defender-security / src / component / security-tweaks / servers / class-nginx.php

class-nginx.php in Defender Security – Malware Scanner, Login Security & Firewall 6.2.4, at src/component/security-tweaks/servers/class-nginx.php

138 lines 3.9 KB

Raw Download Zip

1	<?php
2	/**
3	* Responsible for managing server configurations related to security tweaks .
4	*
5	* @package WP_Defender\Component\Security_Tweaks\Servers
6	*/
7
8	namespace WP_Defender\Component\Security_Tweaks\Servers;
9
10	/**
11	* Provides methods to apply and revert security rules on servers.
12	*/
13	class Nginx {
14
15	/**
16	* Service type.
17	*
18	* @var string
19	*/
20	private $type = null;
21
22	/**
23	* Constructor for class.
24	*
25	* @param string $type The type of the security tweak.
26	*/
27	public function __construct( $type ) {
28	$this->type = $type;
29	}
30
31	/**
32	* Check whether the issue has been resolved or not.
33	*
34	* @return bool
35	*/
36	public function check() {
37	$url = '';
38
39	if ( 'prevent-php-executed' === $this->type ) {
40	$dir = wp_upload_dir();
41	$url = $dir['baseurl'] . '/wp-defender/index.php';
42	}
43
44	if ( 'protect-information' === $this->type ) {
45	$url = defender_asset_url( '/languages/' . WP_DEFENDER_POT_FILENAME );
46	}
47
48	return Server::ping_test_failed( $url );
49	}
50
51	/**
52	* Process the rule.
53	*
54	* @return bool
55	*/
56	public function process() {
57	return true;
58	}
59
60	/**
61	* Revert the rule.
62	*
63	* @return bool
64	*/
65	public function revert() {
66	return true;
67	}
68
69	/**
70	* Get rules.
71	*
72	* @return string
73	*/
74	public function get_rules() {
75	$rules = '';
76	$doc_root = defender_get_data_from_request( 'DOCUMENT_ROOT', 's' );
77	if ( 'prevent-php-executed' === $this->type ) {
78	if ( defender_is_windows() ) {
79	$wp_includes = str_replace( ABSPATH, '', WPINC );
80	$wp_content = str_replace( ABSPATH, '', WP_CONTENT_DIR );
81	} else {
82	$wp_includes = str_replace( $doc_root, '', ABSPATH . WPINC );
83	$wp_content = str_replace( $doc_root, '', WP_CONTENT_DIR );
84	}
85
86	$rules .= '## WP Defender - Prevent PHP Execution ##' . PHP_EOL;
87	$rules .= PHP_EOL;
88	$rules .= '# Stop php access except to needed files in wp-includes' . PHP_EOL;
89	$rules .= "location ~* ^$wp_includes/.*(?<!(js/tinymce/wp-tinymce))\.php$ {" . PHP_EOL;
90	$rules .= ' internal; #internal allows ms-files.php rewrite in multisite to work' . PHP_EOL;
91	$rules .= '}' . PHP_EOL;
92	$rules .= PHP_EOL;
93	$rules .= '# Specifically locks down upload directories in case full wp-content rule below is skipped' . PHP_EOL;
94	$rules .= 'location ~* /(?:uploads\|files)/.*\.php$ {' . PHP_EOL;
95	$rules .= ' deny all;' . PHP_EOL;
96	$rules .= '}' . PHP_EOL;
97	$rules .= PHP_EOL;
98	$rules .= '# Deny direct access to .php files in the /wp-content/ directory (including sub-folders).' . PHP_EOL;
99	$rules .= '# Note this can break some poorly coded plugins/themes, replace the plugin or remove this block if it causes trouble' . PHP_EOL;
100	$rules .= "location ~* ^$wp_content/.*\.php$ {" . PHP_EOL;
101	$rules .= ' deny all;' . PHP_EOL;
102	$rules .= '}' . PHP_EOL;
103	$rules .= PHP_EOL;
104	$rules .= '## WP Defender - End ##';
105	}
106
107	if ( 'protect-information' === $this->type ) {
108	if ( defender_is_windows() ) {
109	$wp_content = str_replace( ABSPATH, '', WP_CONTENT_DIR );
110	} else {
111	$wp_content = str_replace( $doc_root, '', WP_CONTENT_DIR );
112	}
113	$rules .= '## WP Defender - Prevent information disclosure ##';
114	$rules .= PHP_EOL;
115	$rules .= '# Turn off directory indexing autoindex off;' . PHP_EOL;
116	$rules .= PHP_EOL;
117	$rules .= '# Deny access to htaccess and other hidden files' . PHP_EOL;
118	$rules .= 'location ~ /\. {' . PHP_EOL;
119	$rules .= ' deny all;' . PHP_EOL;
120	$rules .= '}' . PHP_EOL;
121	$rules .= PHP_EOL;
122	$rules .= '# Deny access to wp-config.php file' . PHP_EOL;
123	$rules .= 'location = /wp-config.php {' . PHP_EOL;
124	$rules .= ' deny all;' . PHP_EOL;
125	$rules .= '}' . PHP_EOL;
126	$rules .= PHP_EOL;
127	$rules .= '# Deny access to revealing or potentially dangerous files in the /wp-content/ directory (including sub-folders)' . PHP_EOL;
128	$rules .= "location ~* ^$wp_content/.*\.(md\|exe\|sh\|bak\|inc\|pot\|po\|mo\|log\|sql)$ {" . PHP_EOL;
129	$rules .= ' deny all;' . PHP_EOL;
130	$rules .= '}' . PHP_EOL;
131	$rules .= '## WP Defender - End ##';
132	$rules .= PHP_EOL;
133	}
134
135	return $rules;
136	}
137	}
138