defender-security / src / controller / class-onboard.php

class-onboard.php in Defender Security – Malware Scanner, Login Security & Firewall 5.3.1, at src/controller/class-onboard.php

402 lines 10.1 KB

Raw Download Zip

1	<?php
2	/**
3	* Handles onboarding.
4	*
5	* @package WP_Defender\Controller
6	*/
7
8	namespace WP_Defender\Controller;
9
10	use WP_Defender\Event;
11	use Calotes\Helper\HTTP;
12	use Calotes\Helper\Route;
13	use WP_Defender\Behavior\WPMUDEV;
14	use WP_Defender\Model\Setting\Login_Lockout;
15	use WP_Defender\Model\Setting\Notfound_Lockout;
16	use WP_Defender\Model\Setting\User_Agent_Lockout;
17	use WP_Defender\Model\Setting\Main_Setting as Model_Main_Setting;
18	use WP_Defender\Model\Setting\Scan as Scan_Settings;
19	use WP_Defender\Controller\Scan as Controller_Scan;
20	use WP_Defender\Controller\Hub_Connector;
21	use WP_Defender\Model\Setting\Antibot_Global_Firewall_Setting;
22	use WP_Defender\Component\IP\Antibot_Global_Firewall;
23	use WP_Defender\Component\Feature_Modal;
24
25	/**
26	* This class is only used once, after the activation on a fresh install.
27	* We will use this for activating & presets other module settings.
28	*/
29	class Onboard extends Event {
30	/**
31	* The key for the remind later in onboarding page.
32	*
33	* @var string
34	*/
35	public const REMINDER_KEY = 'wp_defender_onboard_antibot_reminder';
36
37	/**
38	* The slug identifier for this controller.
39	*
40	* @var string
41	*/
42	public $slug = 'wp-defender';
43
44	/**
45	* List of steps for the onboarding process.
46	*
47	* @var array
48	*/
49	public const STEPS = array(
50	'init',
51	'activating',
52	'activate-antibot',
53	);
54
55	/**
56	* Initializes the model and service, registers routes, and sets up scheduled events if the model is active.
57	*/
58	public function __construct() {
59	$this->attach_behavior( WPMUDEV::class, WPMUDEV::class );
60	$this->add_main_page();
61	add_action( 'defender_enqueue_assets', array( $this, 'enqueue_assets' ) );
62	}
63
64	/**
65	* Registers the main page in the WordPress admin menu.
66	*/
67	protected function add_main_page() {
68	$this->register_page(
69	$this->get_menu_title(),
70	$this->parent_slug,
71	array(
72	&$this,
73	'main_view',
74	),
75	null,
76	$this->get_menu_icon()
77	);
78	}
79
80	/**
81	* Renders the main view for this page.
82	*/
83	public function main_view() {
84	$class = wd_di()->get( Security_Tweaks::class );
85	$class->refresh_tweaks_status();
86	$this->render( 'main' );
87	}
88
89	/**
90	* Method to handle the activation process.
91	*
92	* @defender_route
93	*/
94	public function activating() {
95	if ( ! $this->check_permission() \|\| ! $this->verify_nonce( 'activatingonboard' ) ) {
96	wp_send_json_error( array( 'message' => esc_html__( 'Invalid', 'defender-security' ) ) );
97	}
98
99	$step = defender_get_data_from_request( 'step', 'p' );
100	if ( ! in_array( $step, self::STEPS, true ) ) {
101	wp_send_json_error( array( 'message' => esc_html__( 'Invalid', 'defender-security' ) ) );
102	}
103
104	if ( 'activate-antibot' !== $step ) {
105	$this->attach_behavior( WPMUDEV::class, WPMUDEV::class );
106
107	$this->maybe_tracking( 'Activate & Configure' );
108	// Run plugin modules.
109	if ( $this->is_pro() ) {
110	$this->preset_audit();
111	$this->preset_blacklist_monitor();
112	}
113	$this->preset_firewall();
114	$this->resolve_security_tweaks();
115	$this->preset_scanning();
116	// @since 4.2.0 No display the Data Tracking after the Onboarding.
117	Data_Tracking::delete_modal_key();
118
119	update_site_option( 'wp_defender_onboarding_step', 'activate-antibot' );
120
121	wp_send_json_success();
122	} else {
123	$antibot_service = wd_di()->get( Antibot_Global_Firewall::class );
124	$managed_by = $antibot_service->get_default_managed_by();
125	$antibot_service->set_managed_by( $managed_by );
126
127	if ( 'plugin' === $managed_by ) {
128	$antibot_service->managed_by_plugin_action();
129	} else {
130	$antibot_service->managed_by_hosting_action();
131	}
132
133	update_site_option( 'wp_defender_shown_activator', true );
134	delete_site_option( 'wp_defender_is_free_activated' );
135	delete_site_option( 'wp_defender_onboarding_step' );
136
137	$data = array(
138	'is_antibot_enabled' => $antibot_service->frontend_is_enabled(),
139	'hub_connector' => wd_di()->get( Hub_Connector::class )->data_frontend(),
140	);
141	// Track.
142	if ( $this->is_tracking_active() ) {
143	wd_di()->get( \WP_Defender\Helper\Analytics\Antibot::class )
144	->track_antibot( false, 'Onboarding' );
145	}
146
147	wp_send_json_success( $data );
148	}
149	}
150
151	/**
152	* Enable blacklist status.
153	*/
154	private function preset_blacklist_monitor() {
155	$this->make_wpmu_request(
156	WPMUDEV::API_BLACKLIST,
157	array(),
158	array(
159	'method' => 'POST',
160	)
161	);
162	}
163
164	/**
165	* Sets the audit logging to enabled and saves the changes.
166	*
167	* @return void
168	*/
169	private function preset_audit() {
170	$audit = new \WP_Defender\Model\Setting\Audit_Logging();
171	$audit->enabled = true;
172	$audit->save();
173	}
174
175	/**
176	* Sets up the preset scanning configuration and creates a new scan.
177	*
178	* @return void
179	*/
180	private function preset_scanning() {
181	$model = new Scan_Settings();
182	$model->save();
183	// Create new scan.
184	$ret = \WP_Defender\Model\Scan::create();
185	if ( is_object( $ret ) && ! is_wp_error( $ret ) ) {
186	if ( $this->is_tracking_active() ) {
187	wd_di()->get( Model_Main_Setting::class )->toggle_tracking( true );
188	}
189	$scan_controller = wd_di()->get( Controller_Scan::class );
190
191	if ( is_multisite() ) {
192	// The admin-ajax.php file doesn't trigger the init hook, so we need to call the scan function directly.
193	$scan_controller->process();
194	} else {
195	$scan_controller->do_async_scan( 'install' );
196	}
197	}
198	}
199
200	/**
201	* Sets up the preset firewall configuration.
202	*
203	* @return void
204	*/
205	private function preset_firewall() {
206	$lockout = new Login_Lockout();
207	$lockout->enabled = true;
208	$lockout->save();
209	$nf = new Notfound_Lockout();
210	$nf->enabled = true;
211	$nf->save();
212	$ua = new User_Agent_Lockout();
213	$ua->enabled = true;
214	$ua->save();
215	}
216
217	/**
218	* Resolve all tweaks that we can.
219	*
220	* @since 2.4.6 Remove tweaks that can be added to wp-config.php manually: 'hide-error', 'disable-file-editor'.
221	*/
222	private function resolve_security_tweaks() {
223	$slugs = array(
224	'disable-xml-rpc',
225	'login-duration',
226	'disable-trackback',
227	'prevent-enum-users',
228	);
229	$class = wd_di()->get( Security_Tweaks::class );
230	$class->refresh_tweaks_status();
231	$class->security_tweaks_auto_action( $slugs, 'resolve' );
232	}
233
234	/**
235	* Get modules in quick setup.
236	*
237	* @return array
238	*/
239	private function get_modules(): array {
240	$modules = array(
241	'Firewall',
242	'Recommendations',
243	);
244	if ( $this->is_pro() ) {
245	$modules[] = 'Malware Scanning';
246	$modules[] = 'Audit Logging';
247	$modules[] = 'Blocklist Monitor';
248	} else {
249	$modules[] = 'WP file scanning';
250	}
251
252	return $modules;
253	}
254
255	/**
256	* Maybe track usage data.
257	*
258	* @param string $action Action name.
259	*/
260	private function maybe_tracking( string $action ) {
261	$usage_data_state = HTTP::post( 'usage_tracking', '' );
262	// Track it, the default option value is changed to True.
263	if ( 'true' === $usage_data_state ) {
264	wd_di()->get( Model_Main_Setting::class )->toggle_tracking( true );
265	$this->track_opt_toggle( true, 'Wizard' );
266	$this->track_feature(
267	'def_quick_setup',
268	array(
269	'module' => $this->get_modules(),
270	'action' => $action,
271	)
272	);
273	}
274	}
275
276	/**
277	* Skip onboarding.
278	*
279	* @defender_route
280	*/
281	public function skip() {
282	if ( ! $this->check_permission() \|\| ! $this->verify_nonce( 'skiponboard' ) ) {
283	wp_send_json_error( array( 'message' => esc_html__( 'Invalid', 'defender-security' ) ) );
284	}
285
286	update_site_option( 'wp_defender_shown_activator', true );
287	delete_site_option( 'wp_defender_is_free_activated' );
288	// @since 4.2.0 No display the Data Tracking after the Onboarding.
289	Data_Tracking::delete_modal_key();
290
291	$this->maybe_tracking( 'Start from scratch' );
292	wp_send_json_success();
293	}
294
295	/**
296	* Enqueues scripts and styles for this page.
297	* Only enqueues assets if the page is active.
298	*/
299	public function enqueue_assets() {
300	if ( ! $this->is_page_active() ) {
301	return;
302	}
303
304	wp_localize_script( 'def-onboard', 'onboard', $this->data_frontend() );
305	wp_enqueue_script( 'def-onboard' );
306	$this->enqueue_main_assets();
307	add_filter( 'admin_body_class', array( $this, 'admin_body_class' ) );
308	}
309
310	/**
311	* Add classes to admin body.
312	*
313	* @param string $classes Admin body classes.
314	*
315	* @return string
316	*/
317	public function admin_body_class( $classes ) {
318	$classes .= ' wdf-full-screen ';
319
320	return $classes;
321	}
322
323	/**
324	* Removes settings for all submodules.
325	*/
326	public function remove_settings() {
327	delete_site_option( self::REMINDER_KEY );
328	delete_site_option( 'wp_defender_onboarding_step' );
329	}
330
331	/**
332	* Delete all the data & the cache.
333	*/
334	public function remove_data() {
335	}
336
337	/**
338	* Exports strings.
339	*
340	* @return array An array of strings.
341	*/
342	public function export_strings() {
343	return array();
344	}
345
346	/**
347	* Converts the current object state to an array.
348	*
349	* @return array The array representation of the object.
350	*/
351	public function to_array(): array {
352	return array();
353	}
354
355	/**
356	* Imports data into the model.
357	*
358	* @param array $data Data to be imported into the model.
359	*/
360	public function import_data( array $data ) {
361	}
362
363	/**
364	* Provides data for the frontend.
365	*
366	* @return array An array of data for the frontend.
367	*/
368	public function data_frontend(): array {
369	[ $endpoints, $nonces ] = Route::export_routes( 'onboard' );
370
371	return array(
372	'endpoints' => $endpoints,
373	'nonces' => $nonces,
374	'misc' => array(
375	'state_usage_tracking' => wd_di()->get( Model_Main_Setting::class )->usage_tracking,
376	'privacy_link' => Model_Main_Setting::PRIVACY_LINK,
377	'antibot' => Antibot_Global_Firewall_Setting::get_module_name(),
378	),
379	'hub_connector' => wd_di()->get( Hub_Connector::class )->data_frontend(),
380	'step' => get_site_option( 'wp_defender_onboarding_step', 'init' ),
381	);
382	}
383
384	/**
385	* Remind Antibot onboarding.
386	*
387	* @defender_route
388	*/
389	public function antibot_reminder() {
390	if ( ! $this->check_permission() \|\| ! $this->verify_nonce( 'antibot_reminderonboard' ) ) {
391	wp_send_json_error( array( 'message' => esc_html__( 'Invalid', 'defender-security' ) ) );
392	}
393
394	update_site_option( 'wp_defender_shown_activator', true );
395	update_site_option( self::REMINDER_KEY, time() );
396	delete_site_option( 'wp_defender_onboarding_step' );
397	delete_site_option( 'wp_defender_is_free_activated' );
398
399	wp_send_json_success();
400	}
401	}
402