defender-security / src / component / security-tweaks / class-disable-trackback.php

class-disable-trackback.php in Defender Security – Malware Scanner, Login Security & Firewall 6.2.2, at src/component/security-tweaks/class-disable-trackback.php

182 lines 4.5 KB

Raw Download Zip

1	<?php
2	/**
3	* Responsible for disabling track backs and ping backs on a WordPress site.
4	*
5	* @package WP_Defender\Component\Security_Tweaks
6	*/
7
8	namespace WP_Defender\Component\Security_Tweaks;
9
10	use WP_Error;
11
12	/**
13	* Handles the implementation of the disable track back security tweak.
14	*/
15	class Disable_Trackback extends Abstract_Security_Tweaks {
16
17	/**
18	* Slug identifier for the component.
19	*
20	* @var string
21	*/
22	public string $slug = 'disable-trackback';
23	/**
24	* Indicates whether the trackback disable issue has been resolved.
25	*
26	* @var bool
27	*/
28	public $resolved = false;
29
30	/**
31	* Check whether the issue has been resolved or not.
32	*
33	* @return bool
34	*/
35	public function check() {
36	return $this->resolved;
37	}
38
39	/**
40	* Here is the code for processing, if the return is true, we add it to resolve list, WP_Error if any error.
41	*
42	* @return bool\|WP_Error
43	*/
44	public function process() {
45	return $this->update_site_trackback();
46	}
47
48	/**
49	* This is for un-do stuff that has be done in @process.
50	*
51	* @return bool
52	*/
53	public function revert() {
54	return $this->update_site_trackback( true );
55	}
56
57	/**
58	* Update site ping status and pingback flag.
59	*
60	* @param bool $revert Set true to revert changes. Default value: false.
61	*
62	* @return bool
63	*/
64	private function update_site_trackback( $revert = false ) {
65	global $wpdb;
66
67	$flag = $revert ? 1 : 0;
68	$status = $revert ? 'open' : 'closed';
69	$ping_status = 'default_ping_status';
70	$pingback_flag = 'default_pingback_flag';
71
72	if ( ! is_multisite() ) {
73	update_option( $ping_status, $status );
74	update_option( $pingback_flag, $flag );
75
76	$this->change_posts_ping_status( $wpdb, $revert );
77
78	return true;
79	}
80
81	$blog_ids = wp_list_pluck( get_sites(), 'blog_id' );
82
83	foreach ( $blog_ids as $blog_id ) {
84	update_blog_option( $blog_id, $ping_status, $status );
85	update_blog_option( $blog_id, $pingback_flag, $flag );
86
87	$this->change_posts_ping_status( $wpdb, $revert, $blog_id );
88	}
89
90	return true;
91	}
92
93	/**
94	* Update the post ping status.
95	*
96	* @param mixed $wpdb WordPress DB object.
97	* @param bool $revert Set to true to revert changes.
98	* @param int $blog_id The blog id if multisite.
99	*
100	* @return void
101	*/
102	private function change_posts_ping_status( $wpdb, $revert = false, $blog_id = 0 ) {
103	$ping_status = $revert ? 'open' : 'closed';
104	$post_type_to_ignore = array( 'wd_ip_lockout', 'wd_iplockout_log' );
105	$post_type_to_ignore = "'" . implode( "','", $post_type_to_ignore ) . "'";
106
107	if ( $blog_id ) {
108	$wpdb->set_blog_id( $blog_id );
109	$wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery
110	$wpdb->prepare(
111	"UPDATE {$wpdb->posts} SET `ping_status` = %s WHERE `post_status` != %s AND `post_type` NOT IN(%s)",
112	$ping_status,
113	'inherit',
114	$post_type_to_ignore
115	)
116	);
117	} else {
118	$wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery
119	$wpdb->prepare(
120	"UPDATE {$wpdb->posts} SET `ping_status` = %s WHERE `post_status` != %s AND `post_type` NOT IN(%s)",
121	$ping_status,
122	'inherit',
123	$post_type_to_ignore
124	)
125	);
126	}
127	}
128
129	/**
130	* Shield up.
131	*
132	* @return void
133	*/
134	public function shield_up() {
135	$this->resolved = true;
136	}
137
138	/**
139	* Retrieve the tweak's label.
140	*
141	* @return string
142	*/
143	public function get_label(): string {
144	return esc_html__( 'Turn off Trackbacks/pingbacks', 'defender-security' );
145	}
146
147	/**
148	* Get the error reason.
149	*
150	* @return string
151	*/
152	public function get_error_reason(): string {
153	return wp_kses(
154	__( '<strong>Trackbacks/pingbacks is turned on</strong> <br /> and may expose your site to DDoS attacks and spam.', 'defender-security' ),
155	array(
156	'strong' => array(),
157	'br' => array(),
158	)
159	);
160	}
161
162	/**
163	* Return a summary data of this tweak.
164	*
165	* @return array
166	*/
167	public function to_array(): array {
168	return array(
169	'slug' => $this->slug,
170	'title' => $this->get_label(),
171	'errorReason' => $this->get_error_reason(),
172	'successReason' => wp_strip_all_tags( __( 'Trackbacks/pingbacks is turned off.', 'defender-security' ) ),
173	'misc' => array(
174	'show_revert_button' => true,
175	'show_action_button' => true,
176	),
177	'bulk_description' => wp_strip_all_tags( __( 'Pingbacks notify your site when another website links to it. Turn off Trackbacks/pingbacks to help reduce spam, limit unwanted requests, and protect your site from abuse.', 'defender-security' ) ),
178	'bulk_title' => wp_strip_all_tags( __( 'Trackbacks and pingbacks', 'defender-security' ) ),
179	);
180	}
181	}
182