captcha.php
2 weeks ago
common.php
2 years ago
dashboard.php
1 month ago
disable-access-system-file.php
9 months ago
disable-author-query.php
2 years ago
disable-login.php
2 years ago
disable-restapi.php
2 weeks ago
disable-xmlrpc.php
2 years ago
login-log-table.php
4 months ago
login-log.php
2 years ago
login-notification.php
3 months ago
rename-login-page.php
1 month ago
restrict-admin-page.php
3 months ago
server-error-notification.php
4 months ago
server-error-table.php
1 year ago
two-factor-authentication-registration.php
3 months ago
two-factor-authentication.php
4 months ago
unify-messages.php
2 years ago
update-notice.php
1 month ago
waf-table.php
1 year ago
waf.php
1 month ago
waf.php
283 lines
| 1 | <?php |
| 2 | |
| 3 | if ( ! defined( 'ABSPATH' ) ) { |
| 4 | exit; |
| 5 | } |
| 6 | |
| 7 | class CloudSecureWP_Admin_Waf extends CloudSecureWP_Admin_Common { |
| 8 | private $waf; |
| 9 | private $waf_table; |
| 10 | private $constant_settings; |
| 11 | |
| 12 | function __construct( array $info, CloudSecureWP_Waf $waf ) { |
| 13 | parent::__construct( $info ); |
| 14 | $this->waf = $waf; |
| 15 | $this->waf_table = new CloudSecureWP_Waf_Table( $this->waf ); |
| 16 | $this->constant_settings = $this->waf->get_constant_settings(); |
| 17 | $this->prepare_view_data(); |
| 18 | $this->render(); |
| 19 | } |
| 20 | |
| 21 | |
| 22 | /** |
| 23 | * 画面表示用のデータを準備 |
| 24 | */ |
| 25 | public function prepare_view_data(): void { |
| 26 | $this->datas = $this->waf->get_settings(); |
| 27 | |
| 28 | if ( ! empty( $_POST ) && check_admin_referer( $this->waf->get_feature_key() . '_csrf' ) ) { |
| 29 | |
| 30 | foreach ( $this->datas as $key => $val ) { |
| 31 | |
| 32 | switch ( $key ) { |
| 33 | case 'waf': |
| 34 | $tmp = sanitize_text_field( $_POST[ $key ] ?? '' ); |
| 35 | |
| 36 | if ( ! $this->is_selected( $tmp, self::TF_VALIES ) ) { |
| 37 | $this->errors[] = '有効・無効の値が不正です'; |
| 38 | } |
| 39 | |
| 40 | if ( ! $this->check_environment() ) { |
| 41 | $tmp = 'f'; |
| 42 | } |
| 43 | |
| 44 | $this->datas[ $key ] = $tmp; |
| 45 | break; |
| 46 | |
| 47 | case 'waf_send_admin_mail': |
| 48 | $tmp = sanitize_text_field( $_POST[ $key ] ?? '' ); |
| 49 | |
| 50 | if ( ! $this->is_selected( $tmp, $this->constant_settings['waf_send_admin_mail'] ) ) { |
| 51 | $this->errors[] = 'メール通知の値が不正です'; |
| 52 | } |
| 53 | |
| 54 | $this->datas[ $key ] = $tmp; |
| 55 | break; |
| 56 | |
| 57 | case 'waf_available_rules': |
| 58 | $tmp = 0; |
| 59 | |
| 60 | if ( isset( $_POST[ $key ] ) ) { |
| 61 | if ( is_array( $_POST[ $key ] ) ) { |
| 62 | $sanitized_post_values = array_map( 'sanitize_text_field', $_POST[ $key ] ); |
| 63 | |
| 64 | foreach ( $sanitized_post_values as $value ) { |
| 65 | if ( ! in_array( intval( $value ), $this->constant_settings['waf_available_rules'], true ) ) { |
| 66 | $this->errors[] = '検知する攻撃種別の値が不正です'; |
| 67 | break; |
| 68 | } |
| 69 | |
| 70 | $tmp = $tmp | intval( $value ); |
| 71 | } |
| 72 | } else { |
| 73 | $this->errors[] = '検知する攻撃種別の値が不正です'; |
| 74 | } |
| 75 | } |
| 76 | |
| 77 | $this->datas[ $key ] = $tmp; |
| 78 | break; |
| 79 | |
| 80 | case 'waf_backtrack_error': |
| 81 | $this->datas[ $key ] = isset( $_POST['waf_backtrack_error_deny'] ) ? '1' : '0'; |
| 82 | break; |
| 83 | } |
| 84 | } |
| 85 | |
| 86 | if ( empty( $this->errors ) ) { |
| 87 | if ( 't' === $this->datas['waf'] ) { |
| 88 | $this->messages[] = 'シンプルWAF機能が有効になりました。'; |
| 89 | } else { |
| 90 | $this->messages[] = 'シンプルWAF機能が無効になりました。'; |
| 91 | } |
| 92 | |
| 93 | $this->waf->save_settings( $this->datas ); |
| 94 | } |
| 95 | } |
| 96 | |
| 97 | $this->waf_table->prepare_items(); |
| 98 | $this->datas = $this->get_checked( $this->datas, array( 'waf', 'waf_send_admin_mail' ) ); |
| 99 | } |
| 100 | |
| 101 | /** |
| 102 | * waf機能画面のデスクリプション表示用データ |
| 103 | */ |
| 104 | public function get_waf_description_data(): void { |
| 105 | ?> |
| 106 | <nav> |
| 107 | <ul class="breadcrumb"> |
| 108 | <li class="breadcrumb__list"><a href="?page=cloudsecurewp">ダッシュボード</a></li> |
| 109 | <li class="breadcrumb__list">シンプルWAF</li> |
| 110 | </ul> |
| 111 | </nav> |
| 112 | <div class="title-block mb-12"> |
| 113 | <p class="title-block-small-text">この機能のマニュアルは<a class="title-block-link" target="_blank" href="https://wpplugin.cloudsecure.ne.jp/cloudsecure_wp_security/waf.php">こちら</a></p> |
| 114 | <h1 class="title-block-title">シンプルWAF</h1> |
| 115 | </div> |
| 116 | <div class="title-bottom-text"> |
| 117 | WordPressへの代表的な攻撃を検知した際、アクセスを遮断して403エラー（Forbidden）を表示します。<br /> |
| 118 | 同時に検知履歴を記録し、WordPressの管理� |
| 119 | ユーザーにメールで通知します。 |
| 120 | </div> |
| 121 | <?php |
| 122 | } |
| 123 | |
| 124 | /** |
| 125 | * waf履歴一覧画面のデスクリプション表示用データ |
| 126 | */ |
| 127 | public function get_log_description_data(): void { |
| 128 | ?> |
| 129 | <nav> |
| 130 | <ul class="breadcrumb"> |
| 131 | <li class="breadcrumb__list"><a href="?page=cloudsecurewp">ダッシュボード</a></li> |
| 132 | <li class="breadcrumb__list"><a href="?page=cloudsecurewp_waf">シンプルWAF</a></li> |
| 133 | <li class="breadcrumb__list">検知履歴一覧</li> |
| 134 | </ul> |
| 135 | </nav> |
| 136 | <div class="title-block mb-12"> |
| 137 | <p class="title-block-small-text">この機能のマニュアルは<a class="title-block-link" target="_blank" href="https://wpplugin.cloudsecure.ne.jp/cloudsecure_wp_security/waf.php">こちら</a></p> |
| 138 | <h1 class="title-block-title">検知履歴一覧</h1> |
| 139 | </div> |
| 140 | <div class="title-bottom-text"> |
| 141 | シンプルWAFで検知したアクセスの履歴を表示します。<br /> |
| 142 | 正常な操作が遮断された場合は、シンプルWAFの設定を確認してください。 |
| 143 | </div> |
| 144 | <?php |
| 145 | } |
| 146 | |
| 147 | /** |
| 148 | * デスクリプション |
| 149 | */ |
| 150 | protected function admin_description(): void { |
| 151 | if ( isset( $_GET['childpage'] ) && 'log' === $_GET['childpage'] ) { |
| 152 | $this->get_log_description_data(); |
| 153 | } else { |
| 154 | $this->get_waf_description_data(); |
| 155 | } |
| 156 | } |
| 157 | |
| 158 | /** |
| 159 | * waf機能画面のページコンテンツ表示用データ |
| 160 | */ |
| 161 | public function get_waf_page_data(): void { |
| 162 | $lastkey = ''; |
| 163 | |
| 164 | if ( ! empty( $this->constant_settings['waf_rules_category'] ) ) { |
| 165 | end( $this->constant_settings['waf_rules_category'] ); |
| 166 | $lastkey = key( $this->constant_settings['waf_rules_category'] ); |
| 167 | reset( $this->constant_settings['waf_rules_category'] ); |
| 168 | } |
| 169 | |
| 170 | ?> |
| 171 | <form method="post"> |
| 172 | <div class="waf-enabled-or-disabled-and-link-button-flex"> |
| 173 | <div class="enabled-or-disabled"> |
| 174 | <input class="enabled-or-disabled__btn" id="enabled" type="radio" name="waf" value="t" <?php echo esc_html( $this->datas['waf_t'] ?? '' ); ?> /><label for="enabled">有効</label> |
| 175 | <input class="enabled-or-disabled__btn" id="disabled" type="radio" name="waf" value="f" <?php echo esc_html( $this->datas['waf_f'] ?? '' ); ?> /><label for="disabled">無効</label> |
| 176 | </div> |
| 177 | <div class="link-button next-page"><a href="admin.php?page=cloudsecurewp_waf&childpage=log">検知履歴を表示</a></div> |
| 178 | </div> |
| 179 | <div class="box"> |
| 180 | <div class="box-bottom"> |
| 181 | <div class="box-row flex-start"> |
| 182 | <div class="box-row-title not-label">メール通知</div> |
| 183 | <div class="box-row-content radio-btns"> |
| 184 | <input type="radio" class="circle-radio" id="waf_send_admin_mail-on" name="waf_send_admin_mail" value="<?php echo esc_attr( $this->constant_settings['waf_send_admin_mail'][1] ); ?>" <?php echo esc_html( $this->datas[ 'waf_send_admin_mail_' . $this->constant_settings['waf_send_admin_mail'][1] ] ?? '' ); ?> /><label for="waf_send_admin_mail-on">通知する</label><br /> |
| 185 | <input type="radio" class="circle-radio" id="waf_send_admin_mail-off" name="waf_send_admin_mail" value="<?php echo esc_attr( $this->constant_settings['waf_send_admin_mail'][0] ); ?>" <?php echo esc_html( $this->datas[ 'waf_send_admin_mail_' . $this->constant_settings['waf_send_admin_mail'][0] ] ?? '' ); ?> /><label for="waf_send_admin_mail-off">通知しない</label> |
| 186 | <p class="description"> |
| 187 | 1分以� |
| 188 | に同じ種別の攻撃を検知した場合は、検知履歴のみ記録し、メール通知は行いません。 |
| 189 | </p> |
| 190 | </div> |
| 191 | </div> |
| 192 | <div class="box-row flex-start"> |
| 193 | <div class="box-row-title not-label">遮断する攻撃種別</div> |
| 194 | <div class="box-row-content "> |
| 195 | <?php foreach ( $this->constant_settings['waf_rules_category'] as $key => $value ) : ?> |
| 196 | <input id="<?php echo esc_attr( $key ); ?>" class="checkbox" type="checkbox" name="waf_available_rules[]" value=<?php echo esc_attr( $key ); ?> <?php echo esc_html( ( ( $key & $this->datas['waf_available_rules'] ) > 0 ) ? 'checked' : '' ); ?> /><label for="<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $value ); ?></label> |
| 197 | <?php if ( $key !== $lastkey ) : ?> |
| 198 | <br/> |
| 199 | <?php endif; ?> |
| 200 | <?php endforeach; ?> |
| 201 | </div> |
| 202 | </div> |
| 203 | <div class="box-row flex-start"> |
| 204 | <div class="box-row-title not-label">検査上限� |
| 205 | 過時の扱い</div> |
| 206 | <div class="box-row-content"> |
| 207 | <input type="checkbox" class="checkbox" id="waf_backtrack_error_deny" |
| 208 | name="waf_backtrack_error_deny" |
| 209 | value="1"<?php checked( $this->datas['waf_backtrack_error'] !== '0' ); ?> /> |
| 210 | <label for="waf_backtrack_error_deny">検査上限を� |
| 211 | えたアクセスを遮断する</label> |
| 212 | <br/> |
| 213 | <p class="description"> |
| 214 | 通常は、安� |
| 215 | �のため設定を有効にしておくことを推奨します。<br /> |
| 216 | 正常な操作が遮断される場合のみ、詳細を確認のうえチェックを外してください。<a class="title-block-link" target="_blank" href="https://wpplugin.cloudsecure.ne.jp/cloudsecure_wp_security/waf.php#test-limit-exceeded">詳細はこちら</a> |
| 217 | </p> |
| 218 | </div> |
| 219 | </div> |
| 220 | </div> |
| 221 | </div> |
| 222 | <div id="submit-btn-area"> |
| 223 | <?php $this->nonce_wp( $this->waf->get_feature_key() ); ?> |
| 224 | <?php $this->submit_button_wp(); ?> |
| 225 | </div> |
| 226 | </form> |
| 227 | <?php |
| 228 | } |
| 229 | |
| 230 | /** |
| 231 | * waf履歴一覧画面のページコンテンツ表示用データ |
| 232 | */ |
| 233 | public function get_log_page_data(): void { |
| 234 | ?> |
| 235 | <div class="waf-table-and-link-button" > |
| 236 | <div class="waf-link-button-position link-button back-page"><a href="admin.php?page=cloudsecurewp_waf">戻る</a></div> |
| 237 | <style> |
| 238 | table.cloudsecure-wp-security_page_cloudsecurewp_waf{ |
| 239 | margin: 20px 0; |
| 240 | } |
| 241 | .tablenav { |
| 242 | height: 30px; |
| 243 | margin: 6px 0 4px; |
| 244 | padding-top: 0px; |
| 245 | } |
| 246 | |
| 247 | th.column-access_at { |
| 248 | width: 13em; |
| 249 | } |
| 250 | |
| 251 | th.column-attack { |
| 252 | width: 14%; |
| 253 | } |
| 254 | |
| 255 | th.column-ip { |
| 256 | width: 14em; |
| 257 | } |
| 258 | |
| 259 | th.sortable a, th.sorted a { |
| 260 | display: block; |
| 261 | overflow: hidden; |
| 262 | padding: 12px 8px 12px 23px; |
| 263 | } |
| 264 | |
| 265 | </style> |
| 266 | <?php $this->waf_table->display(); ?> |
| 267 | </div> |
| 268 | <?php |
| 269 | } |
| 270 | |
| 271 | /** |
| 272 | * ページコンテンツ |
| 273 | */ |
| 274 | protected function page(): void { |
| 275 | if ( isset( $_GET['childpage'] ) && 'log' === $_GET['childpage'] ) { |
| 276 | $this->get_log_page_data(); |
| 277 | } else { |
| 278 | $this->get_waf_page_data(); |
| 279 | } |
| 280 | |
| 281 | } |
| 282 | } |
| 283 |