← All changes | src/controller/class-malicious-bot.php +57 -8 6.0.1 → 6.3.0 View file →

		@@ -26,9 +26,9 @@
26	26	* Service for handling logic.
27	27	*
28	28	* @var Malicious_Bot_Component
29	29	*/
30		- protected $service;
	30	+ public $service;
31	31
32	32	/**
33	33	* Constructor for the Malicious_Bot class.
34	34	* Initializes the service and sets up necessary hooks.
		@@ -41,9 +41,8 @@
41	41	if ( $this->service->is_enabled() ) {
42	42	add_action( 'init', array( $this, 'init' ) );
43	43	add_action( 'wpdef_rotate_malicious_bot_secret_hash', array( $this->service, 'rotate_hash' ) );
44	44	add_filter( 'query_vars', array( $this, 'add_query_var' ) );
45		- add_action( 'after_switch_theme', array( $this, 'flush_rewrite' ) );
46	45
47	46	$service = wd_di()->get( Blacklist_Lockout::class );
48	47	$ip = $this->get_user_ip();
49	48	if ( ! $service->are_ips_whitelisted( $ip ) ) {
		@@ -109,8 +108,12 @@
109	108	$used_hash = get_query_var( Malicious_Bot_Component::URL_QUERY );
110	109	$valid_hash = $this->service->get_hash();
111	110
112	111	if ( $used_hash === $valid_hash ) {
	112	+ if ( $this->is_cross_site_request() ) {
	113	+ return;
	114	+ }
	115	+
113	116	$known_bots = Known_Bots_Factory::create();
114	117	$bot_ips = $known_bots->get_all_bot_ips();
115	118
116	119	// Flatten 2D array into a single array.
		@@ -166,8 +169,55 @@
166	169	}
167	170	}
168	171
169	172	/**
	173	+ * Checks if the current request is a cross-site or embedded request.
	174	+ *
	175	+ * @return bool True if cross-site or embedded, false otherwise.
	176	+ */
	177	+ public function is_cross_site_request(): bool {
	178	+ $sec_fetch_site = defender_get_data_from_request( 'HTTP_SEC_FETCH_SITE', 's' );
	179	+ if ( is_string( $sec_fetch_site ) && 'cross-site' === strtolower( $sec_fetch_site ) ) {
	180	+ return true;
	181	+ }
	182	+
	183	+ $sec_fetch_dest = defender_get_data_from_request( 'HTTP_SEC_FETCH_DEST', 's' );
	184	+ if ( is_string( $sec_fetch_dest ) && in_array( strtolower( $sec_fetch_dest ), array( 'image', 'iframe', 'frame', 'embed', 'object', 'audio', 'video', 'track', 'style', 'script', 'font' ), true ) ) {
	185	+ return true;
	186	+ }
	187	+
	188	+ $sec_fetch_mode = defender_get_data_from_request( 'HTTP_SEC_FETCH_MODE', 's' );
	189	+ if ( is_string( $sec_fetch_mode ) && 'no-cors' === strtolower( $sec_fetch_mode ) ) {
	190	+ return true;
	191	+ }
	192	+
	193	+ $site_host = wp_parse_url( home_url(), PHP_URL_HOST );
	194	+ $site_host = is_string( $site_host ) ? strtolower( $site_host ) : '';
	195	+
	196	+ $http_host = defender_get_data_from_request( 'HTTP_HOST', 's' );
	197	+ if ( is_string( $http_host ) && '' !== $http_host ) {
	198	+ $http_host = strtolower( explode( ':', $http_host )[0] );
	199	+ } else {
	200	+ $http_host = '';
	201	+ }
	202	+
	203	+ foreach ( array( 'HTTP_REFERER', 'HTTP_ORIGIN' ) as $header ) {
	204	+ $header_val = defender_get_data_from_request( $header, 's' );
	205	+ if ( is_string( $header_val ) && '' !== $header_val ) {
	206	+ $header_host = wp_parse_url( $header_val, PHP_URL_HOST );
	207	+ if ( is_string( $header_host ) && '' !== $header_host ) {
	208	+ $header_host_lower = strtolower( $header_host );
	209	+ if ( $header_host_lower !== $site_host && ( '' === $http_host || $header_host_lower !== $http_host ) ) {
	210	+ return true;
	211	+ }
	212	+ }
	213	+ }
	214	+ }
	215	+
	216	+ return false;
	217	+ }
	218	+
	219	+ /**
170	220	* Injects the malicious bot URL into the footer of frontend pages.
171	221	* This URL is hidden.
172	222	*/
173	223	public function inject_footer() {
		@@ -189,19 +239,18 @@
189	239	if ( ! is_string( $hash ) || '' === trim( $hash ) ) {
190	240	return false;
191	241	}
192	242
193		- $uri = defender_get_data_from_request( 'REQUEST_URI', 's' );
194		- if ( ! is_string( $uri ) || '' === $uri ) {
	243	+ $uri = defender_get_data_from_request( 'REQUEST_URI', 's' );
	244	+ $path = is_string( $uri ) ? wp_parse_url( $uri, PHP_URL_PATH ) : null;
	245	+ if ( ! is_string( $path ) || '' === $path ) {
195	246	return false;
196	247	}
197	248
198		- // Get request path.
199		- $uri = wp_parse_url( $uri, PHP_URL_PATH );
200		- $uri = trim( $uri, '/' );
	249	+ $path = trim( $path, '/' );
201	250
202	251	// Always check last segment only.
203		- $segments = explode( '/', $uri );
	252	+ $segments = explode( '/', $path );
204	253	$last = end( $segments );
205	254
206	255	return $last === $hash;
207	256	}