defender-security / src / controller / class-onboard.php

class-onboard.php in Defender Security – Malware Scanner, Login Security & Firewall 5.7.2, at src/controller/class-onboard.php

399 lines 10.1 KB

Raw Download Zip

1	<?php
2	/**
3	* Handles onboarding.
4	*
5	* @package WP_Defender\Controller
6	*/
7
8	namespace WP_Defender\Controller;
9
10	use WP_Defender\Event;
11	use Calotes\Helper\HTTP;
12	use Calotes\Helper\Route;
13	use WP_Defender\Behavior\WPMUDEV;
14	use WP_Defender\Model\Setting\Login_Lockout;
15	use WP_Defender\Model\Setting\Notfound_Lockout;
16	use WP_Defender\Model\Setting\User_Agent_Lockout;
17	use WP_Defender\Model\Setting\Main_Setting as Model_Main_Setting;
18	use WP_Defender\Model\Setting\Scan as Scan_Settings;
19	use WP_Defender\Controller\Scan as Controller_Scan;
20	use WP_Defender\Controller\Hub_Connector;
21	use WP_Defender\Model\Setting\Antibot_Global_Firewall_Setting;
22	use WP_Defender\Component\IP\Antibot_Global_Firewall;
23	use WP_Defender\Component\Feature_Modal;
24
25	/**
26	* This class is only used once, after the activation on a fresh install.
27	* We will use this for activating & presets other module settings.
28	*/
29	class Onboard extends Event {
30	/**
31	* The key for the remind later in onboarding page.
32	*
33	* @var string
34	*/
35	public const REMINDER_KEY = 'wp_defender_onboard_antibot_reminder';
36
37	/**
38	* The slug identifier for this controller.
39	*
40	* @var string
41	*/
42	public $slug = 'wp-defender';
43
44	/**
45	* List of steps for the onboarding process.
46	*
47	* @var array
48	*/
49	public const STEPS = array(
50	'init',
51	'activating',
52	'activate-antibot',
53	);
54
55	/**
56	* Initializes the model and service, registers routes, and sets up scheduled events if the model is active.
57	*/
58	public function __construct() {
59	$this->attach_behavior( WPMUDEV::class, WPMUDEV::class );
60	$this->add_main_page();
61	add_action( 'defender_enqueue_assets', array( $this, 'enqueue_assets' ) );
62	}
63
64	/**
65	* Registers the main page in the WordPress admin menu.
66	*/
67	protected function add_main_page() {
68	$this->register_page(
69	$this->get_menu_title(),
70	$this->parent_slug,
71	array( $this, 'main_view' ),
72	null,
73	$this->get_menu_icon()
74	);
75	}
76
77	/**
78	* Renders the main view for this page.
79	*/
80	public function main_view() {
81	$class = wd_di()->get( Security_Tweaks::class );
82	$class->refresh_tweaks_status();
83	$this->render( 'main' );
84	}
85
86	/**
87	* Method to handle the activation process.
88	*
89	* @defender_route
90	*/
91	public function activating() {
92	if ( ! $this->check_permission() \|\| ! $this->verify_nonce( 'activatingonboard' ) ) {
93	wp_send_json_error( array( 'message' => esc_html__( 'Invalid', 'defender-security' ) ) );
94	}
95
96	$step = defender_get_data_from_request( 'step', 'p' );
97	if ( ! in_array( $step, self::STEPS, true ) ) {
98	wp_send_json_error( array( 'message' => esc_html__( 'Invalid', 'defender-security' ) ) );
99	}
100
101	if ( 'activate-antibot' !== $step ) {
102	$this->attach_behavior( WPMUDEV::class, WPMUDEV::class );
103
104	$this->maybe_tracking( 'Activate & Configure' );
105	// Run plugin modules.
106	if ( $this->is_pro() ) {
107	$this->preset_audit();
108	$this->preset_blacklist_monitor();
109	}
110	$this->preset_firewall();
111	$this->resolve_security_tweaks();
112	$this->preset_scanning();
113	// @since 4.2.0 No display the Data Tracking after the Onboarding.
114	Data_Tracking::delete_modal_key();
115
116	update_site_option( 'wp_defender_onboarding_step', 'activate-antibot' );
117
118	wp_send_json_success();
119	} else {
120	$antibot_service = wd_di()->get( Antibot_Global_Firewall::class );
121	$managed_by = $antibot_service->get_default_managed_by();
122	$antibot_service->set_managed_by( $managed_by );
123
124	if ( 'plugin' === $managed_by ) {
125	$antibot_service->managed_by_plugin_action();
126	} else {
127	$antibot_service->managed_by_hosting_action();
128	}
129
130	update_site_option( 'wp_defender_shown_activator', true );
131	delete_site_option( 'wp_defender_is_free_activated' );
132	delete_site_option( 'wp_defender_onboarding_step' );
133
134	$data = array(
135	'is_antibot_enabled' => $antibot_service->frontend_is_enabled(),
136	'hub_connector' => wd_di()->get( Hub_Connector::class )->data_frontend(),
137	);
138	// Track.
139	if ( $this->is_tracking_active() ) {
140	wd_di()->get( \WP_Defender\Helper\Analytics\Antibot::class )
141	->track_antibot( false, 'Onboarding' );
142	}
143
144	wp_send_json_success( $data );
145	}
146	}
147
148	/**
149	* Enable blacklist status.
150	*/
151	private function preset_blacklist_monitor() {
152	$this->make_wpmu_request(
153	WPMUDEV::API_BLACKLIST,
154	array(),
155	array(
156	'method' => 'POST',
157	)
158	);
159	}
160
161	/**
162	* Sets the audit logging to enabled and saves the changes.
163	*
164	* @return void
165	*/
166	private function preset_audit() {
167	$audit = new \WP_Defender\Model\Setting\Audit_Logging();
168	$audit->enabled = true;
169	$audit->save();
170	}
171
172	/**
173	* Sets up the preset scanning configuration and creates a new scan.
174	*
175	* @return void
176	*/
177	private function preset_scanning() {
178	$model = new Scan_Settings();
179	$model->save();
180	// Create new scan.
181	$ret = \WP_Defender\Model\Scan::create();
182	if ( is_object( $ret ) && ! is_wp_error( $ret ) ) {
183	if ( $this->is_tracking_active() ) {
184	wd_di()->get( Model_Main_Setting::class )->toggle_tracking( true );
185	}
186	$scan_controller = wd_di()->get( Controller_Scan::class );
187
188	if ( is_multisite() ) {
189	// The admin-ajax.php file doesn't trigger the init hook, so we need to call the scan function directly.
190	$scan_controller->process();
191	} else {
192	$scan_controller->do_async_scan( 'install' );
193	}
194	}
195	}
196
197	/**
198	* Sets up the preset firewall configuration.
199	*
200	* @return void
201	*/
202	private function preset_firewall() {
203	$lockout = new Login_Lockout();
204	$lockout->enabled = true;
205	$lockout->save();
206	$nf = new Notfound_Lockout();
207	$nf->enabled = true;
208	$nf->save();
209	$ua = new User_Agent_Lockout();
210	$ua->enabled = true;
211	$ua->save();
212	}
213
214	/**
215	* Resolve all tweaks that we can.
216	*
217	* @since 2.4.6 Remove tweaks that can be added to wp-config.php manually: 'hide-error', 'disable-file-editor'.
218	*/
219	private function resolve_security_tweaks() {
220	$slugs = array(
221	'disable-xml-rpc',
222	'login-duration',
223	'disable-trackback',
224	'prevent-enum-users',
225	);
226	$class = wd_di()->get( Security_Tweaks::class );
227	$class->refresh_tweaks_status();
228	$class->security_tweaks_auto_action( $slugs, 'resolve' );
229	}
230
231	/**
232	* Get modules in quick setup.
233	*
234	* @return array
235	*/
236	private function get_modules(): array {
237	$modules = array(
238	'Firewall',
239	'Recommendations',
240	);
241	if ( $this->is_pro() ) {
242	$modules[] = 'Malware Scanning';
243	$modules[] = 'Audit Logging';
244	$modules[] = 'Blocklist Monitor';
245	} else {
246	$modules[] = 'WP file scanning';
247	}
248
249	return $modules;
250	}
251
252	/**
253	* Maybe track usage data.
254	*
255	* @param string $action Action name.
256	*/
257	private function maybe_tracking( string $action ) {
258	$usage_data_state = HTTP::post( 'usage_tracking', '' );
259	// Track it, the default option value is changed to True.
260	if ( 'true' === $usage_data_state ) {
261	wd_di()->get( Model_Main_Setting::class )->toggle_tracking( true );
262	$this->track_opt_toggle( true, 'Wizard' );
263	$this->track_feature(
264	'def_quick_setup',
265	array(
266	'module' => $this->get_modules(),
267	'action' => $action,
268	)
269	);
270	}
271	}
272
273	/**
274	* Skip onboarding.
275	*
276	* @defender_route
277	*/
278	public function skip() {
279	if ( ! $this->check_permission() \|\| ! $this->verify_nonce( 'skiponboard' ) ) {
280	wp_send_json_error( array( 'message' => esc_html__( 'Invalid', 'defender-security' ) ) );
281	}
282
283	update_site_option( 'wp_defender_shown_activator', true );
284	delete_site_option( 'wp_defender_is_free_activated' );
285	// @since 4.2.0 No display the Data Tracking after the Onboarding.
286	Data_Tracking::delete_modal_key();
287
288	$this->maybe_tracking( 'Start from scratch' );
289	wp_send_json_success();
290	}
291
292	/**
293	* Enqueues scripts and styles for this page.
294	* Only enqueues assets if the page is active.
295	*/
296	public function enqueue_assets() {
297	if ( ! $this->is_page_active() ) {
298	return;
299	}
300
301	wp_localize_script( 'def-onboard', 'onboard', $this->data_frontend() );
302	wp_enqueue_script( 'def-onboard' );
303	$this->enqueue_main_assets();
304	add_filter( 'admin_body_class', array( $this, 'admin_body_class' ) );
305	}
306
307	/**
308	* Add classes to admin body.
309	*
310	* @param string $classes Admin body classes.
311	*
312	* @return string
313	*/
314	public function admin_body_class( $classes ) {
315	$classes .= ' wdf-full-screen ';
316
317	return $classes;
318	}
319
320	/**
321	* Removes settings for all submodules.
322	*/
323	public function remove_settings() {
324	delete_site_option( self::REMINDER_KEY );
325	delete_site_option( 'wp_defender_onboarding_step' );
326	}
327
328	/**
329	* Delete all the data & the cache.
330	*/
331	public function remove_data() {
332	}
333
334	/**
335	* Exports strings.
336	*
337	* @return array An array of strings.
338	*/
339	public function export_strings() {
340	return array();
341	}
342
343	/**
344	* Converts the current object state to an array.
345	*
346	* @return array The array representation of the object.
347	*/
348	public function to_array(): array {
349	return array();
350	}
351
352	/**
353	* Imports data into the model.
354	*
355	* @param array $data Data to be imported into the model.
356	*/
357	public function import_data( array $data ) {
358	}
359
360	/**
361	* Provides data for the frontend.
362	*
363	* @return array An array of data for the frontend.
364	*/
365	public function data_frontend(): array {
366	[ $endpoints, $nonces ] = Route::export_routes( 'onboard' );
367
368	return array(
369	'endpoints' => $endpoints,
370	'nonces' => $nonces,
371	'misc' => array(
372	'state_usage_tracking' => wd_di()->get( Model_Main_Setting::class )->usage_tracking,
373	'privacy_link' => Model_Main_Setting::PRIVACY_LINK,
374	'antibot' => Antibot_Global_Firewall_Setting::get_module_name(),
375	),
376	'hub_connector' => wd_di()->get( Hub_Connector::class )->data_frontend(),
377	'step' => get_site_option( 'wp_defender_onboarding_step', 'init' ),
378	);
379	}
380
381	/**
382	* Remind Antibot onboarding.
383	*
384	* @defender_route
385	*/
386	public function antibot_reminder() {
387	if ( ! $this->check_permission() \|\| ! $this->verify_nonce( 'antibot_reminderonboard' ) ) {
388	wp_send_json_error( array( 'message' => esc_html__( 'Invalid', 'defender-security' ) ) );
389	}
390
391	update_site_option( 'wp_defender_shown_activator', true );
392	update_site_option( self::REMINDER_KEY, time() );
393	delete_site_option( 'wp_defender_onboarding_step' );
394	delete_site_option( 'wp_defender_is_free_activated' );
395
396	wp_send_json_success();
397	}
398	}
399