Automattic / Automattic/jetpack
Connection: review the use of the HTTP_RAW_POST_DATA global
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 898
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 774
Description
The `HTTP_RAW_POST_DATA` global [has been deprecated](https://github.com/Automattic/jetpack/issues/16488). We're using it to [set](https://github.com/Automattic/jetpack/blob/master/projects/packages/connection/src/class-manager.php#L2431) the `Manager::raw_post_data` property in `Manager::xmlrpc_methods`.
We should review the use of `HTTP_RAW_POST_DATA` and the `Manager::raw_post_data` property in the `Manager` class. For example, `$this->raw_post_data` is passed to the `jetpack_signature_check_token` filter hooks. Will this work properly if the `HTTP_RAW_POST_DATA` global is not populated?
Contributor guide
Research direction
Start in projects/packages/connection/src/class-manager.php at the Manager::xmlrpc_methods code that sets Manager::raw_post_data from HTTP_RAW_POST_DATA. Trace how raw_post_data reaches the jetpack_signature_check_token filter hooks and determine the expected behavior when the global is absent; done means the deprecated global's use and filter behavior have been reviewed and addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- api
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100