defender-security / src / behavior / scan-item / class-plugin-integrity.php

class-plugin-integrity.php in Defender Security – Malware Scanner, Login Security & Firewall 5.6.0, at src/behavior/scan-item/class-plugin-integrity.php

234 lines 6.8 KB

Raw Download Zip

1	<?php
2	/**
3	* Handles plugin integrity scan item.
4	*
5	* @package WP_Defender\Behavior\Scan_Item
6	*/
7
8	namespace WP_Defender\Behavior\Scan_Item;
9
10	use WP_Error;
11	use Calotes\Base\File;
12	use WP_Defender\Traits\IO;
13	use WP_Defender\Model\Scan;
14	use WP_Defender\Traits\Plugin;
15	use WP_Defender\Traits\Formats;
16	use Calotes\Component\Behavior;
17	use WP_Defender\Model\Scan_Item;
18	use WP_Defender\Traits\File_Operations;
19	use WP_Defender\Component\Quarantine as Quarantine_Component;
20	use WP_Filesystem_Base;
21
22	/**
23	* Class Plugin_Integrity
24	* This class represents a plugin integrity behavior.
25	*/
26	class Plugin_Integrity extends Behavior {
27
28	use Formats;
29	use IO;
30	use Plugin;
31	use File_Operations;
32
33	/**
34	* Return general data so we can output on frontend.
35	*
36	* @return array
37	*/
38	public function to_array(): array {
39	$data = $this->owner->raw_data;
40	$file = $data['file'];
41	list ( $file_created_at, $file_size, $deleted ) = $this->get_file_meta( $file );
42
43	$is_quarantinable = $this->is_quarantinable( $this->owner->raw_data['file'] );
44
45	$quarantine_data = class_exists( 'WP_Defender\Component\Quarantine' ) ?
46	wd_di()->get( Quarantine_Component::class )->scan_item_data( $this->owner ) :
47	array( 'is_quarantinable' => $is_quarantinable );
48
49	return array_merge(
50	array(
51	'id' => $this->owner->id,
52	'type' => Scan_Item::TYPE_PLUGIN_CHECK,
53	'file_name' => pathinfo( $file, PATHINFO_BASENAME ),
54	'full_path' => $file,
55	'date_added' => $file_created_at,
56	'size' => $file_size,
57	'deleted' => $deleted,
58	'scenario' => $data['type'],
59	'short_desc' => $this->get_short_description(),
60	),
61	$quarantine_data
62	);
63	}
64
65	/**
66	* We will get the origin code by looking into svn repo.
67	*
68	* @return false\|string\|WP_Error
69	*/
70	private function get_origin_code() {
71	$file = $this->owner->raw_data['file'];
72
73	$directory_name = $this->get_plugin_directory_name( $file );
74	$plugin_header = $this->get_plugin_headers( $file );
75	$plugin_header = reset( $plugin_header );
76	$file_path = $this->get_plugin_relative_path( $file );
77
78	$source_file_url = $this->get_file_url(
79	$directory_name,
80	$plugin_header['Version'],
81	$file_path
82	);
83
84	return $this->get_url_content( $source_file_url );
85	}
86
87	/**
88	* Restore the file with its origin content.
89	*
90	* @return void\|array\|WP_Error
91	*/
92	public function resolve() {
93	global $wp_filesystem;
94	// Initialize the WP filesystem, no more using 'file-put-contents' function.
95	if ( ! $wp_filesystem instanceof WP_Filesystem_Base ) {
96	require_once ABSPATH . '/wp-admin/includes/file.php';
97	WP_Filesystem();
98	}
99	$data = $this->owner->raw_data;
100	if ( 'modified' !== $data['type'] ) {
101	// Should not be here unless case changed.
102	return;
103	}
104
105	$origin = $this->get_origin_code();
106	if ( false === $origin \|\| is_wp_error( $origin ) ) {
107	return;
108	}
109
110	$path = $data['file'];
111	$ret = $wp_filesystem->put_contents( $path, $origin );
112	if ( $ret ) {
113	$scan = Scan::get_last();
114	$scan->remove_issue( $this->owner->id );
115	$this->log( sprintf( '%s is deleted', $path ), \WP_Defender\Controller\Scan::SCAN_LOG );
116
117	do_action( 'wpdef_fixed_scan_issue', 'plugin_integrity', 'resolve' );
118
119	return array( 'message' => esc_html__( 'This item has been resolved.', 'defender-security' ) );
120	} else {
121	return new WP_Error(
122	'defender_permissions_denied',
123	esc_html__(
124	'Permissions Denied. Defender does not have the needed permissions to edit the file. Please change file permissions to 640 or contact your hosting provider so they could change them for you.',
125	'defender-security'
126	)
127	);
128	}
129	}
130
131	/**
132	* Ignore the suspicious file for the current scan.
133	*
134	* @return array An array with a message indicating successful ignore.
135	*/
136	public function ignore(): array {
137	$scan = Scan::get_last();
138	$scan->ignore_issue( $this->owner->id );
139
140	return array( 'message' => esc_html__( 'The suspicious file has been successfully ignored.', 'defender-security' ) );
141	}
142
143	/**
144	* Allow the suspicious file for the current scan.
145	*
146	* @return array An array with a message indicating successful restoration.
147	*/
148	public function unignore(): array {
149	$scan = Scan::get_last();
150	$scan->unignore_issue( $this->owner->id );
151
152	return array( 'message' => esc_html__( 'The suspicious file has been successfully restored.', 'defender-security' ) );
153	}
154
155	/**
156	* Delete the file or whole folder.
157	*
158	* @return array\|WP_Error
159	*/
160	public function delete() {
161	$data = $this->owner->raw_data;
162	$scan = Scan::get_last();
163	$file = $data['file'];
164	if ( ! file_exists( $file ) \|\| ! is_readable( $file ) ) {
165	$scan->remove_issue( $this->owner->id );
166	$this->log(
167	sprintf( '%s is not readable and will be removed from the scan result', $file ),
168	\WP_Defender\Controller\Scan::SCAN_LOG
169	);
170
171	return array( 'message' => esc_html__( 'This item has been deleted.', 'defender-security' ) );
172	} elseif ( 'unversion' === $data['type'] && $this->delete_infected_file( $file ) ) {
173	return $this->after_delete( $file, $scan, 'plugin_integrity' );
174	} elseif ( 'dir' === $data['type'] && $this->delete_dir( $file ) ) {
175	return $this->after_delete( $file, $scan, 'plugin_integrity' );
176	}
177
178	return $this->get_permission_error( $file );
179	}
180
181	/**
182	* Return the source code depending on the type of the issue.
183	*
184	* @return array
185	*/
186	public function pull_src(): array {
187	global $wp_filesystem;
188	// Initialize the WP filesystem, no more using 'file-put-contents' function.
189	if ( ! $wp_filesystem instanceof WP_Filesystem_Base ) {
190	require_once ABSPATH . '/wp-admin/includes/file.php';
191	WP_Filesystem();
192	}
193	$data = $this->owner->raw_data;
194	if ( ! file_exists( $data['file'] ) && ! is_dir( $data['file'] ) ) {
195	return array(
196	'code' => '',
197	'origin' => '',
198	);
199	}
200	switch ( $data['type'] ) {
201	case 'unversion':
202	return array( 'code' => $wp_filesystem->get_contents( $data['file'] ) );
203	case 'dir':
204	$dir_tree = new File( $data['file'], true, true, array(), array(), false );
205
206	return array( 'code' => implode( PHP_EOL, $dir_tree->get_dir_tree() ) );
207	case 'modified':
208	default:
209	return array(
210	'code' => $wp_filesystem->get_contents( $data['file'] ),
211	'origin' => $this->get_origin_code(),
212	);
213	}
214	}
215
216	/**
217	* Return a short description of the WordPress plugin file based on its type.
218	*
219	* @return string The short description of the file.
220	*/
221	private function get_short_description(): string {
222	$data = $this->owner->raw_data;
223	if ( 'unversion' === $data['type'] ) {
224	return esc_html__( 'Unknown file in the WordPress plugin', 'defender-security' );
225	} elseif ( 'dir' === $data['type'] ) {
226	return esc_html__( 'This directory does not belong to the WordPress plugin', 'defender-security' );
227	} elseif ( 'modified' === $data['type'] ) {
228	return esc_html__( 'This plugin file appears modified', 'defender-security' );
229	}
230
231	return '';
232	}
233	}
234