| 1 |
<?php |
| 2 |
/** |
| 3 |
* Handle abandoned plugin scan. |
| 4 |
* |
| 5 |
* @package WP_Defender\Behavior\Scan |
| 6 |
*/ |
| 7 |
|
| 8 |
namespace WP_Defender\Behavior\Scan; |
| 9 |
|
| 10 |
use Calotes\Component\Behavior; |
| 11 |
use WP_Defender\Component\Scan as Scan_Component; |
| 12 |
use WP_Defender\Controller\Scan as Scan_Controller; |
| 13 |
use WP_Defender\Model\Scan; |
| 14 |
use WP_Defender\Model\Scan_Item; |
| 15 |
use WP_Defender\Traits\IO; |
| 16 |
use WP_Defender\Traits\Plugin; |
| 17 |
|
| 18 |
/** |
| 19 |
* Handle abandoned plugin scan. |
| 20 |
*/ |
| 21 |
class Abandoned_Plugin extends Behavior { |
| 22 |
|
| 23 |
use IO; |
| 24 |
use Plugin; |
| 25 |
|
| 26 |
/** |
| 27 |
* Hold the Scan model or null if not set. |
| 28 |
* |
| 29 |
* @var Scan|null |
| 30 |
*/ |
| 31 |
private ?Scan $scan; |
| 32 |
|
| 33 |
/** |
| 34 |
* Outdated plugin period. |
| 35 |
* |
| 36 |
* @var string |
| 37 |
*/ |
| 38 |
private const OUTDATED_PERIOD = '2 years'; |
| 39 |
|
| 40 |
/** |
| 41 |
* Initialize Scan instance. |
| 42 |
* |
| 43 |
* @param Scan $scan The Scan model. |
| 44 |
*/ |
| 45 |
public function __construct( Scan $scan ) { |
| 46 |
$this->scan = $scan; |
| 47 |
} |
| 48 |
|
| 49 |
/** |
| 50 |
* Get the outdated period of the plugin. |
| 51 |
* |
| 52 |
* @return string |
| 53 |
*/ |
| 54 |
public static function get_outdated_period(): string { |
| 55 |
// Filter to override outdated threshold period. |
| 56 |
$period = (string) apply_filters( 'wpdef_scan_outdated_period', self::OUTDATED_PERIOD ); |
| 57 |
// If time period is invalid, use the default one. |
| 58 |
return strtotime( '- ' . $period ) ? $period : self::OUTDATED_PERIOD; |
| 59 |
} |
| 60 |
|
| 61 |
/** |
| 62 |
* Check if there are abandoned plugins. |
| 63 |
* |
| 64 |
* @return bool |
| 65 |
*/ |
| 66 |
public function abandoned_plugin_check(): bool { |
| 67 |
$ignored_issues = $this->get_ignored_issues(); |
| 68 |
|
| 69 |
$actioned_plugins = get_site_option( Scan_Component::PLUGINS_ACTIONED ); |
| 70 |
$plugin_list = Scan_Component::are_actioned_plugins( $actioned_plugins ) |
| 71 |
? $actioned_plugins |
| 72 |
: $this->get_plugin_slugs(); |
| 73 |
|
| 74 |
foreach ( $plugin_list as $slug => $plugin_data ) { |
| 75 |
$this->check_abandoned_plugin_by( $slug ); |
| 76 |
} |
| 77 |
|
| 78 |
$this->scan->calculate_percent( 100, 4 ); |
| 79 |
$this->add_ignored_issues( $ignored_issues ); |
| 80 |
|
| 81 |
return true; |
| 82 |
} |
| 83 |
|
| 84 |
/** |
| 85 |
* Retrieve the list of ignored issues. |
| 86 |
* |
| 87 |
* @return array The list of ignored issues. |
| 88 |
*/ |
| 89 |
private function get_ignored_issues(): array { |
| 90 |
$last = Scan::get_last(); |
| 91 |
|
| 92 |
return is_object( $last ) |
| 93 |
? $last->get_issues( |
| 94 |
Scan::get_abandoned_types(), |
| 95 |
Scan_Item::STATUS_IGNORE |
| 96 |
) |
| 97 |
: array(); |
| 98 |
} |
| 99 |
|
| 100 |
/** |
| 101 |
* Add ignored issues to the scan. |
| 102 |
* |
| 103 |
* @param array $ignored_issues The array of ignored issues to add. |
| 104 |
*/ |
| 105 |
private function add_ignored_issues( array $ignored_issues ) { |
| 106 |
if ( ! empty( $ignored_issues ) ) { |
| 107 |
foreach ( $ignored_issues as $issue ) { |
| 108 |
$this->scan->add_item( $issue->type, $issue->raw_data, Scan_Item::STATUS_IGNORE ); |
| 109 |
} |
| 110 |
} |
| 111 |
} |
| 112 |
|
| 113 |
/** |
| 114 |
* Handle the error by different actions, e.g. logging. |
| 115 |
* |
| 116 |
* @param string $error_message The error message. |
| 117 |
*/ |
| 118 |
private function handle_error( string $error_message ) { |
| 119 |
$this->log( $error_message, Scan_Controller::SCAN_LOG ); |
| 120 |
} |
| 121 |
|
| 122 |
/** |
| 123 |
* Prepare data before saving. |
| 124 |
* |
| 125 |
* @param array $body_json Data from WP API. |
| 126 |
* @param array $plugin_details Data from local plugin headers. |
| 127 |
* |
| 128 |
* @return array { |
| 129 |
* Plugin data. Values will be empty if not supplied by the plugin or API sides. |
| 130 |
* |
| 131 |
* @type string $name Plugin name. |
| 132 |
* @type string $slug Plugin slug. |
| 133 |
* @type string $url Plugin URL. |
| 134 |
* @type string $version Plugin version. |
| 135 |
* @type string $tested_wp Latest tested WordPress version. |
| 136 |
* @type string $last_updated Last updated date. |
| 137 |
* @type string $reason_text Reason for saving or update. |
| 138 |
* } |
| 139 |
*/ |
| 140 |
private function prepare_item_data( array $body_json, array $plugin_details ): array { |
| 141 |
$data = array(); |
| 142 |
// Check plugin name. |
| 143 |
if ( isset( $body_json['name'] ) ) { |
| 144 |
$data['name'] = $body_json['name']; |
| 145 |
} elseif ( isset( $plugin_details['Name'] ) ) { |
| 146 |
$data['name'] = $plugin_details['Name']; |
| 147 |
} else { |
| 148 |
$data['name'] = ''; |
| 149 |
} |
| 150 |
// Check plugin slug. |
| 151 |
if ( isset( $body_json['slug'] ) ) { |
| 152 |
$data['slug'] = $body_json['slug']; |
| 153 |
} elseif ( isset( $plugin_details['slug'] ) ) { |
| 154 |
$data['slug'] = $plugin_details['slug']; |
| 155 |
} else { |
| 156 |
$data['slug'] = ''; |
| 157 |
} |
| 158 |
// Check plugin URL. Sometimes URL values are empty. |
| 159 |
if ( isset( $body_json['homepage'] ) && '' !== $body_json['homepage'] ) { |
| 160 |
$data['url'] = $body_json['homepage']; |
| 161 |
} elseif ( isset( $plugin_details['PluginURI'] ) && '' !== $plugin_details['PluginURI'] ) { |
| 162 |
$data['url'] = $plugin_details['PluginURI']; |
| 163 |
} elseif ( isset( $plugin_details['AuthorURI'] ) && '' !== $plugin_details['AuthorURI'] ) { |
| 164 |
$data['url'] = $plugin_details['AuthorURI']; |
| 165 |
} else { |
| 166 |
$data['url'] = ''; |
| 167 |
} |
| 168 |
// Check plugin version. |
| 169 |
if ( isset( $body_json['version'] ) ) { |
| 170 |
$data['version'] = $body_json['version']; |
| 171 |
} elseif ( isset( $plugin_details['Version'] ) ) { |
| 172 |
$data['version'] = $plugin_details['Version']; |
| 173 |
} else { |
| 174 |
$data['version'] = ''; |
| 175 |
} |
| 176 |
// Check a tested WP version. |
| 177 |
if ( isset( $body_json['tested'] ) ) { |
| 178 |
$data['tested_wp'] = $body_json['tested']; |
| 179 |
} else { |
| 180 |
$data['tested_wp'] = ''; |
| 181 |
} |
| 182 |
// Check plugin updated time. |
| 183 |
if ( isset( $body_json['closed_date'] ) ) { |
| 184 |
$data['last_updated'] = $body_json['closed_date']; |
| 185 |
} elseif ( isset( $body_json['last_updated'] ) ) { |
| 186 |
$data['last_updated'] = $body_json['last_updated']; |
| 187 |
} else { |
| 188 |
$data['last_updated'] = ''; |
| 189 |
} |
| 190 |
// Specific key for closed plugin. |
| 191 |
if ( isset( $body_json['reason_text'] ) ) { |
| 192 |
$data['reason_text'] = $body_json['reason_text']; |
| 193 |
} else { |
| 194 |
$data['reason_text'] = ''; |
| 195 |
} |
| 196 |
|
| 197 |
return $data; |
| 198 |
} |
| 199 |
|
| 200 |
/** |
| 201 |
* Get list of plugin slugs whose names do not match the specified names on wp.org. |
| 202 |
*/ |
| 203 |
private function get_plugin_slugs_with_mismatched_names(): array { |
| 204 |
return array( |
| 205 |
'miniorange-malware-protection', |
| 206 |
'admin-bar-user-switching', |
| 207 |
); |
| 208 |
} |
| 209 |
|
| 210 |
/** |
| 211 |
* Is abandoned plugin? |
| 212 |
* |
| 213 |
* @param string $slug The slug to check. |
| 214 |
* |
| 215 |
* @return bool |
| 216 |
*/ |
| 217 |
public function check_abandoned_plugin_by( string $slug ): bool { |
| 218 |
// Check if the plugin is not from wp.org. |
| 219 |
$premium_plugin_slugs = get_site_option( Plugin_Integrity::PLUGIN_PREMIUM_SLUGS, false ); |
| 220 |
if ( ( is_array( $premium_plugin_slugs ) && in_array( $slug, $premium_plugin_slugs, true ) ) |
| 221 |
|| ! $this->is_likely_wporg_slug( $slug ) |
| 222 |
) { |
| 223 |
return true; |
| 224 |
} |
| 225 |
|
| 226 |
$results = $this->handle_wp_org_response_by( $slug ); |
| 227 |
if ( ! $results['success'] ) { |
| 228 |
$this->handle_error( $results['message'] ); |
| 229 |
|
| 230 |
return false; |
| 231 |
} else { |
| 232 |
$body_json = $results['body']; |
| 233 |
$plugin_details = $this->get_plugin_details_by( $slug ); |
| 234 |
if ( |
| 235 |
isset( $body_json['name'], $plugin_details['Name'] ) |
| 236 |
&& $plugin_details['Name'] !== $body_json['name'] |
| 237 |
&& ! in_array( $slug, $this->get_plugin_slugs_with_mismatched_names(), true ) |
| 238 |
) { |
| 239 |
// This is premium plugin with the same slug as on wp.org but with another name value OR the plugin developer named the plugin differently on wp.org and inside the main file. |
| 240 |
return false; |
| 241 |
} |
| 242 |
|
| 243 |
if ( isset( $body_json['error'] ) && 'closed' === $body_json['error'] ) { |
| 244 |
$this->log( sprintf( 'Plugin slug closed: %s', $slug ), Scan_Controller::SCAN_LOG ); |
| 245 |
|
| 246 |
$this->scan->add_item( |
| 247 |
Scan_Item::TYPE_PLUGIN_CLOSED, |
| 248 |
$this->prepare_item_data( $body_json, $plugin_details ) |
| 249 |
); |
| 250 |
|
| 251 |
return true; |
| 252 |
} |
| 253 |
|
| 254 |
if ( '' !== $body_json['last_updated'] ) { |
| 255 |
$last_updated_time = $body_json['last_updated']; |
| 256 |
$ttl = strtotime( $last_updated_time ); |
| 257 |
if ( $ttl < strtotime( '- ' . self::get_outdated_period() ) ) { |
| 258 |
$this->log( sprintf( 'Plugin slug outdated: %s', $slug ), Scan_Controller::SCAN_LOG ); |
| 259 |
$plugin_details = $this->prepare_item_data( $body_json, $plugin_details ); |
| 260 |
// Improve the date view. |
| 261 |
$plugin_details['last_updated'] = gmdate( 'F j, Y', $ttl ); |
| 262 |
|
| 263 |
$this->scan->add_item( |
| 264 |
Scan_Item::TYPE_PLUGIN_OUTDATED, |
| 265 |
$plugin_details |
| 266 |
); |
| 267 |
|
| 268 |
return true; |
| 269 |
} |
| 270 |
} |
| 271 |
|
| 272 |
return false; |
| 273 |
} |
| 274 |
} |
| 275 |
} |
| 276 |
|
