| 1 |
<?php |
| 2 |
|
| 3 |
namespace WP_Defender\Behavior\Scan; |
| 4 |
|
| 5 |
use Calotes\Component\Behavior; |
| 6 |
use WP_Defender\Behavior\WPMUDEV; |
| 7 |
use WP_Defender\Model\Scan; |
| 8 |
use WP_Defender\Model\Scan_Item; |
| 9 |
use WP_Defender\Traits\IO; |
| 10 |
use WP_Defender\Traits\Plugin; |
| 11 |
use WP_Defender\Traits\Theme; |
| 12 |
|
| 13 |
class Known_Vulnerability extends Behavior { |
| 14 |
use IO, Plugin, Theme; |
| 15 |
|
| 16 |
public function vuln_check() { |
| 17 |
$this->attach_behavior( WPMUDEV::class, WPMUDEV::class ); |
| 18 |
global $wp_version; |
| 19 |
$info_cached = []; |
| 20 |
$data = [ |
| 21 |
'plugins' => json_encode( $this->gather_fact_plugins( $info_cached ) ), |
| 22 |
'themes' => json_encode( $this->gather_fact_themes( $info_cached ) ), |
| 23 |
'wordpress' => $wp_version |
| 24 |
]; |
| 25 |
|
| 26 |
$ret = $this->make_check( $data ); |
| 27 |
if ( is_wp_error( $ret ) ) { |
| 28 |
$this->log( $ret->get_error_message(), 'scan.log' ); |
| 29 |
$this->owner->scan->status = Scan::STATUS_ERROR; |
| 30 |
$this->owner->scan->save(); |
| 31 |
|
| 32 |
return true; |
| 33 |
} |
| 34 |
|
| 35 |
$this->process_result( $ret['plugins'], $info_cached, 'plugin' ); |
| 36 |
$this->process_result( $ret['themes'], $info_cached, 'theme' ); |
| 37 |
$this->process_result( $ret['wordpress'], [], 'wordpress' ); |
| 38 |
$this->owner->scan->calculate_percent( 100, 5 ); |
| 39 |
|
| 40 |
$last = Scan::get_last(); |
| 41 |
if ( is_object( $last ) ) { |
| 42 |
$ignored_issues = $last->get_issues( Scan_Item::TYPE_VULNERABILITY, Scan_Item::STATUS_IGNORE ); |
| 43 |
foreach ( $ignored_issues as $issue ) { |
| 44 |
$this->owner->scan->add_item( Scan_Item::TYPE_VULNERABILITY, $issue->raw_data, Scan_Item::STATUS_IGNORE ); |
| 45 |
} |
| 46 |
} |
| 47 |
|
| 48 |
return true; |
| 49 |
|
| 50 |
} |
| 51 |
|
| 52 |
/** |
| 53 |
* @param $data |
| 54 |
* |
| 55 |
* @return mixed |
| 56 |
*/ |
| 57 |
public function make_check( $data ) { |
| 58 |
$ret = $this->make_wpmu_request( WPMUDEV::API_SCAN_KNOWN_VULN, $data, [ |
| 59 |
'method' => 'POST' |
| 60 |
] ); |
| 61 |
|
| 62 |
return $ret; |
| 63 |
} |
| 64 |
|
| 65 |
/** |
| 66 |
* @param $result |
| 67 |
* @param $info |
| 68 |
* @param $type |
| 69 |
*/ |
| 70 |
private function process_result( $result, $info, $type ) { |
| 71 |
if ( empty( $result ) ) { |
| 72 |
return; |
| 73 |
} |
| 74 |
$this->log( sprintf( 'Checking %s', $type ) ); |
| 75 |
$model = $this->owner->scan; |
| 76 |
|
| 77 |
foreach ( $result as $base_slug => $bugs ) { |
| 78 |
if ( empty( $info[ $base_slug ] ) ) { |
| 79 |
continue; |
| 80 |
} |
| 81 |
[$name, $current_version, $slug] = $info[ $base_slug ]; |
| 82 |
$raw_data = [ |
| 83 |
'type' => $type, |
| 84 |
'slug' => $slug, |
| 85 |
'base_slug' => $base_slug, |
| 86 |
'version' => $current_version, |
| 87 |
'name' => $name, |
| 88 |
'bugs' => [] |
| 89 |
]; |
| 90 |
if ( isset( $bugs['confirmed'] ) && (is_array($bugs['confirmed']) || $bugs['confirmed'] instanceof \Countable ? count( $bugs['confirmed'] ) : 0) ) { |
| 91 |
$this->log( sprintf( '%s has %d known bugs', $slug, is_array($bugs['confirmed']) || $bugs['confirmed'] instanceof \Countable ? count( $bugs['confirmed'] ) : 0 ) ); |
| 92 |
foreach ( (array) $bugs['confirmed'] as $bug ) { |
| 93 |
$raw_data['bugs'][] = [ |
| 94 |
'vuln_type' => $bug['vuln_type'], |
| 95 |
'title' => $bug['title'], |
| 96 |
'ref' => $bug['references'], |
| 97 |
'fixed_in' => $bug['fixed_in'], |
| 98 |
]; |
| 99 |
} |
| 100 |
|
| 101 |
$model->add_item( Scan_Item::TYPE_VULNERABILITY, $raw_data ); |
| 102 |
} |
| 103 |
} |
| 104 |
} |
| 105 |
|
| 106 |
/** |
| 107 |
* Get all the plugins install on this site, no matter the plugin status. |
| 108 |
* |
| 109 |
* @param $info_cached |
| 110 |
* |
| 111 |
* @return mixed |
| 112 |
*/ |
| 113 |
private function gather_fact_plugins( &$info_cached ) { |
| 114 |
$plugins = []; |
| 115 |
$model = Scan::get_last(); |
| 116 |
foreach ( $this->get_plugins() as $slug => $plugin ) { |
| 117 |
if ( is_object( $model ) && $model->is_issue_ignored( $slug ) ) { |
| 118 |
continue; |
| 119 |
} |
| 120 |
// DIRECTORY_SEPARATOR won't work on Windows OS. |
| 121 |
$base_slug = explode( '/', $slug ); |
| 122 |
$base_slug = array_shift( $base_slug ); |
| 123 |
$plugins[ $base_slug ] = $plugin['Version']; |
| 124 |
$info_cached[ $base_slug ] = [ $plugin['Name'], $plugin['Version'], $slug ]; |
| 125 |
} |
| 126 |
|
| 127 |
return $plugins; |
| 128 |
} |
| 129 |
|
| 130 |
/** |
| 131 |
* @return mixed |
| 132 |
*/ |
| 133 |
private function gather_fact_themes( &$info_cached ) { |
| 134 |
$themes = []; |
| 135 |
$model = Scan::get_last(); |
| 136 |
foreach ( $this->get_themes() as $theme ) { |
| 137 |
if ( is_object( $theme->parent() ) ) { |
| 138 |
continue; |
| 139 |
} |
| 140 |
if ( is_object( $model ) && $model->is_issue_ignored( $theme->get_template() ) ) { |
| 141 |
continue; |
| 142 |
} |
| 143 |
$themes[ $theme->get_template() ] = $theme->Version; |
| 144 |
$info_cached[ $theme->get_template() ] = [ $theme->Name, $theme->Version, $theme->get_template() ]; |
| 145 |
} |
| 146 |
|
| 147 |
return $themes; |
| 148 |
} |
| 149 |
} |
