TECH-132: [alleyvate] Limit access to XML-RPC #50

composer.json

@@ -21,7 +21,8 @@
   "require": {
     "php": "^8.1",
     "alleyinteractive/composer-wordpress-autoloader": "^1.0",
-    "alleyinteractive/wp-type-extensions": "^2.0"
+    "alleyinteractive/wp-type-extensions": "^2.0",
+    "symfony/http-foundation": "^v6.4.12"
   },
   "require-dev": {
     "alleyinteractive/alley-coding-standards": "^2.0",

src/alley/wp/alleyvate/features/class-disable-xmlrpc.php

@@ -0,0 +1,112 @@
+<?php
+/**
+ * Class file for Disable_XMLRPC.
+ *
+ * (c) Alley <[email protected]>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ *
+ * @package wp-alleyvate
+ */
+
+namespace Alley\WP\Alleyvate\Features;
+
+use Symfony\Component\HttpFoundation\IpUtils;
+use Alley\WP\Types\Feature;
+
+/**
+ * Disables XMLRPC requests and methods for all requests except those coming from known Jetpack IPs.
+ */
+final class Disable_XMLRPC implements Feature {
+	/**
+	 * Boot the feature.
+	 */
+	public function boot(): void {
+
+		// Disable XML-RPC for non-Jetpack requests.
+		add_filter(
+			'xmlrpc_enabled',
+			fn( $enabled ) => Disable_XMLRPC::is_jetpack_enabled() && Disable_XMLRPC::is_jetpack_xmlrpc_request() ? $enabled : false,
+			PHP_INT_MAX,
+		);
+
+		// Remove all XML-RPC methods for non-Jetpack requests.
+		add_filter(
+			'xmlrpc_methods',
+			fn( $methods ) => Disable_XMLRPC::is_jetpack_enabled() && Disable_XMLRPC::is_jetpack_xmlrpc_request() ? $methods : [],
+			PHP_INT_MAX,
+		);
+	}
+
+	/**
+	 * Determine if Jetpack is enabled.
+	 *
+	 * @return bool
+	 */
+	public static function is_jetpack_enabled(): bool {
+		return defined( 'JETPACK__VERSION' );
+	}
+
+	/**
+	 * Determine if the current request is a Jetpack XML-RPC request.
+	 *
+	 * @return bool
+	 */
+	public static function is_jetpack_xmlrpc_request(): bool {
+		// Bail if there's no remote address.
+		if ( empty( $_SERVER['REMOTE_ADDR'] ) ) {
+			return false;
+		}
+
+		// Get Jetpack IPs.
+		$jetpack_ips = self::get_jetpack_ips();
+
+		// Bail if we don't have any Jetpack IPs.
+		if ( empty( $jetpack_ips ) ) {
+			return false;
+		}
+
+		// Check if the request is from a Jetpack IP.
+		if ( IpUtils::checkIp( $_SERVER['REMOTE_ADDR'], $jetpack_ips ) ) {
+			return true;
+		}
+
+		// Check if the request is from a forwarded Jetpack IP.
+		return isset( $_SERVER['HTTP_X_FORWARDED_FOR'] ) && IpUtils::checkIp( $_SERVER['HTTP_X_FORWARDED_FOR'], $jetpack_ips );
+	}
+
+	/**
+	 * Get the Jetpack IPs.
+	 *
+	 * @return array
+	 */
+	public static function get_jetpack_ips(): array {
+		// Look for cache.
+		$jetpack_ips = wp_cache_get( 'jetpack_ips', 'alleyvate_disable_xmlrpc' );
+
+		// If there's no cache, fetch the Jetpack IPs.
+		if ( empty( $jetpack_ips ) ) {
+			$response = wp_safe_remote_get( 'https://jetpack.com/ips-v4.json' );
+			if ( ! is_wp_error( $response ) ) {
+				// Ensure good response.
+				if ( 200 === (int) wp_remote_retrieve_response_code( $response ) ) {
+					$body        = wp_remote_retrieve_body( $response );
+					$jetpack_ips = json_decode( $body, true );
+
+					// Update cache.
+					wp_cache_set(
+						'jetpack_ips',
+						$jetpack_ips,
+						'alleyvate_disable_xmlrpc',
+						is_array( $jetpack_ips ) ? WEEK_IN_SECONDS : HOUR_IN_SECONDS
+					);
+
+					return ( is_array( $jetpack_ips ) && ! empty( $jetpack_ips ) ) ? $jetpack_ips : [];
+				}
+			}
+		}
+
+		return [];
+	}
+}

src/alley/wp/alleyvate/load.php

@@ -69,6 +69,10 @@ function load(): void {
 			'disable_trackbacks',
 			new Features\Disable_Trackbacks(),
 		),
+		new Feature(
+			'disable_xmlrpc',
+			new Features\Disable_XMLRPC(),
+		),
 		new Feature(
 			'disallow_file_edit',
 			new Features\Disallow_File_Edit(),