| 1 |
<?php |
| 2 |
|
| 3 |
namespace WP_Defender\Component\Security_Tweaks; |
| 4 |
|
| 5 |
use Calotes\Base\Component; |
| 6 |
use WP_Error; |
| 7 |
use WP_Defender\Component\Security_Tweaks\Servers\Server; |
| 8 |
use WP_Defender\Component\Security_Tweak as Security_Tweak_Component; |
| 9 |
|
| 10 |
/** |
| 11 |
* Class Disable_File_Editor |
| 12 |
* @package WP_Defender\Component\Security_Tweaks |
| 13 |
*/ |
| 14 |
class Disable_File_Editor extends Component { |
| 15 |
public $slug = 'disable-file-editor'; |
| 16 |
|
| 17 |
/** |
| 18 |
* @return bool |
| 19 |
*/ |
| 20 |
public function check() { |
| 21 |
if ( defined( 'DISALLOW_FILE_EDIT' ) && true === constant( 'DISALLOW_FILE_EDIT' ) ) { |
| 22 |
return true; |
| 23 |
} |
| 24 |
|
| 25 |
return false; |
| 26 |
} |
| 27 |
|
| 28 |
/** |
| 29 |
* Get pattern for DISALLOW_FILE_EDIT. |
| 30 |
* |
| 31 |
* @return string |
| 32 |
*/ |
| 33 |
private function get_file_edit_pattern() { |
| 34 |
return "/^define\(\s*['|\"]DISALLOW_FILE_EDIT['|\"],(.*)\)/"; |
| 35 |
} |
| 36 |
|
| 37 |
/** |
| 38 |
* Set data in wp-config.php. |
| 39 |
* |
| 40 |
* @param bool $value |
| 41 |
* |
| 42 |
* @return bool|\WP_Error |
| 43 |
*/ |
| 44 |
private function set_file_edit_data( $value ) { |
| 45 |
$sec_tweak_component = new Security_Tweak_Component(); |
| 46 |
$obj_file = 'flywheel' === Server::get_current_server() |
| 47 |
? $sec_tweak_component->advanced_check_file() |
| 48 |
: $sec_tweak_component->file(); |
| 49 |
if ( false === $obj_file ) { |
| 50 |
return new WP_Error( |
| 51 |
'defender_file_not_writable', |
| 52 |
__( 'The file wp-config.php is not writable', 'wpdef' ) |
| 53 |
); |
| 54 |
} elseif ( is_numeric( $obj_file ) ) { |
| 55 |
return new WP_Error( |
| 56 |
'defender_file_not_writable', |
| 57 |
$sec_tweak_component->show_hosting_notice( 'DISALLOW_FILE_EDIT' ) |
| 58 |
); |
| 59 |
} |
| 60 |
|
| 61 |
$file_edit = 'DISALLOW_FILE_EDIT'; |
| 62 |
$value = $value ? 'true' : 'false'; |
| 63 |
$pattern = $this->get_file_edit_pattern(); |
| 64 |
$hook_line_pattern = $sec_tweak_component->get_hook_line_pattern(); |
| 65 |
$file_edit_line = "define( '{$file_edit}', {$value} ); // Added by Defender"; |
| 66 |
$lines = array(); |
| 67 |
$line_found = false; |
| 68 |
$hook_line_no = null; |
| 69 |
|
| 70 |
foreach ( $obj_file as $line ) { |
| 71 |
if ( ! $line_found && preg_match( $pattern, $line ) ) { |
| 72 |
// If this is revert request and the changes is not made by us throw error. |
| 73 |
if ( 'true' === $value && ! preg_match( "/^define\(\s*['|\"]{$file_edit}['|\"],(.*)\);\s*\/\/\s*Added\s*by\s*Defender.?.*/i", $line ) ) { |
| 74 |
return new WP_Error( |
| 75 |
'defender_file_not_writable', |
| 76 |
$sec_tweak_component->show_hosting_notice_with_code( $file_edit, $file_edit_line ) |
| 77 |
); |
| 78 |
} |
| 79 |
|
| 80 |
$lines[] = $file_edit_line; |
| 81 |
$line_found = true; |
| 82 |
continue; |
| 83 |
} |
| 84 |
|
| 85 |
// If there is no match, keep reference of `hook_line_no` so that we can insert data there as needed. |
| 86 |
if ( ! $line_found && preg_match( $hook_line_pattern, $line ) ) { |
| 87 |
$hook_line_no = $obj_file->key(); |
| 88 |
$lines[ $hook_line_no + 1 ] = trim( $line ); |
| 89 |
continue; |
| 90 |
} |
| 91 |
|
| 92 |
$lines[] = trim( $line ); |
| 93 |
} |
| 94 |
|
| 95 |
// There is no match, so set DISALLOW_FILE_EDIT data just before the hook line ei: `$table_prefix`. |
| 96 |
if ( ! $line_found && ! is_null( $hook_line_no ) ) { |
| 97 |
$line_found = true; |
| 98 |
$lines[ $hook_line_no ] = $file_edit_line; |
| 99 |
ksort( $lines ); |
| 100 |
} |
| 101 |
|
| 102 |
return $line_found |
| 103 |
? $sec_tweak_component->write( $lines ) |
| 104 |
: new WP_Error( |
| 105 |
'defender_line_not_found', |
| 106 |
__( 'Error writing to file.', 'wpdef' ), |
| 107 |
404 |
| 108 |
); |
| 109 |
} |
| 110 |
|
| 111 |
/** |
| 112 |
* Enable file editor. |
| 113 |
* |
| 114 |
* @return bool|\WP_Error |
| 115 |
*/ |
| 116 |
private function enable_file_editor() { |
| 117 |
return $this->set_file_edit_data( false ); |
| 118 |
} |
| 119 |
|
| 120 |
/** |
| 121 |
* Disable file editor. |
| 122 |
* |
| 123 |
* @return bool|\WP_Error |
| 124 |
*/ |
| 125 |
private function disable_file_editor() { |
| 126 |
return $this->set_file_edit_data( true ); |
| 127 |
} |
| 128 |
|
| 129 |
/** |
| 130 |
* Here is the code for processing, if the return is true, we add it to resolve list, WP_Error if any error. |
| 131 |
* |
| 132 |
* @return bool|\WP_Error |
| 133 |
*/ |
| 134 |
public function process() { |
| 135 |
return $this->disable_file_editor(); |
| 136 |
} |
| 137 |
|
| 138 |
/** |
| 139 |
* This is for un-do stuff that has be done in @process. |
| 140 |
* |
| 141 |
* @return bool|\WP_Error |
| 142 |
*/ |
| 143 |
public function revert() { |
| 144 |
return $this->enable_file_editor(); |
| 145 |
} |
| 146 |
|
| 147 |
/** |
| 148 |
* Define the DISALLOW_FILE_EDIT constant, so we can hide the editor page. |
| 149 |
*/ |
| 150 |
public function shield_up() { |
| 151 |
return true; |
| 152 |
} |
| 153 |
|
| 154 |
/** |
| 155 |
* Return a summary data of this tweak. |
| 156 |
* |
| 157 |
* @return array |
| 158 |
*/ |
| 159 |
public function to_array() { |
| 160 |
return array( |
| 161 |
'slug' => $this->slug, |
| 162 |
'title' => __( 'Disable the file editor', 'wpdef' ), |
| 163 |
'errorReason' => __( 'The file editor is currently enabled.', 'wpdef' ), |
| 164 |
'successReason' => __( 'You\'ve disabled the file editor, winning.', 'wpdef' ), |
| 165 |
'misc' => array(), |
| 166 |
'bulk_description' => __( 'The file editor is currently active, this means anyone with access to your login information can further edit your plugin and theme files and inject malicious code. We will disable file editor for you.', 'wpdef' ), |
| 167 |
'bulk_title' => __( 'File Editor', 'wpdef' ), |
| 168 |
); |
| 169 |
} |
| 170 |
} |
| 171 |
|
