defender-security / src / component / security-tweaks / servers / class-iis-7.php

class-iis-7.php in Defender Security – Malware Scanner, Login Security & Firewall 5.5.1, at src/component/security-tweaks/servers/class-iis-7.php

196 lines 5.3 KB

Raw Download Zip

1	<?php
2	/**
3	* Responsible for managing server configurations related to security tweaks .
4	*
5	* @package WP_Defender\Component\Security_Tweaks\Servers
6	*/
7
8	namespace WP_Defender\Component\Security_Tweaks\Servers;
9
10	use WP_Error;
11	use DOMXPath;
12	use DOMDocument;
13	use DOMException;
14
15	/**
16	* Provides methods to apply and revert security rules on servers.
17	*/
18	class IIS_7 {
19
20	/**
21	* New htaccess file.
22	*
23	* @var array
24	*/
25	private $new_htaccess_config = array();
26
27	/**
28	* Service type.
29	*
30	* @var string
31	*/
32	private $type = null;
33
34	/**
35	* Constructor for class.
36	*
37	* @param string $type The type of the security tweak.
38	*/
39	public function __construct( $type ) {
40	$this->type = $type;
41	}
42
43	/**
44	* Check whether the issue has been resolved or not.
45	*
46	* @return bool
47	*/
48	public function check() {
49	$url = '';
50
51	if ( 'prevent-php-executed' === $this->type ) {
52	$dir = wp_upload_dir();
53	$url = $dir['baseurl'] . '/wp-defender/index.php';
54	}
55
56	if ( 'protect-information' === $this->type ) {
57	$url = defender_asset_url( '/languages/' . WP_DEFENDER_POT_FILENAME );
58	}
59
60	return Server::ping_test_failed( $url );
61	}
62
63	/**
64	* Process the rule.
65	*
66	* @return bool\|WP_Error
67	* @throws DOMException If invalid $localName.
68	*/
69	public function process() {
70	global $wp_filesystem;
71	// Initialize the WP filesystem, no more using 'file-put-contents' function.
72	if ( empty( $wp_filesystem ) ) {
73	require_once ABSPATH . '/wp-admin/includes/file.php';
74	WP_Filesystem();
75	}
76	$path = WP_CONTENT_DIR . '/uploads';
77	$filename = 'web.config';
78	if ( ! file_exists( $path . '/' . $filename ) ) {
79	$wp_filesystem->put_contents( $path . '/' . $filename, '<configuration/>' );
80	}
81	$formatxml = PHP_EOL;
82	$formatxml .= ' <handlers accessPolicy="Read" />';
83	$formatxml .= PHP_EOL;
84
85	$doc = new DOMDocument();
86	// This property is belongs to DOMDocument. So we can ignore the warning.
87	$doc->preserveWhiteSpace = true; // phpcs:ignore WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase
88
89	if ( $doc->load( $path . '/' . $filename ) === false ) {
90	return new WP_Error(
91	'defender_file_not_editable',
92	sprintf(
93	/* translators: %s: File name. */
94	esc_html__( 'The file %s could not be loaded.', 'defender-security' ),
95	$filename
96	)
97	);
98	}
99
100	$xpath = new DOMXPath( $doc );
101	$read_accesspolicy = $xpath->query( '/configuration/system.webServer/handlers[starts-with(@accessPolicy,\'Read\')]' );
102
103	if ( $read_accesspolicy->length > 0 ) {
104	return true;
105	}
106
107	$xmlnodes = $xpath->query( '/configuration/system.webServer/handlers' );
108
109	if ( $xmlnodes->length > 0 ) {
110	$handlers_node = $xmlnodes->item( 0 );
111	} else {
112	$handlers_node = $doc->createElement( 'handlers' );
113	$xmlnodes = $xpath->query( '/configuration/system.webServer' );
114
115	if ( $xmlnodes->length > 0 ) {
116	$system_web_server_node = $xmlnodes->item( 0 );
117	$handler_fragment = $doc->createDocumentFragment();
118	$handler_fragment->appendXML( $formatxml );
119	$system_web_server_node->appendChild( $handler_fragment );
120	} else {
121	$system_web_server_node = $doc->createElement( 'system.webServer' );
122	$handler_fragment = $doc->createDocumentFragment();
123	$handler_fragment->appendXML( $formatxml );
124	$system_web_server_node->appendChild( $handler_fragment );
125	$xmlnodes = $xpath->query( '/configuration' );
126
127	if ( $xmlnodes->length > 0 ) {
128	$config_node = $xmlnodes->item( 0 );
129	$config_node->appendChild( $system_web_server_node );
130	} else {
131	$config_node = $doc->createElement( 'configuration' );
132	$doc->appendChild( $config_node );
133	$config_node->appendChild( $system_web_server_node );
134	}
135	}
136	}
137
138	$rule_fragment = $doc->createDocumentFragment();
139	$rule_fragment->appendXML( $formatxml );
140	$handlers_node->appendChild( $rule_fragment );
141
142	$doc->encoding = 'UTF-8';
143	$doc->formatOutput = true; // phpcs:ignore WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase
144	saveDomDocument( $doc, $path . '/' . $filename );
145
146	$settings = array(
147	'new_htaccess_config' => $this->get_new_htaccess_config(),
148	);
149
150	return update_site_option( "defender_security_tweeks_{$this->type}", $settings );
151	}
152
153	/**
154	* Revert the rule.
155	*
156	* @return bool
157	*/
158	public function revert() {
159	$path = WP_CONTENT_DIR . '/uploads';
160	$filename = 'web.config';
161
162	if ( ! file_exists( $path . '/' . $filename ) ) {
163	return true;
164	}
165
166	$doc = new DOMDocument();
167	$doc->preserveWhiteSpace = false; // phpcs:ignore WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase
168
169	if ( $doc->load( $path . '/' . $filename ) === false ) {
170	return false;
171	}
172
173	$xpath = new DOMXPath( $doc );
174	$handlers = $xpath->query( '/configuration/system.webServer/handlers[contains(@accessPolicy,\'Read\')]' );
175
176	if ( $handlers->length > 0 ) {
177	$child = $handlers->item( 0 );
178	$parent = $child->parentNode; // phpcs:ignore WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase
179	$parent->removeChild( $child );
180	$doc->formatOutput = true; // phpcs:ignore WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase
181	saveDomDocument( $doc, $path . '/' . $filename );
182	}
183
184	return true;
185	}
186
187	/**
188	* Get the new HT config.
189	*
190	* @return array
191	*/
192	public function get_new_htaccess_config() {
193	return $this->new_htaccess_config;
194	}
195	}
196