| 1 |
<?php |
| 2 |
// Direct calls to this file are Forbidden when core files are not present |
| 3 |
if ( ! function_exists ('add_action') ) { |
| 4 |
header('Status: 403 Forbidden'); |
| 5 |
header('HTTP/1.1 403 Forbidden'); |
| 6 |
exit(); |
| 7 |
} |
| 8 |
|
| 9 |
// jQuery ScrollTop Animation based on Browser User Agent |
| 10 |
// Opera uses the Chromium Rendering engine & the UA is Chrome |
| 11 |
function bpsPro_Browser_UA_scroll_animation() { |
| 12 |
|
| 13 |
$user_agent = esc_html($_SERVER['HTTP_USER_AGENT']); |
| 14 |
|
| 15 |
if ( preg_match( '/Chrome/i', $user_agent, $matches ) ) { ?> |
| 16 |
|
| 17 |
<script type="text/javascript"> |
| 18 |
/* <![CDATA[ */ |
| 19 |
jQuery(document).ready(function($){ |
| 20 |
|
| 21 |
$("html, body").animate({ scrollTop: "50px" }, 400, function(){ |
| 22 |
$("html, body").animate({ scrollTop: "0px" }); |
| 23 |
// essential for the jQuery UI Tabs framework hash anchors |
| 24 |
$( this ).css( "background", "url('') no-repeat left top" ); |
| 25 |
}); |
| 26 |
return false; |
| 27 |
}); |
| 28 |
/* ]]> */ |
| 29 |
</script> |
| 30 |
|
| 31 |
<?php } elseif ( preg_match( '/Firefox/i', $user_agent, $matches ) ) { ?> |
| 32 |
|
| 33 |
<script type="text/javascript"> |
| 34 |
/* <![CDATA[ */ |
| 35 |
jQuery(document).ready(function($){ |
| 36 |
|
| 37 |
$("html, body").animate({ scrollTop: "50px" }, 600, function(){ |
| 38 |
$("html, body").animate({ scrollTop: "0px" }); |
| 39 |
// essential for the jQuery UI Tabs framework hash anchors |
| 40 |
$( this ).css( "background", "url('') no-repeat left top" ); |
| 41 |
}); |
| 42 |
return false; |
| 43 |
}); |
| 44 |
/* ]]> */ |
| 45 |
</script> |
| 46 |
|
| 47 |
<?php } elseif ( preg_match( '/Safari/i', $user_agent, $matches ) ) { ?> |
| 48 |
|
| 49 |
<script type="text/javascript"> |
| 50 |
/* <![CDATA[ */ |
| 51 |
jQuery(document).ready(function($){ |
| 52 |
|
| 53 |
$("html, body").animate({ scrollTop: "100px" }, 600, function(){ |
| 54 |
$("html, body").animate({ scrollTop: "0px" }); |
| 55 |
// essential for the jQuery UI Tabs framework hash anchors |
| 56 |
$( this ).css( "background", "url('') no-repeat left top" ); |
| 57 |
}); |
| 58 |
return false; |
| 59 |
}); |
| 60 |
/* ]]> */ |
| 61 |
</script> |
| 62 |
|
| 63 |
<?php } elseif ( preg_match( '/MSIE/i', $user_agent, $matches ) || preg_match( '/Trident/i', $user_agent, $matches ) ) { ?> |
| 64 |
|
| 65 |
<script type="text/javascript"> |
| 66 |
/* <![CDATA[ */ |
| 67 |
jQuery(document).ready(function($){ |
| 68 |
|
| 69 |
$("html, body").animate({ scrollTop: "350px" }, 400, function(){ |
| 70 |
$("html, body").animate({ scrollTop: "0px" }); |
| 71 |
// essential for the jQuery UI Tabs framework hash anchors |
| 72 |
$( this ).css( "background", "url('') no-repeat left top" ); |
| 73 |
}); |
| 74 |
return false; |
| 75 |
}); |
| 76 |
/* ]]> */ |
| 77 |
</script> |
| 78 |
|
| 79 |
<?php } else { ?> |
| 80 |
|
| 81 |
<script type="text/javascript"> |
| 82 |
/* <![CDATA[ */ |
| 83 |
jQuery(document).ready(function($){ |
| 84 |
|
| 85 |
$("html, body").animate({ scrollTop: "50px" }, 400, function(){ |
| 86 |
$("html, body").animate({ scrollTop: "0px" }); |
| 87 |
// essential for the jQuery UI Tabs framework hash anchors |
| 88 |
$( this ).css( "background", "url('') no-repeat left top" ); |
| 89 |
}); |
| 90 |
return false; |
| 91 |
}); |
| 92 |
/* ]]> */ |
| 93 |
</script> |
| 94 |
<?php |
| 95 |
} |
| 96 |
} |
| 97 |
|
| 98 |
// Get the Current / Last Modifed Date of the bulletproof-security.php File - Minutes check |
| 99 |
function getBPSInstallTime() { |
| 100 |
$filename = WP_PLUGIN_DIR . '/bulletproof-security/bulletproof-security.php'; |
| 101 |
|
| 102 |
if ( file_exists($filename) ) { |
| 103 |
$gmt_offset = get_option( 'gmt_offset' ) * 3600; |
| 104 |
$last_modified_install = date("F d Y H:i", filemtime($filename) + $gmt_offset ); |
| 105 |
return $last_modified_install; |
| 106 |
} |
| 107 |
} |
| 108 |
|
| 109 |
// Get the Current / Last Modifed Date of the bulletproof-security.php File + one minute buffer - Minutes check |
| 110 |
function getBPSInstallTime_plusone() { |
| 111 |
$filename = WP_PLUGIN_DIR . '/bulletproof-security/bulletproof-security.php'; |
| 112 |
|
| 113 |
if ( file_exists($filename) ) { |
| 114 |
$gmt_offset = get_option( 'gmt_offset' ) * 3600; |
| 115 |
$last_modified_install = date("F d Y H:i", filemtime($filename) + $gmt_offset + (60 * 1)); |
| 116 |
return $last_modified_install; |
| 117 |
} |
| 118 |
} |
| 119 |
|
| 120 |
// Get the Current / Last Modifed Date of the Root .htaccess File - Minutes check |
| 121 |
function getBPSRootHtaccessLasModTime_minutes() { |
| 122 |
$filename = ABSPATH . '.htaccess'; |
| 123 |
|
| 124 |
if ( file_exists($filename) ) { |
| 125 |
$gmt_offset = get_option( 'gmt_offset' ) * 3600; |
| 126 |
$last_modified_install = date ("F d Y H:i", filemtime($filename) + $gmt_offset ); |
| 127 |
return $last_modified_install; |
| 128 |
} |
| 129 |
} |
| 130 |
|
| 131 |
// Get the Current / Last Modifed Date of the wp-admin .htaccess File - Minutes check |
| 132 |
function getBPSwpadminHtaccessLasModTime_minutes() { |
| 133 |
$filename = ABSPATH . 'wp-admin/.htaccess'; |
| 134 |
|
| 135 |
if ( file_exists($filename) ) { |
| 136 |
$gmt_offset = get_option( 'gmt_offset' ) * 3600; |
| 137 |
$last_modified_install = date ("F d Y H:i", filemtime($filename) + $gmt_offset ); |
| 138 |
return $last_modified_install; |
| 139 |
} |
| 140 |
} |
| 141 |
|
| 142 |
// Recreate the User Agent filters in the 403.php file on BPS upgrade |
| 143 |
function bpsPro_autoupdate_useragent_filters() { |
| 144 |
global $wpdb; |
| 145 |
|
| 146 |
$bps403File = WP_PLUGIN_DIR . '/bulletproof-security/403.php'; |
| 147 |
|
| 148 |
if ( ! file_exists($bps403File) ) { |
| 149 |
return; |
| 150 |
} |
| 151 |
|
| 152 |
$blankFile = WP_PLUGIN_DIR . '/bulletproof-security/admin/htaccess/blank.txt'; |
| 153 |
$userAgentMaster = WP_CONTENT_DIR . '/bps-backup/master-backups/UserAgentMaster.txt'; |
| 154 |
|
| 155 |
if ( file_exists($blankFile) ) { |
| 156 |
copy($blankFile, $userAgentMaster); |
| 157 |
} |
| 158 |
|
| 159 |
$table_name = $wpdb->prefix . "bpspro_seclog_ignore"; |
| 160 |
$search = ''; |
| 161 |
|
| 162 |
$getSecLogTable = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $table_name WHERE user_agent_bot LIKE %s", "%$search%" ) ); |
| 163 |
$UserAgentRules = array(); |
| 164 |
|
| 165 |
if ( $wpdb->num_rows != 0 ) { |
| 166 |
|
| 167 |
foreach ( $getSecLogTable as $row ) { |
| 168 |
$UserAgentRules[] = "(.*)".$row->user_agent_bot."(.*)|"; |
| 169 |
file_put_contents($userAgentMaster, $UserAgentRules); |
| 170 |
} |
| 171 |
|
| 172 |
$UserAgentRulesT = file_get_contents($userAgentMaster); |
| 173 |
$stringReplace = file_get_contents($bps403File); |
| 174 |
|
| 175 |
$stringReplace = preg_replace('/# BEGIN USERAGENT FILTER(.*)# END USERAGENT FILTER/s', "# BEGIN USERAGENT FILTER\nif ( !preg_match('/".trim($UserAgentRulesT, "|")."/', \$bpsPro_http_user_agent) ) {\n# END USERAGENT FILTER", $stringReplace); |
| 176 |
|
| 177 |
file_put_contents($bps403File, $stringReplace); |
| 178 |
} |
| 179 |
} |
| 180 |
|
| 181 |
// Update/Add/Save any new DB options/features during the BPS upgrades |
| 182 |
// bpsPro_new_version_db_options_files_autoupdate() is in general-functions.php |
| 183 |
function bpsPro_new_feature_autoupdate() { |
| 184 |
bpsPro_new_version_db_options_files_autoupdate(); |
| 185 |
} |
| 186 |
|
| 187 |
// BPS Status Display Admin notices |
| 188 |
function bps_status_display_admin_notices() { |
| 189 |
|
| 190 |
if ( preg_match( '/page=stories-dashboard/', esc_html($_SERVER['QUERY_STRING']) ) || preg_match( '/page=backwpupbackups/', esc_html( $_SERVER['QUERY_STRING'] ) ) || preg_match( '/post_type=ai1ec_event/', esc_html( $_SERVER['QUERY_STRING'] ) ) ) { |
| 191 |
return; |
| 192 |
} |
| 193 |
|
| 194 |
if ( current_user_can('manage_options') ) { |
| 195 |
bps_root_htaccess_status_dashboard(); |
| 196 |
bps_wpadmin_htaccess_status_dashboard(); |
| 197 |
bpsProMScanStatus(); |
| 198 |
bpsProDBBStatus(); |
| 199 |
bps_Login_Security_admin_notice_status_bps(); |
| 200 |
bps_jtc_antispam_admin_notice_status_bps(); |
| 201 |
bpsPro_isl_notice_status_bps(); |
| 202 |
bpsPro_ace_notice_status_bps(); |
| 203 |
} |
| 204 |
} |
| 205 |
|
| 206 |
add_action('admin_notices', 'bps_status_display_admin_notices'); |
| 207 |
|
| 208 |
// BPS Update/Upgrade Status Alert in WP Dashboard|Status Display BPS pages only |
| 209 |
function bps_root_htaccess_status_dashboard() { |
| 210 |
|
| 211 |
if ( current_user_can('manage_options') ) { |
| 212 |
|
| 213 |
global $bps_version, $bps_last_version, $aitpro_bullet, $pagenow; |
| 214 |
|
| 215 |
if ( preg_match( '/page=bulletproof-security.*mscan-scan-status.php/', esc_html($_SERVER['REQUEST_URI']) ) ) { |
| 216 |
return; |
| 217 |
} |
| 218 |
|
| 219 |
if ( esc_html($_SERVER['REQUEST_METHOD']) == 'POST' ) { |
| 220 |
|
| 221 |
$bps_status_display = get_option('bulletproof_security_options_status_display'); |
| 222 |
|
| 223 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] != 'Off' ) { |
| 224 |
|
| 225 |
if ( preg_match( '/page=bulletproof-security/', esc_html($_SERVER['REQUEST_URI']), $matches ) ) { |
| 226 |
|
| 227 |
$wp_admin_url = admin_url(); |
| 228 |
|
| 229 |
if ( 'update-core.php' != $pagenow ) { |
| 230 |
?> |
| 231 |
|
| 232 |
<div id="url-hash"></div> |
| 233 |
|
| 234 |
<script type="text/javascript"> |
| 235 |
/* <![CDATA[ */ |
| 236 |
var bpsPage = "<?php echo $wp_admin_url . 'admin.php?' . $_SERVER['QUERY_STRING']; ?>" |
| 237 |
var hash = window.location.hash; |
| 238 |
|
| 239 |
document.getElementById("url-hash").innerHTML = '<div id="bps-status-display" style="float:left;margin:6px 0px 0px 2px;padding:3px 5px 3px 5px;background-color:#e8e8e8;border:1px solid gray;"><a href="' + bpsPage + hash + '" style="text-decoration:none;font-weight:bold;">Reload BPS Status Display</a></div><div style="clear:both;"></div>'; |
| 240 |
/* ]]> */ |
| 241 |
</script> |
| 242 |
|
| 243 |
<?php |
| 244 |
} |
| 245 |
} |
| 246 |
} |
| 247 |
|
| 248 |
if ( isset($_POST['Submit-DBB-Run-Job']) && $_POST['Submit-DBB-Run-Job'] == true || isset($_POST['Submit-DB-Table-Prefix']) && $_POST['Submit-DB-Table-Prefix'] == true || isset($_POST['Submit-DB-Prefix-Table-Refresh']) && $_POST['Submit-DB-Prefix-Table-Refresh'] == true ) { |
| 249 |
|
| 250 |
$bpsPro_Spinner = get_option('bulletproof_security_options_spinner'); |
| 251 |
|
| 252 |
if ( $bpsPro_Spinner['bps_spinner'] != 'Off' ) { |
| 253 |
|
| 254 |
echo '<div id="bps-status-display" style="padding:2px 0px 4px 8px;width:240px;">'; |
| 255 |
echo '<div id="bps-spinner" class="bps-spinner" style="background:#fff;border:4px solid black;">'; |
| 256 |
echo '<img id="bps-img-spinner" src="'.plugins_url('/bulletproof-security/admin/images/bps-spinner.gif').'" style="float:left;margin:0px 20px 0px 0px;" />'; |
| 257 |
echo '<div id="bps-spinner-text-btn" style="padding:20px 0px 26px 0px;font-size:14px;">Processing...<br><button style="margin:10px 0px 0px 10px;" onclick="javascript:history.go(-1)">Cancel</button></div>'; |
| 258 |
echo '</div>'; |
| 259 |
?> |
| 260 |
|
| 261 |
<style> |
| 262 |
<!-- |
| 263 |
.bps-spinner { |
| 264 |
visibility:visible; |
| 265 |
position:fixed; |
| 266 |
top:7%; |
| 267 |
left:45%; |
| 268 |
width:240px; |
| 269 |
padding:2px 0px 4px 8px; |
| 270 |
z-index:99999; |
| 271 |
} |
| 272 |
--> |
| 273 |
</style> |
| 274 |
|
| 275 |
<?php |
| 276 |
echo '</div>'; |
| 277 |
} |
| 278 |
} |
| 279 |
|
| 280 |
} elseif ( esc_html($_SERVER['QUERY_STRING']) == 'page=bulletproof-security/admin/system-info/system-info.php' ) { |
| 281 |
|
| 282 |
$bps_status_display = get_option('bulletproof_security_options_status_display'); |
| 283 |
|
| 284 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] != 'Off' ) { |
| 285 |
|
| 286 |
echo '<div id="bps-status-display" style="float:left;padding:0px 0px 10px 0px;">'.__('The BPS Status Display is set to Off by default on the System Info page', 'bulletproof-security').'</div>'; |
| 287 |
echo '<div style="clear:both;"></div>'; |
| 288 |
} |
| 289 |
|
| 290 |
} else { |
| 291 |
|
| 292 |
$options = get_option('bulletproof_security_options_autolock'); |
| 293 |
$HFiles_options = get_option('bulletproof_security_options_htaccess_files'); |
| 294 |
|
| 295 |
$filename = ABSPATH . '.htaccess'; |
| 296 |
|
| 297 |
if ( file_exists($filename) ) { |
| 298 |
|
| 299 |
$permsHtaccess = substr(sprintf('%o', fileperms($filename)), -4); |
| 300 |
$sapi_type = php_sapi_name(); |
| 301 |
$check_string = file_get_contents($filename); |
| 302 |
$section = file_get_contents($filename, false, NULL, 3, 38); |
| 303 |
$bps_get_domain_root = bpsGetDomainRoot(); |
| 304 |
$bps_get_wp_root_secure = bps_wp_get_root_folder(); |
| 305 |
$bps_plugin_dir = str_replace( ABSPATH, '', WP_PLUGIN_DIR ); |
| 306 |
$bps_root_upgrade = ''; |
| 307 |
|
| 308 |
$patterna = '/RedirectMatch\s403\s\/\\\.\.\*\$/'; |
| 309 |
//$pattern0 = '/ErrorDocument\s404\s(.*)\/404\.php\s*ErrorDocument\s410\s(.*)410\.php/s'; |
| 310 |
$pattern0 = '/#{1,}(\s|){1,}ErrorDocument\s405(.*)\/bulletproof-security\/405\.php/'; |
| 311 |
$pattern1 = '/#\sFORBID\sEMPTY\sREFFERER\sSPAMBOTS(.*)RewriteCond\s%{HTTP_USER_AGENT}\s\^\$\sRewriteRule\s\.\*\s\-\s\[F\]/s'; |
| 312 |
// Only match 2 or more identical duplicate referer lines: 1 will not match and 2, 3, 4... will match |
| 313 |
$pattern2 = '/AnotherWebsite\.com\)\.\*\s*(RewriteCond\s%\{HTTP_REFERER\}\s\^\.\*'.$bps_get_domain_root.'\.\*\s*){2,}\s*RewriteRule\s\.\s\-\s\[S=1\]/s'; |
| 314 |
$pattern4 = '/\.\*\(allow_url_include\|allow_url_fopen\|safe_mode\|disable_functions\|auto_prepend_file\) \[NC,OR\]/s'; |
| 315 |
$pattern6 = '/(\[|\]|\(|\)|<|>|%3c|%3e|%5b|%5d)/s'; |
| 316 |
$pattern7 = '/RewriteCond %{QUERY_STRING} \^\.\*(.*)[3](.*)[5](.*)[5](.*)[7](.*)\)/'; |
| 317 |
$pattern8 = '/\[NC\]\s*RewriteCond\s%{HTTP_REFERER}\s\^\.\*(.*)\.\*\s*(.*)\s*(.*)\s*(.*)\s*(.*)\s*(.*)\s*RewriteRule\s\.\s\-\s\[S=1\]/'; |
| 318 |
$pattern9 = '/RewriteCond\s%{QUERY_STRING}\s\(sp_executesql\)\s\[NC\]\s*(.*)\s*(.*)END\sBPSQSE(.*)\s*RewriteCond\s%{REQUEST_FILENAME}\s!-f\s*RewriteCond\s%{REQUEST_FILENAME}\s!-d\s*RewriteRule\s\.(.*)\/index\.php\s\[L\]\s*(.*)LOOP\sEND/'; |
| 319 |
$pattern10 = '/#\sBEGIN\sBPSQSE\sBPS\sQUERY\sSTRING\sEXPLOITS\s*#\sThe\slibwww-perl\sUser\sAgent\sis\sforbidden/'; |
| 320 |
$pattern10a = '/RewriteCond\s%\{THE_REQUEST\}\s(.*)\?(.*)\sHTTP\/\s\[NC,OR\]\s*RewriteCond\s%\{THE_REQUEST\}\s(.*)\*(.*)\sHTTP\/\s\[NC,OR\]/'; |
| 321 |
$pattern10b = '/RewriteCond\s%\{THE_REQUEST\}\s.*\?\+\(%20\{1,\}.*\s*RewriteCond\s%\{THE_REQUEST\}\s.*\+\(.*\*\|%2a.*\s\[NC,OR\]/'; |
| 322 |
$pattern10c = '/RewriteCond\s%\{THE_REQUEST\}\s\(\\\\?.*%2a\)\+\(%20\+\|\\\\s\+.*HTTP\(:\/.*\[NC,OR\]/'; |
| 323 |
$pattern11 = '/RewriteCond\s%\{QUERY_STRING\}\s\[a-zA-Z0-9_\]\=http:\/\/\s\[OR\]/'; |
| 324 |
$pattern12 = '/RewriteCond\s%\{QUERY_STRING\}\s\[a-zA-Z0-9_\]\=\(\\\.\\\.\/\/\?\)\+\s\[OR\]/'; |
| 325 |
$pattern13 = '/RewriteCond\s%\{QUERY_STRING\}\s\(\\\.\\\.\/\|\\\.\\\.\)\s\[OR\]/'; |
| 326 |
$pattern14 = '/RewriteCond\s%{QUERY_STRING}\s\(\\\.\/\|\\\.\.\/\|\\\.\.\.\/\)\+\(motd\|etc\|bin\)\s\[NC,OR\]/'; |
| 327 |
$pattern_amod = '/#\sDENY\sBROWSER\sACCESS\sTO\sTHESE\sFILES(.*\s*){6,8}<FilesMatch(.*)wp-config(.*\s*){4,6}<\/FilesMatch>/'; |
| 328 |
$pattern15 = '/BPS\sPOST\sRequest\sAttack\sProtection/'; |
| 329 |
$pattern16 = '/#\sNEVER\sCOMMENT\sOUT\sTHIS\sLINE\sOF\sCODE\sBELOW\sFOR\sANY\sREASON(\s*){1}RewriteCond\s%\{REQUEST_URI\}\s\!\^\.\*\/wp-admin\/\s\[NC\]/'; |
| 330 |
$pattern17 = '/#\sNEVER\sCOMMENT\sOUT\sTHIS\sLINE\sOF\sCODE\sBELOW\sFOR\sANY\sREASON(\s*){1}#{1,}(\s|){1,}RewriteCond\s%\{REQUEST_URI\}\s\!\^\.\*\/wp-admin\/\s\[NC\]/'; |
| 331 |
$pattern18 = '/#\sREQUEST\sMETHODS\sFILTERED(.*)RewriteCond\s\%\{REQUEST_METHOD\}\s\^\(HEAD\|TRACE\|DELETE\|TRACK\|DEBUG\)\s\[NC\](\s*){1}RewriteRule\s\^\(\.\*\)\$\s\-\s\[F\]/s'; |
| 332 |
$pattern19 = '/RewriteRule\s\^\(\.\*\)\$\s\-\s\[R=405,L\]/'; |
| 333 |
// 2.3: Reverting: Match R,L for replacement to L |
| 334 |
$pattern20 = '/RewriteRule\s\^\(\.\*\)\$(.*)\/bulletproof-security\/405\.php\s\[R,L\]/'; |
| 335 |
$pattern21 = '/RewriteCond\s%\{THE_REQUEST\}\s\(\\\?.*%2a\)\+\(%20.*HTTP\(:\/.*\[NC,OR\]/'; |
| 336 |
$pattern22 = '/RewriteCond\s%\{QUERY_STRING\}\s\[a-zA-Z0-9_\]=http:\/\/\s\[NC,OR\]/'; |
| 337 |
$pattern23 = '/RewriteCond\s%\{QUERY_STRING\}\s\^\(\.\*\)cPath=http:\/\/\(\.\*\)\$\s\[NC,OR\]/'; |
| 338 |
$pattern24 = '/RewriteCond\s%\{QUERY_STRING\}\shttp\\\:\s\[NC,OR\](.*\s*){1}.*RewriteCond\s%\{QUERY_STRING\}\shttps\\\:\s\[NC,OR\]/'; |
| 339 |
// BPS 1.0: version numbering change. The string replace is on line 365 |
| 340 |
$BPSVpattern = '/BULLETPROOF\s\.[\d](.*)[\>]/'; |
| 341 |
$BPSVpattern2 = '/BULLETPROOF\s[\d]\.[\d]/'; |
| 342 |
$BPSVpattern3 = '/BULLETPROOF\s\.[\d][\d]\.[\d]/'; |
| 343 |
$BPSVreplace = "BULLETPROOF $bps_version"; |
| 344 |
} |
| 345 |
|
| 346 |
if ( ! file_exists($filename) ) { |
| 347 |
|
| 348 |
if ( $HFiles_options['bps_htaccess_files'] == 'disabled' ) { |
| 349 |
|
| 350 |
echo '<div id="bps-status-display" style="float:left;"><strong>'.__('BPS ', 'bulletproof-security').$bps_version.'</strong></div>'; |
| 351 |
|
| 352 |
} elseif ( $HFiles_options['bps_htaccess_files'] != 'disabled' ) { |
| 353 |
|
| 354 |
if ( ! get_option('bulletproof_security_options_wizard_free') ) { |
| 355 |
|
| 356 |
$text = '<div class="update-nag" style="BPS Setup Wizard Notification><font color="blue">'.__('BPS Setup Wizard Notification', 'bulletproof-security').'</font><br><a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/wizard/wizard.php' ).'">'.esc_attr__('Click Here', 'bulletproof-security').'</a>'.__(' to go to the BPS Setup Wizard page and click the Setup Wizard button to setup the BPS plugin.', 'bulletproof-security').'</div>'; |
| 357 |
echo $text; |
| 358 |
|
| 359 |
} else { |
| 360 |
|
| 361 |
$text = '<div class="update-nag" style="background-color:#dfecf2;border:1px solid #999;font-size:1em;font-weight:500;padding:2px 5px;margin-top:2px;-moz-border-radius-topleft:3px;-webkit-border-top-left-radius:3px;-khtml-border-top-left-radius:3px;border-top-left-radius:3px;-moz-border-radius-topright:3px;-webkit-border-top-right-radius:3px;-khtml-border-top-right-radius:3px;border-top-right-radius:3px;-webkit-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);-moz-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);"><font color="#fb0101">'.__('BPS Alert! An htaccess file was NOT found in your WordPress root folder', 'bulletproof-security').'</font><br>'.__('If you have deleted the root htaccess file for troubleshooting purposes you can disregard this Alert.', 'bulletproof-security').'<br>'.__('Go to the ', 'bulletproof-security').'<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/core/core.php' ).'">'.esc_attr__('Security Modes page', 'bulletproof-security').'</a>'.__(' and click the Root Folder BulletProof Mode Activate button.', 'bulletproof-security').'</div>'; |
| 362 |
echo $text; |
| 363 |
} |
| 364 |
} |
| 365 |
|
| 366 |
} else { |
| 367 |
|
| 368 |
if ( file_exists($filename) ) { |
| 369 |
|
| 370 |
switch ( $bps_version ) { |
| 371 |
case $bps_last_version: // for testing |
| 372 |
if ( strpos( $check_string, "BULLETPROOF $bps_last_version" ) && strpos( $check_string, "BPSQSE" ) ) { |
| 373 |
print($section); |
| 374 |
} |
| 375 |
break; |
| 376 |
case ! strpos( $check_string, "BULLETPROOF" ) && ! strpos( $check_string, "DEFAULT" ): |
| 377 |
|
| 378 |
// Setup Wizard Notice |
| 379 |
if ( ! get_option('bulletproof_security_options_wizard_free') ) { |
| 380 |
|
| 381 |
$text = '<div class="update-nag" style="background-color:#dfecf2;border:1px solid #999;font-size:1em;font-weight:600;padding:2px 5px;margin-top:2px;-moz-border-radius-topleft:3px;-webkit-border-top-left-radius:3px;-khtml-border-top-left-radius:3px;border-top-left-radius:3px;-moz-border-radius-topright:3px;-webkit-border-top-right-radius:3px;-khtml-border-top-right-radius:3px;border-top-right-radius:3px;-webkit-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);-moz-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);"><font color="blue">'.__('BPS Setup Wizard Notification', 'bulletproof-security').'</font><br><a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/wizard/wizard.php' ).'">'.esc_attr__('Click Here', 'bulletproof-security').'</a>'.__(' to go to the BPS Setup Wizard page and click the Setup Wizard button to setup the BPS plugin.', 'bulletproof-security').'</div>'; |
| 382 |
echo $text; |
| 383 |
|
| 384 |
} else { |
| 385 |
|
| 386 |
global $current_user; |
| 387 |
$user_id = $current_user->ID; |
| 388 |
|
| 389 |
if ( ! get_user_meta($user_id, 'bps_ignore_root_version_check_notice') ) { |
| 390 |
|
| 391 |
if ( esc_html($_SERVER['QUERY_STRING']) == '' && basename(esc_html($_SERVER['REQUEST_URI'])) != 'wp-admin' ) { |
| 392 |
$bps_base = basename(esc_html($_SERVER['REQUEST_URI'])) . '?'; |
| 393 |
} elseif ( esc_html($_SERVER['QUERY_STRING']) == '' && basename(esc_html($_SERVER['REQUEST_URI'])) == 'wp-admin' ) { |
| 394 |
$bps_base = basename( str_replace( 'wp-admin', 'index.php?', esc_html($_SERVER['REQUEST_URI']))); |
| 395 |
} else { |
| 396 |
$bps_base = str_replace( admin_url(), '', esc_html($_SERVER['REQUEST_URI']) ) . '&'; |
| 397 |
} |
| 398 |
|
| 399 |
$text = '<div class="update-nag" style="background-color:#dfecf2;border:1px solid #999;font-size:1em;font-weight:600;padding:2px 5px;margin-top:2px;-moz-border-radius-topleft:3px;-webkit-border-top-left-radius:3px;-khtml-border-top-left-radius:3px;border-top-left-radius:3px;-moz-border-radius-topright:3px;-webkit-border-top-right-radius:3px;-khtml-border-top-right-radius:3px;border-top-right-radius:3px;-webkit-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);-moz-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);"><font color="#fb0101">'.__('BPS Alert! Your site may not be protected by BulletProof Security', 'bulletproof-security').'</font><br>'.__('The BPS version: BULLETPROOF x.x SECURE .HTACCESS line of code was not found at the top of your Root htaccess file.', 'bulletproof-security').'<br>'.__('The BPS version line of code MUST be at the very top of your Root htaccess file.', 'bulletproof-security').'<br><a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/wizard/wizard.php' ).'">'.esc_attr__('Click Here', 'bulletproof-security').'</a>'.__(' to go to the BPS Setup Wizard page and click the Setup Wizard button to setup the BPS plugin again.', 'bulletproof-security').'<br>'.__('Important Note: If you manually added other htaccess code above the BPS version line of code in your root htaccess file, you can copy that code to BPS Root Custom Code so that your code is saved in the correct place in the BPS root htaccess file. ', 'bulletproof-security').'<br><a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/core/core.php#bps-tabs-7' ).'">'.esc_attr__('Click Here', 'bulletproof-security').'</a>'.__(' to go to the BPS Custom Code page, add your Root custom htaccess code in an appropriate Root Custom Code text box and click the Save Root Custom Code button before running the Setup Wizard again.', 'bulletproof-security').'<br>'.__('To Dismiss this Notice click the Dismiss Notice button below. To Reset Dismiss Notices click the Reset|Recheck Dismiss Notices button on the Alerts|Logs|Email Options page.', 'bulletproof-security').'<br><div style="float:left;margin:3px 0px 3px 0px;padding:2px 6px 2px 6px;background-color:#e8e8e8;border:1px solid gray;"><a href="'.$bps_base.'bps_root_version_check_nag_ignore=0'.'" style="text-decoration:none;font-weight:bold;">'.__('Dismiss Notice', 'bulletproof-security').'</a></div></div>'; |
| 400 |
echo $text; |
| 401 |
} |
| 402 |
} |
| 403 |
|
| 404 |
break; |
| 405 |
case ! strpos( $check_string, "BULLETPROOF $bps_version" ) && strpos( $check_string, "BPSQSE" ): |
| 406 |
|
| 407 |
// Update/Add/Save any New DB options/features on upgrade |
| 408 |
bpsPro_new_feature_autoupdate(); |
| 409 |
// mod_authz_core forward/backward compatibility: create new htaccess files if needed |
| 410 |
bpsPro_apache_mod_directive_check(); |
| 411 |
$Apache_Mod_options = get_option('bulletproof_security_options_apache_modules'); |
| 412 |
$BPSCustomCodeOptions = get_option('bulletproof_security_options_customcode'); |
| 413 |
// Recreate the User Agent filters in the 403.php file on BPS upgrade |
| 414 |
bpsPro_autoupdate_useragent_filters(); |
| 415 |
|
| 416 |
if ( substr($sapi_type, 0, 6) != 'apache' || $permsHtaccess != '0666' || $permsHtaccess != '0777') { // Windows IIS, XAMPP, etc |
| 417 |
chmod($filename, 0644); |
| 418 |
} |
| 419 |
|
| 420 |
$stringReplace = file_get_contents($filename); |
| 421 |
|
| 422 |
if ( preg_match($BPSVpattern, $stringReplace) ) { |
| 423 |
$stringReplace = preg_replace($BPSVpattern, $BPSVreplace, $stringReplace); |
| 424 |
} elseif ( preg_match($BPSVpattern2, $stringReplace) ) { |
| 425 |
$stringReplace = preg_replace($BPSVpattern2, $BPSVreplace, $stringReplace); |
| 426 |
} elseif ( preg_match($BPSVpattern3, $stringReplace) ) { |
| 427 |
$stringReplace = preg_replace($BPSVpattern3, $BPSVreplace, $stringReplace); |
| 428 |
} |
| 429 |
|
| 430 |
$stringReplace = str_replace("RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC,OR]", "RewriteCond %{HTTP_USER_AGENT} (havij|libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC,OR]", $stringReplace); |
| 431 |
|
| 432 |
if ( preg_match($patterna, $stringReplace, $matches) ) { |
| 433 |
$stringReplace = preg_replace('/#\sDENY\sACCESS\sTO\sPROTECTED\sSERVER\sFILES(.*)RedirectMatch\s403\s\/\\\.\.\*\$/s', "# DENY ACCESS TO PROTECTED SERVER FILES AND FOLDERS\n# Files and folders starting with a dot: .htaccess, .htpasswd, .errordocs, .logs\nRedirectMatch 403 \.(htaccess|htpasswd|errordocs|logs)$", $stringReplace); |
| 434 |
} |
| 435 |
|
| 436 |
// .53.1: Create new block of Error Logging and Tracking code & help text if Custom Code is blank & New ErrorDocument 405 code does not exist. |
| 437 |
if ( $BPSCustomCodeOptions['bps_customcode_error_logging'] == '' && ! preg_match( $pattern0, $stringReplace, $matches ) ) { |
| 438 |
$stringReplace = preg_replace('/#\sBPS\sERROR\sLOGGING\sAND\sTRACKING.*(ErrorDocument\s404(.*)\/404\.php|ErrorDocument\s410(.*)\/bulletproof-security\/410\.php)/s', "# BPS ERROR LOGGING AND TRACKING\n# Use BPS Custom Code to modify/edit/change this code and to save it permanently.\n# BPS has premade 400 Bad Request, 403 Forbidden, 404 Not Found, 405 Method Not Allowed and\n# 410 Gone template logging files that are used to track and log 400, 403, 404, 405 and 410 errors\n# that occur on your website. When a hacker attempts to hack your website the hackers IP address,\n# Host name, Request Method, Referering link, the file name or requested resource, the user agent\n# of the hacker and the query string used in the hack attempt are logged.\n# All BPS log files are htaccess protected so that only you can view them.\n# The 400.php, 403.php, 404.php, 405.php and 410.php files are located in /$bps_plugin_dir/bulletproof-security/\n# The 400, 403, 405 and 410 Error logging files are already set up and will automatically start logging errors\n# after you install BPS and have activated BulletProof Mode for your Root folder.\n# If you would like to log 404 errors you will need to copy the logging code in the BPS 404.php file\n# to your Theme's 404.php template file. Simple instructions are included in the BPS 404.php file.\n# You can open the BPS 404.php file using the WP Plugins Editor or manually editing the file.\n# NOTE: By default WordPress automatically looks in your Theme's folder for a 404.php Theme template file.\n\nErrorDocument 400 $bps_get_wp_root_secure"."$bps_plugin_dir/bulletproof-security/400.php\nErrorDocument 401 default\nErrorDocument 403 $bps_get_wp_root_secure"."$bps_plugin_dir/bulletproof-security/403.php\nErrorDocument 404 $bps_get_wp_root_secure"."404.php\nErrorDocument 405 $bps_get_wp_root_secure"."$bps_plugin_dir/bulletproof-security/405.php\nErrorDocument 410 $bps_get_wp_root_secure"."$bps_plugin_dir/bulletproof-security/410.php", $stringReplace); |
| 439 |
} |
| 440 |
|
| 441 |
// 2.0: Add additional https scheme conditions to 3 htaccess security rules and combine 2 rules into 1 rule. |
| 442 |
if ( preg_match( $pattern21, $stringReplace, $matches ) ) { |
| 443 |
$stringReplace = preg_replace( $pattern21, "RewriteCond %{THE_REQUEST} (\?|\*|%2a)+(%20+|\\\\\s+|%20+\\\\\s+|\\\\\s+%20+|\\\\\s+%20+\\\\\s+)(http|https)(:/|/) [NC,OR]", $stringReplace); |
| 444 |
} |
| 445 |
|
| 446 |
if ( preg_match( $pattern22, $stringReplace, $matches ) ) { |
| 447 |
$stringReplace = preg_replace( $pattern22, "RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(http|https):// [NC,OR]", $stringReplace); |
| 448 |
} |
| 449 |
|
| 450 |
if ( preg_match( $pattern23, $stringReplace, $matches ) ) { |
| 451 |
$stringReplace = preg_replace( $pattern23, "RewriteCond %{QUERY_STRING} ^(.*)cPath=(http|https)://(.*)$ [NC,OR]", $stringReplace); |
| 452 |
} |
| 453 |
|
| 454 |
if ( preg_match( $pattern24, $stringReplace, $matches ) ) { |
| 455 |
$stringReplace = preg_replace( $pattern24, "RewriteCond %{QUERY_STRING} (http|https)\: [NC,OR]", $stringReplace); |
| 456 |
} |
| 457 |
|
| 458 |
if ( preg_match($pattern1, $stringReplace, $matches) ) { |
| 459 |
$stringReplace = preg_replace('/#\sFORBID\sEMPTY\sREFFERER\sSPAMBOTS(.*)RewriteCond\s%{HTTP_USER_AGENT}\s\^\$\sRewriteRule\s\.\*\s\-\s\[F\]/s', '', $stringReplace); |
| 460 |
} |
| 461 |
|
| 462 |
if ( preg_match($pattern2, $stringReplace, $matches) ) { |
| 463 |
$stringReplace = preg_replace('/AnotherWebsite\.com\)\.\*\s*(RewriteCond\s%\{HTTP_REFERER\}\s\^\.\*'.$bps_get_domain_root.'\.\*\s*){2,}\s*RewriteRule\s\.\s\-\s\[S=1\]/s', "AnotherWebsite.com).*\nRewriteCond %{HTTP_REFERER} ^.*$bps_get_domain_root.*\nRewriteRule . - [S=1]", $stringReplace); |
| 464 |
} |
| 465 |
|
| 466 |
if ( ! preg_match($pattern10, $stringReplace, $matches) ) { |
| 467 |
$stringReplace = preg_replace('/#\sBPSQSE\sBPS\sQUERY\sSTRING\sEXPLOITS\s*#\sThe\slibwww-perl\sUser\sAgent\sis\sforbidden/', "# BEGIN BPSQSE BPS QUERY STRING EXPLOITS\n# The libwww-perl User Agent is forbidden", $stringReplace); |
| 468 |
} |
| 469 |
|
| 470 |
if ( preg_match($pattern10a, $stringReplace, $matches) ) { |
| 471 |
$stringReplace = preg_replace( $pattern10a, "RewriteCond %{THE_REQUEST} (\?|\*|%2a)+(%20+|\\\\\s+|%20+\\\\\s+|\\\\\s+%20+|\\\\\s+%20+\\\\\s+)HTTP(:/|/) [NC,OR]", $stringReplace); |
| 472 |
} |
| 473 |
|
| 474 |
if ( preg_match($pattern10b, $stringReplace, $matches) ) { |
| 475 |
$stringReplace = preg_replace( $pattern10b, "RewriteCond %{THE_REQUEST} (\?|\*|%2a)+(%20+|\\\\\s+|%20+\\\\\s+|\\\\\s+%20+|\\\\\s+%20+\\\\\s+)HTTP(:/|/) [NC,OR]", $stringReplace); |
| 476 |
} |
| 477 |
|
| 478 |
if ( preg_match($pattern10c, $stringReplace, $matches) ) { |
| 479 |
$stringReplace = preg_replace( $pattern10c, "RewriteCond %{THE_REQUEST} (\?|\*|%2a)+(%20+|\\\\\s+|%20+\\\\\s+|\\\\\s+%20+|\\\\\s+%20+\\\\\s+)HTTP(:/|/) [NC,OR]", $stringReplace); |
| 480 |
} |
| 481 |
|
| 482 |
if ( preg_match($pattern11, $stringReplace, $matches) ) { |
| 483 |
$stringReplace = preg_replace('/RewriteCond\s%\{QUERY_STRING\}\s\[a-zA-Z0-9_\]\=http:\/\/\s\[OR\]/s', "RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [NC,OR]", $stringReplace); |
| 484 |
} |
| 485 |
|
| 486 |
if ( preg_match($pattern12, $stringReplace, $matches) ) { |
| 487 |
$stringReplace = preg_replace('/RewriteCond\s%\{QUERY_STRING\}\s\[a-zA-Z0-9_\]\=\(\\\.\\\.\/\/\?\)\+\s\[OR\]/s', "RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [NC,OR]", $stringReplace); |
| 488 |
} |
| 489 |
|
| 490 |
if ( preg_match($pattern13, $stringReplace, $matches) ) { |
| 491 |
$stringReplace = preg_replace('/RewriteCond\s%\{QUERY_STRING\}\s\(\\\.\\\.\/\|\\\.\\\.\)\s\[OR\]/s', "RewriteCond %{QUERY_STRING} (\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f|%2e\.%2f|%2e\./|\.%2e%2f|\.%2e/) [NC,OR]", $stringReplace); |
| 492 |
} |
| 493 |
|
| 494 |
if ( preg_match($pattern6, $stringReplace, $matches)) { |
| 495 |
$stringReplace = str_replace("RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>|%3c|%3e|%5b|%5d).* [NC,OR]", "RewriteCond %{QUERY_STRING} ^.*(\(|\)|<|>|%3c|%3e).* [NC,OR]", $stringReplace); |
| 496 |
$stringReplace = str_replace("RewriteCond %{QUERY_STRING} ^.*(\x00|\x04|\x08|\x0d|\x1b|\x20|\x3c|\x3e|\x5b|\x5d|\x7f).* [NC,OR]", "RewriteCond %{QUERY_STRING} ^.*(\x00|\x04|\x08|\x0d|\x1b|\x20|\x3c|\x3e|\x7f).* [NC,OR]", $stringReplace); |
| 497 |
} |
| 498 |
|
| 499 |
if ( preg_match($pattern7, $stringReplace, $matches)) { |
| 500 |
$stringReplace = preg_replace('/RewriteCond %{QUERY_STRING} \^\.\*(.*)[5](.*)[5](.*)\)/', 'RewriteCond %{QUERY_STRING} ^.*(\x00|\x04|\x08|\x0d|\x1b|\x20|\x3c|\x3e|\x7f)', $stringReplace); |
| 501 |
} |
| 502 |
|
| 503 |
if ( preg_match($pattern14, $stringReplace, $matches) ) { |
| 504 |
$stringReplace = preg_replace('/RewriteCond\s%{QUERY_STRING}\s\(\\\.\/\|\\\.\.\/\|\\\.\.\.\/\)\+\(motd\|etc\|bin\)\s\[NC,OR\]/s', "RewriteCond %{QUERY_STRING} (\.{1,}/)+(motd|etc|bin) [NC,OR]", $stringReplace); |
| 505 |
} |
| 506 |
|
| 507 |
if ( ! preg_match($pattern4, $stringReplace, $matches) ) { |
| 508 |
$stringReplace = str_replace("RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]", "RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]\nRewriteCond %{QUERY_STRING} \-[sdcr].*(allow_url_include|allow_url_fopen|safe_mode|disable_functions|auto_prepend_file) [NC,OR]", $stringReplace); |
| 509 |
} |
| 510 |
|
| 511 |
if ( ! is_multisite() && ! preg_match($pattern9, $stringReplace, $matches) ) { |
| 512 |
$stringReplace = preg_replace('/RewriteCond\s%{QUERY_STRING}\s\(sp_executesql\)\s\[NC\]\s*(.*)\s*RewriteCond\s%{REQUEST_FILENAME}\s!-f\s*RewriteCond\s%{REQUEST_FILENAME}\s!-d\s*RewriteRule\s\.(.*)\/index\.php\s\[L\]/', "RewriteCond %{QUERY_STRING} (sp_executesql) [NC]\nRewriteRule ^(.*)$ - [F,L]\n# END BPSQSE BPS QUERY STRING EXPLOITS\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteRule . ".$bps_get_wp_root_secure."index.php [L]\n# WP REWRITE LOOP END", $stringReplace); |
| 513 |
} |
| 514 |
|
| 515 |
if ( preg_match( $pattern_amod, $stringReplace, $matches ) && $BPSCustomCodeOptions['bps_customcode_deny_files'] == '' && $Apache_Mod_options['bps_apache_mod_ifmodule'] == 'Yes' ) { |
| 516 |
|
| 517 |
$stringReplace = preg_replace( $pattern_amod, "# DENY BROWSER ACCESS TO THESE FILES\n# Use BPS Custom Code to modify/edit/change this code and to save it permanently.\n# wp-config.php, bb-config.php, php.ini, php5.ini, readme.html\n# To be able to view these files from a Browser, replace 127.0.0.1 with your actual\n# current IP address. Comment out: #Require all denied and Uncomment: Require ip 127.0.0.1\n# Comment out: #Deny from all and Uncomment: Allow from 127.0.0.1\n# Note: The BPS System Info page displays which modules are loaded on your server.\n\n<FilesMatch \"^(wp-config\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php)\">\n<IfModule mod_authz_core.c>\nRequire all denied\n#Require ip 127.0.0.1\n</IfModule>\n\n<IfModule !mod_authz_core.c>\n<IfModule mod_access_compat.c>\nOrder Allow,Deny\nDeny from all\n#Allow from 127.0.0.1\n</IfModule>\n</IfModule>\n</FilesMatch>", $stringReplace); |
| 518 |
|
| 519 |
} elseif ( preg_match( $pattern_amod, $stringReplace, $matches ) && $BPSCustomCodeOptions['bps_customcode_deny_files'] == '' && $Apache_Mod_options['bps_apache_mod_ifmodule'] == 'No' ) { |
| 520 |
|
| 521 |
$stringReplace = preg_replace( $pattern_amod, "# DENY BROWSER ACCESS TO THESE FILES\n# Use BPS Custom Code to modify/edit/change this code and to save it permanently.\n# wp-config.php, bb-config.php, php.ini, php5.ini, readme.html\n# To be able to view these files from a Browser, replace 127.0.0.1 with your actual\n# current IP address. Comment out: #Deny from all and Uncomment: Allow from 127.0.0.1\n# Note: The BPS System Info page displays which modules are loaded on your server.\n\n<FilesMatch \"^(wp-config\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php)\">\nOrder Allow,Deny\nDeny from all\n#Allow from 127.0.0.1\n</FilesMatch>", $stringReplace); |
| 522 |
} |
| 523 |
|
| 524 |
// .52.9: POST Request Attack Protection code correction|addition |
| 525 |
// .53: Condition added to allow commenting out wp-admin URI whitelist rule |
| 526 |
if ( preg_match( $pattern15, $stringReplace, $matches ) && ! preg_match( $pattern16, $stringReplace, $matches ) && ! preg_match( $pattern17, $stringReplace, $matches ) ) { |
| 527 |
$stringReplace = preg_replace('/RewriteCond\s%\{REQUEST_METHOD\}\sPOST\s\[NC\]/s', "RewriteCond %{REQUEST_METHOD} POST [NC]\n# NEVER COMMENT OUT THIS LINE OF CODE BELOW FOR ANY REASON\nRewriteCond %{REQUEST_URI} !^.*/wp-admin/ [NC]\n# Whitelist the WordPress Theme Customizer\nRewriteCond %{HTTP_REFERER} !^.*/wp-admin/customize.php", $stringReplace); |
| 528 |
} |
| 529 |
|
| 530 |
// Clean up - replace 3 and 4 multiple newlines with 1 newline |
| 531 |
if ( preg_match('/(\n\n\n|\n\n\n\n)/', $stringReplace, $matches) ) { |
| 532 |
$stringReplace = preg_replace("/(\n\n\n|\n\n\n\n)/", "\n", $stringReplace); |
| 533 |
} |
| 534 |
// remove duplicate referer lines |
| 535 |
if ( preg_match($pattern8, $stringReplace, $matches) ) { |
| 536 |
$stringReplace = preg_replace("/\[NC\]\s*RewriteCond\s%{HTTP_REFERER}\s\^\.\*(.*)\.\*\s*(.*)\s*(.*)\s*(.*)\s*(.*)\s*(.*)\s*RewriteRule\s\.\s\-\s\[S=1\]/", "[NC]\nRewriteCond %{HTTP_REFERER} ^.*$bps_get_domain_root.*\nRewriteRule . - [S=1]", $stringReplace); |
| 537 |
} |
| 538 |
|
| 539 |
file_put_contents($filename, $stringReplace); |
| 540 |
|
| 541 |
if ( isset($options['bps_root_htaccess_autolock']) && $options['bps_root_htaccess_autolock'] == 'On') { |
| 542 |
chmod($filename, 0404); |
| 543 |
} |
| 544 |
|
| 545 |
if ( getBPSInstallTime() == getBPSRootHtaccessLasModTime_minutes() || getBPSInstallTime_plusone() == getBPSRootHtaccessLasModTime_minutes() ) { |
| 546 |
|
| 547 |
$bps_root_upgrade = 'upgrade'; |
| 548 |
|
| 549 |
$pos = strpos( $check_string, 'IMPORTANT!!! DO NOT DELETE!!! - B E G I N Wordpress' ); |
| 550 |
|
| 551 |
if ( $pos === false ) { |
| 552 |
|
| 553 |
$updateText = '<div class="update-nag" style="float:left;"background-color:#dfecf2;border:1px solid #999;font-size:1em;font-weight:600;padding:2px 5px;margin-top:2px;-moz-border-radius-topleft:3px;-webkit-border-top-left-radius:3px;-khtml-border-top-left-radius:3px;border-top-left-radius:3px;-moz-border-radius-topright:3px;-webkit-border-top-right-radius:3px;-khtml-border-top-right-radius:3px;border-top-right-radius:3px;-webkit-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);-moz-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);><font color="blue">'.__("The BPS Automatic htaccess File Update Completed Successfully!", 'bulletproof-security').'</font></div>'; |
| 554 |
print($updateText); |
| 555 |
} |
| 556 |
} // end up upgrade processing |
| 557 |
break; |
| 558 |
case strpos( $check_string, "BULLETPROOF $bps_version" ) && strpos( $check_string, "BPSQSE" ): |
| 559 |
|
| 560 |
$bps_status_display = get_option('bulletproof_security_options_status_display'); |
| 561 |
|
| 562 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] != 'Off' ) { |
| 563 |
|
| 564 |
if ( preg_match( '/page=bulletproof-security/', esc_html($_SERVER['REQUEST_URI']), $matches ) ) { |
| 565 |
|
| 566 |
$RBM = $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/core/core.php' ).'" title="Root Folder BulletProof Mode" style="text-decoration:none;">'.__('RBM', 'bulletproof-security').'</a>: <font color="green"><strong>'.__('On', 'bulletproof-security').'</strong></font>'; |
| 567 |
$RBM_str = str_replace( "BULLETPROOF $bps_version SECURE .HTACCESS", "BPS $bps_version", $section ); |
| 568 |
|
| 569 |
echo '<div id="bps-status-display" style="float:left;font-weight:600;margin:0px 0px 0px 5px;"><strong>'.$RBM_str.'</strong>'.$RBM.'</div>'; |
| 570 |
} |
| 571 |
} |
| 572 |
break; |
| 573 |
default: |
| 574 |
|
| 575 |
if ( $bps_root_upgrade != 'upgrade' ) { |
| 576 |
|
| 577 |
$text = '<div class="update-nag" style="background-color:#dfecf2;border:1px solid #999;font-size:1em;font-weight:600;padding:2px 5px;margin-top:2px;-moz-border-radius-topleft:3px;-webkit-border-top-left-radius:3px;-khtml-border-top-left-radius:3px;border-top-left-radius:3px;-moz-border-radius-topright:3px;-webkit-border-top-right-radius:3px;-khtml-border-top-right-radius:3px;border-top-right-radius:3px;-webkit-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);-moz-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);"><font color="#fb0101">'.__('BPS Alert! Your site does not appear to be protected by BulletProof Security', 'bulletproof-security').'</font><br>'.__('Go to the ', 'bulletproof-security').'<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/core/core.php' ).'">'.esc_attr__('Security Modes page', 'bulletproof-security').'</a>'.__(' and click the Root Folder BulletProof Mode Activate button.', 'bulletproof-security').'</div>'; |
| 578 |
echo $text; |
| 579 |
} |
| 580 |
} |
| 581 |
} |
| 582 |
} |
| 583 |
} |
| 584 |
} |
| 585 |
} |
| 586 |
|
| 587 |
// 3.7: Changed the BPS version check in the root htaccess file to a Dismiss Notice |
| 588 |
add_action('admin_init', 'bps_root_version_check_nag_ignore'); |
| 589 |
|
| 590 |
function bps_root_version_check_nag_ignore() { |
| 591 |
global $current_user; |
| 592 |
$user_id = $current_user->ID; |
| 593 |
|
| 594 |
if ( isset($_GET['bps_root_version_check_nag_ignore']) && '0' == $_GET['bps_root_version_check_nag_ignore'] ) { |
| 595 |
add_user_meta($user_id, 'bps_ignore_root_version_check_notice', 'true', true); |
| 596 |
} |
| 597 |
} |
| 598 |
|
| 599 |
// BPS Update/Upgrade Status Alert in WP Dashboard|Status Display in BPS pages only |
| 600 |
function bps_wpadmin_htaccess_status_dashboard() { |
| 601 |
|
| 602 |
if ( current_user_can('manage_options') ) { |
| 603 |
|
| 604 |
global $bps_version, $bps_last_version, $aitpro_bullet; |
| 605 |
|
| 606 |
if ( preg_match( '/page=bulletproof-security.*mscan-scan-status.php/', esc_html($_SERVER['REQUEST_URI']) ) ) { |
| 607 |
return; |
| 608 |
} |
| 609 |
|
| 610 |
if ( esc_html($_SERVER['REQUEST_METHOD']) != 'POST' && esc_html($_SERVER['QUERY_STRING']) != 'page=bulletproof-security/admin/system-info/system-info.php' ) { |
| 611 |
|
| 612 |
$BPS_wpadmin_Options = get_option('bulletproof_security_options_htaccess_res'); |
| 613 |
$GDMW_options = get_option('bulletproof_security_options_GDMW'); |
| 614 |
|
| 615 |
if ( isset( $BPS_wpadmin_Options['bps_wpadmin_restriction'] ) && $BPS_wpadmin_Options['bps_wpadmin_restriction'] == 'disabled' || isset( $GDMW_options['bps_gdmw_hosting'] ) && $GDMW_options['bps_gdmw_hosting'] == 'yes' ) { |
| 616 |
return; |
| 617 |
} |
| 618 |
|
| 619 |
$HFiles_options = get_option('bulletproof_security_options_htaccess_files'); |
| 620 |
$filename = ABSPATH . 'wp-admin/.htaccess'; |
| 621 |
|
| 622 |
if ( file_exists($filename) ) { |
| 623 |
|
| 624 |
$permsHtaccess = substr(sprintf('%o', fileperms($filename)), -4); |
| 625 |
$check_string = file_get_contents($filename); |
| 626 |
$section = file_get_contents($filename, false, NULL, 3, 46); |
| 627 |
$bps_wpadmin_upgrade = ''; |
| 628 |
|
| 629 |
$pattern10a = '/RewriteCond\s%\{THE_REQUEST\}\s(.*)\?(.*)\sHTTP\/\s\[NC,OR\]\s*RewriteCond\s%\{THE_REQUEST\}\s(.*)\*(.*)\sHTTP\/\s\[NC,OR\]/'; |
| 630 |
$pattern10b = '/RewriteCond\s%\{THE_REQUEST\}\s.*\?\+\(%20\{1,\}.*\s*RewriteCond\s%\{THE_REQUEST\}\s.*\+\(.*\*\|%2a.*\s\[NC,OR\]/'; |
| 631 |
$pattern10c = '/RewriteCond\s%\{THE_REQUEST\}\s\(\\\\?.*%2a\)\+\(%20\+\|\\\\s\+.*HTTP\(:\/.*\[NC,OR\]/'; |
| 632 |
$pattern1 = '/(\[|\]|\(|\)|<|>)/s'; |
| 633 |
$pattern_amod = '/#\sWPADMIN\sDENY\sBROWSER\sACCESS\sTO\sFILES(.*\s*){13,16}#\sEND\sBPS\sWPADMIN\sDENY\sACCESS\sTO\sFILES/'; |
| 634 |
$pattern21 = '/RewriteCond\s%\{THE_REQUEST\}\s\(\\\?.*%2a\)\+\(%20.*HTTP\(:\/.*\[NC,OR\]/'; |
| 635 |
$pattern22 = '/RewriteCond\s%\{QUERY_STRING\}\s\[a-zA-Z0-9_\]=http:\/\/\s\[NC,OR\]/'; |
| 636 |
$pattern23 = '/RewriteCond\s%\{QUERY_STRING\}\s\^\(\.\*\)cPath=http:\/\/\(\.\*\)\$\s\[NC,OR\]/'; |
| 637 |
$pattern24 = '/RewriteCond\s%\{QUERY_STRING\}\shttp\\\:\s\[NC,OR\](.*\s*){1}.*RewriteCond\s%\{QUERY_STRING\}\shttps\\\:\s\[NC,OR\]/'; |
| 638 |
$pattern25 = '/#\sREQUEST\sMETHODS\sFILTERED(.*\s*){1}RewriteEngine\sOn(.*\s*){1}RewriteCond(.*\s*){1}RewriteRule\s\^\(\.\*\)\$\s\-\s\[F\]/'; |
| 639 |
$pattern26 = '/RewriteCond\s%\{REQUEST_URI\}\s\(press-this\\\.php\)\s\[NC\]/'; |
| 640 |
$BPSVpattern = '/BULLETPROOF\s\.[\d](.*)WP-ADMIN/'; |
| 641 |
$BPSVpattern2 = '/BULLETPROOF\s[\d]\.[\d]\sWP-ADMIN/'; |
| 642 |
$BPSVreplace = "BULLETPROOF $bps_version WP-ADMIN"; |
| 643 |
} |
| 644 |
|
| 645 |
if ( ! file_exists($filename) && isset($HFiles_options['bps_htaccess_files']) && $HFiles_options['bps_htaccess_files'] != 'disabled' ) { |
| 646 |
|
| 647 |
if ( get_option('bulletproof_security_options_wizard_free') ) { |
| 648 |
|
| 649 |
$text = '<div class="update-nag" style="background-color:#dfecf2;border:1px solid #999;font-size:1em;font-weight:600;padding:2px 5px;margin-top:2px;-moz-border-radius-topleft:3px;-webkit-border-top-left-radius:3px;-khtml-border-top-left-radius:3px;border-top-left-radius:3px;-moz-border-radius-topright:3px;-webkit-border-top-right-radius:3px;-khtml-border-top-right-radius:3px;border-top-right-radius:3px;-webkit-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);-moz-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);"><font color="#fb0101">'.__('BPS Alert! An htaccess file was NOT found in your WordPress wp-admin folder', 'bulletproof-security').'</font><br>'.__('If you have deleted the wp-admin htaccess file for troubleshooting purposes you can disregard this Alert.', 'bulletproof-security').'<br>'.__('Go to the ', 'bulletproof-security').'<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/core/core.php' ).'">'.esc_attr__('Security Modes page', 'bulletproof-security').'</a>'.__(' and click the wp-admin Folder BulletProof Mode Activate button.', 'bulletproof-security').'</div>'; |
| 650 |
echo $text; |
| 651 |
} |
| 652 |
|
| 653 |
} else { |
| 654 |
|
| 655 |
if ( file_exists($filename) ) { |
| 656 |
|
| 657 |
switch ( $bps_version ) { |
| 658 |
case $bps_last_version: // for Testing |
| 659 |
if ( strpos( $check_string, "BULLETPROOF $bps_last_version" ) && strpos( $check_string, "BPSQSE-check" ) ) { |
| 660 |
// echo or print for testing |
| 661 |
} |
| 662 |
break; |
| 663 |
case ! strpos( $check_string, "BULLETPROOF" ): |
| 664 |
|
| 665 |
// Setup Wizard Notice: not displayed. The Setup Wizard DB option is automatically saved in the root htaccess funcion on BPS plugin upgrades. |
| 666 |
if ( ! get_option('bulletproof_security_options_wizard_free') ) { |
| 667 |
// display nothing. Notice is already displayed in the root htaccess function. |
| 668 |
|
| 669 |
} else { |
| 670 |
|
| 671 |
$text = '<div class="update-nag" style="background-color:#dfecf2;border:1px solid #999;font-size:1em;font-weight:600;padding:2px 5px;margin-top:2px;-moz-border-radius-topleft:3px;-webkit-border-top-left-radius:3px;-khtml-border-top-left-radius:3px;border-top-left-radius:3px;-moz-border-radius-topright:3px;-webkit-border-top-right-radius:3px;-khtml-border-top-right-radius:3px;border-top-right-radius:3px;-webkit-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);-moz-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);"><font color="#fb0101">'.__('BPS Alert! Your wp-admin folder may not be protected by BulletProof Security', 'bulletproof-security').'</font><br>'.__('The BPS version: BULLETPROOF .xx.x WP-ADMIN SECURE .HTACCESS line of code was not found at the top of your wp-admin htaccess file.', 'bulletproof-security').'<br>'.__('The BPS version line of code MUST be at the very top of your wp-admin htaccess file.', 'bulletproof-security').'<br><a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/wizard/wizard.php' ).'">'.esc_attr__('Click Here', 'bulletproof-security').'</a>'.__(' to go to the BPS Setup Wizard page and click the Setup Wizard button to setup the BPS plugin again.', 'bulletproof-security').'<br>'.__('Important Note: If you manually added other htaccess code above the BPS version line of code in your wp-admin htaccess file, you can copy that code to BPS wp-admin Custom Code so that your code is saved in the correct place in the BPS wp-admin htaccess file. ', 'bulletproof-security').'<br><a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/core/core.php#bps-tabs-7' ).'">'.esc_attr__('Click Here', 'bulletproof-security').'</a>'.__(' to go to the BPS Custom Code page, add your wp-admin custom htaccess code in an appropriate wp-admin Custom Code text box and click the Save wp-admin Custom Code button before running the Setup Wizard again.', 'bulletproof-security').'</div>'; |
| 672 |
echo $text; |
| 673 |
} |
| 674 |
|
| 675 |
break; |
| 676 |
case ! strpos( $check_string, "BULLETPROOF $bps_version" ) && strpos( $check_string, "BPSQSE-check" ): |
| 677 |
|
| 678 |
// mod_authz_core forward/backward compatibility: create new htaccess files if needed |
| 679 |
bpsPro_apache_mod_directive_check(); |
| 680 |
$CC_Options_wpadmin = get_option('bulletproof_security_options_customcode_WPA'); |
| 681 |
$Apache_Mod_options = get_option('bulletproof_security_options_apache_modules'); |
| 682 |
$sapi_type = php_sapi_name(); |
| 683 |
|
| 684 |
if ( substr($sapi_type, 0, 6) != 'apache' || $permsHtaccess != '0666' || $permsHtaccess != '0777') { // Windows IIS, XAMPP, etc |
| 685 |
chmod($filename, 0644); |
| 686 |
} |
| 687 |
|
| 688 |
$stringReplace = file_get_contents($filename); |
| 689 |
|
| 690 |
if ( preg_match($BPSVpattern, $stringReplace) ) { |
| 691 |
$stringReplace = preg_replace($BPSVpattern, $BPSVreplace, $stringReplace); |
| 692 |
} elseif ( preg_match($BPSVpattern2, $stringReplace) ) { |
| 693 |
$stringReplace = preg_replace($BPSVpattern2, $BPSVreplace, $stringReplace); |
| 694 |
} |
| 695 |
|
| 696 |
if ( preg_match( $pattern_amod, $stringReplace, $matches ) && $CC_Options_wpadmin['bps_customcode_deny_files_wpa'] == '' && $Apache_Mod_options['bps_apache_mod_ifmodule'] == 'Yes' ) { |
| 697 |
|
| 698 |
$stringReplace = preg_replace( $pattern_amod, "# WPADMIN DENY BROWSER ACCESS TO FILES\n# Deny Browser access to /wp-admin/install.php\n# Use BPS Custom Code to modify/edit/change this code and to save it permanently.\n# To be able to view the install.php file from a Browser, replace 127.0.0.1 with your actual\n# current IP address. Comment out: #Require all denied and Uncomment: Require ip 127.0.0.1\n# Comment out: #Deny from all and Uncomment: Allow from 127.0.0.1\n# Note: The BPS System Info page displays which modules are loaded on your server.\n\n# BEGIN BPS WPADMIN DENY ACCESS TO FILES\n<FilesMatch \"^(install\.php)\">\n<IfModule mod_authz_core.c>\nRequire all denied\n#Require ip 127.0.0.1\n</IfModule>\n\n<IfModule !mod_authz_core.c>\n<IfModule mod_access_compat.c>\nOrder Allow,Deny\nDeny from all\n#Allow from 127.0.0.1\n</IfModule>\n</IfModule>\n</FilesMatch>\n# END BPS WPADMIN DENY ACCESS TO FILES", $stringReplace); |
| 699 |
|
| 700 |
} elseif ( preg_match( $pattern_amod, $stringReplace, $matches ) && $CC_Options_wpadmin['bps_customcode_deny_files_wpa'] == '' && $Apache_Mod_options['bps_apache_mod_ifmodule'] == 'No' ) { |
| 701 |
|
| 702 |
$stringReplace = preg_replace( $pattern_amod, "# WPADMIN DENY BROWSER ACCESS TO FILES\n# Deny Browser access to /wp-admin/install.php\n# Use BPS Custom Code to modify/edit/change this code and to save it permanently.\n# To be able to view the install.php file from a Browser, replace 127.0.0.1 with your actual\n# current IP address. Comment out: #Deny from all and Uncomment: Allow from 127.0.0.1\n# Note: The BPS System Info page displays which modules are loaded on your server.\n\n# BEGIN BPS WPADMIN DENY ACCESS TO FILES\n<FilesMatch \"^(install\.php)\">\nOrder Allow,Deny\nDeny from all\n#Allow from 127.0.0.1\n</FilesMatch>\n# END BPS WPADMIN DENY ACCESS TO FILES", $stringReplace); |
| 703 |
} |
| 704 |
|
| 705 |
if ( preg_match( $pattern26, $stringReplace, $matches ) ) { |
| 706 |
$stringReplace = preg_replace( $pattern26, "RewriteCond %{REQUEST_URI} (press-this\.php|widgets\.php) [NC]", $stringReplace); |
| 707 |
} |
| 708 |
|
| 709 |
if ( preg_match( $pattern25, $stringReplace, $matches ) ) { |
| 710 |
$stringReplace = preg_replace( $pattern25, "# BPS REWRITE ENGINE\nRewriteEngine On", $stringReplace); |
| 711 |
} |
| 712 |
|
| 713 |
if ( preg_match($pattern10a, $stringReplace, $matches) ) { |
| 714 |
$stringReplace = preg_replace( $pattern10a, "RewriteCond %{THE_REQUEST} (\?|\*|%2a)+(%20+|\\\\\s+|%20+\\\\\s+|\\\\\s+%20+|\\\\\s+%20+\\\\\s+)HTTP(:/|/) [NC,OR]", $stringReplace); |
| 715 |
} |
| 716 |
|
| 717 |
if ( preg_match($pattern10b, $stringReplace, $matches) ) { |
| 718 |
$stringReplace = preg_replace( $pattern10b, "RewriteCond %{THE_REQUEST} (\?|\*|%2a)+(%20+|\\\\\s+|%20+\\\\\s+|\\\\\s+%20+|\\\\\s+%20+\\\\\s+)HTTP(:/|/) [NC,OR]", $stringReplace); |
| 719 |
} |
| 720 |
|
| 721 |
if ( preg_match($pattern10c, $stringReplace, $matches) ) { |
| 722 |
$stringReplace = preg_replace( $pattern10c, "RewriteCond %{THE_REQUEST} (\?|\*|%2a)+(%20+|\\\\\s+|%20+\\\\\s+|\\\\\s+%20+|\\\\\s+%20+\\\\\s+)HTTP(:/|/) [NC,OR]", $stringReplace); |
| 723 |
} |
| 724 |
|
| 725 |
// 2.0: Add additional https scheme conditions to 3 htaccess security rules and combine 2 rules into 1 rule. |
| 726 |
if ( preg_match( $pattern21, $stringReplace, $matches ) ) { |
| 727 |
$stringReplace = preg_replace( $pattern21, "RewriteCond %{THE_REQUEST} (\?|\*|%2a)+(%20+|\\\\\s+|%20+\\\\\s+|\\\\\s+%20+|\\\\\s+%20+\\\\\s+)(http|https)(:/|/) [NC,OR]", $stringReplace); |
| 728 |
} |
| 729 |
|
| 730 |
if ( preg_match( $pattern22, $stringReplace, $matches ) ) { |
| 731 |
$stringReplace = preg_replace( $pattern22, "RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(http|https):// [NC,OR]", $stringReplace); |
| 732 |
} |
| 733 |
|
| 734 |
if ( preg_match( $pattern23, $stringReplace, $matches ) ) { |
| 735 |
$stringReplace = preg_replace( $pattern23, "RewriteCond %{QUERY_STRING} ^(.*)cPath=(http|https)://(.*)$ [NC,OR]", $stringReplace); |
| 736 |
} |
| 737 |
|
| 738 |
if ( preg_match( $pattern24, $stringReplace, $matches ) ) { |
| 739 |
$stringReplace = preg_replace( $pattern24, "RewriteCond %{QUERY_STRING} (http|https)\: [NC,OR]", $stringReplace); |
| 740 |
} |
| 741 |
|
| 742 |
if ( preg_match($pattern1, $stringReplace, $matches) ) { |
| 743 |
$stringReplace = str_replace("RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>).* [NC,OR]", "RewriteCond %{QUERY_STRING} ^.*(\(|\)|<|>).* [NC,OR]", $stringReplace); |
| 744 |
} |
| 745 |
|
| 746 |
file_put_contents($filename, $stringReplace); |
| 747 |
|
| 748 |
if ( getBPSInstallTime() == getBPSwpadminHtaccessLasModTime_minutes() || getBPSInstallTime_plusone() == getBPSwpadminHtaccessLasModTime_minutes() ) { |
| 749 |
//print("Testing wp-admin auto-update"); |
| 750 |
$bps_wpadmin_upgrade = 'upgrade'; |
| 751 |
} // end upgrade processing |
| 752 |
break; |
| 753 |
case strpos( $check_string, "BULLETPROOF $bps_version" ) && strpos( $check_string, "BPSQSE-check" ): |
| 754 |
|
| 755 |
$bps_status_display = get_option('bulletproof_security_options_status_display'); |
| 756 |
|
| 757 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] != 'Off' ) { |
| 758 |
|
| 759 |
if ( preg_match( '/page=bulletproof-security/', esc_html($_SERVER['REQUEST_URI']), $matches ) ) { |
| 760 |
|
| 761 |
$WBM = $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/core/core.php#RBM-Status' ).'" title="wp-admin Folder BulletProof Mode" style="text-decoration:none;">'.__('WBM', 'bulletproof-security').'</a>: <font color="green"><strong>'.__('On', 'bulletproof-security').'</strong></font>'; |
| 762 |
$WBM_str = str_replace( "BULLETPROOF $bps_version WP-ADMIN SECURE .HTACCESS", "$WBM", $section ); |
| 763 |
|
| 764 |
echo '<div id="bps-status-display" style="float:left;font-weight:600;margin:0px;">'.$WBM_str.'</div>'; |
| 765 |
} |
| 766 |
} |
| 767 |
break; |
| 768 |
default: |
| 769 |
|
| 770 |
if ( $bps_wpadmin_upgrade != 'upgrade' ) { |
| 771 |
|
| 772 |
$text = '<div class="update-nag" style="background-color:#dfecf2;border:1px solid #999;font-size:1em;font-weight:600;padding:2px 5px;margin-top:2px;-moz-border-radius-topleft:3px;-webkit-border-top-left-radius:3px;-khtml-border-top-left-radius:3px;border-top-left-radius:3px;-moz-border-radius-topright:3px;-webkit-border-top-right-radius:3px;-khtml-border-top-right-radius:3px;border-top-right-radius:3px;-webkit-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);-moz-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);"><font color="#fb0101">'.__('BPS Alert! A valid BPS htaccess file was NOT found in your wp-admin folder', 'bulletproof-security').'</font><br>'.__('BulletProof Mode for the wp-admin folder should also be activated when you have BulletProof Mode activated for the Root folder.', 'bulletproof-security').'</div>'; |
| 773 |
echo $text; |
| 774 |
} |
| 775 |
} |
| 776 |
} |
| 777 |
} |
| 778 |
} |
| 779 |
} |
| 780 |
} |
| 781 |
|
| 782 |
// MScan Status display BPS pages only |
| 783 |
// Displays the question mark hover icon if a scan has not been run or the Delete Scan Status Tool has been used. |
| 784 |
// Displays last scan timestamp when scheduled scans are Off > MSCAN: August 3, 2017 8:45 am |
| 785 |
// BPS Pro only (code removed): Displays next scheduled cron job when scheduled scan frequency is used > MSCAN: On : 60 Min : 9:30 am |
| 786 |
function bpsProMScanStatus() { |
| 787 |
|
| 788 |
if ( current_user_can('manage_options') ) { |
| 789 |
global $aitpro_bullet; |
| 790 |
|
| 791 |
if ( preg_match( '/page=bulletproof-security.*mscan-scan-status.php/', esc_html($_SERVER['REQUEST_URI']) ) ) { |
| 792 |
return; |
| 793 |
} |
| 794 |
|
| 795 |
if ( esc_html($_SERVER['REQUEST_METHOD']) != 'POST' && esc_html($_SERVER['QUERY_STRING']) != 'page=bulletproof-security/admin/system-info/system-info.php' ) { |
| 796 |
|
| 797 |
$bps_status_display = get_option('bulletproof_security_options_status_display'); |
| 798 |
|
| 799 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] == 'Off' ) { |
| 800 |
return; |
| 801 |
} |
| 802 |
|
| 803 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] != 'Off' && preg_match( '/page=bulletproof-security/', esc_html($_SERVER['REQUEST_URI']), $matches ) ) { |
| 804 |
|
| 805 |
// New BPS installation - do not display status |
| 806 |
if ( ! get_option('bulletproof_security_options_wizard_free') ) { |
| 807 |
return; |
| 808 |
} |
| 809 |
|
| 810 |
$MScan_status = get_option('bulletproof_security_options_MScan_status'); |
| 811 |
|
| 812 |
?> |
| 813 |
|
| 814 |
<style> |
| 815 |
<!-- |
| 816 |
div.mscan-tooltip {display:inline-block;position:relative;} |
| 817 |
div.mscan-tooltip:hover {z-index:10;} |
| 818 |
div.mscan-tooltip img:hover {z-index:10;} |
| 819 |
div.mscan-tooltip span {display:none;position:absolute;bottom:0;left:0;right:0;} |
| 820 |
div.mscan-tooltip:hover span {width:500px;height:60px;display:block;position:absolute;top:30px;left:5px;right:0;color:#000;background-color:#dfecf2;border:1px solid #999;font-size:1em;font-weight:600;padding:2px 5px;margin-top:2px;-moz-border-radius-topleft:3px;-webkit-border-top-left-radius:3px;-khtml-border-top-left-radius:3px;border-top-left-radius:3px;-moz-border-radius-topright:3px;-webkit-border-top-right-radius:3px;-khtml-border-top-right-radius:3px;border-top-right-radius:3px;-webkit-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);-moz-box-shadow:3px 3px 5px -1px rgba(153,153,153,0.7);box-shadow:3px 3px 5px -1px rgba(153,153,153,0.7);} |
| 821 |
--> |
| 822 |
</style> |
| 823 |
|
| 824 |
<?php |
| 825 |
$bps_question_mark_mscan = '<div class="mscan-tooltip"><img src="'.plugins_url('/bulletproof-security/admin/images/question-mark.png').'" style="position:relative;top:3px;right:1px;" /><span>An MScan scan has not been run yet. To run an MScan scan go to the MScan page or you can just ignore this hover tooltip and not run a scan.</span></div>'; |
| 826 |
|
| 827 |
if ( ! isset($MScan_status['bps_mscan_status']) || ! isset($MScan_status['bps_mscan_last_scan_timestamp']) ) { |
| 828 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:-2px 0px 0px 0px;">' . $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/mscan/mscan.php' ).'" title="MScan Malware Scanner" style="text-decoration:none;">'.esc_attr__('MSCAN', 'bulletproof-security').'</a>: '.$bps_question_mark_mscan.'</div>'; |
| 829 |
echo $text; |
| 830 |
return; |
| 831 |
} |
| 832 |
|
| 833 |
$MScan_options = get_option('bulletproof_security_options_MScan'); |
| 834 |
|
| 835 |
if ( $MScan_options['mscan_scan_frequency'] == 'Off' ) { |
| 836 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:0px;">' . $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/mscan/mscan.php' ).'" title="MScan Malware Scanner" style="text-decoration:none;">'.esc_attr__('MSCAN', 'bulletproof-security').'</a>: <font color="green"><strong>'.$MScan_status['bps_mscan_last_scan_timestamp'].'</strong></font></div>'; |
| 837 |
echo $text; |
| 838 |
|
| 839 |
} |
| 840 |
} |
| 841 |
} |
| 842 |
} |
| 843 |
} |
| 844 |
|
| 845 |
// DB Backup Status display BPS pages only |
| 846 |
// First time installations and upgrades the DB option bps_db_backup_status_display has value "No DB Backups" |
| 847 |
// When a Backup Job is created for the first time the value is "Backup Job Created" - one time/one-shot option |
| 848 |
// All DB Backup options are automatically created and saved for new installations and upgrades |
| 849 |
function bpsProDBBStatus() { |
| 850 |
|
| 851 |
if ( current_user_can('manage_options') ) { |
| 852 |
|
| 853 |
global $aitpro_bullet; |
| 854 |
|
| 855 |
if ( preg_match( '/page=bulletproof-security.*mscan-scan-status.php/', esc_html($_SERVER['REQUEST_URI']) ) ) { |
| 856 |
return; |
| 857 |
} |
| 858 |
|
| 859 |
if ( esc_html($_SERVER['REQUEST_METHOD']) != 'POST' && esc_html($_SERVER['QUERY_STRING']) != 'page=bulletproof-security/admin/system-info/system-info.php' ) { |
| 860 |
|
| 861 |
$bps_status_display = get_option('bulletproof_security_options_status_display'); |
| 862 |
|
| 863 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] == 'Off' ) { |
| 864 |
return; |
| 865 |
} |
| 866 |
|
| 867 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] != 'Off' && preg_match( '/page=bulletproof-security/', esc_html($_SERVER['REQUEST_URI']), $matches ) ) { |
| 868 |
|
| 869 |
// New BPS installation - do not display status |
| 870 |
if ( ! get_option('bulletproof_security_options_wizard_free') ) { |
| 871 |
return; |
| 872 |
} |
| 873 |
|
| 874 |
$DBBoptions = get_option('bulletproof_security_options_db_backup'); |
| 875 |
?> |
| 876 |
|
| 877 |
<style> |
| 878 |
<!-- |
| 879 |
div.dbb-status-tooltip {display:inline-block;position:relative;} |
| 880 |
div.dbb-status-tooltip:hover {z-index:10;} |
| 881 |
div.dbb-status-tooltip img:hover {z-index:10;} |
| 882 |
div.dbb-status-tooltip span {display:none;position:absolute;bottom:0;left:0;right:0;} |
| 883 |
div.dbb-status-tooltip:hover span {width:500px;height:60px;display:block;position:absolute;top:30px;left:5px;right:0;color:#000;background-color:#dfecf2;border:1px solid #999;font-size:1em;font-weight:600;padding:2px 5px;margin-top:2px;-moz-border-radius-topleft:3px;-webkit-border-top-left-radius:3px;-khtml-border-top-left-radius:3px;border-top-left-radius:3px;-moz-border-radius-topright:3px;-webkit-border-top-right-radius:3px;-khtml-border-top-right-radius:3px;border-top-right-radius:3px;-webkit-box-shadow: 3px 3px 5px -1px rgba(153,153,153,0.7);-moz-box-shadow:3px 3px 5px -1px rgba(153,153,153,0.7);box-shadow:3px 3px 5px -1px rgba(153,153,153,0.7);} |
| 884 |
--> |
| 885 |
</style> |
| 886 |
|
| 887 |
<?php |
| 888 |
$bps_qm_dbb1 = '<div class="dbb-status-tooltip"><img src="'.plugins_url('/bulletproof-security/admin/images/question-mark.png').'" style="position:relative;top:3px;right:1px;" /><span>A BPS DB Backup has not been performed yet. To run a DB Backup go to the BPS DB Backup page, create a Backup Job and run the Backup Job or you can just ignore this hover tooltip and not perform a DB Backup.</span></div>'; |
| 889 |
|
| 890 |
$bps_qm_dbb2 = '<div class="dbb-status-tooltip"><img src="'.plugins_url('/bulletproof-security/admin/images/question-mark.png').'" style="position:relative;top:3px;right:1px;" /><span>A BPS DB Backup Job has been created. To run a DB Backup go to the BPS DB Backup page and run the Backup Job or you can just ignore this hover tooltip and not perform a DB Backup.</span></div>'; |
| 891 |
|
| 892 |
if ( isset($DBBoptions['bps_db_backup_status_display']) && $DBBoptions['bps_db_backup_status_display'] == 'No DB Backups' || isset($DBBoptions['bps_db_backup_status_display']) && $DBBoptions['bps_db_backup_status_display'] == '' ) { |
| 893 |
|
| 894 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:-2px 0px 0px 0px;">' . $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/db-backup-security/db-backup-security.php' ).'" title="Database Backup" style="text-decoration:none;">'.esc_attr__('DBB', 'bulletproof-security').'</a>: '.$bps_qm_dbb1.'</div>'; |
| 895 |
echo $text; |
| 896 |
|
| 897 |
} elseif ( isset($DBBoptions['bps_db_backup_status_display']) && $DBBoptions['bps_db_backup_status_display'] == 'Backup Job Created' ) { |
| 898 |
|
| 899 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:-2px 0px 0px 0px;">' . $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/db-backup-security/db-backup-security.php' ).'" title="Database Backup" style="text-decoration:none;">'.esc_attr__('DBB', 'bulletproof-security').'</a>: '.$bps_qm_dbb2.'</div>'; |
| 900 |
echo $text; |
| 901 |
|
| 902 |
} else { |
| 903 |
|
| 904 |
$bps_db_backup_status_display = isset($DBBoptions['bps_db_backup_status_display']) ? $DBBoptions['bps_db_backup_status_display'] : ''; |
| 905 |
|
| 906 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:0px;">' . $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/db-backup-security/db-backup-security.php' ).'" title="Database Backup" style="text-decoration:none;">'.esc_attr__('DBB', 'bulletproof-security').'</a>: <font color="green"><strong>'.$bps_db_backup_status_display.'</strong></font></div>'; |
| 907 |
echo $text; |
| 908 |
} |
| 909 |
} |
| 910 |
} |
| 911 |
} |
| 912 |
} |
| 913 |
|
| 914 |
// Login Security Status display - BPS pages ONLY |
| 915 |
function bps_Login_Security_admin_notice_status_bps() { |
| 916 |
global $aitpro_bullet; |
| 917 |
|
| 918 |
if ( current_user_can('manage_options') ) { |
| 919 |
|
| 920 |
if ( preg_match( '/page=bulletproof-security.*mscan-scan-status.php/', esc_html($_SERVER['REQUEST_URI']) ) ) { |
| 921 |
return; |
| 922 |
} |
| 923 |
|
| 924 |
if ( esc_html($_SERVER['REQUEST_METHOD']) != 'POST' && esc_html($_SERVER['QUERY_STRING']) != 'page=bulletproof-security/admin/system-info/system-info.php' ) { |
| 925 |
|
| 926 |
$bps_status_display = get_option('bulletproof_security_options_status_display'); |
| 927 |
|
| 928 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] == 'Off' ) { |
| 929 |
return; |
| 930 |
} |
| 931 |
|
| 932 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] != 'Off' && preg_match( '/page=bulletproof-security/', esc_html($_SERVER['REQUEST_URI']), $matches ) ) { |
| 933 |
|
| 934 |
// New BPS installation - do not display status |
| 935 |
if ( ! get_option('bulletproof_security_options_wizard_free') ) { |
| 936 |
return; |
| 937 |
} |
| 938 |
|
| 939 |
$BPSoptions = get_option('bulletproof_security_options_login_security'); |
| 940 |
|
| 941 |
if ( $BPSoptions['bps_login_security_OnOff'] == 'On' ) { |
| 942 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:0px;">' . $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/login/login.php' ).'" title="Login Security & Monitoring" style="text-decoration:none;">'.esc_attr__('LSM', 'bulletproof-security').'</a>: <font color="green">'.__('On', 'bulletproof-security').'</font></div>'; |
| 943 |
echo $text; |
| 944 |
} |
| 945 |
|
| 946 |
if ( ! $BPSoptions['bps_login_security_OnOff'] || $BPSoptions['bps_login_security_OnOff'] == 'Off' || $BPSoptions['bps_login_security_OnOff'] == '' || $BPSoptions['bps_login_security_OnOff'] == 'pwreset' ) { |
| 947 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:0px;">' . $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/login/login.php' ).'" title="Login Security & Monitoring" style="text-decoration:none;">'.__('LSM', 'bulletproof-security').'</a>: <font color="#fb0101">'.__('Off', 'bulletproof-security').'</font></div>'; |
| 948 |
echo $text; |
| 949 |
} |
| 950 |
} |
| 951 |
} |
| 952 |
} |
| 953 |
} |
| 954 |
|
| 955 |
// JTC-Lite Status display - BPS pages ONLY |
| 956 |
function bps_jtc_antispam_admin_notice_status_bps() { |
| 957 |
global $aitpro_bullet; |
| 958 |
|
| 959 |
if ( current_user_can('manage_options') ) { |
| 960 |
|
| 961 |
if ( preg_match( '/page=bulletproof-security.*mscan-scan-status.php/', esc_html($_SERVER['REQUEST_URI']) ) ) { |
| 962 |
return; |
| 963 |
} |
| 964 |
|
| 965 |
if ( esc_html($_SERVER['REQUEST_METHOD']) != 'POST' && esc_html($_SERVER['QUERY_STRING']) != 'page=bulletproof-security/admin/system-info/system-info.php' ) { |
| 966 |
|
| 967 |
$bps_status_display = get_option('bulletproof_security_options_status_display'); |
| 968 |
|
| 969 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] == 'Off' ) { |
| 970 |
return; |
| 971 |
} |
| 972 |
|
| 973 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] != 'Off' && preg_match( '/page=bulletproof-security/', esc_html($_SERVER['REQUEST_URI']), $matches ) ) { |
| 974 |
|
| 975 |
// New BPS installation - do not display status |
| 976 |
if ( ! get_option('bulletproof_security_options_wizard_free') ) { |
| 977 |
return; |
| 978 |
} |
| 979 |
|
| 980 |
$BPSoptionsJTC = get_option('bulletproof_security_options_login_security_jtc'); |
| 981 |
|
| 982 |
if ( ! get_option('bulletproof_security_options_idle_session') && ! get_option('bulletproof_security_options_auth_cookie') ) { |
| 983 |
$status_DDiv = '</div><div style="clear:both;"></div>'; |
| 984 |
} else { |
| 985 |
$status_DDiv = '</div>'; |
| 986 |
} |
| 987 |
|
| 988 |
if ( $BPSoptionsJTC['bps_jtc_login_form'] == '1' ) { |
| 989 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:0px;">' . $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/login/login.php#bps-tabs-2' ).'" title="JTC-Lite" style="text-decoration:none;">'.esc_attr__('JTC', 'bulletproof-security').'</a>: <font color="green">'.__('On', 'bulletproof-security').'</font>'.$status_DDiv; |
| 990 |
echo $text; |
| 991 |
} |
| 992 |
|
| 993 |
if ( $BPSoptionsJTC['bps_jtc_login_form'] != '1' ) { |
| 994 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:0px;">' . $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/login/login.php#bps-tabs-2' ).'" title="'.esc_attr( 'JTC-Lite' ).'" style="text-decoration:none;">'.__('JTC', 'bulletproof-security').'</a>: <font color="#fb0101">'.__('Off', 'bulletproof-security').'</font>'.$status_DDiv; |
| 995 |
echo $text; |
| 996 |
} |
| 997 |
} |
| 998 |
} |
| 999 |
} |
| 1000 |
} |
| 1001 |
|
| 1002 |
// Idle Session Logout ISL Status display - BPS pages ONLY |
| 1003 |
function bpsPro_isl_notice_status_bps() { |
| 1004 |
global $aitpro_bullet; |
| 1005 |
|
| 1006 |
if ( current_user_can('manage_options') ) { |
| 1007 |
|
| 1008 |
if ( preg_match( '/page=bulletproof-security.*mscan-scan-status.php/', esc_html($_SERVER['REQUEST_URI']) ) ) { |
| 1009 |
return; |
| 1010 |
} |
| 1011 |
|
| 1012 |
if ( esc_html($_SERVER['REQUEST_METHOD']) != 'POST' && esc_html($_SERVER['QUERY_STRING']) != 'page=bulletproof-security/admin/system-info/system-info.php' ) { |
| 1013 |
|
| 1014 |
$bps_status_display = get_option('bulletproof_security_options_status_display'); |
| 1015 |
|
| 1016 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] == 'Off' ) { |
| 1017 |
return; |
| 1018 |
} |
| 1019 |
|
| 1020 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] != 'Off' && preg_match( '/page=bulletproof-security/', esc_html($_SERVER['REQUEST_URI']), $matches ) ) { |
| 1021 |
|
| 1022 |
// New BPS installation - do not display status |
| 1023 |
if ( ! get_option('bulletproof_security_options_wizard_free') ) { |
| 1024 |
return; |
| 1025 |
} |
| 1026 |
|
| 1027 |
if ( ! get_option('bulletproof_security_options_idle_session') ) { |
| 1028 |
return; |
| 1029 |
} |
| 1030 |
|
| 1031 |
$BPSoptionsISL = get_option('bulletproof_security_options_idle_session'); |
| 1032 |
|
| 1033 |
if ( ! get_option('bulletproof_security_options_auth_cookie') ) { |
| 1034 |
$status_DDiv = '</div><div style="clear:both;"></div>'; |
| 1035 |
} else { |
| 1036 |
$status_DDiv = '</div>'; |
| 1037 |
} |
| 1038 |
|
| 1039 |
if ( $BPSoptionsISL['bps_isl'] == 'On' ) { |
| 1040 |
|
| 1041 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:0px;">'. $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/login/login.php#bps-tabs-3' ).'" title="'.esc_attr( 'Idle Session Logout' ).'" style="text-decoration:none;">'.__('ISL', 'bulletproof-security').'</a>: <font color="green"><strong>'.__('On', 'bulletproof-security').'</strong></font>'.$status_DDiv; |
| 1042 |
echo $text; |
| 1043 |
} |
| 1044 |
|
| 1045 |
if ( $BPSoptionsISL['bps_isl'] == 'Off' ) { |
| 1046 |
|
| 1047 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:0px;">'. $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/login/login.php#bps-tabs-3' ).'" title="'.esc_attr( 'Idle Session Logout' ).'" style="text-decoration:none;">'.__('ISL', 'bulletproof-security').'</a>: <font color="#fb0101"><strong>'.__('Off', 'bulletproof-security').'</strong></font>'.$status_DDiv; |
| 1048 |
echo $text; |
| 1049 |
} |
| 1050 |
} |
| 1051 |
} |
| 1052 |
} |
| 1053 |
} |
| 1054 |
|
| 1055 |
// Auth Cookie Expiration ACE Status display - BPS pages ONLY |
| 1056 |
function bpsPro_ace_notice_status_bps() { |
| 1057 |
global $aitpro_bullet; |
| 1058 |
|
| 1059 |
if ( current_user_can('manage_options') ) { |
| 1060 |
|
| 1061 |
if ( preg_match( '/page=bulletproof-security.*mscan-scan-status.php/', esc_html($_SERVER['REQUEST_URI']) ) ) { |
| 1062 |
return; |
| 1063 |
} |
| 1064 |
|
| 1065 |
if ( esc_html($_SERVER['REQUEST_METHOD']) != 'POST' && esc_html($_SERVER['QUERY_STRING']) != 'page=bulletproof-security/admin/system-info/system-info.php' ) { |
| 1066 |
|
| 1067 |
$bps_status_display = get_option('bulletproof_security_options_status_display'); |
| 1068 |
|
| 1069 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] == 'Off' ) { |
| 1070 |
return; |
| 1071 |
} |
| 1072 |
|
| 1073 |
if ( isset($bps_status_display['bps_status_display']) && $bps_status_display['bps_status_display'] != 'Off' && preg_match( '/page=bulletproof-security/', esc_html($_SERVER['REQUEST_URI']), $matches ) ) { |
| 1074 |
|
| 1075 |
// New BPS installation - do not display status |
| 1076 |
if ( ! get_option('bulletproof_security_options_wizard_free') ) { |
| 1077 |
return; |
| 1078 |
} |
| 1079 |
|
| 1080 |
if ( ! get_option('bulletproof_security_options_auth_cookie') ) { |
| 1081 |
return; |
| 1082 |
} |
| 1083 |
|
| 1084 |
$BPSoptionsACE = get_option('bulletproof_security_options_auth_cookie'); |
| 1085 |
$status_DDiv = '</div><div style="clear:both;"></div>'; |
| 1086 |
|
| 1087 |
if ( $BPSoptionsACE['bps_ace'] == 'On' ) { |
| 1088 |
|
| 1089 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:0px;">'. $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/login/login.php#bps-tabs-3' ).'" title="'.esc_attr( 'Auth Cookie Expiration' ).'" style="text-decoration:none;">'.__('ACE', 'bulletproof-security').'</a>: <font color="green"><strong>'.__('On', 'bulletproof-security').'</strong></font>'.$status_DDiv; |
| 1090 |
echo $text; |
| 1091 |
} |
| 1092 |
|
| 1093 |
if ( $BPSoptionsACE['bps_ace'] == 'Off' ) { |
| 1094 |
|
| 1095 |
$text = '<div id="bps-status-display" style="float:left;font-weight:600;margin:0px;">'. $aitpro_bullet . '<a href="'.admin_url( 'admin.php?page=bulletproof-security/admin/login/login.php#bps-tabs-3' ).'" title="'.esc_attr( 'Auth Cookie Expiration' ).'" style="text-decoration:none;">'.__('ACE', 'bulletproof-security').'</a>: <font color="#fb0101"><strong>'.__('Off', 'bulletproof-security').'</strong></font>'.$status_DDiv; |
| 1096 |
echo $text; |
| 1097 |
} |
| 1098 |
} |
| 1099 |
} |
| 1100 |
} |
| 1101 |
} |
| 1102 |
|
| 1103 |
// GET HTTP Status Response from /mod-test/ images to determine which Apache Modules are Loaded, |
| 1104 |
// Directive Backward Compatibility & if Host is allowing/processing IfModule conditions (Known Hosts: HostGator). |
| 1105 |
// System Info page updates the DB option on page load in real-time, but does not create htaccess files. |
| 1106 |
// htaccess File Options updates/creates the DB option and creates htaccess files if needed inpage on page load based on timestamp: once per 15 minute time restriction. |
| 1107 |
// BPS plugin upgrades & Pre-Installation Wizard checks: new htaccess files created if needed. |
| 1108 |
// bpsPro_apache_mod_create_htaccess_files() executed in this function which creates new htaccess files if needed. |
| 1109 |
// .52.6: fallback to mod_access_compat. see .53.6 |
| 1110 |
// .53: The Setup Wizard no longer has a time restriction so that it can create new htaccess files on each page load if |
| 1111 |
// htaccess files do not already exist or new htaccess files need to be created. |
| 1112 |
// .53.6: Fubar condition added for servers that do not have either mod_access_compat and mod_authz_core or mod_rewrite Loaded. |
| 1113 |
// A user can override this check by enabling Enable|Disable htaccess Files: htaccess Files Enabled in the Setup Wizard. |
| 1114 |
// If an override is chosen then the fallback used is mod_access_compat. |
| 1115 |
// 4.5: Using IfModule conditions for all tests. No longer checking for No IfModule conditions. All htaccess code now contains IfModule condtions. |
| 1116 |
function bpsPro_apache_mod_directive_check() { |
| 1117 |
|
| 1118 |
if ( current_user_can('manage_options') ) { |
| 1119 |
|
| 1120 |
if ( esc_html($_SERVER['QUERY_STRING']) == 'page=bulletproof-security/admin/system-info/system-info.php' ) { |
| 1121 |
|
| 1122 |
// 2: 403: mod_access_compat Module IS loaded. "Deny from all". Allows "Order, Deny, Allow" directives |
| 1123 |
$url2 = plugins_url( '/bulletproof-security/admin/mod-test/mod_access_compat-od-denied.png' ); |
| 1124 |
// 3: 403: mod_authz_core Module IS loaded. "Require all denied" Conditional |
| 1125 |
$url3 = plugins_url( '/bulletproof-security/admin/mod-test/mod_authz_core-denied.png' ); |
| 1126 |
// 4: 403: mod_authz_core|mod_access_compat Order Directive Denied Conditional |
| 1127 |
$url4 = plugins_url( '/bulletproof-security/admin/mod-test/mod_authz_core-od-cond-denied.png' ); |
| 1128 |
// 5: 403: mod_authz_host Module IS loaded. "Require ip 127.9.9.1" Conditional |
| 1129 |
$url5 = plugins_url( '/bulletproof-security/admin/mod-test/mod_authz_host-require-ip.png' ); |
| 1130 |
// 6: 403: mod_authz_host|mod_access_compat Order Directive Denied Conditional |
| 1131 |
$url6 = plugins_url( '/bulletproof-security/admin/mod-test/mod_authz_host-od-cond-denied.png' ); |
| 1132 |
// 9: 302 or 200: mod_rewrite Module IS loaded. |
| 1133 |
// 9: 500 error if mod_rewrite Module is not loaded. |
| 1134 |
$url9 = plugins_url( '/bulletproof-security/admin/mod-test/mod_rewrite-nc.png' ); |
| 1135 |
// 12: mod_security: 403 if mod_security IS loaded. |
| 1136 |
$url12 = plugins_url( '/bulletproof-security/admin/mod-test/mod_security.png' ); |
| 1137 |
// 13: mod_security2: 403 if mod_security2 IS loaded. |
| 1138 |
$url13 = plugins_url( '/bulletproof-security/admin/mod-test/mod_security-2.png' ); |
| 1139 |
|
| 1140 |
$url_array = array( $url2, $url3, $url4, $url5, $url6, $url9, $url12, $url13 ); |
| 1141 |
|
| 1142 |
echo '<strong><span class="sysinfo-label-text">'.__('Apache Modules|Directives|Backward Compatibility(Yes|No)|IfModule(Yes|No): ', 'bulletproof-security').'</span></strong><br>'; |
| 1143 |
|
| 1144 |
foreach ( $url_array as $key => $value ) { |
| 1145 |
|
| 1146 |
$response = wp_remote_get( $value ); |
| 1147 |
|
| 1148 |
if ( ! is_wp_error( $response ) ) { |
| 1149 |
|
| 1150 |
if ( $key == 0 ) { // 2 |
| 1151 |
$status_code2 = $response['response']['code']; |
| 1152 |
} |
| 1153 |
|
| 1154 |
if ( $key == 1 ) { // 3 |
| 1155 |
$status_code3 = $response['response']['code']; |
| 1156 |
} |
| 1157 |
|
| 1158 |
if ( $key == 2 ) { // 4 |
| 1159 |
$status_code4 = $response['response']['code']; |
| 1160 |
} |
| 1161 |
|
| 1162 |
if ( $key == 3 ) { // 5 |
| 1163 |
$status_code5 = $response['response']['code']; |
| 1164 |
} |
| 1165 |
|
| 1166 |
if ( $key == 4 ) { // 6 |
| 1167 |
$status_code6 = $response['response']['code']; |
| 1168 |
} |
| 1169 |
|
| 1170 |
if ( $key == 5 ) { // 9 |
| 1171 |
$status_code9 = $response['response']['code']; |
| 1172 |
} |
| 1173 |
|
| 1174 |
if ( $key == 6 ) { // 12 |
| 1175 |
$status_code12 = $response['response']['code']; |
| 1176 |
} |
| 1177 |
|
| 1178 |
if ( $key == 7 ) { // 13 |
| 1179 |
$status_code13 = $response['response']['code']; |
| 1180 |
} |
| 1181 |
|
| 1182 |
} else { |
| 1183 |
|
| 1184 |
$text = '<font color="#fb0101"><strong>'.__('ERROR: wp_remote_get() function is blocked or unable to get the URL path', 'bulletproof-security').'</strong></font><br>'; |
| 1185 |
echo $text;; |
| 1186 |
} |
| 1187 |
} |
| 1188 |
|
| 1189 |
// mod_access_compat loaded, Order, Allow, Deny directives are supported |
| 1190 |
if ( 403 == $status_code2 ) { |
| 1191 |
|
| 1192 |
$apache_ifmodule = 'Yes'; |
| 1193 |
|
| 1194 |
$text = '<font color="green"><strong>'.$status_code2.':</strong></font> '.__('mod_access_compat is Loaded|Order, Allow, Deny directives are supported|IfModule: Yes', 'bulletproof-security').'<br>'; |
| 1195 |
echo $text; |
| 1196 |
|
| 1197 |
// mod_access_compat is not loaded|available. |
| 1198 |
} elseif ( 403 != $status_code2 ) { |
| 1199 |
|
| 1200 |
$apache_ifmodule = 'Yes'; |
| 1201 |
|
| 1202 |
$text = '<font color="#2271b1"><strong>'.$status_code2.':</strong></font> '.__('mod_access_compat is not Loaded|IfModule: Yes', 'bulletproof-security').'<br>'; |
| 1203 |
echo $text; |
| 1204 |
} |
| 1205 |
|
| 1206 |
// mod_authz_core loaded, IfModule condition working, Order, Allow, Deny directives are supported |
| 1207 |
// 3 normal mod_authz_core test| 4 is mod_access_compat BC |
| 1208 |
if ( 403 == $status_code3 && 403 == $status_code4 ) { |
| 1209 |
|
| 1210 |
$text = '<font color="green"><strong>'.$status_code3.':</strong></font> '.__('mod_authz_core is Loaded|Order, Allow, Deny directives are supported|BC: Yes|IfModule: Yes', 'bulletproof-security').'<br>'; |
| 1211 |
echo $text; |
| 1212 |
|
| 1213 |
} elseif ( 403 == $status_code3 && 403 != $status_code4 ) { |
| 1214 |
|
| 1215 |
$text = '<font color="green"><strong>'.$status_code3.':</strong></font> '.__('mod_authz_core is Loaded|Order, Allow, Deny directives are not supported|BC: No|IfModule: Yes', 'bulletproof-security').'<br>'; |
| 1216 |
echo $text; |
| 1217 |
|
| 1218 |
} elseif ( 403 != $status_code3 && 403 != $status_code4 ) { |
| 1219 |
|
| 1220 |
$text = '<font color="#2271b1"><strong>'.$status_code3.':</strong></font> '.__('mod_authz_core is not Loaded|IfModule: Yes', 'bulletproof-security').'<br>'; |
| 1221 |
echo $text; |
| 1222 |
} |
| 1223 |
|
| 1224 |
// mod_authz_host loaded, IfModule condition working, Order, Allow, Deny directives are supported |
| 1225 |
// 5 normal mod_authz_core test| 6 is mod_access_compat BC |
| 1226 |
if ( 403 == $status_code5 && 403 == $status_code6 ) { |
| 1227 |
|
| 1228 |
$text = '<font color="green"><strong>'.$status_code5.':</strong></font> '.__('mod_authz_host is Loaded|Order, Allow, Deny directives are supported|BC: Yes|IfModule: Yes', 'bulletproof-security').'<br>'; |
| 1229 |
echo $text; |
| 1230 |
|
| 1231 |
} elseif ( 403 == $status_code5 && 403 != $status_code6 ) { |
| 1232 |
|
| 1233 |
$text = '<font color="green"><strong>'.$status_code5.':</strong></font> '.__('mod_authz_host is Loaded|Order, Allow, Deny directives are not supported|BC: No|IfModule: Yes', 'bulletproof-security').'<br>'; |
| 1234 |
echo $text; |
| 1235 |
|
| 1236 |
} elseif ( 403 != $status_code5 && 403 != $status_code6 ) { |
| 1237 |
|
| 1238 |
$text = '<font color="#2271b1"><strong>'.$status_code6.':</strong></font> '.__('mod_authz_host is not Loaded|IfModule: Yes', 'bulletproof-security').'<br>'; |
| 1239 |
echo $text; |
| 1240 |
} |
| 1241 |
|
| 1242 |
// mod_rewrite Module loaded. |
| 1243 |
if ( 301 == $status_code9 || 302 == $status_code9 || 200 == $status_code9 || 404 == $status_code9 || 403 == $status_code9 ) { |
| 1244 |
|
| 1245 |
$text = '<font color="green"><strong>'.$status_code9.':</strong></font> '.__('mod_rewrite Module is Loaded|IfModule: Yes', 'bulletproof-security').'<br>'; |
| 1246 |
echo $text; |
| 1247 |
|
| 1248 |
} else { |
| 1249 |
|
| 1250 |
$text = '<font color="#2271b1"><strong>'.$status_code9.':</strong></font> '.__('mod_rewrite Inconclusive: Status is not 200, 301, 302, 403 or 404', 'bulletproof-security').'<br>'; |
| 1251 |
echo $text; |
| 1252 |
} |
| 1253 |
|
| 1254 |
$apache_modules_Options = array( |
| 1255 |
'bps_apache_mod_ifmodule' => $apache_ifmodule, |
| 1256 |
'bps_apache_mod_time' => time() + 900 |
| 1257 |
); |
| 1258 |
|
| 1259 |
foreach( $apache_modules_Options as $key => $value ) { |
| 1260 |
update_option('bulletproof_security_options_apache_modules', $apache_modules_Options); |
| 1261 |
} |
| 1262 |
|
| 1263 |
if ( $apache_ifmodule == 'fubar' ) { |
| 1264 |
|
| 1265 |
$htaccess_files_Options = array( |
| 1266 |
'bps_htaccess_files' => 'disabled' |
| 1267 |
); |
| 1268 |
|
| 1269 |
foreach( $htaccess_files_Options as $key => $value ) { |
| 1270 |
update_option('bulletproof_security_options_htaccess_files', $htaccess_files_Options); |
| 1271 |
} |
| 1272 |
} |
| 1273 |
|
| 1274 |
## 4.7: BugFix |
| 1275 |
## 5.3: BugFix: htaccess files enabled if disabled using the disable htaccess files Setup Wizard option |
| 1276 |
$HFiles_options = get_option('bulletproof_security_options_htaccess_files'); |
| 1277 |
|
| 1278 |
$htaccess_files_disabled_enabled = isset($HFiles_options['bps_htaccess_files']) ? $HFiles_options['bps_htaccess_files'] : ''; |
| 1279 |
|
| 1280 |
if ( $apache_ifmodule == 'Yes' && $htaccess_files_disabled_enabled != 'disabled' ) { |
| 1281 |
|
| 1282 |
$htaccess_files_Options = array( |
| 1283 |
'bps_htaccess_files' => 'enabled' |
| 1284 |
); |
| 1285 |
|
| 1286 |
foreach( $htaccess_files_Options as $key => $value ) { |
| 1287 |
update_option('bulletproof_security_options_htaccess_files', $htaccess_files_Options); |
| 1288 |
} |
| 1289 |
} |
| 1290 |
|
| 1291 |
// mod_security or mod_security2 Module loaded. |
| 1292 |
if ( 403 == $status_code12 || 403 == $status_code13 ) { |
| 1293 |
|
| 1294 |
if ( 403 == $status_code12 ) { |
| 1295 |
$text = '<font color="#2271b1"><strong>'.$status_code12.':</strong></font> '.__('mod_security Module is Loaded|Enabled|IfModule: Yes', 'bulletproof-security').'<br>'; |
| 1296 |
echo $text; |
| 1297 |
} elseif ( 403 == $status_code13 ) { |
| 1298 |
$text = '<font color="#2271b1"><strong>'.$status_code13.':</strong></font> '.__('mod_security2 Module is Loaded|Enabled|IfModule: Yes', 'bulletproof-security').'<br>'; |
| 1299 |
echo $text; |
| 1300 |
} |
| 1301 |
|
| 1302 |
$bps_mod_security_options = array( 'bps_mod_security_check' => '1' ); |
| 1303 |
|
| 1304 |
foreach( $bps_mod_security_options as $key => $value ) { |
| 1305 |
update_option('bulletproof_security_options_mod_security', $bps_mod_security_options); |
| 1306 |
} |
| 1307 |
|
| 1308 |
} else { |
| 1309 |
|
| 1310 |
$text = '<font color="green"><strong>'.$status_code12.':</strong></font> '.__('mod_security Module is not Loaded|Enabled|IfModule: Yes', 'bulletproof-security').'<br>'; |
| 1311 |
echo $text; |
| 1312 |
|
| 1313 |
$bps_mod_security_options = array( 'bps_mod_security_check' => '0' ); |
| 1314 |
|
| 1315 |
foreach( $bps_mod_security_options as $key => $value ) { |
| 1316 |
update_option('bulletproof_security_options_mod_security', $bps_mod_security_options); |
| 1317 |
} |
| 1318 |
} |
| 1319 |
|
| 1320 |
// End: System Info page check |
| 1321 |
// BEGIN: Setup Wizard, BPS Upgrade & Core Inpage check. Create/update db options and new htaccess files |
| 1322 |
} else { |
| 1323 |
|
| 1324 |
// 2: 403: mod_access_compat Module IS loaded. "Deny from all". Allows "Order, Deny, Allow" directives |
| 1325 |
$url2 = plugins_url( '/bulletproof-security/admin/mod-test/mod_access_compat-od-denied.png' ); |
| 1326 |
// 3: 403: mod_authz_core Module IS loaded. "Require all denied" Conditional |
| 1327 |
$url3 = plugins_url( '/bulletproof-security/admin/mod-test/mod_authz_core-denied.png' ); |
| 1328 |
// 4: 403: mod_authz_core|mod_access_compat Order Directive Denied Conditional |
| 1329 |
$url4 = plugins_url( '/bulletproof-security/admin/mod-test/mod_authz_core-od-cond-denied.png' ); |
| 1330 |
// 9: 302 or 200: mod_rewrite Module IS loaded. |
| 1331 |
// 9: 500 error if mod_rewrite Module is not loaded. |
| 1332 |
$url9 = plugins_url( '/bulletproof-security/admin/mod-test/mod_rewrite-nc.png' ); |
| 1333 |
// 12: mod_security: 403 if mod_security IS loaded. |
| 1334 |
$url12 = plugins_url( '/bulletproof-security/admin/mod-test/mod_security.png' ); |
| 1335 |
// 13: mod_security2: 403 if mod_security2 IS loaded. |
| 1336 |
$url13 = plugins_url( '/bulletproof-security/admin/mod-test/mod_security-2.png' ); |
| 1337 |
|
| 1338 |
$url_array = array( $url2, $url3, $url4, $url9, $url12, $url13 ); |
| 1339 |
|
| 1340 |
// Setup Wizard: No time restriction |
| 1341 |
if ( esc_html($_SERVER['QUERY_STRING']) == 'page=bulletproof-security/admin/wizard/wizard.php' ) { |
| 1342 |
|
| 1343 |
foreach ( $url_array as $key => $value ) { |
| 1344 |
|
| 1345 |
$response = wp_remote_get( $value ); |
| 1346 |
|
| 1347 |
if ( ! is_wp_error( $response ) ) { |
| 1348 |
|
| 1349 |
if ( $key == 0 ) { // 2 |
| 1350 |
$status_code2 = $response['response']['code']; |
| 1351 |
} |
| 1352 |
|
| 1353 |
if ( $key == 1 ) { // 3 |
| 1354 |
$status_code3 = $response['response']['code']; |
| 1355 |
} |
| 1356 |
|
| 1357 |
if ( $key == 2 ) { // 4 |
| 1358 |
$status_code4 = $response['response']['code']; |
| 1359 |
} |
| 1360 |
|
| 1361 |
if ( $key == 3 ) { // 9 |
| 1362 |
$status_code9 = $response['response']['code']; |
| 1363 |
} |
| 1364 |
|
| 1365 |
if ( $key == 4 ) { // 12 |
| 1366 |
$status_code12 = $response['response']['code']; |
| 1367 |
} |
| 1368 |
|
| 1369 |
if ( $key == 5 ) { // 13 |
| 1370 |
$status_code13 = $response['response']['code']; |
| 1371 |
} |
| 1372 |
} |
| 1373 |
} |
| 1374 |
|
| 1375 |
// mod_access_compat loaded, IfModule condition working, Order, Allow, Deny directives are supported |
| 1376 |
if ( 403 == $status_code2 ) { |
| 1377 |
|
| 1378 |
$apache_ifmodule = 'Yes'; |
| 1379 |
|
| 1380 |
} else { |
| 1381 |
|
| 1382 |
$apache_ifmodule = 'Yes'; |
| 1383 |
} |
| 1384 |
|
| 1385 |
$apache_modules_Options = array( |
| 1386 |
'bps_apache_mod_ifmodule' => $apache_ifmodule, |
| 1387 |
'bps_apache_mod_time' => time() + 900 |
| 1388 |
); |
| 1389 |
|
| 1390 |
foreach( $apache_modules_Options as $key => $value ) { |
| 1391 |
update_option('bulletproof_security_options_apache_modules', $apache_modules_Options); |
| 1392 |
} |
| 1393 |
|
| 1394 |
if ( $apache_ifmodule == 'fubar' ) { |
| 1395 |
|
| 1396 |
$htaccess_files_Options = array( |
| 1397 |
'bps_htaccess_files' => 'disabled' |
| 1398 |
); |
| 1399 |
|
| 1400 |
foreach( $htaccess_files_Options as $key => $value ) { |
| 1401 |
update_option('bulletproof_security_options_htaccess_files', $htaccess_files_Options); |
| 1402 |
} |
| 1403 |
} |
| 1404 |
|
| 1405 |
## 4.7: BugFix |
| 1406 |
## 5.3: BugFix: htaccess files enabled if disabled using the disable htaccess files Setup Wizard option |
| 1407 |
$HFiles_options = get_option('bulletproof_security_options_htaccess_files'); |
| 1408 |
|
| 1409 |
$htaccess_files_disabled_enabled = isset($HFiles_options['bps_htaccess_files']) ? $HFiles_options['bps_htaccess_files'] : ''; |
| 1410 |
|
| 1411 |
if ( $apache_ifmodule == 'Yes' && $htaccess_files_disabled_enabled != 'disabled' ) { |
| 1412 |
|
| 1413 |
$htaccess_files_Options = array( |
| 1414 |
'bps_htaccess_files' => 'enabled' |
| 1415 |
); |
| 1416 |
|
| 1417 |
foreach( $htaccess_files_Options as $key => $value ) { |
| 1418 |
update_option('bulletproof_security_options_htaccess_files', $htaccess_files_Options); |
| 1419 |
} |
| 1420 |
} |
| 1421 |
|
| 1422 |
// mod_security or mod_security2 Module loaded. |
| 1423 |
if ( 403 == $status_code12 || 403 == $status_code13 ) { |
| 1424 |
|
| 1425 |
$bps_mod_security_options = array( 'bps_mod_security_check' => '1' ); |
| 1426 |
|
| 1427 |
foreach( $bps_mod_security_options as $key => $value ) { |
| 1428 |
update_option('bulletproof_security_options_mod_security', $bps_mod_security_options); |
| 1429 |
} |
| 1430 |
|
| 1431 |
} else { |
| 1432 |
|
| 1433 |
$bps_mod_security_options = array( 'bps_mod_security_check' => '0' ); |
| 1434 |
|
| 1435 |
foreach( $bps_mod_security_options as $key => $value ) { |
| 1436 |
update_option('bulletproof_security_options_mod_security', $bps_mod_security_options); |
| 1437 |
} |
| 1438 |
} |
| 1439 |
|
| 1440 |
bpsPro_apache_mod_create_htaccess_files(); |
| 1441 |
|
| 1442 |
} else { // END: Setup Wizard no time restriction. |
| 1443 |
// BEGIN: BPS upgrade & Core with Time restriction |
| 1444 |
|
| 1445 |
$Apache_Mod_options = get_option('bulletproof_security_options_apache_modules'); |
| 1446 |
$bps_apache_mod_time = isset($Apache_Mod_options['bps_apache_mod_time']) ? $Apache_Mod_options['bps_apache_mod_time'] : ''; |
| 1447 |
|
| 1448 |
// Note: if the db option does not exist yet it is created: time now is greater than nothing |
| 1449 |
if ( time() < $bps_apache_mod_time ) { |
| 1450 |
// do nothing |
| 1451 |
|
| 1452 |
} else { |
| 1453 |
|
| 1454 |
foreach ( $url_array as $key => $value ) { |
| 1455 |
|
| 1456 |
$response = wp_remote_get( $value ); |
| 1457 |
|
| 1458 |
if ( ! is_wp_error( $response ) ) { |
| 1459 |
|
| 1460 |
if ( $key == 0 ) { // 2 |
| 1461 |
$status_code2 = $response['response']['code']; |
| 1462 |
} |
| 1463 |
|
| 1464 |
if ( $key == 1 ) { // 3 |
| 1465 |
$status_code3 = $response['response']['code']; |
| 1466 |
} |
| 1467 |
|
| 1468 |
if ( $key == 2 ) { // 4 |
| 1469 |
$status_code4 = $response['response']['code']; |
| 1470 |
} |
| 1471 |
|
| 1472 |
if ( $key == 3 ) { // 9 |
| 1473 |
$status_code9 = $response['response']['code']; |
| 1474 |
} |
| 1475 |
|
| 1476 |
if ( $key == 4 ) { // 12 |
| 1477 |
$status_code12 = $response['response']['code']; |
| 1478 |
} |
| 1479 |
|
| 1480 |
if ( $key == 5 ) { // 13 |
| 1481 |
$status_code13 = $response['response']['code']; |
| 1482 |
} |
| 1483 |
} |
| 1484 |
} |
| 1485 |
|
| 1486 |
// mod_access_compat loaded, IfModule condition working, Order, Allow, Deny directives are supported |
| 1487 |
if ( 403 == $status_code2 ) { |
| 1488 |
|
| 1489 |
$apache_ifmodule = 'Yes'; |
| 1490 |
|
| 1491 |
} else { |
| 1492 |
|
| 1493 |
$apache_ifmodule = 'Yes'; |
| 1494 |
} |
| 1495 |
|
| 1496 |
$apache_modules_Options = array( |
| 1497 |
'bps_apache_mod_ifmodule' => $apache_ifmodule, |
| 1498 |
'bps_apache_mod_time' => time() + 900 |
| 1499 |
); |
| 1500 |
|
| 1501 |
foreach( $apache_modules_Options as $key => $value ) { |
| 1502 |
update_option('bulletproof_security_options_apache_modules', $apache_modules_Options); |
| 1503 |
} |
| 1504 |
|
| 1505 |
if ( $apache_ifmodule == 'fubar' ) { |
| 1506 |
|
| 1507 |
$htaccess_files_Options = array( |
| 1508 |
'bps_htaccess_files' => 'disabled' |
| 1509 |
); |
| 1510 |
|
| 1511 |
foreach( $htaccess_files_Options as $key => $value ) { |
| 1512 |
update_option('bulletproof_security_options_htaccess_files', $htaccess_files_Options); |
| 1513 |
} |
| 1514 |
} |
| 1515 |
|
| 1516 |
## 4.7: BugFix |
| 1517 |
## 5.3: BugFix: htaccess files enabled if disabled using the disable htaccess files Setup Wizard option |
| 1518 |
$HFiles_options = get_option('bulletproof_security_options_htaccess_files'); |
| 1519 |
|
| 1520 |
$htaccess_files_disabled_enabled = isset($HFiles_options['bps_htaccess_files']) ? $HFiles_options['bps_htaccess_files'] : ''; |
| 1521 |
|
| 1522 |
if ( $apache_ifmodule == 'Yes' && $htaccess_files_disabled_enabled != 'disabled' ) { |
| 1523 |
|
| 1524 |
$htaccess_files_Options = array( |
| 1525 |
'bps_htaccess_files' => 'enabled' |
| 1526 |
); |
| 1527 |
|
| 1528 |
foreach( $htaccess_files_Options as $key => $value ) { |
| 1529 |
update_option('bulletproof_security_options_htaccess_files', $htaccess_files_Options); |
| 1530 |
} |
| 1531 |
} |
| 1532 |
|
| 1533 |
// mod_security or mod_security2 Module loaded. |
| 1534 |
if ( 403 == $status_code12 || 403 == $status_code13 ) { |
| 1535 |
|
| 1536 |
$bps_mod_security_options = array( 'bps_mod_security_check' => '1' ); |
| 1537 |
|
| 1538 |
foreach( $bps_mod_security_options as $key => $value ) { |
| 1539 |
update_option('bulletproof_security_options_mod_security', $bps_mod_security_options); |
| 1540 |
} |
| 1541 |
|
| 1542 |
} else { |
| 1543 |
|
| 1544 |
$bps_mod_security_options = array( 'bps_mod_security_check' => '0' ); |
| 1545 |
|
| 1546 |
foreach( $bps_mod_security_options as $key => $value ) { |
| 1547 |
update_option('bulletproof_security_options_mod_security', $bps_mod_security_options); |
| 1548 |
} |
| 1549 |
} |
| 1550 |
bpsPro_apache_mod_create_htaccess_files(); |
| 1551 |
} // end if ( time() < $Apache_Mod_options['bps_apache_mod_time'] ) { |
| 1552 |
} |
| 1553 |
} |
| 1554 |
} |
| 1555 |
} |
| 1556 |
|
| 1557 |
|
| 1558 |
// Creates htaccess files based on bps_apache_mod_ifmodule DB value |
| 1559 |
// 11 htaccess files total |
| 1560 |
// .53.6: Fubar condition added for servers that do not have either mod_access_compat and mod_authz_core or mod_rewrite Loaded. |
| 1561 |
function bpsPro_apache_mod_create_htaccess_files() { |
| 1562 |
|
| 1563 |
if ( is_admin() && current_user_can('manage_options') ) { |
| 1564 |
|
| 1565 |
$denyall_htaccess = WP_PLUGIN_DIR . '/bulletproof-security/admin/htaccess/deny-all.htaccess'; |
| 1566 |
$denyall_ifmodule_htaccess = WP_PLUGIN_DIR . '/bulletproof-security/admin/htaccess/deny-all-ifmodule.htaccess'; |
| 1567 |
|
| 1568 |
$bps_backup = WP_CONTENT_DIR . '/bps-backup/.htaccess'; |
| 1569 |
$bps_master_backups = WP_CONTENT_DIR . '/bps-backup/master-backups/.htaccess'; |
| 1570 |
$bpsPro_pf = WP_PLUGIN_DIR . '/bulletproof-security/'; |
| 1571 |
$core1 = $bpsPro_pf . 'admin/core/.htaccess'; |
| 1572 |
$core2 = $bpsPro_pf . 'admin/db-backup-security/.htaccess'; |
| 1573 |
$core3 = $bpsPro_pf . 'admin/htaccess/.htaccess'; |
| 1574 |
$core4 = $bpsPro_pf . 'admin/login/.htaccess'; |
| 1575 |
$core5 = $bpsPro_pf . 'admin/maintenance/.htaccess'; |
| 1576 |
$core6 = $bpsPro_pf . 'admin/security-log/.htaccess'; |
| 1577 |
$core7 = $bpsPro_pf . 'admin/system-info/.htaccess'; |
| 1578 |
$core8 = $bpsPro_pf . 'admin/theme-skin/.htaccess'; |
| 1579 |
$core9 = $bpsPro_pf . 'admin/wizard/.htaccess'; |
| 1580 |
$core10 = $bpsPro_pf . 'admin/email-log-settings/.htaccess'; |
| 1581 |
$core11 = $bpsPro_pf . 'admin/mscan/.htaccess'; |
| 1582 |
|
| 1583 |
$Zip_download_Options = get_option('bulletproof_security_options_zip_fix'); |
| 1584 |
|
| 1585 |
if ( isset($Zip_download_Options['bps_zip_download_fix']) && $Zip_download_Options['bps_zip_download_fix'] == 'On' ) { |
| 1586 |
$files = array( $bps_backup, $bps_master_backups, $core2, $core3, $core5, $core6, $core7, $core8, $core10, $core11 ); |
| 1587 |
} else { |
| 1588 |
$files = array( $bps_backup, $bps_master_backups, $core1, $core2, $core3, $core4, $core5, $core6, $core7, $core8, $core9, $core10, $core11 ); |
| 1589 |
} |
| 1590 |
|
| 1591 |
$Apache_Mod_options = get_option('bulletproof_security_options_apache_modules'); |
| 1592 |
$HFiles_options = get_option('bulletproof_security_options_htaccess_files'); |
| 1593 |
|
| 1594 |
// .53.6: htaccess Files Enabled|Disabled Override |
| 1595 |
// If someone manually chooses Disable htaccess files then htaccess files will not be created. |
| 1596 |
if ( isset($HFiles_options['bps_htaccess_files']) && $HFiles_options['bps_htaccess_files'] == 'enabled' ) { |
| 1597 |
|
| 1598 |
foreach ( $files as $file ) { |
| 1599 |
|
| 1600 |
if ( ! file_exists($file) ) { |
| 1601 |
|
| 1602 |
if ( isset($Apache_Mod_options['bps_apache_mod_ifmodule']) && $Apache_Mod_options['bps_apache_mod_ifmodule'] == 'Yes' ) { |
| 1603 |
copy($denyall_ifmodule_htaccess, $file); |
| 1604 |
} elseif ( isset($Apache_Mod_options['bps_apache_mod_ifmodule']) && $Apache_Mod_options['bps_apache_mod_ifmodule'] == 'No' ) { |
| 1605 |
copy($denyall_htaccess, $file); |
| 1606 |
} |
| 1607 |
} |
| 1608 |
|
| 1609 |
if ( file_exists($file) ) { |
| 1610 |
$check_string = file_get_contents($file); |
| 1611 |
|
| 1612 |
if ( $Apache_Mod_options['bps_apache_mod_ifmodule'] == 'Yes' && ! strpos( $check_string, "BPS mod_authz_core IfModule BC" ) ) { |
| 1613 |
copy($denyall_ifmodule_htaccess, $file); |
| 1614 |
} elseif ( $Apache_Mod_options['bps_apache_mod_ifmodule'] == 'No' && ! strpos( $check_string, "BPS mod_access_compat" ) ) { |
| 1615 |
copy($denyall_htaccess, $file); |
| 1616 |
} |
| 1617 |
} |
| 1618 |
} |
| 1619 |
} |
| 1620 |
} |
| 1621 |
} |
| 1622 |
|
| 1623 |
// 4.5: Remove (unset) the WP Site Health "A scheduled event is late" error message for any BPS Cron jobs. |
| 1624 |
function bpsPro_filter_scheduled_events( $tests ) { |
| 1625 |
|
| 1626 |
if ( ! class_exists( 'WP_Site_Health' ) ) { |
| 1627 |
require_once ABSPATH . 'wp-admin/includes/class-wp-site-health.php'; |
| 1628 |
} |
| 1629 |
|
| 1630 |
$get_test_scheduled_events = new WP_Site_Health(); |
| 1631 |
$test_description = $get_test_scheduled_events->get_test_scheduled_events(); |
| 1632 |
$pattern = '/(bpsPro_DBB_check|bpsPro_email_log_files|bpsPro_HPF_check|bpsPro_MScan_check)/'; |
| 1633 |
|
| 1634 |
if ( preg_match( $pattern, $test_description['description'] ) ) { |
| 1635 |
|
| 1636 |
unset( $tests['direct']['scheduled_events'] ); |
| 1637 |
} |
| 1638 |
|
| 1639 |
return $tests; |
| 1640 |
} |
| 1641 |
|
| 1642 |
add_filter( 'site_status_tests', 'bpsPro_filter_scheduled_events' ); |
| 1643 |
|
| 1644 |
// 5.5: disables the Rank Math plugin htaccess file editor - ModSecurity blocks the editor and prevents Rank Math options from being saved. |
| 1645 |
add_filter( 'rank_math/settings/general', function( $tabs) { |
| 1646 |
unset( $tabs['htaccess'] ); |
| 1647 |
return $tabs; |
| 1648 |
}) |
| 1649 |
?> |
