Fix. FW. Improve AC module to correct processing loopback. (#862)

* Fix. FW. Improve AC module to correct processing loopback.

* fix cp

* fix psalm

Author: svfcode

cleantalk.php

@@ -347,6 +347,7 @@ function apbct_register_my_rest_routes()
      && empty(Post::get('action')) //bbPress
      && ! \Cleantalk\Variables\Server::inUri('/favicon.ico') // /favicon request rewritten cookies fix
      && ! apbct__is_wp_rocket_preloader_request()
+     && ! apbct__is_wordpress_loopback_request()
 ) {
     if ( $apbct->data['cookies_type'] !== 'alternative' ) {
         if ( !$apbct->settings['forms__search_test'] && !Get::get('s') ) { //skip cookie set for search form redirect page

inc/cleantalk-ajax.php

@@ -894,7 +894,6 @@ function ct_ajax_hook($message_obj = null)
                     'message' => $ct_result->comment
                 )
             );
-            die();
         }
 
         // Plugin Name: eForm - WordPress Form Builder; ajax action ipt_fsqm_save_form

inc/cleantalk-pluggable.php

@@ -2235,6 +2235,58 @@ function apbct__is_wp_rocket_preloader_request()
     );
 }
 
+/**
+ * True for WordPress HTTP API loopback requests (Site Health, updates, cron).
+ * Default WP user-agent: "WordPress/{version}; {siteurl}"
+ *
+ * Requires both the WordPress UA prefix and that the URL in the UA belongs
+ * to this site. UA-only matching would skip Anti-Crawler for any spoofed
+ * WordPress client, including requests from other sites.
+ *
+ * Do not require REMOTE_ADDR === SERVER_ADDR: php-fpm loopbacks often arrive
+ * from the public origin IP while SERVER_ADDR is 127.0.0.1.
+ *
+ * @return bool
+ */
+function apbct__is_wordpress_loopback_request()
+{
+    if ( ! isset($_SERVER['HTTP_USER_AGENT']) ) {
+        return false;
+    }
+
+    if ( preg_match('#^WordPress/\d[\d.]*;\s+(\S+)#', $_SERVER['HTTP_USER_AGENT'], $matches) !== 1 ) {
+        return false;
+    }
+
+    $ua_url = isset($matches[1]) ? $matches[1] : '';
+    if ( $ua_url === '' ) {
+        return false;
+    }
+
+    $ua_host = wp_parse_url($ua_url, PHP_URL_HOST);
+    if ( ! is_string($ua_host) || $ua_host === '' ) {
+        return false;
+    }
+    $ua_host = strtolower($ua_host);
+
+    $site_hosts = array();
+    foreach ( array(home_url(), site_url()) as $url ) {
+        $host = wp_parse_url($url, PHP_URL_HOST);
+        if ( is_string($host) && $host !== '' ) {
+            $site_hosts[] = strtolower($host);
+        }
+    }
+
+    if ( isset($_SERVER['HTTP_HOST']) ) {
+        $host_header = preg_replace('/:\d+$/', '', $_SERVER['HTTP_HOST']);
+        if ( is_string($host_header) && $host_header !== '' ) {
+            $site_hosts[] = strtolower($host_header);
+        }
+    }
+
+    return in_array($ua_host, $site_hosts, true);
+}
+
 /**
  * Generates MD5 hash for email encoder pass key
  *

inc/cleantalk-public-integrations.php

@@ -2448,9 +2448,6 @@ function apbct_form__the7_contact_form()
                 );
 
                 wp_send_json($response);
-
-                // IMPORTANT: don't forget to "exit" @todo AG: Why? Exit does not terminate connection, but I can't see how it is applicable
-                exit;
             }
         }
     }

lib/Cleantalk/Antispam/Integrations/ChatyContactForm.php

@@ -41,6 +41,5 @@ public function doBlock($message)
             'message' => $message,
         ];
         wp_send_json($response);
-        exit;
     }
 }

lib/Cleantalk/Antispam/Integrations/ElementorUltimateAddonsRegister.php

@@ -24,7 +24,6 @@ public function doBlock($message)
                 )
             )
         );
-        return false;
     }
 
     public function allow()

lib/Cleantalk/Antispam/Integrations/HivePress.php

@@ -39,6 +39,5 @@ public function doBlock($message)
                 'error' => ['message' => $message],
             ]
         );
-        die();
     }
 }

lib/Cleantalk/Antispam/Integrations/HivePressRegistration.php

@@ -35,6 +35,5 @@ public function doBlock($message)
                 'error' => ['message' => $message],
             ]
         );
-        die();
     }
 }

lib/Cleantalk/Antispam/Integrations/MailPoet.php

@@ -58,6 +58,5 @@ public function doBlock($message)
             ),
             403
         );
-        die();
     }
 }

lib/Cleantalk/Antispam/Integrations/SureForms.php

@@ -29,6 +29,5 @@ public function doBlock($message)
                 'message' => $message
             )
         );
-        die();
     }
 }