← All changes
|
src/component/security-tweaks/class-disable-file-editor.php
+25
-18
5.5.0
→
6.3.0
View file →
| @@ -15,8 +15,9 @@ | ||
| 15 | 15 | * Handles the implementation of the disable-file-editor security tweak. |
| 16 | 16 | */ |
| 17 | 17 | class Disable_File_Editor extends Abstract_Security_Tweaks { |
| 18 | 18 | |
| 19 | + | |
| 19 | 20 | /** |
| 20 | 21 | * Slug identifier for the component. |
| 21 | 22 | * |
| 22 | 23 | * @var string |
| @@ -47,9 +48,9 @@ | ||
| 47 | 48 | |
| 48 | 49 | /** |
| 49 | 50 | * Set data in wp-config.php. |
| 50 | 51 | * |
| 51 | - * @param bool $value The value to set for DISALLOW_FILE_EDIT. | |
| 52 | + * @param bool $value The value to set for DISALLOW_FILE_EDIT. | |
| 52 | 53 | * |
| 53 | 54 | * @return bool|WP_Error |
| 54 | 55 | */ |
| 55 | 56 | private function set_file_edit_data( $value ) { |
| @@ -54,10 +55,10 @@ | ||
| 54 | 55 | */ |
| 55 | 56 | private function set_file_edit_data( $value ) { |
| 56 | 57 | $sec_tweak_component = new Security_Tweak_Component(); |
| 57 | 58 | $obj_file = 'flywheel' === Server::get_current_server() |
| 58 | - ? $sec_tweak_component->advanced_check_file() | |
| 59 | - : $sec_tweak_component->file(); | |
| 59 | + ? $sec_tweak_component->advanced_check_file() | |
| 60 | + : $sec_tweak_component->file(); | |
| 60 | 61 | if ( false === $obj_file ) { |
| 61 | 62 | return new WP_Error( |
| 62 | 63 | 'defender_file_not_writable', |
| 63 | 64 | esc_html__( 'The file wp-config.php is not writable', 'defender-security' ) |
| @@ -83,9 +84,10 @@ | ||
| 83 | 84 | // If this is revert request and the changes is not made by us throw error. |
| 84 | 85 | if ( 'true' === $value && ! preg_match( |
| 85 | 86 | "/^define\(\s*['|\"]{$file_edit}['|\"],(.*)\);\s*\/\/\s*Added\s*by\s*Defender.?.*/i", |
| 86 | 87 | $line |
| 87 | - ) ) { | |
| 88 | + ) | |
| 89 | + ) { | |
| 88 | 90 | return new WP_Error( |
| 89 | 91 | 'defender_file_not_writable', |
| 90 | 92 | $sec_tweak_component->show_hosting_notice_with_code( $file_edit, $file_edit_line ) |
| 91 | 93 | ); |
| @@ -113,14 +115,14 @@ | ||
| 113 | 115 | ksort( $lines ); |
| 114 | 116 | } |
| 115 | 117 | |
| 116 | 118 | return $line_found |
| 117 | - ? $sec_tweak_component->write( $lines ) | |
| 118 | - : new WP_Error( | |
| 119 | - 'defender_line_not_found', | |
| 120 | - esc_html__( 'Error writing to file.', 'defender-security' ), | |
| 121 | - 404 | |
| 122 | - ); | |
| 119 | + ? $sec_tweak_component->write( $lines ) | |
| 120 | + : new WP_Error( | |
| 121 | + 'defender_line_not_found', | |
| 122 | + esc_html__( 'Error writing to file.', 'defender-security' ), | |
| 123 | + 404 | |
| 124 | + ); | |
| 123 | 125 | } |
| 124 | 126 | |
| 125 | 127 | /** |
| 126 | 128 | * Allow file editor. |
| @@ -172,9 +174,9 @@ | ||
| 172 | 174 | * |
| 173 | 175 | * @return string |
| 174 | 176 | */ |
| 175 | 177 | public function get_label(): string { |
| 176 | - return esc_html__( 'Disable the file editor', 'defender-security' ); | |
| 178 | + return esc_html__( 'Turn off file editor', 'defender-security' ); | |
| 177 | 179 | } |
| 178 | 180 | |
| 179 | 181 | /** |
| 180 | 182 | * Get the error reason. |
| @@ -181,9 +183,14 @@ | ||
| 181 | 183 | * |
| 182 | 184 | * @return string |
| 183 | 185 | */ |
| 184 | 186 | public function get_error_reason(): string { |
| 185 | - return esc_html__( 'The file editor is currently enabled.', 'defender-security' ); | |
| 187 | + return wp_kses( | |
| 188 | + __( '<strong>File editor is turned on</strong> and may allow malicious code changes.', 'defender-security' ), | |
| 189 | + array( | |
| 190 | + 'strong' => array(), | |
| 191 | + ) | |
| 192 | + ); | |
| 186 | 193 | } |
| 187 | 194 | |
| 188 | 195 | /** |
| 189 | 196 | * Return a summary data of this tweak. |
| @@ -194,14 +201,14 @@ | ||
| 194 | 201 | return array( |
| 195 | 202 | 'slug' => $this->slug, |
| 196 | 203 | 'title' => $this->get_label(), |
| 197 | 204 | 'errorReason' => $this->get_error_reason(), |
| 198 | - 'successReason' => esc_html__( 'You\'ve disabled the file editor, winning.', 'defender-security' ), | |
| 199 | - 'misc' => array(), | |
| 200 | - 'bulk_description' => esc_html__( | |
| 201 | - 'The file editor is currently active, this means anyone with access to your login information can further edit your plugin and theme files and inject malicious code. We will disable file editor for you.', | |
| 202 | - 'defender-security' | |
| 205 | + 'successReason' => wp_strip_all_tags( __( 'File editor is turned off.', 'defender-security' ) ), | |
| 206 | + 'misc' => array( | |
| 207 | + 'show_revert_button' => true, | |
| 208 | + 'show_action_button' => true, | |
| 203 | 209 | ), |
| 204 | - 'bulk_title' => esc_html__( 'File Editor', 'defender-security' ), | |
| 210 | + 'bulk_description' => wp_strip_all_tags( __( 'WordPress includes a built-in file editor for theme and plugin files. Turn off file editor to help prevent unauthorized code changes if an attacker gains access.', 'defender-security' ) ), | |
| 211 | + 'bulk_title' => wp_strip_all_tags( __( 'File Editor', 'defender-security' ) ), | |
| 205 | 212 | ); |
| 206 | 213 | } |
| 207 | 214 | } |