( 'wp_login' === $current_filter ) { $user = get_user_by( 'ID', $args[1]->data->ID ); } else { $user = wp_get_current_user(); } $roles = new Roles(); $translated_role = $roles->translate_user_to_role( $user ); $actor = array( 'wpcom_user_id' => null, 'external_user_id' => $user->ID ?? null, 'display_name' => $user->display_name ?? null, 'user_email' => $user->user_email ?? null, 'user_roles' => $user->roles ?? null, 'translated_role' => $translated_role ? $translated_role : null, 'is_cron' => defined( 'DOING_CRON' ) ? DOING_CRON : false, 'is_rest' => defined( 'REST_API_REQUEST' ) ? REST_API_REQUEST : false, 'is_xmlrpc' => defined( 'XMLRPC_REQUEST' ) ? XMLRPC_REQUEST : false, 'is_wp_rest' => defined( 'REST_REQUEST' ) ? REST_REQUEST : false, 'is_ajax' => defined( 'DOING_AJAX' ) ? DOING_AJAX : false, 'is_wp_admin' => is_admin(), 'is_cli' => defined( 'WP_CLI' ) ? WP_CLI : false, 'from_url' => $this->get_request_url(), ); if ( $this->should_send_user_data_with_actor( $current_filter ) ) { $ip = IP_Utils::get_ip(); $actor['ip'] = $ip ? $ip : ''; $actor['user_agent'] = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : 'unknown'; } $raw_mcp_header = ''; if ( isset( $_SERVER['HTTP_X_WPCOM_MCP'] ) && is_string( $_SERVER['HTTP_X_WPCOM_MCP'] ) ) { $raw_mcp_header = trim( wp_unslash( $_SERVER['HTTP_X_WPCOM_MCP'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitization happens below. } if ( ! empty( $raw_mcp_header ) && preg_match( '/^[A-Za-z0-9+\/=]+$/', $raw_mcp_header ) ) { // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- Decoding MCP header payload. $decoded = base64_decode( $raw_mcp_header, true ); if ( false !== $decoded ) { $mcp_data = json_decode( $decoded, true ); if ( is_array( $mcp_data ) ) { if ( isset( $mcp_data['mcp_client_name'] ) && is_string( $mcp_data['mcp_client_name'] ) ) { $actor['mcp_client_name'] = sanitize_text_field( $mcp_data['mcp_client_name'] ); } if ( isset( $mcp_data['mcp_client_version'] ) && is_string( $mcp_data['mcp_client_version'] ) ) { $actor['mcp_client_version'] = sanitize_text_field( $mcp_data['mcp_client_version'] ); } if ( ! empty( $actor['mcp_client_name'] ) || ! empty( $actor['mcp_client_version'] ) ) { $actor['is_mcp_agent'] = true; } } } } /** * Filters the actor data attached to sync events. * * Actor data identifies who or what triggered a sync event (user info, * request context, MCP client details, etc.) and is sent alongside every * event to WordPress.com. * * @since 4.33.0 * * @param array $actor Associative array of actor information. */ $actor = apply_filters( 'jetpack_sync_actor_data', $actor ); // Ensure the filter returns a valid array. if ( ! is_array( $actor ) ) { $actor = array(); } // Sanitize string values added via the filter. foreach ( $actor as $key => $value ) { if ( is_string( $value ) ) { $actor[ $key ] = sanitize_text_field( $value ); } } return $actor; } /** * Should user data be sent as the actor? * * @param string $current_filter The current WordPress filter being executed. * @return bool */ public function should_send_user_data_with_actor( $current_filter ) { $should_send = in_array( $current_filter, array( 'jetpack_wp_login', 'wp_logout', 'jetpack_valid_failed_login_attempt' ), true ); /** * Allow or deny sending actor's user data ( IP and UA ) during a sync event * * @since 1.6.3 * @since-jetpack 5.8.0 * * @module sync * * @param bool True if we should send user data * @param string The current filter that is performing the sync action */ return apply_filters( 'jetpack_sync_actor_user_data', $should_send, $current_filter ); } /** * Sets Listener defaults. */ public function set_defaults() { $this->sync_queue = new Queue( 'sync' ); $this->full_sync_queue = new Queue( 'full_sync' ); $this->set_queue_size_limit( Settings::get_setting( 'max_queue_size' ) ); $this->set_queue_lag_limit( Settings::get_setting( 'max_queue_lag' ) ); } /** * Get the request URL. * * @return string Request URL, if known. Otherwise, wp-admin or home_url. */ public function get_request_url() { if ( isset( $_SERVER['HTTP_HOST'] ) && isset( $_SERVER['REQUEST_URI'] ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- False positive, sniff misses the call to esc_url_raw. return esc_url_raw( 'http' . ( isset( $_SERVER['HTTPS'] ) ? 's' : '' ) . '://' . wp_unslash( "{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}" ) ); } return is_admin() ? get_admin_url( get_current_blog_id() ) : home_url(); } }