0

I have a PHP(Laravel) application that pushes data to WooCommerce through the WooCommerce REST API, everything works except for images. I was able to pin this down to wp_safe_remote_get() and $args['reject_unsafe_urls'].

I had found a way around this, but I cannot recall where I found it. I seem to remember a hook in functions.php that turned off this feature. It wasn't recommended, but it is the only recourse.

Can anyone help me out? Or does anyone have another solution? I'm only pushing URLs from an application I made from the same server.

Code Example from External Application

$this->woocommerce->post('products', ['product' => $book_data_array])

where $this->woocommerce is an instance of the WooCommerce API.

and $book_data_array is an array of data. For an example of the data arra, see: 'http://woocommerce.github.io/woocommerce-rest-api-docs/wp-api-v1.html#create-a-product'

The only thing that doesn't work is images coming from the same server, which is a WordPress issue and has been confirmed as much by a WooCommerce dev. WordPress doesn't allow downloads from the same origin without an override.

6
  • Where is wp_safe_remote_get being called? By API I assume you mean the REST API?
    – Tom J Nowell
    May 4, 2017 at 12:15
  • wp_safe_remote_get is being called wherever WordPress calls it, I'm not calling it anywhere specifically. My assumption is the WooCommerce REST API is using the native WordPress REST API. I do mean REST API. You assumed correctly. May 4, 2017 at 12:23
  • Can we see the code you're using to create posts? Technically this falls under WooCommerce plugin support though, so there's a high chance this is out of scope/offtopic here
    – Tom J Nowell
    May 4, 2017 at 12:27
  • Posts are created through the PHP REST API. It isn't a WooCommerce issue, I've gone down that route. It is because WordPress uses wp_safe_remote_get to filter out URLs coming from the same server. May 4, 2017 at 12:46
  • I don't understand, are the URLs passed for post meta? Or are they embedded in the content? We really need to see the code that makes the REST API calls, you may disagree but where's the harm? You might get an answer that provides a different way of doing it that bypasses the problem entirely and gets you what you need. It also provides people with a way of replicating the issue and testing out solutions
    – Tom J Nowell
    May 4, 2017 at 13:02

2 Answers 2

0

This is the fix I found.

function turn_off_reject_unsafe_urls($args) {
    $args['reject_unsafe_urls'] = false;

    return $args;
}

add_filter( 'http_request_args', 'turn_off_reject_unsafe_urls');
5
  • 1
    this sounds wrong. you basically reduce the security of all requests being done, not just the ones that apply to you May 8, 2017 at 9:33
  • You are right, in a sense. I can add an if statement and a $url parameter, though I haven't tried it yet. Beyond that, I cannot find a solution other than changing the core files, which is futile. If you have any ideas, let me know. May 8, 2017 at 9:50
  • sorry, no other idea, I just wonder why is it that you run into it in the first place. is it possible it is just the specifics of your dev enviroment, and you might not need it on production? May 8, 2017 at 10:00
  • @MarkKaplun WordPress doesn't like URLs coming from the same server, so we ran into this issue. There are a few other people out there with a similar problem, and it is a really bizarre design decision. I'm sure they had a good reason, but it has created many problems for us in this case. May 8, 2017 at 16:30
  • 1
    I can understand why it is like this, it is supposed to prevent people to gain access via external APIs to private local resources.IMHO they should have had a way to white list things.... May 8, 2017 at 16:49
0

A safer way to archive the same result since WP 5.1, is to use http_request_reject_unsafe_urls filter:

function performize_turn_off_reject_unsafe_urls($ret,$url) 
{
    //here you can use regex or anything you want to check the url 
    
    if($url==='https://urltowhitelist')
        $ret = false;

    return $args;
}

add_filter( 'http_request_reject_unsafe_urls', 'performize_turn_off_reject_unsafe_urls',10,2 );

Also http_request_args use 2 parameters so if you want to use http_request_args you can do it in this way:

function turn_off_reject_unsafe_urls($args,$url) {
 if($url==='https://urltowhitelist')
    $args['reject_unsafe_urls'] = false;

    return $args;
}

add_filter( 'http_request_args', 'turn_off_reject_unsafe_urls',10,2);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.