| 1 |
<?php |
| 2 |
/** |
| 3 |
* Handles plugin integrity scan item. |
| 4 |
* |
| 5 |
* @package WP_Defender\Behavior\Scan_Item |
| 6 |
*/ |
| 7 |
|
| 8 |
namespace WP_Defender\Behavior\Scan_Item; |
| 9 |
|
| 10 |
use WP_Error; |
| 11 |
use Calotes\Base\File; |
| 12 |
use WP_Defender\Traits\IO; |
| 13 |
use WP_Defender\Model\Scan; |
| 14 |
use WP_Defender\Traits\Plugin; |
| 15 |
use WP_Defender\Traits\Formats; |
| 16 |
use Calotes\Component\Behavior; |
| 17 |
use WP_Defender\Model\Scan_Item; |
| 18 |
use WP_Defender\Traits\File_Operations; |
| 19 |
use WP_Defender\Component\Quarantine as Quarantine_Component; |
| 20 |
use WP_Filesystem_Base; |
| 21 |
|
| 22 |
/** |
| 23 |
* Class Plugin_Integrity |
| 24 |
* This class represents a plugin integrity behavior. |
| 25 |
*/ |
| 26 |
class Plugin_Integrity extends Behavior { |
| 27 |
|
| 28 |
use Formats; |
| 29 |
use IO; |
| 30 |
use Plugin; |
| 31 |
use File_Operations; |
| 32 |
|
| 33 |
/** |
| 34 |
* Return general data so we can output on frontend. |
| 35 |
* |
| 36 |
* @return array |
| 37 |
*/ |
| 38 |
public function to_array(): array { |
| 39 |
$data = $this->owner->raw_data; |
| 40 |
$file = $data['file']; |
| 41 |
list ( $file_created_at, $file_size, $deleted ) = $this->get_file_meta( $file ); |
| 42 |
|
| 43 |
$is_quarantinable = $this->is_quarantinable( $this->owner->raw_data['file'] ); |
| 44 |
|
| 45 |
$quarantine_data = class_exists( 'WP_Defender\Component\Quarantine' ) ? |
| 46 |
wd_di()->get( Quarantine_Component::class )->scan_item_data( $this->owner ) : |
| 47 |
array( 'is_quarantinable' => $is_quarantinable ); |
| 48 |
|
| 49 |
return array_merge( |
| 50 |
array( |
| 51 |
'id' => $this->owner->id, |
| 52 |
'type' => Scan_Item::TYPE_PLUGIN_CHECK, |
| 53 |
'file_name' => pathinfo( $file, PATHINFO_BASENAME ), |
| 54 |
'full_path' => $file, |
| 55 |
'date_added' => $file_created_at, |
| 56 |
'size' => $file_size, |
| 57 |
'deleted' => $deleted, |
| 58 |
'scenario' => $data['type'], |
| 59 |
'short_desc' => $this->get_short_description(), |
| 60 |
), |
| 61 |
$quarantine_data |
| 62 |
); |
| 63 |
} |
| 64 |
|
| 65 |
/** |
| 66 |
* We will get the origin code by looking into svn repo. |
| 67 |
* |
| 68 |
* @return false|string|WP_Error |
| 69 |
*/ |
| 70 |
private function get_origin_code() { |
| 71 |
$file = $this->owner->raw_data['file']; |
| 72 |
|
| 73 |
$directory_name = $this->get_plugin_directory_name( $file ); |
| 74 |
$plugin_header = $this->get_plugin_headers( $file ); |
| 75 |
$plugin_header = reset( $plugin_header ); |
| 76 |
$file_path = $this->get_plugin_relative_path( $file ); |
| 77 |
|
| 78 |
$source_file_url = $this->get_file_url( |
| 79 |
$directory_name, |
| 80 |
$plugin_header['Version'], |
| 81 |
$file_path |
| 82 |
); |
| 83 |
|
| 84 |
return $this->get_url_content( $source_file_url ); |
| 85 |
} |
| 86 |
|
| 87 |
/** |
| 88 |
* Restore the file with its origin content. |
| 89 |
* |
| 90 |
* @return void|array|WP_Error |
| 91 |
*/ |
| 92 |
public function resolve() { |
| 93 |
global $wp_filesystem; |
| 94 |
// Initialize the WP filesystem, no more using 'file-put-contents' function. |
| 95 |
if ( ! $wp_filesystem instanceof WP_Filesystem_Base ) { |
| 96 |
require_once ABSPATH . '/wp-admin/includes/file.php'; |
| 97 |
WP_Filesystem(); |
| 98 |
} |
| 99 |
$data = $this->owner->raw_data; |
| 100 |
if ( 'modified' !== $data['type'] ) { |
| 101 |
// Should not be here unless case changed. |
| 102 |
return; |
| 103 |
} |
| 104 |
|
| 105 |
$origin = $this->get_origin_code(); |
| 106 |
if ( false === $origin || is_wp_error( $origin ) ) { |
| 107 |
return; |
| 108 |
} |
| 109 |
|
| 110 |
$path = $data['file']; |
| 111 |
$ret = $wp_filesystem->put_contents( $path, $origin ); |
| 112 |
if ( $ret ) { |
| 113 |
$scan = Scan::get_last(); |
| 114 |
$scan->remove_issue( $this->owner->id ); |
| 115 |
$this->log( sprintf( '%s is deleted', $path ), \WP_Defender\Controller\Scan::SCAN_LOG ); |
| 116 |
|
| 117 |
do_action( 'wpdef_fixed_scan_issue', 'plugin_integrity', 'resolve' ); |
| 118 |
|
| 119 |
return array( 'message' => esc_html__( 'This item has been resolved.', 'defender-security' ) ); |
| 120 |
} else { |
| 121 |
return new WP_Error( |
| 122 |
'defender_permissions_denied', |
| 123 |
esc_html__( |
| 124 |
'Permissions Denied. Defender does not have the needed permissions to edit the file. Please change file permissions to 640 or contact your hosting provider so they could change them for you.', |
| 125 |
'defender-security' |
| 126 |
) |
| 127 |
); |
| 128 |
} |
| 129 |
} |
| 130 |
|
| 131 |
/** |
| 132 |
* Ignore the suspicious file for the current scan. |
| 133 |
* |
| 134 |
* @return array An array with a message indicating successful ignore. |
| 135 |
*/ |
| 136 |
public function ignore(): array { |
| 137 |
$scan = Scan::get_last(); |
| 138 |
$data = $this->owner->raw_data; |
| 139 |
$issue_name = '<b>' . pathinfo( $data['file'], PATHINFO_BASENAME ) . '</b>'; |
| 140 |
$res = $scan->ignore_issue( $this->owner->id ); |
| 141 |
if ( ! $res ) { |
| 142 |
return array( |
| 143 |
'type_notice' => 'error', |
| 144 |
'message' => $this->get_failed_ignore_result( $issue_name ), |
| 145 |
); |
| 146 |
} |
| 147 |
|
| 148 |
return array( |
| 149 |
'message' => sprintf( |
| 150 |
/* translators: %s: Scan issue name. */ |
| 151 |
esc_html__( 'You’ve successfully ignored the security issue related to %s.', 'defender-security' ), |
| 152 |
$issue_name |
| 153 |
), |
| 154 |
); |
| 155 |
} |
| 156 |
|
| 157 |
/** |
| 158 |
* Allow the suspicious file for the current scan. |
| 159 |
* |
| 160 |
* @return array An array with a message indicating successful restoration. |
| 161 |
*/ |
| 162 |
public function unignore(): array { |
| 163 |
$scan = Scan::get_last(); |
| 164 |
$scan->unignore_issue( $this->owner->id ); |
| 165 |
|
| 166 |
return array( 'message' => esc_html__( 'The suspicious file has been successfully restored.', 'defender-security' ) ); |
| 167 |
} |
| 168 |
|
| 169 |
/** |
| 170 |
* Delete the file or whole folder. |
| 171 |
* |
| 172 |
* @return array|WP_Error |
| 173 |
*/ |
| 174 |
public function delete() { |
| 175 |
$data = $this->owner->raw_data; |
| 176 |
$scan = Scan::get_last(); |
| 177 |
$file = $data['file']; |
| 178 |
if ( ! file_exists( $file ) || ! is_readable( $file ) ) { |
| 179 |
$scan->remove_issue( $this->owner->id ); |
| 180 |
$this->log( |
| 181 |
sprintf( '%s is not readable and will be removed from the scan result', $file ), |
| 182 |
\WP_Defender\Controller\Scan::SCAN_LOG |
| 183 |
); |
| 184 |
|
| 185 |
return array( 'message' => esc_html__( 'This item has been deleted.', 'defender-security' ) ); |
| 186 |
} elseif ( 'unversion' === $data['type'] && $this->delete_infected_file( $file ) ) { |
| 187 |
return $this->after_delete( $file, $scan, 'plugin_integrity' ); |
| 188 |
} elseif ( 'dir' === $data['type'] && $this->delete_dir( $file ) ) { |
| 189 |
return $this->after_delete( $file, $scan, 'plugin_integrity' ); |
| 190 |
} |
| 191 |
|
| 192 |
return $this->get_permission_error( $file ); |
| 193 |
} |
| 194 |
|
| 195 |
/** |
| 196 |
* Return the source code depending on the type of the issue. |
| 197 |
* |
| 198 |
* @return array |
| 199 |
*/ |
| 200 |
public function pull_src(): array { |
| 201 |
global $wp_filesystem; |
| 202 |
// Initialize the WP filesystem, no more using 'file-put-contents' function. |
| 203 |
if ( ! $wp_filesystem instanceof WP_Filesystem_Base ) { |
| 204 |
require_once ABSPATH . '/wp-admin/includes/file.php'; |
| 205 |
WP_Filesystem(); |
| 206 |
} |
| 207 |
$data = $this->owner->raw_data; |
| 208 |
if ( ! file_exists( $data['file'] ) && ! is_dir( $data['file'] ) ) { |
| 209 |
return array( |
| 210 |
'code' => '', |
| 211 |
'origin' => '', |
| 212 |
); |
| 213 |
} |
| 214 |
switch ( $data['type'] ) { |
| 215 |
case 'unversion': |
| 216 |
return array( 'code' => $wp_filesystem->get_contents( $data['file'] ) ); |
| 217 |
case 'dir': |
| 218 |
$dir_tree = new File( $data['file'], true, true, array(), array(), false ); |
| 219 |
|
| 220 |
return array( 'code' => implode( PHP_EOL, $dir_tree->get_dir_tree() ) ); |
| 221 |
case 'modified': |
| 222 |
default: |
| 223 |
return array( |
| 224 |
'code' => $wp_filesystem->get_contents( $data['file'] ), |
| 225 |
'origin' => $this->get_origin_code(), |
| 226 |
); |
| 227 |
} |
| 228 |
} |
| 229 |
|
| 230 |
/** |
| 231 |
* Return a short description of the WordPress plugin file based on its type. |
| 232 |
* |
| 233 |
* @return string The short description of the file. |
| 234 |
*/ |
| 235 |
private function get_short_description(): string { |
| 236 |
$data = $this->owner->raw_data; |
| 237 |
if ( 'unversion' === $data['type'] ) { |
| 238 |
return esc_html__( 'Unknown file in the WordPress plugin', 'defender-security' ); |
| 239 |
} elseif ( 'dir' === $data['type'] ) { |
| 240 |
return esc_html__( 'This directory does not belong to the WordPress plugin', 'defender-security' ); |
| 241 |
} elseif ( 'modified' === $data['type'] ) { |
| 242 |
return esc_html__( 'This plugin file appears modified', 'defender-security' ); |
| 243 |
} |
| 244 |
|
| 245 |
return ''; |
| 246 |
} |
| 247 |
} |
| 248 |
|
