defender-security / src / behavior / scan / class-abandoned-plugin.php

class-abandoned-plugin.php in Defender Security – Malware Scanner, Login Security & Firewall 5.5.1, at src/behavior/scan/class-abandoned-plugin.php

272 lines 7.3 KB

Raw Download Zip

1	<?php
2	/**
3	* Handle abandoned plugin scan.
4	*
5	* @package WP_Defender\Behavior\Scan
6	*/
7
8	namespace WP_Defender\Behavior\Scan;
9
10	use Calotes\Component\Behavior;
11	use WP_Defender\Controller\Scan as Scan_Controller;
12	use WP_Defender\Model\Scan;
13	use WP_Defender\Model\Scan_Item;
14	use WP_Defender\Traits\IO;
15	use WP_Defender\Traits\Plugin;
16
17	/**
18	* Handle abandoned plugin scan.
19	*/
20	class Abandoned_Plugin extends Behavior {
21
22	use IO;
23	use Plugin;
24
25	/**
26	* Hold the Scan model or null if not set.
27	*
28	* @var Scan\|null
29	*/
30	private ?Scan $scan;
31
32	/**
33	* Outdated plugin period.
34	*
35	* @var string
36	*/
37	private const OUTDATED_PERIOD = '2 years';
38
39	/**
40	* Initialize Scan instance.
41	*
42	* @param Scan $scan The Scan model.
43	*/
44	public function __construct( Scan $scan ) {
45	$this->scan = $scan;
46	}
47
48	/**
49	* Get the outdated period of the plugin.
50	*
51	* @return string
52	*/
53	public static function get_outdated_period() {
54	// Filter to override outdated threshold period.
55	$period = (string) apply_filters( 'wpdef_scan_outdated_period', self::OUTDATED_PERIOD );
56	// If time period is invalid, use the default one.
57	return strtotime( '- ' . $period ) ? $period : self::OUTDATED_PERIOD;
58	}
59
60	/**
61	* Check if there are abandoned plugins.
62	*
63	* @return bool
64	*/
65	public function abandoned_plugin_check(): bool {
66	$ignored_issues = $this->get_ignored_issues();
67	$model = $this->scan;
68
69	foreach ( $this->get_plugin_slugs() as $slug ) {
70	if ( is_object( $model ) && $model->is_issue_ignored( $slug ) ) {
71	continue;
72	}
73	$this->check_abandoned_plugin_by( $slug );
74	}
75
76	$this->scan->calculate_percent( 100, 4 );
77	$this->add_ignored_issues( $ignored_issues );
78
79	return true;
80	}
81
82	/**
83	* Retrieve the list of ignored issues.
84	*
85	* @return array The list of ignored issues.
86	*/
87	private function get_ignored_issues(): array {
88	$last = Scan::get_last();
89
90	return is_object( $last )
91	? $last->get_issues(
92	Scan::get_abandoned_types(),
93	Scan_Item::STATUS_IGNORE
94	)
95	: array();
96	}
97
98	/**
99	* Add ignored issues to the scan.
100	*
101	* @param array $ignored_issues The array of ignored issues to add.
102	*/
103	private function add_ignored_issues( array $ignored_issues ) {
104	if ( ! empty( $ignored_issues ) ) {
105	foreach ( $ignored_issues as $issue ) {
106	$this->scan->add_item( $issue->type, $issue->raw_data, Scan_Item::STATUS_IGNORE );
107	}
108	}
109	}
110
111	/**
112	* Handle the error by different actions, e.g. logging.
113	*
114	* @param string $error_message The error message.
115	*/
116	private function handle_error( string $error_message ) {
117	$this->log( $error_message, Scan_Controller::SCAN_LOG );
118	}
119
120	/**
121	* Prepare data before saving.
122	*
123	* @param array $body_json Data from WP API.
124	* @param array $plugin_details Data from local plugin headers.
125	*
126	* @return array {
127	* Plugin data. Values will be empty if not supplied by the plugin or API sides.
128	*
129	* @type string $name Plugin name.
130	* @type string $slug Plugin slug.
131	* @type string $url Plugin URL.
132	* @type string $version Plugin version.
133	* @type string $tested_wp Latest tested WordPress version.
134	* @type string $last_updated Last updated date.
135	* @type string $reason_text Reason for saving or update.
136	* }
137	*/
138	private function prepare_item_data( array $body_json, array $plugin_details ): array {
139	$data = array();
140	// Check plugin name.
141	if ( isset( $body_json['name'] ) ) {
142	$data['name'] = $body_json['name'];
143	} elseif ( isset( $plugin_details['Name'] ) ) {
144	$data['name'] = $plugin_details['Name'];
145	} else {
146	$data['name'] = '';
147	}
148	// Check plugin slug.
149	if ( isset( $body_json['slug'] ) ) {
150	$data['slug'] = $body_json['slug'];
151	} elseif ( isset( $plugin_details['slug'] ) ) {
152	$data['slug'] = $plugin_details['slug'];
153	} else {
154	$data['slug'] = '';
155	}
156	// Check plugin URL. Sometimes URL values are empty.
157	if ( isset( $body_json['homepage'] ) && '' !== $body_json['homepage'] ) {
158	$data['url'] = $body_json['homepage'];
159	} elseif ( isset( $plugin_details['PluginURI'] ) && '' !== $plugin_details['PluginURI'] ) {
160	$data['url'] = $plugin_details['PluginURI'];
161	} elseif ( isset( $plugin_details['AuthorURI'] ) && '' !== $plugin_details['AuthorURI'] ) {
162	$data['url'] = $plugin_details['AuthorURI'];
163	} else {
164	$data['url'] = '';
165	}
166	// Check plugin version.
167	if ( isset( $body_json['version'] ) ) {
168	$data['version'] = $body_json['version'];
169	} elseif ( isset( $plugin_details['Version'] ) ) {
170	$data['version'] = $plugin_details['Version'];
171	} else {
172	$data['version'] = '';
173	}
174	// Check a tested WP version.
175	if ( isset( $body_json['tested'] ) ) {
176	$data['tested_wp'] = $body_json['tested'];
177	} else {
178	$data['tested_wp'] = '';
179	}
180	// Check plugin updated time.
181	if ( isset( $body_json['closed_date'] ) ) {
182	$data['last_updated'] = $body_json['closed_date'];
183	} elseif ( isset( $body_json['last_updated'] ) ) {
184	$data['last_updated'] = $body_json['last_updated'];
185	} else {
186	$data['last_updated'] = '';
187	}
188	// Specific key for closed plugin.
189	if ( isset( $body_json['reason_text'] ) ) {
190	$data['reason_text'] = $body_json['reason_text'];
191	} else {
192	$data['reason_text'] = '';
193	}
194
195	return $data;
196	}
197
198	/**
199	* Get list of plugin slugs whose names do not match the specified names.
200	*/
201	private function get_plugin_slugs_with_mismatched_names(): array {
202	return array(
203	'miniorange-malware-protection',
204	);
205	}
206
207	/**
208	* Is abandoned plugin?
209	*
210	* @param string $slug The slug to check.
211	*
212	* @return bool
213	*/
214	public function check_abandoned_plugin_by( string $slug ): bool {
215	$premium_plugin_slugs = get_site_option( Plugin_Integrity::PLUGIN_PREMIUM_SLUGS, false );
216	if ( is_array( $premium_plugin_slugs ) && in_array( $slug, $premium_plugin_slugs, true ) ) {
217	return true;
218	} elseif ( ! $this->is_likely_wporg_slug( $slug ) ) {
219	return true;
220	}
221
222	$results = $this->handle_wp_org_response_by( $slug );
223	if ( ! $results['success'] ) {
224	$this->handle_error( $results['message'] );
225
226	return false;
227	} else {
228	$body_json = $results['body'];
229	$plugin_details = $this->get_plugin_details_by( $slug );
230	if (
231	isset( $body_json['name'], $plugin_details['Name'] )
232	&& $plugin_details['Name'] !== $body_json['name']
233	&& ! in_array( $slug, $this->get_plugin_slugs_with_mismatched_names(), true )
234	) {
235	// This is premium plugin with the same slug as on wp.org but with another name value.
236	return false;
237	}
238
239	if ( isset( $body_json['error'] ) && 'closed' === $body_json['error'] ) {
240	$this->log( sprintf( 'Plugin slug closed: %s', $slug ), Scan_Controller::SCAN_LOG );
241
242	$this->scan->add_item(
243	Scan_Item::TYPE_PLUGIN_CLOSED,
244	$this->prepare_item_data( $body_json, $plugin_details )
245	);
246
247	return true;
248	}
249
250	if ( '' !== $body_json['last_updated'] ) {
251	$last_updated_time = $body_json['last_updated'];
252	$ttl = strtotime( $last_updated_time );
253	if ( $ttl < strtotime( '- ' . self::get_outdated_period() ) ) {
254	$this->log( sprintf( 'Plugin slug outdated: %s', $slug ), Scan_Controller::SCAN_LOG );
255	$plugin_details = $this->prepare_item_data( $body_json, $plugin_details );
256	// Improve the date view.
257	$plugin_details['last_updated'] = gmdate( 'F j, Y', $ttl );
258
259	$this->scan->add_item(
260	Scan_Item::TYPE_PLUGIN_OUTDATED,
261	$plugin_details
262	);
263
264	return true;
265	}
266	}
267
268	return false;
269	}
270	}
271	}
272