defender-security / src / controller / class-onboard.php

class-onboard.php in Defender Security – Malware Scanner, Login Security & Firewall 6.0.1, at src/controller/class-onboard.php

393 lines 10.1 KB

Raw Download Zip

1	<?php
2	/**
3	* Handles onboarding.
4	*
5	* @package WP_Defender\Controller
6	*/
7
8	namespace WP_Defender\Controller;
9
10	use WP_Defender\Event;
11	use Calotes\Helper\HTTP;
12	use Calotes\Helper\Route;
13	use WP_Defender\Behavior\WPMUDEV;
14	use WP_Defender\Model\Setting\Login_Lockout;
15	use WP_Defender\Model\Setting\Notfound_Lockout;
16	use WP_Defender\Model\Setting\User_Agent_Lockout;
17	use WP_Defender\Model\Setting\Main_Setting as Model_Main_Setting;
18	use WP_Defender\Model\Setting\Scan as Scan_Settings;
19	use WP_Defender\Controller\Scan as Controller_Scan;
20	use WP_Defender\Controller\Hub_Connector;
21	use WP_Defender\Model\Setting\Antibot_Global_Firewall_Setting;
22	use WP_Defender\Component\IP\Antibot_Global_Firewall;
23	use WP_Defender\Component\Scan as Scan_Component;
24
25	/**
26	* Todo: remove in the future.
27	* This class is only used once, after the activation on a fresh install.
28	* We will use this for activating & presets other module settings.
29	*/
30	class Onboard extends Event {
31	/**
32	* The key for the remind later in onboarding page.
33	*
34	* @var string
35	*/
36	public const REMINDER_KEY = 'wp_defender_onboard_antibot_reminder';
37
38	/**
39	* The slug identifier for this controller.
40	*
41	* @var string
42	*/
43	public $slug = 'wp-defender';
44
45	/**
46	* List of steps for the onboarding process.
47	*
48	* @var array
49	*/
50	public const STEPS = array(
51	'init',
52	'activating',
53	'activate-antibot',
54	);
55
56	/**
57	* Initializes the model and service, registers routes, and sets up scheduled events if the model is active.
58	*/
59	public function __construct() {
60	$this->attach_behavior( WPMUDEV::class, WPMUDEV::class );
61	$this->add_main_page();
62	add_action( 'defender_enqueue_assets', array( $this, 'enqueue_assets' ) );
63	}
64
65	/**
66	* Registers the main page in the WordPress admin menu.
67	*/
68	protected function add_main_page() {
69	$this->register_page(
70	$this->get_page_title(),
71	$this->parent_slug,
72	array( $this, 'main_view' ),
73	null,
74	$this->get_menu_icon(),
75	$this->get_menu_title()
76	);
77	}
78
79	/**
80	* Renders the main view for this page.
81	*/
82	public function main_view() {
83	$class = wd_di()->get( Security_Tweaks::class );
84	$class->refresh_tweaks_status();
85	$this->render( 'main' );
86	}
87
88	/**
89	* Method to handle the activation process.
90	*
91	* @defender_route
92	*/
93	public function activating() {
94	if ( ! $this->check_permission() \|\| ! $this->verify_nonce( 'activatingonboard' ) ) {
95	wp_send_json_error( array( 'message' => esc_html__( 'Invalid', 'defender-security' ) ) );
96	}
97
98	$step = defender_get_data_from_request( 'step', 'p' );
99	if ( ! in_array( $step, self::STEPS, true ) ) {
100	wp_send_json_error( array( 'message' => esc_html__( 'Invalid', 'defender-security' ) ) );
101	}
102
103	if ( 'activate-antibot' !== $step ) {
104	$this->attach_behavior( WPMUDEV::class, WPMUDEV::class );
105
106	$this->maybe_tracking( 'Activate & Configure' );
107	if ( false !== $this->get_apikey() ) {
108	$this->preset_blacklist_monitor();
109	}
110	$this->preset_firewall();
111	$this->resolve_security_tweaks();
112	$this->preset_scanning();
113	// @since 4.2.0 No display the Data Tracking after the Onboarding.
114	Data_Tracking::delete_modal_key();
115
116	if ( defender_is_unlimited_hosting() ) {
117	// Without Antibot step.
118	$next_step = 'finish';
119	update_site_option( 'wp_defender_shown_activator', true );
120	delete_site_option( 'wp_defender_is_free_activated' );
121	delete_site_option( 'wp_defender_onboarding_step' );
122	// Track.
123	if ( $this->is_tracking_active() ) {
124	wd_di()->get( \WP_Defender\Helper\Analytics\Antibot::class )
125	->track_antibot( false, 'Onboarding' );
126	}
127	} else {
128	$next_step = 'activate-antibot';
129	update_site_option( 'wp_defender_onboarding_step', $next_step );
130	}
131
132	wp_send_json_success( array( 'next_step' => $next_step ) );
133	} else {
134	$antibot_service = wd_di()->get( Antibot_Global_Firewall::class );
135	$managed_by = $antibot_service->get_default_managed_by();
136	$antibot_service->set_managed_by( $managed_by );
137
138	if ( 'plugin' === $managed_by ) {
139	$antibot_service->managed_by_plugin_action();
140	} else {
141	$antibot_service->managed_by_hosting_action();
142	}
143
144	update_site_option( 'wp_defender_shown_activator', true );
145	delete_site_option( 'wp_defender_is_free_activated' );
146	delete_site_option( 'wp_defender_onboarding_step' );
147
148	$data = array(
149	'is_antibot_enabled' => $antibot_service->frontend_is_enabled(),
150	'hub_connector' => wd_di()->get( Hub_Connector::class )->data_frontend(),
151	);
152	// Track.
153	if ( $this->is_tracking_active() ) {
154	wd_di()->get( \WP_Defender\Helper\Analytics\Antibot::class )
155	->track_antibot( false, 'Onboarding' );
156	}
157
158	wp_send_json_success( $data );
159	}
160	}
161	/**
162	* Enable blacklist status.
163	*/
164	private function preset_blacklist_monitor() {
165	$this->make_wpmu_request(
166	WPMUDEV::API_BLACKLIST,
167	array(),
168	array(
169	'method' => 'POST',
170	)
171	);
172	}
173
174
175	/**
176	* Sets up the preset scanning configuration and creates a new scan.
177	*
178	* @return void
179	*/
180	private function preset_scanning() {
181	$model = new Scan_Settings();
182	$model->save();
183	// Create new scan.
184	$ret = \WP_Defender\Model\Scan::create();
185	if ( is_object( $ret ) && ! is_wp_error( $ret ) ) {
186	if ( $this->is_tracking_active() ) {
187	wd_di()->get( Model_Main_Setting::class )->toggle_tracking( true );
188	}
189
190	if ( is_multisite() ) {
191	wd_di()->get( Scan_Component::class )->gather_actioned_plugin_details();
192	// The admin-ajax.php file doesn't trigger the init hook, so we need to call the scan function directly.
193	wd_di()->get( Controller_Scan::class )->process();
194	} else {
195	wd_di()->get( Controller_Scan::class )->run_scan_mechanisms_from( 'install' );
196	}
197	}
198	}
199
200	/**
201	* Sets up the preset firewall configuration.
202	*
203	* @return void
204	*/
205	private function preset_firewall() {
206	$lockout = new Login_Lockout();
207	$lockout->enabled = true;
208	$lockout->save();
209	$nf = new Notfound_Lockout();
210	$nf->enabled = true;
211	$nf->save();
212	$ua = new User_Agent_Lockout();
213	$ua->enabled = true;
214	$ua->save();
215	}
216
217	/**
218	* Resolve all tweaks that we can.
219	*
220	* @since 2.4.6 Remove tweaks that can be added to wp-config.php manually: 'hide-error', 'disable-file-editor'.
221	*/
222	private function resolve_security_tweaks() {
223	$slugs = array(
224	'disable-xml-rpc',
225	'login-duration',
226	'disable-trackback',
227	'prevent-enum-users',
228	);
229	$class = wd_di()->get( Security_Tweaks::class );
230	$class->refresh_tweaks_status();
231	$class->security_tweaks_auto_action( $slugs, 'resolve' );
232	}
233
234	/**
235	* Get modules in quick setup.
236	*
237	* @return array
238	*/
239	private function get_modules(): array {
240	$modules = array(
241	'Firewall',
242	'Recommendations',
243	'Blocklist Monitor',
244	);
245	$modules[] = 'WP file scanning';
246
247	return $modules;
248	}
249
250	/**
251	* Maybe track usage data.
252	*
253	* @param string $action Action name.
254	*/
255	private function maybe_tracking( string $action ) {
256	$usage_data_state = HTTP::post( 'usage_tracking', '' );
257	// Track it, the default option value is changed to True.
258	if ( 'true' === $usage_data_state ) {
259	wd_di()->get( Model_Main_Setting::class )->toggle_tracking( true );
260	$this->track_opt_toggle( true, 'Wizard' );
261	$this->track_feature(
262	'def_quick_setup',
263	array(
264	'module' => $this->get_modules(),
265	'action' => $action,
266	)
267	);
268	}
269	}
270
271	/**
272	* Skip onboarding.
273	*
274	* @defender_route
275	*/
276	public function skip() {
277	if ( ! $this->check_permission() \|\| ! $this->verify_nonce( 'skiponboard' ) ) {
278	wp_send_json_error( array( 'message' => esc_html__( 'Invalid', 'defender-security' ) ) );
279	}
280
281	update_site_option( 'wp_defender_shown_activator', true );
282	delete_site_option( 'wp_defender_is_free_activated' );
283	// @since 4.2.0 No display the Data Tracking after the Onboarding.
284	Data_Tracking::delete_modal_key();
285
286	$this->maybe_tracking( 'Start from scratch' );
287	wp_send_json_success();
288	}
289
290	/**
291	* Enqueues scripts and styles for this page.
292	* Only enqueues assets if the page is active.
293	*/
294	public function enqueue_assets() {
295	if ( ! $this->is_page_active() ) {
296	return;
297	}
298	}
299
300	/**
301	* Add classes to admin body.
302	*
303	* @param string $classes Admin body classes.
304	*
305	* @return string
306	*/
307	public function admin_body_class( $classes ) {
308	$classes .= ' wdf-full-screen ';
309
310	return $classes;
311	}
312
313	/**
314	* Removes settings for all submodules.
315	*/
316	public function remove_settings() {
317	delete_site_option( self::REMINDER_KEY );
318	delete_site_option( 'wp_defender_onboarding_step' );
319	}
320
321	/**
322	* Delete all the data & the cache.
323	*/
324	public function remove_data() {
325	}
326
327	/**
328	* Exports strings.
329	*
330	* @return array An array of strings.
331	*/
332	public function export_strings() {
333	return array();
334	}
335
336	/**
337	* Converts the current object state to an array.
338	*
339	* @return array The array representation of the object.
340	*/
341	public function to_array(): array {
342	return array();
343	}
344
345	/**
346	* Imports data into the model.
347	*
348	* @param array $data Data to be imported into the model.
349	*/
350	public function import_data( array $data ) {
351	}
352
353	/**
354	* Provides data for the frontend.
355	*
356	* @return array An array of data for the frontend.
357	*/
358	public function data_frontend(): array {
359	[ $endpoints, $nonces ] = Route::export_routes( 'onboard' );
360
361	return array(
362	'endpoints' => $endpoints,
363	'nonces' => $nonces,
364	'misc' => array(
365	'state_usage_tracking' => wd_di()->get( Model_Main_Setting::class )->usage_tracking,
366	'privacy_link' => Model_Main_Setting::PRIVACY_LINK,
367	'antibot' => Antibot_Global_Firewall_Setting::get_module_name(),
368	),
369
370	'hub_connector' => wd_di()->get( Hub_Connector::class )->data_frontend(),
371	'step' => get_site_option( 'wp_defender_onboarding_step', 'init' ),
372	);
373	}
374
375	/**
376	* Remind Antibot onboarding.
377	*
378	* @defender_route
379	*/
380	public function antibot_reminder() {
381	if ( ! $this->check_permission() \|\| ! $this->verify_nonce( 'antibot_reminderonboard' ) ) {
382	wp_send_json_error( array( 'message' => esc_html__( 'Invalid', 'defender-security' ) ) );
383	}
384
385	update_site_option( 'wp_defender_shown_activator', true );
386	update_site_option( self::REMINDER_KEY, time() );
387	delete_site_option( 'wp_defender_onboarding_step' );
388	delete_site_option( 'wp_defender_is_free_activated' );
389
390	wp_send_json_success();
391	}
392	}
393