:
				return array( $matcher, 'matchSQLi' );
			default:
				return null;
		}
	}

	/**
	 * Check whether a condition's absent field may be matched as an empty value.
	 *
	 * Limited to a single named header or cookie: those are the only fields
	 * whose absence is equivalent to an empty value for the WordPress backend
	 * that reads them. A regex or bracket-path name has no single field that
	 * could be absent, and the other sources carry their own absence semantics.
	 *
	 * @since 4.1.0
	 *
	 * @param Condition $condition The condition object.
	 *
	 * @return bool True if an absent field resolves to an empty value.
	 */
	private static function absenceMatchesEmptyValue( Condition $condition ) {
		$parsed = $condition->parseName();

		$sources = array( ConditionSource::REQUEST_HEADERS, ConditionSource::REQUEST_COOKIES );
		if ( ! in_array( $parsed['source'], $sources, true ) ) {
			return false;
		}

		return null !== $parsed['field']
			&& null === $parsed['field_regex']
			&& null === $parsed['bracket_path'];
	}

	/**
	 * Evaluate exists condition.
	 *
	 * @param Condition $condition The condition object.
	 * @param Request   $request   Request object.
	 *
	 * @return bool True if field exists, false otherwise.
	 */
	private function evaluateFieldExists( $condition, $request ) {
		if ( ! $condition->hasRequiredFields() ) {
			return false;
		}

		$parsed = $condition->parseName();
		$source = $parsed['source'];
		$field  = $parsed['field'];

		if ( null !== $parsed['field_regex'] ) {
			$values = $this->valueResolver->resolveValues( $condition, $request );
			return ! empty( $values );
		}

		if ( null !== $parsed['bracket_path'] && $this->bracketPathHasRegex( $parsed['bracket_path'] ) ) {
			$values = $this->valueResolver->resolveValues( $condition, $request );
			return ! empty( $values );
		}

		switch ( $source ) {
			case ConditionSource::ARGS:
				if ( null === $field ) {
					return ! empty( $request->getAllArgs() );
				}
				if ( null !== $parsed['bracket_path'] ) {
					$value = $request->resolveNestedGet( $field, $parsed['bracket_path'] );
					if ( null === $value ) {
						$value = $request->resolveNestedPost( $field, $parsed['bracket_path'] );
					}
					if ( null !== $value ) {
						return true;
					}
					return $request->hasGet( $parsed['raw_field'] ) || $request->hasPost( $parsed['raw_field'] );
				}
				return $request->hasGet( $field ) || $request->hasPost( $field );
			case ConditionSource::FILES:
				if ( null === $field ) {
					return false;
				}
				if ( ValueResolver::hasIndexedBracketPath( $parsed ) ) {
					// FILES cannot navigate into a sub-value, so an indexed path
					// names nothing. Fail closed here too, so exists agrees with
					// the matcher and with not_exists rather than answering for
					// the whole field the author did not ask about.
					return false;
				}
				// Scan-all (FILES::name): exists if ANY upload has that sub-value.
				if ( ValueResolver::isFilesScanAll( $parsed ) ) {
					foreach ( $this->valueResolver->resolveValues( $condition, $request ) as $candidate ) {
						if ( $this->subValueIsPresent( $candidate ) ) {
							return true;
						}
					}
					return false;
				}
				$filesParsed = ValueResolver::parseFilesField( $field );
				if ( null === $filesParsed['sub'] ) {
					return $request->hasFile( $filesParsed['field'] );
				}
				$subValue = ValueResolver::getFilesSubValue( $request, $filesParsed['field'], $filesParsed['sub'] );
				return $this->subValueIsPresent( $subValue );
			case ConditionSource::REQUEST_COOKIES:
				if ( null === $field ) {
					return ! empty( $request->getAllCookies() );
				}
				return $request->hasCookie( $field );
			case ConditionSource::REQUEST_HEADERS:
				if ( null === $field ) {
					return ! empty( $request->getAllHeaders() );
				}
				return $request->hasHeader( $field );
			case ConditionSource::REST_ROUTE:
				return null !== $this->valueResolver->getFieldValue( $request, $parsed );
			case ConditionSource::REQUEST_URI:
				return ! empty( $request->getUri() );
			case ConditionSource::ARGS_NAMES:
				// Mirror getArgNames() (not hasAnyArgs()) so &ARGS_NAMES existence
				// agrees with the values: the hidden RAW_BODY_KEY sentinel must not
				// count as a name.
				return ! empty( $request->getArgNames() );
			default:
				return false;
		}
	}

	/**
	 * Check whether a $_FILES sub-value carries anything a rule could match.
	 *
	 * Shared by the scan-all and named-field branches of evaluateFieldExists()
	 * so the two cannot drift, the way uploadEntryIsAbsent() already does for
	 * the absence side.
	 *
	 * A multi-file input mirrors its shape into every $_FILES sub-key, so the
	 * sub-value is an array even when the user picked no file — and an array is
	 * never ''. Testing it directly reported existence for an untouched file
	 * input, which is exactly the case not_exists calls absent, leaving exists
	 * and not_exists both true for one request. Leaf-extracting first restores
	 * the documented "true when at least one upload has a non-empty sub-value".
	 *
	 * @since 4.1.1
	 *
	 * @param mixed $value A resolved $_FILES sub-value.
	 *
	 * @return bool True if the value holds a non-empty string.
	 */
	private function subValueIsPresent( $value ) {
		if ( is_array( $value ) ) {
			foreach ( ValueResolver::flattenFilesValue( $value ) as $leaf ) {
				if ( '' !== $leaf ) {
					return true;
				}
			}
			return false;
		}

		return null !== $value && '' !== $value;
	}

	/**
	 * Evaluate not_exists condition.
	 *
	 * Only negates an existence check that the request can actually decide;
	 * every other shape returns false. Negating an existence check that is
	 * false for every request would turn the rule into a match-everything
	 * rule.
	 *
	 * FILES is decided by presence instead, because evaluateFieldExists()
	 * reads the sub-value: negating it would report a sent upload with an
	 * empty name, type or body as absent. exists() keeps its value-based
	 * behaviour, so for a present-but-empty sub-value both checks are false.
	 *
	 * @since 4.1.0
	 *
	 * @param Condition $condition The condition object.
	 * @param Request   $request   Request object.
	 *
	 * @return bool True if the field is absent from the request.
	 */
	private function evaluateFieldNotExists( Condition $condition, Request $request ) {
		if ( ! $condition->hasRequiredFields() ) {
			return false;
		}

		$parsed = $condition->parseName();
		if ( ! $this->existenceDependsOnRequest( $parsed ) ) {
			return false;
		}

		if ( ConditionSource::FILES === $parsed['source'] ) {
			return $this->fileFieldIsAbsent( $request, $parsed );
		}

		return ! $this->evaluateFieldExists( $condition, $request );
	}

	/**
	 * Check whether a request carries no upload for a FILES field.
	 *
	 * A UPLOAD_ERR_NO_FILE entry counts as absent: the browser sent the part
	 * for a file input the user left empty, which is what a rule author means
	 * by "no file was uploaded". Every other error, including a rejected or
	 * truncated upload, is a present upload. A multi-file field carries one
	 * code per part, nested for a nested input name, and is absent only when
	 * every part is UPLOAD_ERR_NO_FILE, so an empty multiple-file input reads
	 * the same as an empty single one.
	 *
	 * @since 4.1.0
	 *
	 * @param Request $request Request object.
	 * @param array   $parsed  Parsed condition name.
	 *
	 * @return bool True if the request carries no upload for the field.
	 */
	private function fileFieldIsAbsent( Request $request, array $parsed ) {
		// Scan-all (FILES::name) names no single field, so absence is decided
		// across every upload: the request is absent only when it carries no
		// upload at all. Reading $_FILES[''] here instead would report absence
		// for every request, including ones carrying uploads under ordinary
		// field names.
		if ( ValueResolver::isFilesScanAll( $parsed ) ) {
			foreach ( $request->getAllFiles() as $file ) {
				if ( ! $this->uploadEntryIsAbsent( $file ) ) {
					return false;
				}
			}
			return true;
		}

		$filesParsed = ValueResolver::parseFilesField( $parsed['field'] );

		$file = $request->getFile( $filesParsed['field'] );

		if ( null === $file ) {
			return true;
		}

		return $this->uploadEntryIsAbsent( $file );
	}

	/**
	 * Check whether one $_FILES entry represents no uploaded file.
	 *
	 * Shared by the named-field and scan-all paths of fileFieldIsAbsent() so
	 * both read UPLOAD_ERR_NO_FILE the same way.
	 *
	 * @since 4.1.1
	 *
	 * @param mixed $file One $_FILES entry.
	 *
	 * @return bool True if the entry carries no upload.
	 */
	private function uploadEntryIsAbsent( $file ) {
		if ( ! is_array( $file ) || ! isset( $file['error'] ) ) {
			// No error code to read: the entry itself is the presence signal.
			return false;
		}

		if ( isset( $file['name'] ) && $this->subValueIsPresent( $file['name'] ) ) {
			// error is not authoritative on a $_FILES a plugin rewrote: it may be
			// an empty list, or a scalar NO_FILE beside a per-part name array. A
			// name a matcher can still read means the entry is present.
			return false;
		}

		if ( is_array( $file['error'] ) ) {
			return $this->everyPartIsEmpty( $file['error'] );
		}

		return UPLOAD_ERR_NO_FILE === (int) $file['error'];
	}

	/**
	 * Check whether every part of a multi-file upload status reports no file.
	 *
	 * Recurses because a nested input name such as portfolio[images][] puts the
	 * per-part codes one level deeper than a flat doc[] does.
	 *
	 * @since 4.1.0
	 *
	 * @param array $errors Upload status of each part, possibly nested.
	 *
	 * @return bool True if no part carries an upload.
	 */
	private function everyPartIsEmpty( array $errors ) {
		if ( array() === $errors ) {
			// No per-part code claims absence, so absence cannot be concluded.
			return false;
		}

		foreach ( $errors as $error ) {
			$partIsEmpty = is_array( $error )
				? $this->everyPartIsEmpty( $error )
				: UPLOAD_ERR_NO_FILE === (int) $error;

			if ( ! $partIsEmpty ) {
				return false;
			}
		}

		return true;
	}

	/**
	 * Check whether an existence check reads the given name from the request.
	 *
	 * Restricted to a named field of a field-addressable source. REQUEST_URI and
	 * ARGS_NAMES ignore the field entirely, and a bare source name only asks
	 * whether the whole source is empty — which is either never true
	 * (REQUEST_URI, REQUEST_HEADERS) or true of ordinary traffic (ARGS,
	 * ARGS_NAMES, REQUEST_COOKIES), so neither is a usable absence signal.
	 * Beyond that this mirrors the dispatch in evaluateFieldExists(): regex
	 * field names and regex bracket paths resolve through ValueResolver, which
	 * only scans the collection sources, and FILES resolves only a field with
	 * no sub-selector or a known one. Keep in step with evaluateFieldExists()
	 * when a source gains or loses resolution support.
	 *
	 * @since 4.1.0
	 *
	 * @param array $parsed Parsed condition name.
	 *
	 * @return bool True if existence is decided by the request.
	 */
	private function existenceDependsOnRequest( array $parsed ) {
		$source            = $parsed['source'];
		$collectionSources = array(
			ConditionSource::ARGS,
			ConditionSource::REQUEST_COOKIES,
			ConditionSource::REQUEST_HEADERS,
		);

		if ( ! in_array( $source, array_merge( $collectionSources, array( ConditionSource::FILES ) ), true ) ) {
			return false;
		}

		$resolvesByRegex = null !== $parsed['field_regex']
			|| ( null !== $parsed['bracket_path'] && $this->bracketPathHasRegex( $parsed['bracket_path'] ) );

		if ( $resolvesByRegex ) {
			return in_array( $source, $collectionSources, true );
		}

		if ( null === $parsed['field'] ) {
			return false;
		}

		if ( ConditionSource::FILES !== $source ) {
			return true;
		}

		if ( ValueResolver::hasIndexedBracketPath( $parsed ) ) {
			// FILES cannot navigate into a sub-value, so an indexed path names
			// nothing the request can decide. Returning false here keeps
			// FILES::name[0] reading exactly like the FILES::nmae typo — both
			// checks false — instead of reporting absence for every request.
			return false;
		}

		$filesParsed = ValueResolver::parseFilesField( $parsed['field'] );

		if ( '' === $filesParsed['field'] && null === $filesParsed['sub'] ) {
			// FILES: and FILES:[] normalise to an empty key, which no request can
			// carry, so absence would be true for every request — a rule matching
			// everything. Scan-all is unaffected: it always names a sub-selector.
			return false;
		}

		return null === $filesParsed['sub']
			|| in_array( $filesParsed['sub'], ValueResolver::FILES_SUB_SELECTORS, true );
	}

	/**
	 * Evaluate missing_capability condition.
	 *
	 * @param Condition $condition Condition to evaluate.
	 * @param Request   $request   Request object.
	 *
	 * @return bool True if capability is missing (condition matches), false otherwise.
	 */
	private function evaluateMissingCapability( Condition $condition, Request $request ) {
		$capability = $condition->getValue();
		if ( empty( $capability ) ) {
			return false;
		}

		$name = $condition->getName();
		if ( ! empty( $name ) ) {
			$user_ids = $this->getCandidateUserIds( $name, $request );
			if ( empty( $user_ids ) ) {
				// Field absent: request acts on the current user, rule out of scope.
				return false;
			}
			// Fire if ANY candidate the backend might resolve lacks the capability
			// (closes the source/parser gaps; see getCandidateUserIds).
			foreach ( $user_ids as $user_id ) {
				if ( ! user_can( $user_id, $capability ) ) {
					return true;
				}
			}
			return false;
		}

		return ! current_user_can( $capability );
	}

	/**
	 * Evaluate not_current_user condition.
	 *
	 * Checks if the user ID in the request does not match the currently
	 * logged-in user. Returns false when the parameter is absent (no IDOR).
	 *
	 * @since 3.0.2
	 *
	 * @param Condition $condition Condition to evaluate.
	 * @param Request   $request   Request object.
	 *
	 * @return bool True if request user ID differs from current user (condition matches).
	 */
	private function evaluateNotCurrentUser( Condition $condition, Request $request ) {
		$user_ids = $this->getCandidateUserIds( $condition->getName(), $request );
		if ( empty( $user_ids ) ) {
			// No identifier in any source: acts on the current user, not an IDOR.
			return false;
		}

		$current_user_id = get_current_user_id();
		foreach ( $user_ids as $user_id ) {
			if ( $current_user_id !== $user_id ) {
				return true;
			}
		}

		return false;
	}

	/**
	 * Resolve every user ID the WordPress backend could read for an
	 * identity-keyed condition name (e.g. ARGS:user_id).
	 *
	 * Values go through absint() to match get_user_by('id', ...), and a plain
	 * ARGS field is read from both GET and POST (WordPress reads $_REQUEST),
	 * closing the parser/HPP gaps an attacker could use to point firewall and
	 * backend at different users. Duplicates are collapsed.
	 *
	 * @param string  $name    Condition name with source and field.
	 * @param Request $request Request object.
	 *
	 * @return int[] Backend-equivalent user IDs (empty when the field is absent).
	 */
	private function getCandidateUserIds( $name, Request $request ) {
		$parsed = Condition::parseNameString( $name );
		if ( null === $parsed['field'] ) {
			return array();
		}

		$ids = array();
		foreach ( $this->collectRawFieldValues( $request, $parsed ) as $value ) {
			$ids[] = absint( $value );
		}

		return array_values( array_unique( $ids ) );
	}

	/**
	 * Collect every present raw value for an identity-keyed field across the
	 * sources the WordPress backend could read.
	 *
	 * A named ARGS field, plain or bracketed, is read from both the query
	 * string and the body (see getCandidateUserIds). Other sources use the
	 * single-value resolver. Absent values are omitted.
	 *
	 * @param Request $request Request object.
	 * @param array   $parsed  Parsed condition name.
	 *
	 * @return array Present raw values (string/array), in GET-then-POST order.
	 */
	private function collectRawFieldValues( Request $request, $parsed ) {
		if ( ConditionSource::ARGS === $parsed['source'] && null !== $parsed['field'] ) {
			return $this->valueResolver->collectArgOccurrences( $request, $parsed );
		}

		$value = $this->valueResolver->getFieldValue( $request, $parsed );
		return null === $value ? array() : array( $value );
	}

	/**
	 * Check whether a bracket path contains any /regex/ segments.
	 *
	 * @since 3.0.0
	 *
	 * @param array $bracketPath Array of bracket-path segments.
	 *
	 * @return bool True if at least one segment is a /regex/ pattern.
	 */
	private function bracketPathHasRegex( array $bracketPath ) {
		foreach ( $bracketPath as $segment ) {
			if ( preg_match( '#^/(.+)/$#', $segment ) ) {
				return true;
			}
		}
		return false;
	}

	/**
	 * Evaluate probabilistic condition.
	 *
	 * Triggers with a configurable probability per request.
	 * The trigger rate is stored in the condition's value field as a fraction
	 * (e.g., 0.0001 = 1 in 10,000 requests).
	 *
	 * @since 3.1.0
	 *
	 * @param Condition $condition Condition to evaluate.
	 *
	 * @return bool True if the random check passes, false otherwise.
	 */
	private function evaluateProbabilistic( Condition $condition ) {
		$rate = $condition->getValue();
		if ( null === $rate || ! is_numeric( $rate ) ) {
			return false;
		}

		$rate = (float) $rate;
		if ( $rate <= 0.0 ) {
			return false;
		}
		if ( $rate >= 1.0 ) {
			return true;
		}

		$denominator = (int) round( 1.0 / $rate );
		if ( $denominator < 1 ) {
			return true;
		}

		// phpcs:ignore WordPress.WP.AlternativeFunctions.rand_mt_rand -- sampling, not security; avoids syscall overhead at scale
		return mt_rand( 1, $denominator ) === 1;
	}

	/**
	 * Get the last failed condition during evaluation.
	 *
	 * @return Condition|null The last failed Condition object or null if none failed.
	 */
	public function getFailedCondition() {
		return $this->failedCondition;
	}
}

Directory Contents

Dirs: 2 × Files: 16
Name Size Perms Modified Actions
Handler DIR
- drwxr-xr-x 2026-11-03 01:06:25
Edit Download
Model DIR
- drwxr-xr-x 2026-11-03 01:06:25
Edit Download
CachedFileProvider.php
1.97 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
ChangelogWriter.php
3.44 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
ConditionEvaluator.php
22.33 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
ConditionMatcher.php
22.10 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
Defender.php
4.28 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
DefenderLifecycle.php
945 B lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
DisabledRulesManager.php
6.88 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
IncidentRecorder.php
17.87 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
RateLimiter.php
3.08 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
Request.php
62.62 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
RuleHitTracker.php
4.92 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
RuleProvider.php
18.52 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
ServiceWorkerCleanup.php
4.44 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
ServiceWorkerPayloads.php
14.27 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
ServiceWorkerReporter.php
9.23 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
ValueResolver.php
28.98 KB lrwxr-xr-x 2026-11-03 01:06:25
Edit Download
If ZipArchive is unavailable, a .tar will be created (no compression).
© 2026 0xNothings — Secure File Manager. All rights reserved. Built with ❤️ & Tailwind x Dark UI