�PNG  IHDR22?�� pHYs  �� OiCCPPhotoshop ICC profilexڝSgTS�=���BK���KoR RB���&*! J�!��Q�EEȠ�����Q, � ��!���������{�kּ������>���� �H3Q5� �B�������.@� $p�d!s�#�~<<+"��x� �M��0���B�\���t�8K�@z�B�@F���&S�`�cb�P-`'������{[�!�� e�Dh;��V�EX0fK�9�-0IWfH���� � 0Q��){`�##x��F�W<�+��*x��<�$9E�[-qWW.(�I+6aa�@.�y�2�4���������x����6��_-��"bb���ϫp@�t~��,/��;�m��%�h^ �u��f�@����W�p�~<�5�j>{�-�]c�K'Xt����o��(�h���w��?�G�%�fI�q^D$.Tʳ?�D��*�A��,���� �`6�B$��BB d�r`)��B(�Ͱ*`/�@4�Qh��p.�U�=p�a��(�� A�a!ڈb�X#����!�H�$ ɈQ"K�5H1R�T UH�=r9�\F��;�2����G1���Q=� �C��7�F� �dt1�����r�=�6��Ыhڏ>C�0��3�l0.��B�8, �c˱"� ���V����cϱw�E� 6wB aAHXLXN�H� $4� 7 �Q�'"��K�&���b21�XH,#��/{�C�7$�C2'��I��T��F�nR#�,��4H#���dk�9�, +ȅ����3��!�[ �b@q��S�(R�jJ��4�e�2AU��Rݨ�T5�ZB���R�Q��4u�9̓IK�����hh�i��t�ݕN��W���G���w ��Ljg(�gw��L�Ӌ�T071���oUX*�*|�� �J�&�*/T����ު U�U�T��^S}�FU3S� Ԗ�U��P�SSg�;���g�oT?�~Y��Y�L�OC�Q��_�� c�x,!k ��u�5�&���|v*�����=���9C3J3W�R�f?�q��tN �(���~���)�)�4L�1e\k����X�H�Q�G�6������E�Y��A�J'\'Gg����S�Sݧ �M=:��.�k���Dw�n��^��Lo��y���}/�T�m���G X� $� �<�5qo</���QC]�@C�a�a�ᄑ��<��F�F�i�\�$�m�mƣ&&!&KM�M�RM��)�;L;L���͢�֙5�=1�2��כ߷`ZxZ,����eI��Z�Yn�Z9Y�XUZ]�F���%ֻ�����N�N���gð�ɶ�����ۮ�m�}agbg�Ů��}�}��= ���Z~s�r:V:ޚΜ�?}����/gX���3��)�i�S��Ggg�s�󈋉K��.�>.���Ƚ�Jt�q]�z���������ۯ�6�i�ܟ�4�)�Y3s���C�Q��? ��0k߬~OCO�g��#/c/�W�װ��w��a�>�>r��>�<7�2�Y_�7��ȷ�O�o�_��C#�d�z����%g��A�[��z|!��?:�e����A���AA�������!h�쐭!��Α�i�P~���a�a��~ '���W�?�p�X�1�5w��Cs�D�D�Dޛg1O9�-J5*>�.j<�7�4�?�.fY��X�XIlK9.*�6nl������� �{�/�]py�����.,:�@L�N8��A*��%�w%� y��g"/�6ш�C\*N�H*Mz�쑼5y$�3�,幄'���L Lݛ:��v m2=:�1����qB�!M��g�g�fvˬe����n��/��k���Y- �B��TZ(�*�geWf�͉�9���+��̳�ې7�����ᒶ��KW-X潬j9�������(�x��oʿ�ܔ���Ĺd�f�f���-�[����n �ڴ �V����E�/��(ۻ��C���<��e����;?T�T�T�T6��ݵa��n��{��4���[���>ɾ�UUM�f�e�I���?�������m]�Nmq����#�׹���=TR��+�G�����w- 6 U����#pDy��� �� :�v�{���vg/jB��F�S��[b[�O�>����z�G��499�?r����C�d�&����ˮ/~�����јѡ�򗓿m|������������x31^�V���w�w��O�| (�h���SЧ��������c3-� cHRMz%������u0�`:�o�_�F5IDATx��ytUս�?�;���fN$$��@B�!�k��� -*�gE���j�O�kQ�ʠ`U�B_ �AÐ0%�Ȕ�@r3ޛ;߳��$�@��v����^�s����������$��ߢ !�W��5�̱'-٘������4�>�Rƫ$�G��0U�H}�_ _� #��k�MJ/=�9Du *ڲ�k�PQ;0��j|�*�$�^컂脛y���>�z×� B��� ��(�:$�ʔ_�6��C!B����MVx��a��ζyY����j��ƋY2�9�F�{r��r�딟F��Q��hY6��� x��[l��RC��������nt@��;P��3��� F�w��7��:�P���ɋ'���mj���Bƪ�$�Q�L��y��߷g��\���z����v5�p�v$�v櫻�`6~K �Y�X����,�:��"�o�e0II"(��,������l_�C���/4�+f�E�!q��:����u����c��樼.UE�@� �]K�W���$-�h]�JG���Dz)�`��.�A/ ���mᏣc�3jK� �!�>���$�Q�!�_�? \�C2(E �M$Z I{�U���s�ǣ���=��@Բe ޻��W�����@ �w����}�9v,)��.}*|"�s��di���,���G�]W�AC�������|<����[��ߕ������K�*�G nߴ!��‹��J�!��6(L�a)��Am��������;adf��:�xm��nh�;֦I��(���o�C~ډa?�=��s����h��E������xp����)���_���t��W�����´;8���`dz=(��@@�+,�;�`�fhl��XȌ�3,uI�~z(J����� �ZX�A����H'�À�㜦�82|��a�n�z2��I���� ���EY�h�ε<�0�q�{��C��v�˅��?"@��χ�x�WS+��N�~�KQ�J�8ل�� _.W��� !TU{�����,��"�� �;�������HI S� ��))�o�1�H�D� ���� (� ;����"Ҕ��,���� �F=���O��&�Ph>�`���y��߲ &S��P�<��'��1s�1cĂ�N����2)����@�u��tv��<�+�-&�����h��[!FSG���' � z z0��<����8d&�����E0�,��<��"!P�b4��� �{S�����X����.�囤���T��hEF��X�q0"-<����h���]�Py*����F⩍��@v�˂�Y08�� .q��a��s����(!<̫1�3�L�H��7sYW�`��qtu�\7��?�@�Y�� %Ka�x�GZ�*W�P��y�����N0r9��Z�c�%���q,��k�����!!,��>���IB��� �x1�Xu�Y���v-���ֺ��N������JP��a�2`�e5��w��u;�6�i���̃��(K���ťa��(l51��JL��O'%���]���ٖ뿉!��{*�p+f ���i8��D�ȑ���ܩ�M��V��ӟz��x�7Z�1i}�^͜���6e����x��)u�d�ˏ�V�eG�\�X1�����=n�U'�~Y����L�\,�(d!x ,�:�TW8� M`r���@��r+v�Q0��>^;˴�VbF��('����� �*O��i��j�Ӆ����^�S3&� ���{������.ی�� N;��NU%d0�Ce\r"�C�b��&t7N�7��� �ȪD�[%l�۪�$��'m?�A9tI�9>��NVL ��� 6v~M�����ъ�B���0����9$&=ώm��W�0���L���&��E���f�f��'+�9��hv��7,���M��6�D�&�^� �����8 D֮�����o��k^z��O��hP�8q�5d*��YVq3�{��������#LX4�?��jP=3�~�؅c�ݰ�̱�ұ��8̲��2�G�����j��έ�9��w7���U�X�w�85C��?!I&���o&����L���I#�^�eV�,�^t5�k� �xs˛\��U�8��."���{���ǵ�l4��ݼ�;��r"���G�/~���gJV�N糦��ZZ^k+NN�D��I$�=OE�z����|*�*{��%k���G��>�`9��b;�s���8,�qs��c��.b��q�%�>r��n�R�Ƨ�%�,�A��le#�8���}; 21�0�b�&�QX�f���q�00����$>�h�N�'�a3��A���/�r ��L5�8�GԲ'�����w;��c#�q1���h$*��V^�k��QĽ�b:i������� ����H F#�_���,��]g����Ը����`RUU���� ��"�qD���>-��ϤI�~��3�̴�����NZ[[555�eeek7�m����YF#[��Đ��R��i��L�H�r ��@��J-�Pŝ��_|�-��6y��ks�V�U~��6���w.����(��0A� 4��f��� /���C�xŊ�ٳ����z=6�����rg���mKo��o�/����a�g���?'9%9��P��斓��~���L{�� �H��{AW��B��$����v�1b�&Mb�ر��ر#�0`�`xMBp! )Z�Nmo�mZ�g�}�eذaWTVV ���'99��C5��&�&+5�bT>|8��PUUETT����&���t��~TE%��'������b�tEGG;RSS�S�N�v��ѯ��t����u1@�ޚ"f��͈���r'L�Ph��m��ƌ�74o��`�x�q�P���NRSS�X,�����l&&&��MFFA!-��`��ҷ�n��Yuu�����x<I�LB%����KԒ50�!�3�bz�����ʸKL���;---�l6[��`��������Ȏ;�����egg4��!D�T��jWujyZ��������K����%����p�^���X,6��sV=�ܖ����6�3�X ���4ҿ��A2�&����_k�;d�� �VfOIEND�B`� 0x0x
0x0x
PHP 8.1.34
Preview: SiteAllowlist.php Size: 20.41 KB
/home2/astrociv/www/avadhutholidays.in/wp-content/plugins/imunify-security/inc/App/Bot/SiteAllowlist.php
<?php
/**
 * Copyright (с) Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2025 All Rights Reserved
 *
 * Licensed under CLOUD LINUX LICENSE AGREEMENT
 * https://www.cloudlinux.com/legal/
 */

namespace CloudLinux\Imunify\App\Bot;

/**
 * The site owner's four allowlists and the rules for matching a request against them.
 *
 * Values are expected in the form SiteAllowlistValidator stores. REST and path entries
 * match from the start, on whole segments, case-insensitively; a `*` segment stands for
 * exactly one segment, and an entry covers everything below it.
 *
 * IPs are matched through groups keyed by the first byte, the shape the allowlist file
 * stores, so a request scans only its own group plus the broad ranges.
 *
 * @since 4.1.4
 */
class SiteAllowlist {

	const LIST_IP         = 'ip';
	const LIST_REST_API   = 'rest_api';
	const LIST_PATH       = 'path';
	const LIST_USER_AGENT = 'user_agent';

	/**
	 * WordPress root scripts without `.php`, which Apache MultiViews can run.
	 */
	const ROOT_SCRIPT_NAMES = array(
		'index',
		'wp-activate',
		'wp-blog-header',
		'wp-comments-post',
		'wp-config',
		'wp-cron',
		'wp-links-opml',
		'wp-load',
		'wp-login',
		'wp-mail',
		'wp-settings',
		'wp-signup',
		'wp-trackback',
		'xmlrpc',
	);

	/**
	 * WordPress core directories and the REST prefix; no page needs `*` to stand for them.
	 */
	const CORE_DIRECTORY_NAMES = array( 'wp-admin', 'wp-includes', 'wp-json' );

	/**
	 * Values per list in the owner's order. The IP list is null until needed when the
	 * allowlist was read from the stored IP groups.
	 *
	 * @var array
	 */
	private $values;

	/**
	 * Note per value, per list; empty when the allowlist was read without notes.
	 *
	 * @var array
	 */
	private $notes;

	/**
	 * IP ranges as array( 'by_octet' => int => CIDR[], 'broad' => CIDR[] ), built on first use.
	 *
	 * @var array|null
	 */
	private $ip_buckets;

	/**
	 * Lists whose values are known to be non-empty strings. Stored lists are checked on first use,
	 * so a request that only matches an IP never walks the other lists.
	 *
	 * @var array
	 */
	private $checked;

	/**
	 * Lower-case segments of the REST and path entries, built on first use.
	 *
	 * @var array
	 */
	private $segments = array();

	/**
	 * Keep the given lists as they are.
	 *
	 * @param array      $values     Values per list.
	 * @param array      $notes      Note per value, per list.
	 * @param array|null $ip_buckets IP groups, required when the IP list is null.
	 * @param bool       $checked    Whether the values are already known to be non-empty strings.
	 */
	private function __construct( $values, $notes, $ip_buckets = null, $checked = true ) {
		$this->values     = $values;
		$this->notes      = $notes;
		$this->ip_buckets = $ip_buckets;
		$this->checked    = array_fill_keys( self::listNames(), $checked );
	}

	/**
	 * The list names, in the order the lists are stored and validated.
	 *
	 * @return string[]
	 */
	public static function listNames() {
		return array( self::LIST_IP, self::LIST_REST_API, self::LIST_PATH, self::LIST_USER_AGENT );
	}

	/**
	 * An allowlist without entries.
	 *
	 * @return SiteAllowlist
	 */
	public static function createEmpty() {
		return self::fromArray( array() );
	}

	/**
	 * Build an allowlist from lists of entries, dropping anything that is not a well-formed entry.
	 *
	 * @param mixed $data array( 'ip' => array( array( 'value' => ..., 'note' => ... ) ), ... ).
	 * @return SiteAllowlist
	 */
	public static function fromArray( $data ) {
		$values = array();
		$notes  = array();
		foreach ( self::listNames() as $name ) {
			$values[ $name ] = array();
			$notes[ $name ]  = array();
			if ( ! is_array( $data ) || ! isset( $data[ $name ] ) || ! is_array( $data[ $name ] ) ) {
				continue;
			}
			foreach ( $data[ $name ] as $entry ) {
				if ( ! is_array( $entry ) || ! isset( $entry['value'] ) || ! is_string( $entry['value'] ) || '' === $entry['value'] ) {
					continue;
				}
				$values[ $name ][] = $entry['value'];
				if ( isset( $entry['note'] ) && is_string( $entry['note'] ) && '' !== $entry['note'] && ! isset( $notes[ $name ][ $entry['value'] ] ) ) {
					$notes[ $name ][ $entry['value'] ] = $entry['note'];
				}
			}
		}
		return new self( $values, $notes );
	}

	/**
	 * Build an allowlist from the allowlist file's data: values only, every note empty.
	 *
	 * The IP groups are used as stored, so reading them costs nothing per entry; CidrMatcher
	 * skips anything that is not a CIDR string. The other lists are checked on first use.
	 *
	 * @param mixed $stored array( 'ip' => array( 'by_octet' => int => CIDR[], 'broad' => CIDR[] ),
	 *                      'rest_api' => string[], 'path' => string[], 'user_agent' => string[] ).
	 * @return SiteAllowlist
	 */
	public static function fromStored( $stored ) {
		if ( ! is_array( $stored ) ) {
			$stored = array();
		}
		$ip      = isset( $stored[ self::LIST_IP ] ) && is_array( $stored[ self::LIST_IP ] ) ? $stored[ self::LIST_IP ] : array();
		$buckets = array(
			'by_octet' => isset( $ip['by_octet'] ) && is_array( $ip['by_octet'] ) ? $ip['by_octet'] : array(),
			'broad'    => isset( $ip['broad'] ) && is_array( $ip['broad'] ) ? $ip['broad'] : array(),
		);
		$values  = array( self::LIST_IP => null );
		$notes   = array();
		foreach ( self::listNames() as $name ) {
			$notes[ $name ] = array();
			if ( self::LIST_IP !== $name ) {
				$values[ $name ] = isset( $stored[ $name ] ) && is_array( $stored[ $name ] ) ? $stored[ $name ] : array();
			}
		}
		return new self( $values, $notes, $buckets, false );
	}

	/**
	 * The entries of one list.
	 *
	 * @param string $name One of the LIST_* values.
	 * @return array List of array( 'value' => string, 'note' => string ).
	 */
	public function entries( $name ) {
		if ( ! array_key_exists( $name, $this->values ) ) {
			return array();
		}
		$entries = array();
		foreach ( $this->listValues( $name ) as $value ) {
			$entries[] = array(
				'value' => $value,
				'note'  => $this->noteOf( $name, $value ),
			);
		}
		return $entries;
	}

	/**
	 * Number of entries in one list, or in all of them.
	 *
	 * @param string|null $name One of the LIST_* values, null for all lists.
	 * @return int
	 */
	public function count( $name = null ) {
		if ( null === $name ) {
			$total = 0;
			foreach ( self::listNames() as $list ) {
				$total += $this->count( $list );
			}
			return $total;
		}
		return array_key_exists( $name, $this->values ) ? count( $this->listValues( $name ) ) : 0;
	}

	/**
	 * All four lists, in the owner's order, with notes: what the allowlist option stores.
	 *
	 * @return array
	 */
	public function toArray() {
		$lists = array();
		foreach ( self::listNames() as $name ) {
			$lists[ $name ] = $this->entries( $name );
		}
		return $lists;
	}

	/**
	 * The allowlist file's content: values only, IPs grouped by first byte in the shape CidrMatcher reads.
	 *
	 * @return array
	 */
	public function toStored() {
		$buckets = self::cleanBuckets( $this->ipBuckets() );
		$stored  = array(
			self::LIST_IP => array(
				'by_octet' => $buckets['by_octet'],
				'broad'    => $buckets['broad'],
			),
		);
		foreach ( array( self::LIST_REST_API, self::LIST_PATH, self::LIST_USER_AGENT ) as $name ) {
			$stored[ $name ] = $this->listValues( $name );
		}
		return $stored;
	}

	/**
	 * The first IP range that covers the client IP, in group order.
	 *
	 * @param mixed $ip Client IP, IPv4 or IPv6.
	 * @return AllowlistMatch|null
	 */
	public function matchIp( $ip ) {
		if ( ! is_string( $ip ) || '' === $ip ) {
			return null;
		}
		$cidr = CidrMatcher::findInBucketed( self::demapIp( $ip ), $this->ipBuckets() );
		return null === $cidr ? null : $this->found( AllowlistMatch::TYPE_IP, self::LIST_IP, self::displayValue( $cidr ) );
	}

	/**
	 * An IPv4-mapped IPv6 address as plain IPv4, so it matches IPv4 entries and never IPv6 ones.
	 *
	 * @param string $ip Client IP.
	 * @return string
	 */
	private static function demapIp( $ip ) {
		// phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- inet_pton warns on malformed input; the matcher then finds nothing.
		$binary = @inet_pton( $ip );
		if ( false === $binary || 16 !== strlen( $binary ) || "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff" !== substr( $binary, 0, 12 ) ) {
			return $ip;
		}
		$ipv4 = inet_ntop( substr( $binary, 12 ) );
		return false === $ipv4 ? $ip : $ipv4;
	}

	/**
	 * The values of a list; the IP values come from the groups when not kept as a list.
	 *
	 * @param string $name One of the LIST_* values.
	 * @return string[]
	 */
	private function listValues( $name ) {
		if ( null === $this->values[ $name ] ) {
			return self::bucketValues( self::cleanBuckets( $this->ip_buckets ) );
		}
		if ( ! $this->checked[ $name ] ) {
			$this->values[ $name ]  = self::stringList( $this->values[ $name ] );
			$this->checked[ $name ] = true;
		}
		return $this->values[ $name ];
	}

	/**
	 * The IP groups, built from the IP values when they are not there yet.
	 *
	 * @return array
	 */
	private function ipBuckets() {
		if ( null === $this->ip_buckets ) {
			$cidrs = array();
			foreach ( $this->values[ self::LIST_IP ] as $value ) {
				$cidrs[] = false === strpos( $value, '/' ) ? $value . ( false === strpos( $value, ':' ) ? '/32' : '/128' ) : $value;
			}
			$this->ip_buckets = BundledData::bucketsFromPayload( SignatureRefresher::bucketRanges( $cidrs ) );
		}
		return $this->ip_buckets;
	}

	/**
	 * The note of an entry, '' when it has none or the allowlist was read without notes.
	 *
	 * @param string $name  One of the LIST_* values.
	 * @param string $value Entry value.
	 * @return string
	 */
	private function noteOf( $name, $value ) {
		return isset( $this->notes[ $name ][ $value ] ) ? $this->notes[ $name ][ $value ] : '';
	}

	/**
	 * A site-owner match for an entry.
	 *
	 * @param string $type  Match type.
	 * @param string $name  One of the LIST_* values.
	 * @param string $value Entry value.
	 * @return AllowlistMatch
	 */
	private function found( $type, $name, $value ) {
		return new AllowlistMatch( $type, $value, AllowlistMatch::SOURCE_SITE_OWNER, $this->noteOf( $name, $value ) );
	}

	/**
	 * IP groups with anything but non-empty strings dropped.
	 *
	 * @param array $buckets array( 'by_octet' => ..., 'broad' => ... ).
	 * @return array
	 */
	private static function cleanBuckets( $buckets ) {
		$by_octet = array();
		foreach ( $buckets['by_octet'] as $octet => $cidrs ) {
			$cidrs = self::stringList( $cidrs );
			if ( ! empty( $cidrs ) ) {
				$by_octet[ $octet ] = $cidrs;
			}
		}
		return array(
			'by_octet' => $by_octet,
			'broad'    => self::stringList( $buckets['broad'] ),
		);
	}

	/**
	 * The entry values of IP groups: by first byte, then the broad ranges, without /32 and /128.
	 *
	 * @param array $buckets IP groups.
	 * @return string[]
	 */
	private static function bucketValues( $buckets ) {
		$values = array();
		foreach ( $buckets['by_octet'] as $cidrs ) {
			foreach ( $cidrs as $cidr ) {
				$values[] = self::displayValue( $cidr );
			}
		}
		foreach ( $buckets['broad'] as $cidr ) {
			$values[] = self::displayValue( $cidr );
		}
		return $values;
	}

	/**
	 * A stored CIDR as the owner entered it: a single address has no prefix.
	 *
	 * @param string $cidr CIDR.
	 * @return string
	 */
	private static function displayValue( $cidr ) {
		$single = false === strpos( $cidr, ':' ) ? '/32' : '/128';
		return substr( $cidr, -strlen( $single ) ) === $single ? substr( $cidr, 0, -strlen( $single ) ) : $cidr;
	}

	/**
	 * The non-empty strings of a list.
	 *
	 * @param mixed $list Candidate list.
	 * @return string[]
	 */
	private static function stringList( $list ) {
		$strings = array();
		if ( is_array( $list ) ) {
			foreach ( $list as $item ) {
				if ( is_string( $item ) && '' !== $item ) {
					$strings[] = $item;
				}
			}
		}
		return $strings;
	}

	/**
	 * The first user-agent entry found in the request's user agent, ignoring case.
	 *
	 * @param mixed $ua Request user agent.
	 * @return AllowlistMatch|null
	 */
	public function matchUserAgent( $ua ) {
		if ( ! is_string( $ua ) || '' === $ua ) {
			return null;
		}
		foreach ( $this->listValues( self::LIST_USER_AGENT ) as $value ) {
			if ( false !== stripos( $ua, $value ) ) {
				return $this->found( AllowlistMatch::TYPE_USER_AGENT, self::LIST_USER_AGENT, $value );
			}
		}
		return null;
	}

	/**
	 * The first REST entry that covers the route.
	 *
	 * @param mixed $route Route WordPress serves, percent-decoded, such as `/myplugin/v1/hook`.
	 * @return AllowlistMatch|null
	 */
	public function matchRestRoute( $route ) {
		if ( ! is_string( $route ) ) {
			return null;
		}
		$segments = self::splitSegments( strtolower( $route ) );
		foreach ( $segments as $segment ) {
			// WordPress does not resolve dot segments in a route, so neither can the allowlist.
			if ( '.' === $segment || '..' === $segment ) {
				return null;
			}
		}
		return $this->firstSegmentMatch( self::LIST_REST_API, AllowlistMatch::TYPE_REST_API, $segments );
	}

	/**
	 * The first path entry that covers the request path.
	 *
	 * A request with a `rest_route` query variable never matches: WordPress serves it as a
	 * REST call whatever the path is. The same holds for a `rest_route` POST field, which
	 * this method cannot see, so the caller must not apply path entries to such a request.
	 *
	 * When the request is served by a script other than WordPress's front controller, the path
	 * must start with that script's own segments, or nothing matches: a rewrite (subfolder
	 * multisite sends /shop/xmlrpc.php to /xmlrpc.php) or MultiViews (/handler/x runs
	 * handler.php) would otherwise let an entry exempt a script it does not name. A `*` never
	 * stands for one of the script's segments either. Scripts are compared below the home path
	 * and, when given, below the site URL path, where WordPress itself lives when the home URL
	 * is a parent folder; a directory index (/wp-admin/ run by /wp-admin/index.php) counts.
	 *
	 * @param mixed       $request_uri Raw REQUEST_URI.
	 * @param string|null $home_path   Path of the home URL, '' or null on a root site.
	 * @param string|null $script_name SCRIPT_NAME of the request, null when unknown.
	 * @param string|null $site_path   Path of the site URL (where WordPress lives), null when unknown.
	 * @return AllowlistMatch|null
	 */
	public function matchPath( $request_uri, $home_path, $script_name = null, $site_path = null ) {
		if ( ! is_string( $request_uri ) ) {
			return null;
		}
		$segments = self::requestPathSegments( $request_uri );
		if ( null === $segments ) {
			return null;
		}
		$home  = self::splitSegments( strtolower( (string) $home_path ) );
		$depth = count( $home );
		if ( $depth > 0 ) {
			if ( array_map( 'strtolower', array_slice( $segments, 0, $depth ) ) !== $home ) {
				return null;
			}
			$segments = array_slice( $segments, $depth );
		}
		$segments = array_map( 'strtolower', $segments );
		$depth    = self::scriptDepth( $segments, $script_name, $home, $site_path );
		// A rewrite ran another script than the path names (subfolder multisite sends
		// /shop/xmlrpc.php to /xmlrpc.php), so no path entry may exempt the request.
		if ( null === $depth ) {
			return null;
		}
		return $this->firstSegmentMatch( self::LIST_PATH, AllowlistMatch::TYPE_PATH, $segments, $depth );
	}

	/**
	 * How many leading request segments name the script serving the request.
	 *
	 * The script is taken below the home path (dropping the segments SCRIPT_NAME shares with
	 * it: on a subdirectory network the subsite /net/site1 is served by /net/index.php) and,
	 * when given, below the site URL path. index.php there is the front controller: 0.
	 *
	 * @param string[]    $segments    Lower-case request segments below the home path.
	 * @param mixed       $script_name SCRIPT_NAME, null when unknown.
	 * @param string[]    $home        Lower-case home path segments.
	 * @param string|null $site_path   Path of the site URL, null when unknown.
	 * @return int|null Null when the request path does not name the script that serves it.
	 */
	private static function scriptDepth( $segments, $script_name, $home, $site_path ) {
		$script = self::splitSegments( strtolower( is_string( $script_name ) ? $script_name : '' ) );
		if ( empty( $script ) ) {
			return 0;
		}
		$shared = 0;
		while ( isset( $home[ $shared ], $script[ $shared ] ) && $home[ $shared ] === $script[ $shared ] ) {
			++$shared;
		}
		$candidates = array( array_slice( $script, $shared ) );
		$site       = self::splitSegments( strtolower( (string) $site_path ) );
		if ( ! empty( $site ) && array_slice( $script, 0, count( $site ) ) === $site ) {
			$candidates[] = array_slice( $script, count( $site ) );
		}
		foreach ( $candidates as $candidate ) {
			if ( array( 'index.php' ) === $candidate ) {
				return 0;
			}
		}
		foreach ( $candidates as $candidate ) {
			if ( array_slice( $segments, 0, count( $candidate ) ) === $candidate ) {
				return count( $candidate );
			}
			$folder = array_slice( $candidate, 0, -1 );
			if ( 'index.php' === end( $candidate ) && $segments === $folder ) {
				return count( $folder );
			}
		}
		return null;
	}

	/**
	 * The request path as segments, decoded once, or null when it must not match.
	 *
	 * A path with a dot segment never matches: web servers differ in whether they resolve
	 * `..` and `%2e%2e` before mapping a script, so `/wp-login.php%2F..%2Fallowed` can run
	 * wp-login.php. Clients resolve dot segments before sending, so real traffic has none.
	 * A request target carries no fragment, so `#` is part of the path. Null as well for a
	 * target that does not start with `/` or that carries a `rest_route` query variable.
	 *
	 * @param string $request_uri Raw REQUEST_URI.
	 * @return string[]|null
	 */
	private static function requestPathSegments( $request_uri ) {
		// An absolute-form target (`http://host/…`) would put the scheme and host into the first segments.
		if ( '' === $request_uri || '/' !== $request_uri[0] ) {
			return null;
		}
		$query_at = strcspn( $request_uri, '?' );
		if ( $query_at < strlen( $request_uri ) ) {
			parse_str( substr( $request_uri, $query_at + 1 ), $args );
			if ( isset( $args['rest_route'] ) ) {
				return null;
			}
		}
		$path     = rawurldecode( substr( $request_uri, 0, $query_at ) );
		$segments = self::splitSegments( $path );
		foreach ( $segments as $segment ) {
			if ( '.' === $segment || '..' === $segment ) {
				return null;
			}
		}
		return $segments;
	}

	/**
	 * The first entry of a segment list whose segments start the request's segments.
	 *
	 * @param string   $name     LIST_REST_API or LIST_PATH.
	 * @param string   $type     Match type to report.
	 * @param string[] $segments      Lower-case request segments.
	 * @param int      $literal_depth Leading entry segments that may not be `*`.
	 * @return AllowlistMatch|null
	 */
	private function firstSegmentMatch( $name, $type, $segments, $literal_depth = 0 ) {
		if ( empty( $segments ) ) {
			return null;
		}
		if ( ! isset( $this->segments[ $name ] ) ) {
			$this->segments[ $name ] = array();
			foreach ( $this->listValues( $name ) as $i => $value ) {
				$this->segments[ $name ][ $i ] = self::splitSegments( strtolower( $value ) );
			}
		}
		$count = count( $segments );
		foreach ( $this->segments[ $name ] as $i => $pattern ) {
			if ( empty( $pattern ) || count( $pattern ) > $count ) {
				continue;
			}
			foreach ( $pattern as $position => $segment ) {
				if ( '*' === $segment ? $position < $literal_depth || ! $this->wildcardCovers( $name, $segments[ $position ] ) : $segment !== $segments[ $position ] ) {
					continue 2;
				}
			}
			return $this->found( $type, $name, $this->values[ $name ][ $i ] );
		}
		return null;
	}

	/**
	 * Whether a `*` entry segment covers this request segment.
	 *
	 * In a path, `*` never covers a PHP script name: with PATH_INFO, `/xmlrpc.php/feed` runs
	 * xmlrpc.php, so an entry `*` followed by `feed` must not exempt it. Apache MultiViews
	 * also runs it for `/xmlrpc/feed`, so the WordPress root scripts are refused without
	 * their extension too, and so are the core directories (`/wp-admin/admin-ajax/feed`).
	 *
	 * @param string $name    LIST_REST_API or LIST_PATH.
	 * @param string $segment Lower-case request segment.
	 * @return bool
	 */
	private function wildcardCovers( $name, $segment ) {
		return self::LIST_PATH !== $name
			|| ( 1 !== preg_match( '/\.ph(?:p[0-9]?|tml|ar)$/', $segment )
				&& ! in_array( $segment, self::ROOT_SCRIPT_NAMES, true )
				&& ! in_array( $segment, self::CORE_DIRECTORY_NAMES, true ) );
	}

	/**
	 * Split on slashes, dropping empty segments.
	 *
	 * @param string $path Path or route.
	 * @return string[]
	 */
	private static function splitSegments( $path ) {
		return array_values(
			array_filter(
				explode( '/', $path ),
				function ( $segment ) {
					return '' !== $segment;
				}
			)
		);
	}
}

Directory Contents

Dirs: 1 × Files: 77
Name Size Perms Modified Actions
data DIR
- drwxr-xr-x 2026-11-03 01:06:32
Edit Download
AllowlistCheck.php
11.48 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
AllowlistMatch.php
2.43 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
AllowlistMatcher.php
1.47 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
AllowlistType.php
1.38 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
AtomicFileWriter.php
4.45 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
BasePath.php
1.17 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
BlockStorageInterface.php
2.01 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
BotDataConverter.php
21.21 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
BotIpStats.php
7.34 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
BotLifecycle.php
17.81 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
BotSettingsWriter.php
3.38 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
BotShimManager.php
2.79 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
BotStatsExporter.php
13.17 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
BotTrafficStats.php
8.77 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
BotTrafficSummary.php
5.67 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
BundledData.php
14.53 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
Category.php
4.25 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
CdnDetector.php
1.72 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
CidrMatcher.php
7.58 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
Classification.php
1.55 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
Classifier.php
14.00 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
CounterStorageInterface.php
1.58 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
DailyBotAggregator.php
5.99 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
DailyCounter.php
2.88 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
DatacenterDetector.php
1.41 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
DbErrorDetection.php
1.53 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
DbStorageFactory.php
2.61 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
HeaderAnomalyScorer.php
4.73 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
Honeypot.php
7.49 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
HourlyIpStatsStorage.php
17.86 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
HourlyStatsStorage.php
14.97 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
HttpClient.php
1.47 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
HttpResponse.php
4.76 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
IpNormalizer.php
2.06 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
IpRangeLookup.php
5.26 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
IpWhitelist.php
5.64 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
LoopbackResult.php
2.68 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
LoopbackSafetyTest.php
10.47 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
LoopbackStatus.php
2.49 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
MemoryBlockStorage.php
17.09 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
MemoryCounterStorage.php
8.51 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
MirrorDownloader.php
12.60 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
MirrorDownloadResult.php
3.46 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
MonitoringUaMatcher.php
835 B lrw-r--r-- 2026-11-03 01:06:32
Edit Download
MonitoringUserAgents.php
1.71 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
MuLoader.php
22.44 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
MuPluginInstaller.php
5.65 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
MuPluginSelfHealer.php
7.33 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
NullBlockStorage.php
892 B lrw-r--r-- 2026-11-03 01:06:32
Edit Download
NullCounterStorage.php
924 B lrw-r--r-- 2026-11-03 01:06:32
Edit Download
OptOutFlag.php
4.69 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
Pipeline.php
18.57 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
Preset.php
6.92 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
RateLimitDecision.php
3.87 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
RateLimiter.php
7.94 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
RdnsVerifier.php
18.17 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
RealIpResolver.php
8.48 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
RequestAllowlist.php
1.80 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
Responder.php
9.49 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
RestNamespaceMatcher.php
2.84 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
RestRouteResolver.php
7.45 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
SafeInclude.php
1.28 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
SameServerMatcher.php
2.27 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
SelfOriginDetector.php
9.90 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
SignatureRefresher.php
15.82 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
SiteAllowlist.php
20.41 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
SiteAllowlistFile.php
7.79 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
SiteAllowlistStore.php
5.61 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
SiteAllowlistValidation.php
1.80 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
SiteAllowlistValidator.php
30.46 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
SiteOwnerMatcher.php
2.79 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
SiteScope.php
1.41 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
StorageEventBuffer.php
3.72 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
UserAgentSignatures.php
9.60 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
WooCommerceMatcher.php
5.05 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
WordPressInternalsMatcher.php
6.56 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
WpHttpClient.php
5.16 KB lrw-r--r-- 2026-11-03 01:06:32
Edit Download
If ZipArchive is unavailable, a .tar will be created (no compression).
© 2026 0xNothings — Secure File Manager. All rights reserved. Built with ❤️ & Tailwind x Dark UI