defender-security / src / class-controller.php

class-controller.php in Defender Security – Malware Scanner, Login Security & Firewall 6.2.3, at src/class-controller.php

264 lines 7.1 KB

Raw Download Zip

1	<?php
2	/**
3	* This class handles all routes and actions for a particular module.
4	*
5	* @package WP_Defender
6	*/
7
8	namespace WP_Defender;
9
10	use ReflectionClass;
11	use ReflectionMethod;
12	use Calotes\Helper\HTTP;
13	use WP_Defender\Traits\IO;
14	use WP_Defender\Traits\Plugin;
15	use WP_Defender\Traits\User;
16	use WP_Defender\Traits\Permission;
17	use WP_Defender\Component\Hub_Connector;
18	use WP_Defender\Traits\Defender_Dashboard_Client;
19
20	/**
21	* The controller class.
22	*/
23	abstract class Controller extends \Calotes\Base\Controller {
24
25	use IO;
26	use User;
27	use Permission;
28	use Plugin;
29	use Defender_Dashboard_Client;
30
31	/**
32	* The slug identifier for this controller.
33	*
34	* @var string
35	*/
36	protected $parent_slug = 'wp-defender';
37
38	/**
39	* All the variables that we will show on frontend, both in the main page, or dashboard widget.
40	*
41	* @return array
42	*/
43	abstract public function data_frontend();
44
45	/**
46	* Export the data of this module, we will use this for export to HUB, create a preset etc.
47	*
48	* @return array
49	*/
50	abstract public function to_array();
51
52	/**
53	* Import the data of other source into this, it can be when HUB trigger the import, or user apply a preset.
54	*
55	* @param array $data Data from other source.
56	*
57	* @return null\|void
58	*/
59	abstract public function import_data( array $data );
60
61	/**
62	* Remove all settings, configs generated in this container runtime.
63	*
64	* @return void
65	*/
66	abstract public function remove_settings();
67
68	/**
69	* Remove all data.
70	*
71	* @return void
72	*/
73	abstract public function remove_data();
74
75	/**
76	* Export strings.
77	*
78	* @return array
79	*/
80	abstract public function export_strings();
81
82	/**
83	* An internal cache.
84	*
85	* @var array
86	*/
87	private $cache = array();
88
89	/**
90	* Queue mandatory assets.
91	*/
92	public function enqueue_main_assets() {
93	if ( $this->is_page_active() ) {
94	wp_enqueue_script( 'clipboard' );
95	wp_enqueue_style( 'defender' );
96	wp_enqueue_script( 'wpmudev-sui' );
97	}
98	}
99
100	/**
101	* This too check if the current page is active, so we can queue right assets.
102	*
103	* @return bool
104	*/
105	public function is_page_active() {
106	$current = HTTP::get( 'page' );
107
108	return $current === $this->slug;
109	}
110
111	/**
112	* Quick handler to check nonce.
113	*
114	* @param string $intention Should give context to what is taking place and be the same when nonce was created.
115	* @param string $method Current request method.
116	*
117	* @return bool
118	*/
119	protected function verify_nonce( $intention, $method = 'get' ) {
120	$nonce = 'get' === $method ? HTTP::get( '_def_nonce' ) : HTTP::post( '_def_nonce' );
121	if ( ! wp_verify_nonce( $nonce, $intention ) ) {
122	return false;
123	}
124
125	return true;
126	}
127
128	/**
129	* Bind for submit data to DEV.
130	*
131	* @return void
132	*/
133	public function queue_to_sync_with_hub() {
134	if ( ! wp_next_scheduled( 'defender_hub_sync' ) ) {
135	wp_schedule_single_event( time(), 'defender_hub_sync' );
136	}
137	}
138
139	/**
140	* Read through this class and generate a list of intention method, register it with the central.
141	* The methods that have annotation @defender_method will be registered automatically.
142	*/
143	public function register_routes() {
144	foreach ( $this->get_methods() as $method ) {
145	$doc_block = $method->getDocComment();
146	if ( stristr( $doc_block, '@defender_route' ) ) {
147	if ( 'register_routes' === $method->getName() ) {
148	continue;
149	}
150	$is_public = stristr( $doc_block, '@is_public' );
151	$is_redirect = stristr( $doc_block, '@defender_redirect' );
152	wd_central()->add_route( $method->getName(), static::class, ! $is_public, $is_redirect );
153	}
154	}
155	}
156
157	/**
158	* Return all methods from current class.
159	*
160	* @return ReflectionMethod[]
161	*/
162	private function get_methods() {
163	$class = new ReflectionClass( static::class );
164
165	return $class->getMethods( ReflectionMethod::IS_PUBLIC );
166	}
167
168	/**
169	* Dump the routes and nonces.
170	*
171	* @return array[]
172	*/
173	public function dump_routes_and_nonces() {
174	$nonces = array();
175	$routes = array();
176	foreach ( $this->get_methods() as $method ) {
177	$doc_block = $method->getDocComment();
178	if ( stristr( $doc_block, '@defender_route' ) ) {
179	if ( 'register_routes' === $method->getName() ) {
180	continue;
181	}
182	$nonces[ $method->getName() ] = wd_central()->get_nonce( $method->getName(), static::class );
183	$routes[ $method->getName() ] = wd_central()->get_route( $method->getName(), static::class );
184	}
185	}
186
187	return array(
188	'routes' => $routes,
189	'nonces' => $nonces,
190	);
191	}
192
193	/**
194	* Check if DEFENDER_DEBUG is enabled for the route.
195	*
196	* @param string $route Route to check.
197	*
198	* @return string\|array
199	*/
200	public function check_route( string $route ) {
201	return defined( 'DEFENDER_DEBUG' ) && true === constant( 'DEFENDER_DEBUG' )
202	? wp_slash( $route )
203	: $route;
204	}
205
206	/**
207	* Shared data for all controllers (profile, hub connector, isPro, etc.).
208	*
209	* @return array
210	*/
211	protected function get_shared_data(): array {
212	$hub_profile_ui = Hub_Connector::get_profile_data_for_ui();
213	$profile_data = is_array( $hub_profile_ui ) ? $hub_profile_ui : array();
214	$wpmudev = wd_di()->get( \WP_Defender\Behavior\WPMUDEV::class );
215	$scan_api = wd_di()->get( \WP_Defender\Controller\Scan::class )->dump_routes_and_nonces();
216
217	// wp_timezone_string() returns a raw offset like "+05:30" for sites that use
218	// a numeric GMT offset instead of a named timezone. Intl.DateTimeFormat does
219	// not accept "+05:30", but it does accept the "UTC+05:30" form in all modern
220	// browsers (Chrome 24+, Firefox 23+, Safari 10+). Prefix the offset so the
221	// JS Intl APIs work correctly without falling back to the browser timezone.
222	$tz_string = wp_timezone_string();
223	if ( preg_match( '/^[+-]/', $tz_string ) ) {
224	$tz_string = 'UTC' . $tz_string;
225	}
226
227	return array(
228	'defenderUrl' => network_admin_url( 'admin.php?page=wp-defender' ),
229	'pluginUrl' => WP_DEFENDER_BASE_URL,
230	'adminUrl' => network_admin_url(),
231	'siteUrl' => network_site_url(),
232	'timeZone' => $tz_string,
233	'timeZoneOffset' => (int) round( wp_timezone()->getOffset( new \DateTime( 'now' ) ) / 60 ),
234	'startOfWeek' => (int) get_option( 'start_of_week', 1 ),
235	'profileData' => $profile_data,
236	'hubConnector' => wd_di()->get( \WP_Defender\Controller\Hub_Connector::class )->data_frontend(),
237	'isPro' => $wpmudev->is_pro(),
238	'isWpOrg' => defender_is_wp_org_version(),
239	'pluginUpdate' => $this->get_plugin_update_notice_data(),
240	'whiteLabel' => defender_whitelabel_data(),
241	'activityLog' => wd_di()->get( \WP_Defender\Controller\Activity_Log::class )->data_frontend(),
242	'hubApiKey' => array(
243	'available' => $wpmudev->is_apikey_available(),
244	),
245	'hosted' => $wpmudev->is_wpmu_hosting(),
246	'highContrastMode' => defender_high_contrast(),
247	'isUnlimitedHosting' => defender_is_unlimited_hosting(),
248	'scanApi' => array(
249	'routes' => $scan_api['routes'] ?? array(),
250	'nonces' => $scan_api['nonces'] ?? array(),
251	),
252	);
253	}
254
255	/**
256	* Page-specific data for a concrete controller.
257	*
258	* @return array
259	*/
260	protected function get_page_data(): array {
261	return array();
262	}
263	}
264