<?php
/**
* Helper functions related to privacy, geolocation and user data.
*
* @since 1.8.0
*/
/**
* Get the user IP address.
*
* @since 1.2.5
* @since 1.7.3 Improve the IP detection quality by taking care of proxies (e.g. when the site is behind Cloudflare).
*
* Code based on the:
* - WordPress method \WP_Community_Events::get_unsafe_client_ip
* - Cloudflare documentation https://support.cloudflare.com/hc/en-us/articles/206776727
*
* @return string
*/
function wpforms_get_ip(): string {
$ip = '127.0.0.1';
$address_headers = [
'HTTP_TRUE_CLIENT_IP',
'HTTP_CF_CONNECTING_IP',
'HTTP_X_REAL_IP',
'HTTP_CLIENT_IP',
'HTTP_X_FORWARDED_FOR',
'HTTP_X_FORWARDED',
'HTTP_X_CLUSTER_CLIENT_IP',
'HTTP_FORWARDED_FOR',
'HTTP_FORWARDED',
'REMOTE_ADDR',
];
foreach ( $address_headers as $header ) {
if ( empty( $_SERVER[ $header ] ) ) {
continue;
}
/*
* HTTP_X_FORWARDED_FOR can contain a chain of comma-separated addresses, with or without spaces.
* The first address is the original client. It can't be trusted for authenticity,
* but we don't need to for this purpose.
*/
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
$address_chain = explode( ',', wp_unslash( $_SERVER[ $header ] ) );
$ip = filter_var( trim( $address_chain[0] ), FILTER_VALIDATE_IP );
break;
}
/**
* Filter detected IP address.
*
* @since 1.2.5
*
* @param string $ip IP address.
*/
return (string) filter_var( apply_filters( 'wpforms_get_ip', $ip ), FILTER_VALIDATE_IP );
}
/**
* Get the visitor's preferred language tag from the request, e.g. `pt-br` from
* `pt-BR,pt;q=0.9,en-US;q=0.8`.
*
* Read from the request header rather than a form field, so it cannot be spoofed from the
* client. Only the highest-quality tag is kept: a translation is chosen by one language,
* and the rest of the list would be user data with no use for it.
*
* Only the parts the translation lookup reads are kept, so `ca-valencia` is stored as `ca`
* and resolves to the same translation. That also keeps what a client can put in the table
* bounded: the free-form subtag a tag may legally carry is where an unlimited number of
* distinct values would otherwise come from, and nothing ever reads it.
*
* Sites behind a proxy that normalizes the header, and multilingual plugins that hold a
* better signal in a cookie or a URL prefix, can supply the tag through the filter below.
* A filtered value goes through the same shape and the same trimming, so a hook can neither
* put arbitrary text in the entry nor store more of a tag than the header path would.
*
* @since 2.0.2
*
* @return string Lowercase language tag, or an empty string when the request carries none.
*/
function wpforms_get_visitor_language(): string {
// A tag is a two or three letter language, an optional four-letter script and an
// optional region: letters like `BR`, or the UN M49 digits browsers send for `es-419`.
// Any further subtag still matches, so the tag is recognised, but is not captured.
$tag_pattern = '([a-z]{2,3})(?:-([a-z]{4}))?(?:-([a-z]{2}|\d{3}))?(?:-[a-z\d]{1,8})*';
// Join the captured parts back into the tag that gets stored.
$to_tag = static function ( array $parts ): string {
return strtolower( implode( '-', array_filter( [ $parts[1] ?? '', $parts[2] ?? '', $parts[3] ?? '' ] ) ) );
};
$language = '';
$preferred = 0;
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Each tag is matched against the pattern above.
$header = isset( $_SERVER['HTTP_ACCEPT_LANGUAGE'] ) ? (string) wp_unslash( $_SERVER['HTTP_ACCEPT_LANGUAGE'] ) : '';
// The header is attacker-controlled and the winning tag is stored with the entry, so
// it is capped like the user agent (see WPForms\Forms\Submission::get_user_info()).
foreach ( explode( ',', substr( $header, 0, 256 ) ) as $entry ) {
// Anything else, including the `*` wildcard, is skipped. The spacing is part of the
// pattern because the header may arrive as `en-US; q=0.8`.
if ( ! preg_match( '/^\s*' . $tag_pattern . '\s*(?:;\s*q=([\d.]+))?\s*$/i', $entry, $parts ) ) {
continue;
}
// An explicit `q=0` means "not acceptable", so it never wins.
$quality = isset( $parts[4] ) && $parts[4] !== '' ? (float) $parts[4] : 1;
if ( $quality > $preferred ) {
$language = $to_tag( $parts );
$preferred = $quality;
}
}
/**
* Filter the visitor language tag read from the request.
*
* Lets a site read the language from somewhere better than the header: a proxy that
* normalizes it away, or a multilingual plugin holding it in a cookie or URL prefix.
*
* @since 2.0.2
*
* @param string $language Lowercase language tag, or an empty string when the request carries none.
*/
$language = (string) apply_filters( 'wpforms_get_visitor_language', $language );
return preg_match( '/^' . $tag_pattern . '$/i', $language, $parts ) ? $to_tag( $parts ) : '';
}
/**
* Determine if collecting user's IP is allowed by GDPR setting (globally or per form).
* Majority of our users have GDPR disabled.
* So we remove this data from the request only when it's not needed:
* 1) when GDPR is enabled AND globally disabled user details storage;
* 2) when GDPR is enabled AND IP address processing is disabled on per form basis.
*
* @since 1.6.6
*
* @param array $form_data Form settings.
*
* @return bool
*/
function wpforms_is_collecting_ip_allowed( $form_data = [] ) {
if (
wpforms_setting( 'gdpr', false ) &&
(
wpforms_setting( 'gdpr-disable-details', false ) ||
( ! empty( $form_data ) && ! empty( $form_data['settings']['disable_ip'] ) )
)
) {
return false;
}
return true;
}
/**
* Determine if collecting cookies is allowed by GDPR setting.
*
* @since 1.7.5
*
* @return bool
*/
function wpforms_is_collecting_cookies_allowed() {
return ! ( wpforms_setting( 'gdpr', false ) && wpforms_setting( 'gdpr-disable-uuid', false ) );
}