← All changes | src/traits/defender-bootstrap.php +375 -211 5.4.0 → 6.3.0 View file →

		@@ -16,14 +16,14 @@
16	16	use WP_Defender\Controller\WAF;
17	17	use WP_Defender\Controller\Scan;
18	18	use WP_Defender\Component\Crypt;
19	19	use WP_Defender\Behavior\WPMUDEV;
20		-use WP_Defender\Controller\Onboard;
21	20	use WP_Defender\Controller\Webauthn;
22	21	use WP_Defender\Controller\Dashboard;
23		-use WP_Defender\Controller\Recaptcha;
	22	+use WP_Defender\Controller\Captcha;
	23	+use WP_Defender\Controller\Recipients;
	24	+use WP_Defender\Controller\Quarantine;
24	25	use WP_Defender\Controller\Mask_Login;
25		-use WP_Defender\Controller\Quarantine;
26	26	use WP_Defender\Controller\Two_Factor;
27	27	use WP_Defender\Component\Hub_Connector;
28	28	use WP_Defender\Controller\Main_Setting;
29	29	use WP_Defender\Controller\Notification;
		@@ -28,22 +28,24 @@
28	28	use WP_Defender\Controller\Main_Setting;
29	29	use WP_Defender\Controller\Notification;
30	30	use WP_Defender\Controller\Audit_Logging;
31	31	use WP_Defender\Controller\Data_Tracking;
32		-use WP_Defender\Controller\Advanced_Tools;
	32	+use WP_Defender\Controller\Login_Access;
33	33	use WP_Defender\Controller\Password_Reset;
	34	+use WP_Defender\Controller\Setup_Wizard;
34	35	use WP_Defender\Controller\Strong_Password;
35		-use WP_Defender\Controller\Expert_Services;
36	36	use WP_Defender\Controller\Security_Tweaks;
37		-use WP_Defender\Controller\Security_Headers;
38	37	use WP_Defender\Controller\Blocklist_Monitor;
39	38	use WP_Defender\Controller\Session_Protection;
40	39	use WP_Defender\Controller\Password_Protection;
	40	+use WP_Defender\Component\Network_Cron_Manager;
41	41	use WP_Defender\Component\Logger\Rotation_Logger;
42	42	use WP_Defender\Component\Firewall as Firewall_Component;
43	43	use WP_Defender\Controller\Firewall as Firewall_Controller;
44	44	use WP_Defender\Controller\Hub_Connector as Hub_Connector_Controller;
45		-use WP_Defender\Model\Onboard as Onboard_Model;
	45	+use WP_Defender\Controller\Rate as Rate_Controller;
	46	+use WP_Defender\Component\Rate as Rate_Component;
	47	+use WP_Defender\Upgrader;
46	48
47	49	trait Defender_Bootstrap {
48	50
49	51	/**
		@@ -51,8 +53,9 @@
51	53	*
52	54	* @var string
53	55	*/
54	56	private $quarantine_table = 'defender_quarantine';
	57	+
55	58	/**
56	59	* Table name for scan item.
57	60	*
58	61	* @var string
		@@ -59,102 +62,18 @@
59	62	*/
60	63	private $scan_item_table = 'defender_scan_item';
61	64
62	65	/**
63		- * Check is all quarantine dependent table is having storage engine InnoDB.
64		- *
65		- * @return bool True if all dependent table is InnoDB else false.
66		- */
67		- private function is_quarantine_dependent_tables_innodb(): bool {
68		- global $wpdb;
69		-
70		- $tables = array( $wpdb->users, $wpdb->base_prefix . $this->scan_item_table );
71		- $total_table = count( $tables );
72		-
73		- return $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
74		- $wpdb->prepare(
75		- "SELECT COUNT(`ENGINE`) = %d FROM information_schema.TABLES WHERE TABLE_SCHEMA = %s AND `ENGINE` = %s AND TABLE_NAME IN ( '{$wpdb->users}', '{$wpdb->base_prefix}defender_scan_item' );",
76		- $total_table,
77		- $wpdb->dbname,
78		- 'innodb',
79		- )
80		- ) === '1';
81		- }
82		-
83		- /**
84		- * Creates the quarantine table if it doesn't exist.
85		- *
86		- * @return void
87		- */
88		- public function create_table_quarantine() {
89		- global $wpdb;
90		-
91		- // Define table names and charset.
92		- $quarantine_table = $wpdb->base_prefix . $this->quarantine_table;
93		- $scan_item_table = $wpdb->base_prefix . $this->scan_item_table;
94		- $charset_collate = $wpdb->get_charset_collate();
95		- $unique_id = uniqid( $wpdb->prefix );
96		-
97		- $common_columns = <<<SQL
98		- `id` bigint UNSIGNED NOT NULL AUTO_INCREMENT,
99		- `defender_scan_item_id` int UNSIGNED DEFAULT NULL,
100		- `file_hash` char(53) NOT NULL,
101		- `file_full_path` text NOT NULL,
102		- `file_original_name` tinytext NOT NULL,
103		- `file_extension` varchar(16) DEFAULT NULL,
104		- `file_mime_type` varchar(64) DEFAULT NULL,
105		- `file_rw_permission` smallint UNSIGNED DEFAULT NULL,
106		- `file_owner` varchar(255) DEFAULT NULL,
107		- `file_group` varchar(255) DEFAULT NULL,
108		- `file_version` varchar(32) DEFAULT NULL,
109		- `file_category` tinyint UNSIGNED DEFAULT 0,
110		- `file_modified_time` datetime NOT NULL,
111		- `source_slug` varchar(255) NOT NULL,
112		- `created_time` datetime NOT NULL,
113		- `created_by` bigint UNSIGNED DEFAULT NULL,
114		- PRIMARY KEY (`id`)
115		- SQL;
116		-
117		- // Define key names.
118		- $scan_item_key = "{$unique_id}_defender_scan_item_id";
119		- $created_by_key = "{$unique_id}_created_by";
120		-
121		- // Build the SQL statement based on the storage engine.
122		- if ( $this->is_quarantine_dependent_tables_innodb() ) {
123		- $sql = <<<SQL
124		- CREATE TABLE IF NOT EXISTS `{$quarantine_table}` (
125		- $common_columns,
126		- CONSTRAINT `{$scan_item_key}`
127		- FOREIGN KEY (`defender_scan_item_id`) REFERENCES {$scan_item_table}(`id`)
128		- ON UPDATE CASCADE ON DELETE SET NULL,
129		- CONSTRAINT `{$created_by_key}`
130		- FOREIGN KEY (`created_by`) REFERENCES {$wpdb->users}(`ID`)
131		- ON UPDATE CASCADE ON DELETE SET NULL
132		- ) {$charset_collate};
133		- SQL;
134		- } else {
135		- $sql = <<<SQL
136		- CREATE TABLE IF NOT EXISTS `{$quarantine_table}` (
137		- $common_columns,
138		- KEY `{$scan_item_key}` (`defender_scan_item_id`),
139		- KEY `{$created_by_key}` (`created_by`)
140		- ) {$charset_collate};
141		- SQL;
142		- }
143		-
144		- // Execute the SQL query.
145		- $wpdb->query( $sql ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
146		- }
147		-
148		- /**
149	66	* Activation.
150	67	*/
151	68	private function activation_hook_common(): void {
152		- $this->create_database_tables();
	69	+ Upgrader::date_activated();
	70	+ $this->create_database_tables_common();
153	71	$this->on_activation();
	72	+ $this->set_activation_redirect_flag();
154	73	// Create a file with a random key if it doesn't exist.
155	74	( new Crypt() )->create_key_file();
156		- // If this is a plugin reactivatin, then track it. No need the check by 'wd_nofresh_install' key because the option is disabled by default.
	75	+ // If this is a plugin reactivating, then track it. No need the check by 'wd_nofresh_install' key because the option is disabled by default.
157	76	$settings = wd_di()->get( Main_Setting::class );
158	77	$settings->set_intention( 'Reactivation' );
159	78	$settings->track_opt( true );
160	79
		@@ -165,14 +84,12 @@
165	84	wp_schedule_single_event( time() + 5, 'wpdef_smart_ip_detection_ping' );
166	85	}
167	86
168	87	/**
169		- * Deactivation.
	88	+ * Deactivation - clears shared cron hooks present in both free and pro versions.
170	89	*/
171		- public function deactivation_hook(): void {
	90	+ protected function deactivation_hook_common(): void {
172	91	wp_clear_scheduled_hook( 'firewall_clean_up_logs' );
173		- wp_clear_scheduled_hook( 'audit_sync_events' );
174		- wp_clear_scheduled_hook( 'audit_clean_up_logs' );
175	92	wp_clear_scheduled_hook( 'wdf_maybe_send_report' );
176	93	wp_clear_scheduled_hook( 'wp_defender_clear_logs' );
177	94	wp_clear_scheduled_hook( 'wpdef_sec_key_gen' );
178	95	wp_clear_scheduled_hook( 'wpdef_clear_scan_logs' );
		@@ -178,9 +95,8 @@
178	95	wp_clear_scheduled_hook( 'wpdef_clear_scan_logs' );
179	96	wp_clear_scheduled_hook( 'wpdef_log_rotational_delete' );
180	97	wp_clear_scheduled_hook( 'wpdef_update_geoip' );
181	98	wp_clear_scheduled_hook( 'wpdef_fetch_global_ip_list' );
182		- wp_clear_scheduled_hook( 'wpdef_quarantine_delete_expired' );
183	99	wp_clear_scheduled_hook( 'wpdef_firewall_clean_up_lockout' );
184	100	wp_clear_scheduled_hook( 'wpdef_firewall_send_compact_logs_to_api' );
185	101	wp_clear_scheduled_hook( 'wpdef_firewall_fetch_trusted_proxy_preset_ips' );
186	102	wp_clear_scheduled_hook( 'wpdef_firewall_clean_up_unlockout' );
		@@ -187,13 +103,12 @@
187	103	wp_clear_scheduled_hook( 'wpdef_antibot_global_firewall_fetch_blocklist' );
188	104	wp_clear_scheduled_hook( 'wpdef_smart_ip_detection_ping' );
189	105	wp_clear_scheduled_hook( 'wpdef_confirm_antibot_toggle_on_hosting' );
190	106	wp_clear_scheduled_hook( 'wpdef_firewall_whitelist_server_public_ip' );
191		- wp_clear_scheduled_hook( 'wpdef_rotate_bot_trap_secret_hash' );
	107	+ wp_clear_scheduled_hook( 'wpdef_rotate_malicious_bot_secret_hash' );
192	108
193	109	// Remove old legacy cron jobs if they exist.
194	110	wp_clear_scheduled_hook( 'lockoutReportCron' );
195		- wp_clear_scheduled_hook( 'auditReportCron' );
196	111	wp_clear_scheduled_hook( 'cleanUpOldLog' );
197	112	wp_clear_scheduled_hook( 'scanReportCron' );
198	113	wp_clear_scheduled_hook( 'tweaksSendNotification' );
199	114	}
		@@ -246,34 +161,18 @@
246	161	PRIMARY KEY (`id`),
247	162	UNIQUE KEY ip (ip)
248	163	) {$charset_collate};
249	164	SQL;
250		- $wpdb->query( $sql ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	165	+ $wpdb->query( $sql ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
251	166	}
252	167
253	168	/**
254		- * Creates Defender's tables.
255		- *
256		- * @since 2.7.1 No use dbDelta because PHP v8.1 triggers an error when calling query "DESCRIBE {$table};" if the
257		- * table doesn't exist.
	169	+ * Creates the audit log table used for caching audit events.
258	170	*/
259		- protected function create_database_tables(): void {
	171	+ protected function create_table_audit_log(): void {
260	172	global $wpdb;
261	173
262	174	$charset_collate = $wpdb->get_charset_collate();
263		- // Hide errors.
264		- $wpdb->hide_errors();
265		- // Email log table.
266		- $sql = "CREATE TABLE IF NOT EXISTS {$wpdb->base_prefix}defender_email_log (
267		- `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
268		- `timestamp` int NOT NULL,
269		- `source` varchar(255) NOT NULL,
270		- `to` varchar(255) NOT NULL,
271		- PRIMARY KEY (`id`),
272		- KEY `source` (`source`)
273		-) $charset_collate;";
274		- $wpdb->query( $sql ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
275		-
276	175	// Audit log table. Though our data mainly store on API side, we will need a table for caching.
277	176	$sql = "CREATE TABLE IF NOT EXISTS {$wpdb->base_prefix}defender_audit_log (
278	177	`id` int(11) unsigned NOT NULL AUTO_INCREMENT,
279	178	`timestamp` int NOT NULL,
		@@ -294,9 +193,33 @@
294	193	KEY `context` (`context`),
295	194	KEY `ip` (`ip`)
296	195	) $charset_collate;";
297	196	$wpdb->query( $sql ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	197	+ }
298	198
	199	+ /**
	200	+ * Creates Defender's tables.
	201	+ *
	202	+ * @since 2.7.1 No use dbDelta because PHP v8.1 triggers an error when calling query "DESCRIBE {$table};" if the
	203	+ * table doesn't exist.
	204	+ */
	205	+ protected function create_database_tables_common(): void {
	206	+ global $wpdb;
	207	+
	208	+ $charset_collate = $wpdb->get_charset_collate();
	209	+ // Hide errors.
	210	+ $wpdb->hide_errors();
	211	+ // Email log table.
	212	+ $sql = "CREATE TABLE IF NOT EXISTS {$wpdb->base_prefix}defender_email_log (
	213	+ `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
	214	+ `timestamp` int NOT NULL,
	215	+ `source` varchar(255) NOT NULL,
	216	+ `to` varchar(255) NOT NULL,
	217	+ PRIMARY KEY (`id`),
	218	+ KEY `source` (`source`)
	219	+) $charset_collate;";
	220	+ $wpdb->query( $sql ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	221	+
299	222	// Scan item table.
300	223	$sql = "CREATE TABLE IF NOT EXISTS {$wpdb->base_prefix}defender_scan_item (
301	224	`id` int(11) unsigned NOT NULL AUTO_INCREMENT,
302	225	`parent_id` int NOT NULL,
		@@ -361,65 +284,148 @@
361	284	KEY `attempt_404` (`attempt_404`)
362	285	) $charset_collate;";
363	286	$wpdb->query( $sql ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
364	287
365		- $this->create_table_quarantine();
366		-
367		- // Create Unlock table.
	288	+ // Create unlockout table.
368	289	$this->create_table_unlockout();
369	290	// Create Blocklist table.
370	291	$this->create_table_blocklist();
	292	+ // Create Quarantine table.
	293	+ $this->create_table_quarantine();
	294	+ // Create Audit Log table.
	295	+ $this->create_table_audit_log();
371	296	}
372	297
373	298	/**
374		- * Initializes the common modules of the application.
	299	+ * Check if all quarantine-dependent tables use the InnoDB storage engine.
375	300	*
	301	+ * @return bool True if all dependent tables are InnoDB, false otherwise.
	302	+ */
	303	+ private function is_quarantine_dependent_tables_innodb(): bool {
	304	+ global $wpdb;
	305	+
	306	+ $tables = array( $wpdb->users, $wpdb->base_prefix . $this->scan_item_table );
	307	+ $total_table = count( $tables );
	308	+
	309	+ return $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	310	+ $wpdb->prepare(
	311	+ "SELECT COUNT(`ENGINE`) = %d FROM information_schema.TABLES WHERE TABLE_SCHEMA = %s AND `ENGINE` = %s AND TABLE_NAME IN ( '{$wpdb->users}', '{$wpdb->base_prefix}defender_scan_item' );",
	312	+ $total_table,
	313	+ $wpdb->dbname,
	314	+ 'innodb',
	315	+ )
	316	+ ) === '1';
	317	+ }
	318	+
	319	+ /**
	320	+ * Creates the quarantine table if it doesn't exist.
	321	+ * Uses InnoDB foreign key constraints when the dependent tables support it,
	322	+ * otherwise falls back to plain KEY indexes.
	323	+ *
376	324	* @return void
377	325	*/
	326	+ public function create_table_quarantine(): void {
	327	+ global $wpdb;
	328	+
	329	+ $quarantine_table = $wpdb->base_prefix . $this->quarantine_table;
	330	+ $scan_item_table = $wpdb->base_prefix . $this->scan_item_table;
	331	+ $charset_collate = $wpdb->get_charset_collate();
	332	+ $unique_id = uniqid( $wpdb->prefix );
	333	+
	334	+ $common_columns = <<<'SQL'
	335	+ `id` bigint UNSIGNED NOT NULL AUTO_INCREMENT,
	336	+ `defender_scan_item_id` int UNSIGNED DEFAULT NULL,
	337	+ `file_hash` char(53) NOT NULL,
	338	+ `file_full_path` text NOT NULL,
	339	+ `file_original_name` tinytext NOT NULL,
	340	+ `file_extension` varchar(16) DEFAULT NULL,
	341	+ `file_mime_type` varchar(64) DEFAULT NULL,
	342	+ `file_rw_permission` smallint UNSIGNED DEFAULT NULL,
	343	+ `file_owner` varchar(255) DEFAULT NULL,
	344	+ `file_group` varchar(255) DEFAULT NULL,
	345	+ `file_version` varchar(32) DEFAULT NULL,
	346	+ `file_category` tinyint UNSIGNED DEFAULT 0,
	347	+ `file_modified_time` datetime NOT NULL,
	348	+ `source_slug` varchar(255) NOT NULL,
	349	+ `created_time` datetime NOT NULL,
	350	+ `created_by` bigint UNSIGNED DEFAULT NULL,
	351	+ PRIMARY KEY (`id`)
	352	+ SQL;
	353	+
	354	+ // Define key names.
	355	+ $scan_item_key = "{$unique_id}_defender_scan_item_id";
	356	+ $created_by_key = "{$unique_id}_created_by";
	357	+
	358	+ // Build the SQL statement based on the storage engine.
	359	+ if ( $this->is_quarantine_dependent_tables_innodb() ) {
	360	+ $sql = <<<SQL
	361	+ CREATE TABLE IF NOT EXISTS `{$quarantine_table}` (
	362	+ $common_columns,
	363	+ CONSTRAINT `{$scan_item_key}`
	364	+ FOREIGN KEY (`defender_scan_item_id`) REFERENCES {$scan_item_table}(`id`)
	365	+ ON UPDATE CASCADE ON DELETE SET NULL,
	366	+ CONSTRAINT `{$created_by_key}`
	367	+ FOREIGN KEY (`created_by`) REFERENCES {$wpdb->users}(`ID`)
	368	+ ON UPDATE CASCADE ON DELETE SET NULL
	369	+ ) {$charset_collate};
	370	+ SQL;
	371	+ } else {
	372	+ $sql = <<<SQL
	373	+ CREATE TABLE IF NOT EXISTS `{$quarantine_table}` (
	374	+ $common_columns,
	375	+ KEY `{$scan_item_key}` (`defender_scan_item_id`),
	376	+ KEY `{$created_by_key}` (`created_by`)
	377	+ ) {$charset_collate};
	378	+ SQL;
	379	+ }
	380	+
	381	+ // Execute the SQL query.
	382	+ $wpdb->query( $sql ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	383	+ }
	384	+
	385	+ /**
	386	+ * Initialize the common modules of the application.
	387	+ *
	388	+ * @return void
	389	+ */
378	390	private function init_modules_common(): void {
379	391	// Init main ORM.
380	392	Array_Cache::set( 'orm', new Mapper() );
381		- /**
382		- * Display Onboarding if:
383		- * it's a fresh install and there were no requests from the Hub before,
384		- * after Reset Settings.
385		- *
386		- * @var HUB
387		- */
388		- $hub_class = wd_di()->get( HUB::class );
389		- $hub_class->set_onboarding_status( Onboard_Model::maybe_show_onboarding() );
390		- if ( $hub_class->get_onboarding_status() && ! defender_is_wp_cli() ) {
391		- // If it's cli we should start this normally.
392		- Array_Cache::set( 'onboard', wd_di()->get( Onboard::class ) );
393		- } else {
394		- // Initialize the main controllers of every module.
395		- wd_di()->get( Dashboard::class );
396		- }
	393	+
	394	+ // New setup wizard is rendered directly inside Dashboard React UI.
	395	+ wd_di()->get( Setup_Wizard::class );
	396	+ wd_di()->get( \WP_Defender\Controller\Activity_Log::class );
	397	+ wd_di()->get( Dashboard::class );
	398	+ wd_di()->get( Scan::class );
397	399	wd_di()->get( Security_Tweaks::class );
398		- wd_di()->get( Scan::class );
399	400	wd_di()->get( Audit_Logging::class );
400	401	wd_di()->get( Firewall_Controller::class );
	402	+ wd_di()->get( Login_Access::class );
	403	+ // Initialize Mask Login globally so runtime protections hook into wp-login/wp-admin requests.
	404	+ wd_di()->get( Mask_Login::class );
401	405	wd_di()->get( WAF::class );
402	406	wd_di()->get( Two_Factor::class );
403		- wd_di()->get( Advanced_Tools::class );
404	407	wd_di()->get( Mask_Login::class );
405		- wd_di()->get( Security_Headers::class );
406		- wd_di()->get( Recaptcha::class );
	408	+ wd_di()->get( Captcha::class );
407	409	wd_di()->get( Notification::class );
	410	+ wd_di()->get( Recipients::class );
408	411	wd_di()->get( Main_Setting::class );
409	412	wd_di()->get( Blocklist_Monitor::class );
410	413	wd_di()->get( Password_Protection::class );
411	414	wd_di()->get( Password_Reset::class );
412	415	wd_di()->get( Webauthn::class );
413		- wd_di()->get( Expert_Services::class );
414	416	wd_di()->get( Hub_Connector_Controller::class );
415	417	wd_di()->get( Strong_Password::class );
416	418	wd_di()->get( Session_Protection::class );
	419	+ wd_di()->get( Quarantine::class );
	420	+ wd_di()->get( Data_Tracking::class );
	421	+ if ( defender_is_wp_org_version() ) {
	422	+ wd_di()->get( Rate_Controller::class );
	423	+ }
417	424
418		- if ( class_exists( 'WP_Defender\Controller\Quarantine' ) ) {
419		- wd_di()->get( Quarantine::class );
	425	+ if ( is_multisite() ) {
	426	+ wd_di()->get( Network_Cron_Manager::class );
420	427	}
421		- wd_di()->get( Data_Tracking::class );
422	428	}
423	429
424	430	/**
425	431	* Adds a specific class to the body tag if the current page is a Defender page.
		@@ -443,11 +449,36 @@
443	449	* @return void
444	450	*/
445	451	private function register_styles(): void {
446	452	wp_enqueue_style( 'defender-menu', WP_DEFENDER_BASE_URL . 'assets/css/defender-icon.css', array(), DEFENDER_VERSION );
	453	+ wp_add_inline_style(
	454	+ 'defender-menu',
	455	+ '#toplevel_page_wp-defender .wd-issue-indicator-sidebar {
	456	+ position: relative;
	457	+ background-color: transparent !important;
	458	+ width: 8px;
	459	+ min-width: unset;
	460	+ padding: 0;
	461	+ margin-left: 4px;
	462	+ }
	463	+ #toplevel_page_wp-defender .wd-issue-indicator-sidebar::after {
	464	+ content: "";
	465	+ position: absolute;
	466	+ width: 8px;
	467	+ height: 8px;
	468	+ top: 50%;
	469	+ left: 50%;
	470	+ transform: translate(-50%, -50%);
	471	+ border-radius: 50%;
	472	+ background: #d63638;
	473	+ }'
	474	+ );
447	475
448	476	$css_files = array(
449		- 'defender' => WP_DEFENDER_BASE_URL . 'assets/css/styles.css',
	477	+ 'defender' => WP_DEFENDER_BASE_URL . 'assets/css/styles.css',
	478	+ 'def-sui' => WP_DEFENDER_BASE_URL . 'assets/css/shared-ui.css',
	479	+ 'def-admin' => WP_DEFENDER_BASE_URL . 'assets/css/admin.css',
	480	+ 'def-core-ui-style' => WP_DEFENDER_BASE_URL . 'assets/css/core-ui.css',
450	481	);
451	482
452	483	foreach ( $css_files as $slug => $file ) {
453	484	wp_register_style( $slug, $file, array(), DEFENDER_VERSION );
		@@ -460,75 +491,49 @@
460	491	* @return void
461	492	*/
462	493	private function register_scripts(): void {
463	494	$base_url = WP_DEFENDER_BASE_URL;
464		- $dependencies = array( 'def-vue', 'def-manifest', 'defender', 'wp-i18n' );
	495	+ $dependencies = array( 'def-vue', 'def-manifest', 'def-core-ui', 'defender', 'wp-i18n' );
465	496	$js_files = array(
466		- 'wpmudev-sui' => array(
	497	+ 'wpmudev-sui' => array(
467	498	$base_url . 'assets/js/shared-ui.js',
468	499	),
469		- 'defender' => array(
	500	+ 'defender' => array(
470	501	$base_url . 'assets/js/scripts.js',
471	502	),
472		- 'def-vue' => array(
473		- $base_url . 'assets/app/vendor.js',
	503	+ 'def-deactivation-survey' => array(
	504	+ $base_url . 'assets/js/deactivation-survey.js',
	505	+ array( 'clipboard', 'wpmudev-sui' ),
474	506	),
475		- 'def-manifest' => array(
476		- $base_url . 'assets/app/manifest.js',
	507	+ 'def-admin' => array(
	508	+ $base_url . 'assets/js/admin.js',
	509	+ array( 'def-deactivation-survey' ),
477	510	),
478		- 'def-dashboard' => array(
479		- $base_url . 'assets/app/dashboard.js',
480		- $dependencies,
	511	+ 'def-vue' => array(
	512	+ $base_url . 'assets/js/vendor.js',
481	513	),
482		- 'def-securitytweaks' => array(
483		- $base_url . 'assets/app/security-tweak.js',
484		- array_merge( $dependencies, array( 'clipboard', 'wpmudev-sui' ) ),
	514	+ 'def-manifest' => array(
	515	+ $base_url . 'assets/js/manifest.js',
485	516	),
486		- 'def-scan' => array(
487		- $base_url . 'assets/app/scan.js',
488		- array_merge( $dependencies, array( 'clipboard', 'wpmudev-sui' ) ),
	517	+ 'def-core-ui' => array(
	518	+ $base_url . 'assets/js/core-ui.js',
	519	+ array( 'def-vue', 'def-manifest' ),
489	520	),
490		- 'def-audit' => array(
491		- $base_url . 'assets/app/audit.js',
	521	+ // React files.
	522	+ 'def-setup-wizard' => array(
	523	+ $base_url . 'assets/js/setup-wizard.js',
492	524	$dependencies,
493	525	),
494		- 'def-iplockout' => array(
495		- $base_url . 'assets/app/ip-lockout.js',
496		- array_merge( $dependencies, array( 'wpmudev-sui' ) ),
497		- ),
498		- 'def-advancedtools' => array(
499		- $base_url . 'assets/app/advanced-tools.js',
500		- $dependencies,
501		- ),
502		- 'def-settings' => array(
503		- $base_url . 'assets/app/settings.js',
504		- $dependencies,
505		- ),
506		- 'def-2fa' => array(
507		- $base_url . 'assets/app/two-fa.js',
508		- $dependencies,
509		- ),
510		- 'def-notification' => array(
511		- $base_url . 'assets/app/notification.js',
512		- $dependencies,
513		- ),
514		- 'def-waf' => array(
515		- $base_url . 'assets/app/waf.js',
516		- $dependencies,
517		- ),
518		- 'def-onboard' => array(
519		- $base_url . 'assets/app/onboard.js',
520		- $dependencies,
521		- ),
522		- 'def-expert-services' => array(
523		- $base_url . '/assets/app/expert-services.js',
524		- $dependencies,
525		- ),
526	526	);
527	527
528	528	foreach ( $js_files as $slug => $file ) {
529	529	if ( isset( $file[1] ) ) {
530		- wp_register_script( $slug, $file[0], $file[1], DEFENDER_VERSION, true );
	530	+ // This ensures that when JavaScript file changes,
	531	+ // browsers will load the new version instead of
	532	+ // serving a cached old version.
	533	+ $file_path = str_replace( $base_url, WP_DEFENDER_DIR, $file[0] );
	534	+ $file_version = file_exists( $file_path ) ? filemtime( $file_path ) : DEFENDER_VERSION;
	535	+ wp_register_script( $slug, $file[0], $file[1], $file_version, true );
531	536	wp_set_script_translations( $slug, 'defender-security' );
532	537	} else {
533	538	wp_register_script( $slug, $file[0], array( 'jquery' ), DEFENDER_VERSION, true );
534	539	}
		@@ -543,15 +548,24 @@
543	548	private function localize_script(): void {
544	549	$wpmu_dev = new WPMUDEV();
545	550	global $wp_defender_central;
546	551
547		- $misc = array();
548		- $data_tracking = wd_di()->get( Data_Tracking::class );
549		- $is_tracking = $data_tracking->show_tracking_modal();
550		- if ( $is_tracking ) {
551		- $misc = $data_tracking->get_tracking_modal();
	552	+ $misc = array();
	553	+ $misc['high_contrast'] = defender_high_contrast();
	554	+ $is_wp_org = defender_is_wp_org_version();
	555	+ if ( $is_wp_org ) {
	556	+ $misc['rating'] = array();
	557	+ $rate_service = Rate_Component::is_achievement_displayed();
	558	+ if ( $rate_service['is_displayed'] ) {
	559	+ $misc['rating'] = wd_di()->get( Rate_Controller::class )->data_frontend();
	560	+ $misc['rating']['text'] = Rate_Component::get_notice_by_slug( $rate_service['slug'] );
	561	+ }
	562	+
	563	+ $misc['rating']['is_displayed'] = $rate_service['is_displayed'];
	564	+ $misc['rating']['type'] = $rate_service['slug'];
	565	+ } else {
	566	+ $misc['rating']['is_displayed'] = false;
552	567	}
553		- $misc['high_contrast'] = defender_high_contrast();
554	568
555	569	wp_localize_script(
556	570	'def-vue',
557	571	'defender',
		@@ -561,9 +575,12 @@
561	575	'home_url' => network_home_url(),
562	576	'site_url' => network_site_url(),
563	577	'admin_url' => network_admin_url(),
564	578	'defender_url' => WP_DEFENDER_BASE_URL,
	579	+ // There might be Pro version but without pro features, for example when the membership expires.
565	580	'is_free' => $wpmu_dev->is_pro() ? 0 : 1,
	581	+ // Strictly Free version.
	582	+ 'is_wp_org' => $is_wp_org ? 1 : 0,
566	583	'is_membership' => true,
567	584	'is_whitelabel' => $wpmu_dev->is_whitelabel_enabled() ? 'enabled' : 'disabled',
568	585	'wpmu_dev_url_action' => $wpmu_dev->hide_wpmu_dev_urls() ? 'hide' : 'show',
569	586	'opcache_save_comments' => $wp_defender_central->is_opcache_save_comments_disabled() ? 'disabled' : 'enabled',
		@@ -571,15 +588,25 @@
571	588	'wpmudev_url' => WP_DEFENDER_DOCS_LINK,
572	589	'wpmudev_support_ticket_text' => defender_support_ticket_text(),
573	590	'wpmudev_api_base_url' => $wpmu_dev->get_api_base_url(),
574	591	'upgrade_title' => esc_html__( 'UPGRADE TO PRO', 'defender-security' ),
575		- 'tracking_modal' => $is_tracking ? 'show' : 'hide',
576	592	'hosted' => $wpmu_dev->is_wpmu_hosting(),
577	593	'file_upload_nonce' => wp_create_nonce( 'defender_file_upload' ),
	594	+ 'wpmudev_hub_link' => 'https://wpmudev.com/hub2/',
578	595	)
579	596	);
580	597
581	598	wp_localize_script( 'defender', 'defenderGetText', defender_gettext_translations() );
	599	+
	600	+ wp_localize_script(
	601	+ 'def-deactivation-survey',
	602	+ 'defender',
	603	+ array(
	604	+ 'usage_tracking' => wd_di()->get( \WP_Defender\Model\Setting\Main_Setting::class )->usage_tracking,
	605	+ 'admin_url' => admin_url( 'admin-ajax.php' ),
	606	+ 'nonce' => wp_create_nonce( 'defender_deactivation_survey_modal' ),
	607	+ )
	608	+ );
582	609	}
583	610
584	611	/**
585	612	* Register all core assets.
		@@ -595,8 +622,10 @@
595	622	/**
596	623	* Trigger mandatory actions on activation.
597	624	*/
598	625	private function on_activation(): void {
	626	+ update_site_option( Data_Tracking::TRACKING_SLUG, true );
	627	+
599	628	add_action(
600	629	'admin_init',
601	630	function () {
602	631	$security_tweaks = wd_di()->get( Security_Tweaks::class );
		@@ -616,8 +645,87 @@
616	645	return defender_cron_schedules( $schedules );
617	646	}
618	647
619	648	/**
	649	+ * Serves script translations from the single MO file our in-site translation
	650	+ * tools (e.g. WPMU DEV Hub's translation editor) produce, since those only
	651	+ * generate one MO/PO file per plugin rather than the per-script JSON files
	652	+ * `wp_set_script_translations()` normally expects.
	653	+ *
	654	+ * @param string|false $translations Translations as JSON, false if there are none.
	655	+ * @param string|false $file Path to the translation file to load, false if there isn't one.
	656	+ * @param string $handle Name of the script to register a translation domain to.
	657	+ * @param string $domain The text domain.
	658	+ *
	659	+ * @return string|false
	660	+ */
	661	+ public function provide_script_translations( $translations, $file, $handle, $domain ) {
	662	+ if ( 'defender-security' !== $domain ) {
	663	+ return $translations;
	664	+ }
	665	+
	666	+ static $served = false;
	667	+ static $cached_json = null;
	668	+
	669	+ if ( $served ) {
	670	+ return wp_json_encode(
	671	+ array(
	672	+ 'locale_data' => array(
	673	+ 'defender-security' => array(
	674	+ '' => array(
	675	+ 'domain' => 'defender-security',
	676	+ ),
	677	+ ),
	678	+ ),
	679	+ )
	680	+ );
	681	+ }
	682	+
	683	+ if ( null !== $cached_json ) {
	684	+ return $cached_json;
	685	+ }
	686	+
	687	+ $locale = is_admin() ? get_user_locale() : get_locale();
	688	+ $mo_file = WP_LANG_DIR . "/plugins/{$domain}-{$locale}.mo";
	689	+
	690	+ if ( ! file_exists( $mo_file ) ) {
	691	+ return $translations;
	692	+ }
	693	+
	694	+ $mo = new \MO();
	695	+ if ( ! $mo->import_from_file( $mo_file ) ) {
	696	+ return $translations;
	697	+ }
	698	+
	699	+ $locale_data = array(
	700	+ '' => array(
	701	+ 'domain' => $domain,
	702	+ 'lang' => $locale,
	703	+ ),
	704	+ );
	705	+
	706	+ if ( isset( $mo->headers['Plural-Forms'] ) && '' !== $mo->headers['Plural-Forms'] ) {
	707	+ $locale_data['']['plural-forms'] = $mo->headers['Plural-Forms'];
	708	+ }
	709	+
	710	+ foreach ( $mo->entries as $msgid => $entry ) {
	711	+ $locale_data[ $msgid ] = $entry->translations;
	712	+ }
	713	+
	714	+ $cached_json = wp_json_encode(
	715	+ array(
	716	+ 'locale_data' => array(
	717	+ $domain => $locale_data,
	718	+ ),
	719	+ )
	720	+ );
	721	+
	722	+ $served = true;
	723	+
	724	+ return $cached_json;
	725	+ }
	726	+
	727	+ /**
620	728	* Initialize the modules and register the plugin routes. Also include the admin class, adds WP-CLI commands.
621	729	*
622	730	* @return void
623	731	*/
		@@ -626,9 +734,11 @@
626	734	add_action(
627	735	'after_setup_theme',
628	736	function () {
629	737	add_filter( 'cron_schedules', array( $this, 'cron_schedules' ) );
630		- $this->init_modules();
	738	+ if ( method_exists( $this, 'init_modules' ) ) {
	739	+ $this->init_modules();
	740	+ }
631	741	}
632	742	);
633	743	// Register routes.
634	744	add_action(
		@@ -637,14 +747,16 @@
637	747	require_once WP_DEFENDER_DIR . 'src/routes.php';
638	748	},
639	749	9
640	750	);
	751	+ // Serve script translations from the single MO file our in-site translation tools produce.
	752	+ add_filter( 'pre_load_script_translations', array( $this, 'provide_script_translations' ), 10, 4 );
641	753	// Register the Hub Connector early to handle the auth callback during the admin init hook.
642	754	add_action( 'plugins_loaded', array( wd_di()->get( Hub_Connector::class ), 'init' ) );
643		- // Register the Cross-Sell module.
644		- add_action( 'init', array( wd_di()->get( \WP_Defender\Component\Cross_Sell::class ), 'init' ), 9 );
645	755	// Include admin class. Don't use is_admin().
646	756	add_action( 'admin_init', array( ( new Admin() ), 'init' ) );
	757	+ // Initialize deactivation survey.
	758	+ add_action( 'admin_enqueue_scripts', array( ( new Admin() ), 'init_deactivation_survey' ) );
647	759	// Add WP-CLI commands.
648	760	if ( defender_is_wp_cli() ) {
649	761	WP_CLI::add_command( 'defender', Cli::class );
650	762	}
		@@ -651,6 +763,58 @@
651	763	// Rotational logger initialization.
652	764	add_action( 'init', array( ( new Rotation_Logger() ), 'init' ), 99 );
653	765	// Handle plugin deactivation.
654	766	add_action( 'deactivated_plugin', array( ( new HUB() ), 'intercept_deactivate' ) );
	767	+ }
	768	+
	769	+ /**
	770	+ * Sets a one-time redirect flag after plugin activation.
	771	+ *
	772	+ * The actual redirect is executed later during `admin_init` to avoid exiting activation flow prematurely.
	773	+ *
	774	+ * @return void
	775	+ */
	776	+ public function set_activation_redirect_flag(): void {
	777	+ if ( defender_is_wp_cli() ) {
	778	+ return;
	779	+ }
	780	+
	781	+ update_site_option( 'wp_defender_activation_redirect', 1 );
	782	+ }
	783	+
	784	+ /**
	785	+ * Redirects once to the Defender dashboard after activation.
	786	+ *
	787	+ * Safety checks:
	788	+ * - Redirect only when the activation flag exists.
	789	+ * - Skip AJAX, cron and WP-CLI contexts.
	790	+ * - Redirect only for users with proper admin capability.
	791	+ *
	792	+ * @return void
	793	+ */
	794	+ public function maybe_redirect_after_activation(): void {
	795	+ if ( ! (bool) get_site_option( 'wp_defender_activation_redirect' ) ) {
	796	+ return;
	797	+ }
	798	+
	799	+ delete_site_option( 'wp_defender_activation_redirect' );
	800	+
	801	+ if ( wp_doing_ajax() || wp_doing_cron() || defender_is_wp_cli() ) {
	802	+ return;
	803	+ }
	804	+
	805	+ $cap = is_multisite() ? 'manage_network_options' : 'manage_options';
	806	+ if ( ! current_user_can( $cap ) ) {
	807	+ return;
	808	+ }
	809	+
	810	+ $url = add_query_arg(
	811	+ array(
	812	+ 'page' => 'wp-defender',
	813	+ ),
	814	+ is_multisite() ? network_admin_url( 'admin.php' ) : admin_url( 'admin.php' )
	815	+ );
	816	+
	817	+ wp_safe_redirect( $url );
	818	+ exit;
655	819	}
656	820	}