defender-security / src / behavior / scan-item / vuln-result.php

vuln-result.php in Defender Security – Malware Scanner, Login Security & Firewall 3.1.0, at src/behavior/scan-item/vuln-result.php

208 lines 5.3 KB

Raw Download Zip

1	<?php
2
3	namespace WP_Defender\Behavior\Scan_Item;
4
5	use Calotes\Component\Behavior;
6	use WP_Defender\Component\Error_Code;
7	use WP_Defender\Model\Scan;
8	use WP_Defender\Model\Scan_Item;
9	use WP_Defender\Traits\Formats;
10
11	class Vuln_Result extends Behavior {
12	use Formats;
13
14	public function to_array() {
15	$data = $this->owner->raw_data;
16	if ( isset( $data['name'], $data['version'], $data['bugs'] ) ) {
17
18	return [
19	'id' => $this->owner->id,
20	'type' => Scan_Item::TYPE_VULNERABILITY,
21	'file_name' => $data['name'],
22	'short_desc' => sprintf( __( 'Vulnerability found in %s.', 'wpdef' ), $data['version'] ),
23	'detail' => $this->get_detail_as_string( $data ),
24	// Need for all scan items for WP-CLI command. Full path = base slug for this item.
25	'full_path' => $data['slug'],
26	];
27	}
28	}
29
30	/**
31	* @return array
32	*/
33	public function ignore() {
34	$scan = Scan::get_last();
35	$scan->ignore_issue( $this->owner->id );
36
37	return [
38	'message' => __( 'The suspicious file has been successfully ignored.', 'wpdef' )
39	];
40	}
41
42	/**
43	* @return array
44	*/
45	public function unignore() {
46	$scan = Scan::get_last();
47	$scan->unignore_issue( $this->owner->id );
48
49	return [
50	'message' => __( 'The suspicious file has been successfully restored.', 'wpdef' )
51	];
52	}
53
54	/**
55	* @return mixed
56	*/
57	public function resolve() {
58	$data = $this->owner->raw_data;
59	if ( 'wordpress' === $data['type'] ) {
60	return [
61	'url' => network_admin_url( 'wp-admin/update-core.php' )
62	];
63	}
64
65	if ( 'plugin' === $data['type'] ) {
66	return $this->upgrade_plugin( $data['slug'] );
67	} elseif ( 'theme' === $data['type'] ) {
68	return $this->upgrade_theme( $data['base_slug'] );
69	}
70
71	// If type does not match.
72	return new \WP_Error( Error_Code::INVALID, __( 'Please try again! We could not find the issue type.', 'wpdef' ) );
73	}
74
75	/**
76	* @param $slug
77	*
78	* @return array\|bool\|\WP_Error
79	*/
80	private function upgrade_theme( $slug ) {
81	$skin = new Silent_Skin();
82	$upgrader = new \Theme_Upgrader( $skin );
83	$ret = $upgrader->upgrade( $slug );
84
85	if ( true === $ret ) {
86	$model = Scan::get_last();
87	$model->remove_issue( $this->owner->id );
88
89	return [
90	'message' => __( 'This item has been resolved.', 'wpdef' )
91	];
92	}
93
94	// This is WP error.
95	if ( is_wp_error( $ret ) ) {
96	return $ret;
97	}
98
99	// Sometimes it returns false because of it could not complete the update process.
100	return new \WP_Error( Error_Code::INVALID, __( "We couldn't update your theme. Please try updating with another method.", 'wpdef' ) );
101	}
102
103	/**
104	* @param string $slug
105	*
106	* @return array
107	* @since 2.8.1 Change Upgrade plugin logic.
108	*/
109	private function upgrade_plugin( $slug ) {
110	$skin = new Plugin_Skin();
111	$upgrader = new \Plugin_Upgrader( $skin );
112	$result = $upgrader->bulk_upgrade( array( $slug ) );
113
114	if ( is_wp_error( $skin->result ) ) {
115	return array(
116	'type_notice' => 'error',
117	'message' => $skin->result->get_error_message(),
118	);
119	} elseif ( $skin->get_errors()->has_errors() ) {
120	return array(
121	'type_notice' => 'error',
122	'message' => $skin->get_error_messages(),
123	);
124	} elseif ( is_array( $result ) && ! empty( $result[ $slug ] ) ) {
125	/*
126	* Plugin is already at the latest version.
127	*
128	* This may also be the return value if the `update_plugins` site transient is empty,
129	* e.g. when you update two plugins in quick succession before the transient repopulates.
130	*
131	* Preferably something can be done to ensure `update_plugins` isn't empty.
132	* For now, surface some sort of error here.
133	*/
134	if ( true === $result[ $slug ] ) {
135	return array(
136	'type_notice' => 'error',
137	'message' => $upgrader->strings['up_to_date'],
138	);
139	}
140	$model = Scan::get_last();
141	$model->remove_issue( $this->owner->id );
142
143	return array(
144	'message' => __( 'This item has been resolved.', 'wpdef' )
145	);
146	} elseif ( false === $result ) {
147	return array(
148	'type_notice' => 'error',
149	'message' => __( 'Unable to connect to the filesystem. Please confirm your credentials.', 'wpdef' ),
150	);
151	}
152
153	return array(
154	'type_notice' => 'info',
155	'message' => __( 'There is no update available for this plugin.', 'wpdef' ),
156	);
157	}
158
159	/**
160	* @param $data
161	*
162	* @return string
163	*/
164	public function get_detail_as_string( $data ) {
165	$strings = [];
166	foreach ( $data['bugs'] as $bug ) {
167	$text = '';
168	$text .= '#' . $bug['title'] . PHP_EOL;
169	$text .= '-' . __( 'Vulnerability type:', 'wpdef' ) . ' ' . $bug['vuln_type'] . PHP_EOL;
170	if ( isset( $bug['fixed_in'] ) ) {
171	$text .= '-' . __( 'This bug has been fixed in version:', 'wpdef' ) . ' ' . $bug['fixed_in'] . PHP_EOL;
172	} else {
173	$text .= __( 'No Update Available', 'wpdef' ) . PHP_EOL;
174	}
175	$strings[] = $text;
176	}
177
178	return implode( PHP_EOL, $strings );
179	}
180	}
181
182	if ( ! class_exists( \WP_Upgrader::class ) ) {
183	require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
184	}
185	if ( ! class_exists( \Theme_Upgrader::class ) ) {
186	require_once ABSPATH . 'wp-admin/includes/class-theme-upgrader.php';
187	}
188
189	class Silent_Skin extends \Automatic_Upgrader_Skin {
190	public function footer() {
191	return;
192	}
193
194	public function header() {
195	return;
196	}
197
198	public function feedback( $data, ...$args ) {
199	return '';
200	}
201	}
202
203	class Plugin_Skin extends \WP_Ajax_Upgrader_Skin {
204	public function feedback( $data, ...$args ) {
205	return '';
206	}
207	}
208