defender-security / src / component / security-tweaks / class-disable-file-editor.php

class-disable-file-editor.php in Defender Security – Malware Scanner, Login Security & Firewall 5.6.1, at src/component/security-tweaks/class-disable-file-editor.php

208 lines 5.4 KB

Raw Download Zip

1	<?php
2	/**
3	* Responsible for enabling or disabling the file editor in WordPress.
4	*
5	* @package WP_Defender\Component\Security_Tweaks
6	*/
7
8	namespace WP_Defender\Component\Security_Tweaks;
9
10	use WP_Error;
11	use WP_Defender\Component\Security_Tweaks\Servers\Server;
12	use WP_Defender\Component\Security_Tweak as Security_Tweak_Component;
13
14	/**
15	* Handles the implementation of the disable-file-editor security tweak.
16	*/
17	class Disable_File_Editor extends Abstract_Security_Tweaks {
18
19	/**
20	* Slug identifier for the component.
21	*
22	* @var string
23	*/
24	public string $slug = 'disable-file-editor';
25
26	/**
27	* Check whether the issue has been resolved or not.
28	*
29	* @return bool
30	*/
31	public function check() {
32	if ( defined( 'DISALLOW_FILE_EDIT' ) && true === constant( 'DISALLOW_FILE_EDIT' ) ) {
33	return true;
34	}
35
36	return false;
37	}
38
39	/**
40	* Get pattern for DISALLOW_FILE_EDIT.
41	*
42	* @return string
43	*/
44	private function get_file_edit_pattern() {
45	return "/^define$\s['\|\"]DISALLOW_FILE_EDIT['\|\"],(.)$/";
46	}
47
48	/**
49	* Set data in wp-config.php.
50	*
51	* @param bool $value The value to set for DISALLOW_FILE_EDIT.
52	*
53	* @return bool\|WP_Error
54	*/
55	private function set_file_edit_data( $value ) {
56	$sec_tweak_component = new Security_Tweak_Component();
57	$obj_file = 'flywheel' === Server::get_current_server()
58	? $sec_tweak_component->advanced_check_file()
59	: $sec_tweak_component->file();
60	if ( false === $obj_file ) {
61	return new WP_Error(
62	'defender_file_not_writable',
63	esc_html__( 'The file wp-config.php is not writable', 'defender-security' )
64	);
65	} elseif ( is_numeric( $obj_file ) ) {
66	return new WP_Error(
67	'defender_file_not_writable',
68	$sec_tweak_component->show_hosting_notice( 'DISALLOW_FILE_EDIT' )
69	);
70	}
71
72	$file_edit = 'DISALLOW_FILE_EDIT';
73	$value = $value ? 'true' : 'false';
74	$pattern = $this->get_file_edit_pattern();
75	$hook_line_pattern = $sec_tweak_component->get_hook_line_pattern();
76	$file_edit_line = "define( '{$file_edit}', {$value} ); // Added by Defender";
77	$lines = array();
78	$line_found = false;
79	$hook_line_no = null;
80
81	foreach ( $obj_file as $line ) {
82	if ( ! $line_found && preg_match( $pattern, $line ) ) {
83	// If this is revert request and the changes is not made by us throw error.
84	if ( 'true' === $value && ! preg_match(
85	"/^define$\s['\|\"]{$file_edit}['\|\"],(.)$;\s\/\/\sAdded\sby\sDefender.?.*/i",
86	$line
87	) ) {
88	return new WP_Error(
89	'defender_file_not_writable',
90	$sec_tweak_component->show_hosting_notice_with_code( $file_edit, $file_edit_line )
91	);
92	}
93
94	$lines[] = $file_edit_line;
95	$line_found = true;
96	continue;
97	}
98
99	// If there is no match, keep reference of `hook_line_no` so that we can insert data there as needed.
100	if ( ! $line_found && preg_match( $hook_line_pattern, $line ) ) {
101	$hook_line_no = $obj_file->key();
102	$lines[ $hook_line_no + 1 ] = trim( $line );
103	continue;
104	}
105
106	$lines[] = trim( $line );
107	}
108
109	// There is no match, so set DISALLOW_FILE_EDIT data just before the hook line ei: `$table_prefix`.
110	if ( ! $line_found && ! is_null( $hook_line_no ) ) {
111	$line_found = true;
112	$lines[ $hook_line_no ] = $file_edit_line;
113	ksort( $lines );
114	}
115
116	return $line_found
117	? $sec_tweak_component->write( $lines )
118	: new WP_Error(
119	'defender_line_not_found',
120	esc_html__( 'Error writing to file.', 'defender-security' ),
121	404
122	);
123	}
124
125	/**
126	* Allow file editor.
127	*
128	* @return bool\|WP_Error
129	*/
130	private function allow_file_editor() {
131	return $this->set_file_edit_data( false );
132	}
133
134	/**
135	* Prevent file editor.
136	*
137	* @return bool\|WP_Error
138	*/
139	private function prevent_file_editor() {
140	return $this->set_file_edit_data( true );
141	}
142
143	/**
144	* Here is the code for processing, if the return is true, we add it to resolve list, WP_Error if any error.
145	*
146	* @return bool\|WP_Error
147	*/
148	public function process() {
149	return $this->prevent_file_editor();
150	}
151
152	/**
153	* This is for un-do stuff that has be done in @process.
154	*
155	* @return bool\|WP_Error
156	*/
157	public function revert() {
158	return $this->allow_file_editor();
159	}
160
161	/**
162	* Define the DISALLOW_FILE_EDIT constant, so we can hide the editor page.
163	*
164	* @return bool Always returns true.
165	*/
166	public function shield_up() {
167	return true;
168	}
169
170	/**
171	* Retrieve the tweak's label.
172	*
173	* @return string
174	*/
175	public function get_label(): string {
176	return esc_html__( 'Disable the file editor', 'defender-security' );
177	}
178
179	/**
180	* Get the error reason.
181	*
182	* @return string
183	*/
184	public function get_error_reason(): string {
185	return esc_html__( 'The file editor is currently enabled.', 'defender-security' );
186	}
187
188	/**
189	* Return a summary data of this tweak.
190	*
191	* @return array
192	*/
193	public function to_array(): array {
194	return array(
195	'slug' => $this->slug,
196	'title' => $this->get_label(),
197	'errorReason' => $this->get_error_reason(),
198	'successReason' => esc_html__( 'You\'ve disabled the file editor, winning.', 'defender-security' ),
199	'misc' => array(),
200	'bulk_description' => esc_html__(
201	'The file editor is currently active, this means anyone with access to your login information can further edit your plugin and theme files and inject malicious code. We will disable file editor for you.',
202	'defender-security'
203	),
204	'bulk_title' => esc_html__( 'File Editor', 'defender-security' ),
205	);
206	}
207	}
208