Automattic / Automattic/jetpack

Connection: review the use of the HTTP_RAW_POST_DATA global

Open
#18,463 0 comments 0 reactions 0 assignees View on GitHub
[Package] Connection [Pri] Low
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 18h
Merged PRs (30d)
774

Description

The `HTTP_RAW_POST_DATA` global [has been deprecated](https://github.com/Automattic/jetpack/issues/16488). We're using it to [set](https://github.com/Automattic/jetpack/blob/master/projects/packages/connection/src/class-manager.php#L2431) the `Manager::raw_post_data` property in `Manager::xmlrpc_methods`.

We should review the use of `HTTP_RAW_POST_DATA` and the `Manager::raw_post_data` property in the `Manager` class. For example, `$this->raw_post_data` is passed to the `jetpack_signature_check_token` filter hooks. Will this work properly if the `HTTP_RAW_POST_DATA` global is not populated?

Contributor guide

Open the contributing guide

Research direction

Start in projects/packages/connection/src/class-manager.php at the Manager::xmlrpc_methods code that sets Manager::raw_post_data from HTTP_RAW_POST_DATA. Trace how raw_post_data reaches the jetpack_signature_check_token filter hooks and determine the expected behavior when the global is absent; done means the deprecated global's use and filter behavior have been reviewed and addressed.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
api
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.