HighPrivilegeContentModeratorCheck.php — Advanced Access Manager – Access Governance for WordPress trunk

advanced-access-manager / application / Audit / HighPrivilegeContentModeratorCheck.php

advanced-access-manager / application / Audit Last commit date

AuditCheckTrait.php 1 year ago CoreUserRoleOptionIntegrityCheck.php 1 year ago EditableFileSystemCheck.php 7 months ago ElevatedCoreRoleCheck.php 7 months ago EmptyUnusedRoleCheck.php 7 months ago HighPrivilegeContentModeratorCheck.php 7 months ago HighPrivilegeOrElevatedUserCheck.php 7 months ago HighPrivilegeRoleCheck.php 7 months ago HighPrivilegeUserCountCheck.php 7 months ago RestfulAutoDiscoverEndpointCheck.php 7 months ago RoleCapabilityNamingConventionCheck.php 7 months ago RoleIntegrityCheck.php 7 months ago RoleTransparencyCheck.php 7 months ago XmlRpcEndpointCheck.php 7 months ago

HighPrivilegeContentModeratorCheck.php

156 lines

1	<?php
2
3	/**
4	* ======================================================================
5	* LICENSE: This file is subject to the terms and conditions defined in *
6	* file 'license.txt', which is part of this source code package. *
7	* ======================================================================
8	*/
9
10	/**
11	* Check for the high privilege roles
12	*
13	* @package AAM
14	* @version 7.0.0
15	*/
16	class AAM_Audit_HighPrivilegeContentModeratorCheck
17	{
18
19	use AAM_Audit_AuditCheckTrait;
20
21	/**
22	* Step ID
23	*
24	* @version 7.0.0
25	*/
26	const ID = 'high_privilege_content_moderator_roles';
27
28	/**
29	* List of roles that are allowed to be high-privileged
30	*
31	* @version 7.0.0
32	*/
33	const WHITELISTED_ROLES = [
34	'administrator',
35	'editor'
36	];
37
38	/**
39	* List of core capabilities that can cause damage to the site's content
40	*
41	* @version 7.0.0
42	*/
43	const HIGH_PRIVILEGE_CAPS = [
44	'manage_categories',
45	'unfiltered_html',
46	'edit_published_pages',
47	'delete_published_pages',
48	'unfiltered_upload'
49	];
50
51	/**
52	* Run the check
53	*
54	* @return array
55	*
56	* @access public
57	* @static
58	*
59	* @version 7.0.0
60	*/
61	public static function run()
62	{
63	$issues = [];
64	$response = [ 'is_completed' => true ];
65
66	try {
67	// Scan for high privilege roles
68	array_push(
69	$issues,
70	...self::_scan_for_high_privilege_roles(self::_read_role_key_option())
71	);
72	} catch (Exception $e) {
73	array_push($issues, self::_format_issue(
74	'APPLICATION_ERROR',
75	[
76	'message' => $e->getMessage()
77	],
78	'error'
79	));
80	}
81
82	if (count($issues) > 0) {
83	$response['issues'] = $issues;
84	}
85
86	// Determine final status for the check
87	self::_determine_check_status($response);
88
89	return $response;
90	}
91
92	/**
93	* Get a collection of error messages for current step
94	*
95	* @return array
96	* @access private
97	* @static
98	*
99	* @version 7.0.0
100	*/
101	private static function _get_message_templates()
102	{
103	return [
104	'HIGH_CONTENT_MODERATOR_ROLE' => __(
105	'Detected high-privilege content moderator role %s (%s) with caps: %s',
106	'advanced-access-manager'
107	)
108	];
109	}
110
111	/**
112	* Scan for high-privilege roles that are not whitelisted
113	*
114	* @param array $db_roles
115	*
116	* @return array
117	*
118	* @access private
119	* @static
120	*
121	* @version 7.0.0
122	*/
123	private static function _scan_for_high_privilege_roles($db_roles)
124	{
125	$response = [];
126
127	foreach($db_roles as $role_id => $role) {
128	if (!in_array($role_id, self::WHITELISTED_ROLES)) {
129	$assigned_caps = array_keys(
130	array_filter($role['capabilities'], function($v) {
131	return !empty($v);
132	})
133	);
134
135	$matched = array_intersect($assigned_caps, self::HIGH_PRIVILEGE_CAPS);
136
137	if (!empty($matched)) {
138	array_push($response, self::_format_issue(
139	'HIGH_CONTENT_MODERATOR_ROLE',
140	[
141	'name' => translate_user_role(
142	!empty($role['name']) ? $role['name'] : $role_id
143	),
144	'slug' => $role_id,
145	'caps' => $matched
146	],
147	'critical'
148	));
149	}
150	}
151	}
152
153	return $response;
154	}
155
156	}