$mode, self::TOKEN => $token, self::INDEX => $index, '_wpnonce' => wp_create_nonce( self::NONCE ), ), $page ); } /** * Turn this request into a scan of the page. Call it once allowed() * said yes, as early as can be (Core\Plugin: first at `plugins_loaded`): * what runs after it sees a visitor. * * @return void */ public static function begin(): void { $mode = self::argument( self::QUERY ); $token = self::argument( self::TOKEN ); $index = absint( self::argument( self::INDEX ) ); if ( ! defined( 'DONOTCACHEPAGE' ) ) { define( 'DONOTCACHEPAGE', true ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound -- The constant page caches agree on. } nocache_headers(); add_filter( 'wp_robots', 'wp_robots_no_robots' ); self::becomeVisitor(); // First in : registered before anything else of this plugin. ( new Probe( $mode, $index ) )->register(); if ( 'inventory' === $mode ) { add_action( 'template_redirect', array( new Observer( $token, $index ), 'start' ), 9999 ); return; } $manifest = Manifest::get(); if ( null !== $manifest ) { // The banner and the blocking as visitors have them, told to keep // quiet: no banner to look at, nothing reported (src/public). add_filter( 'wmcc_public_config', static function ( array $config ): array { $config['scan'] = true; return $config; } ); ( new Output( $manifest ) )->register(); } } /** * From here on, this request is a visitor's: nobody is logged in, and * the cookies that say otherwise are out of sight. Plugins that leave * their tracking out for administrators, or show members other pages, * do what they do for everyone else. * * @return void */ private static function becomeVisitor(): void { wp_set_current_user( 0 ); add_filter( 'show_admin_bar', '__return_false' ); // The names a site may have given its login cookies (wp-config.php), besides WordPress' own. $named = array(); foreach ( array( 'AUTH_COOKIE', 'SECURE_AUTH_COOKIE', 'LOGGED_IN_COOKIE', 'USER_COOKIE', 'PASS_COOKIE' ) as $constant ) { if ( defined( $constant ) ) { $named[] = (string) constant( $constant ); } } foreach ( array_keys( $_COOKIE ) as $name ) { if ( in_array( (string) $name, $named, true ) || 1 === preg_match( '/^(wordpress_|wp-settings-|wp_lang$)/', (string) $name ) ) { unset( $_COOKIE[ $name ] ); } } } }