Tracking pixel recursion may have DoSed our website

[chriszs]

The tracking pixel tries to get the page title for the referring page. But what happens when the referrer is set to the URL of the pixel? In our case, it seems to have resulted in an infinite loop, puzzling metrics and a denial of service on our website.

[benlk]

In this section:

republication-tracker-tool/includes/pixel.php

Lines 45 to 57 in 4775fa7

	if( array_key_exists( 'HTTP_REFERER', $_SERVER ) ){
	if( isset( $_SERVER['HTTP_REFERER'] ) ){
	$url = esc_url_raw( $_SERVER['HTTP_REFERER'] );
	}
	$url_title = wprtt_get_referring_page_title( $url );
	$url_title = str_replace( ' ', '%20', $url_title );
	$url_host = parse_url( $url, PHP_URL_HOST );
	$url_path = parse_url( $url, PHP_URL_PATH );
	} else {

We'd want to compare $_SERVER['HTTP_REFERER'] to this site's name, in order to eliminate the false positive, and also include a short-circuit filter that would allow people to disable the lookup for whatever reason.

Also, since wprtt_get_referring_page_title( $url ) can return nothing, wrap the rest of that in a if ( ! empty() ) check as well.

[chriszs]

Could also set the referer sent by wp_remote_get to something other than the URL it's calling to prevent the recursive scenario from spiraling.