← All changes | src/component/security-tweaks/class-security-key.php +64 -15 6.1.0 → 6.3.0 View file →

		@@ -116,9 +116,9 @@
116	116	private function get_options(): void {
117	117	$options = get_site_option( 'defender_security_tweaks_' . $this->slug );
118	118	$this->reminder_date = $options['reminder_date'] ?? 0;
119	119	$this->reminder_duration = isset( $options['reminder_duration'] ) && '' !== $options['reminder_duration'] ? $options['reminder_duration'] : $this->default_days;
120		- $this->is_reverted = ! empty( $options['is_reverted'] );
	120	+ $this->is_reverted = isset( $options['is_reverted'] ) && true === (bool) $options['is_reverted'];
121	121
122	122	$last_modified = $this->get_wp_config_last_modified_time();
123	123	if ( false === $last_modified ) {
124	124	$last_modified = $options['last_modified'] ?? null;
		@@ -195,24 +195,20 @@
195	195	return true;
196	196	}
197	197
198	198	/**
199		- * Get salts to be placed in wp-config.php.
	199	+ * Parse and validate salt definitions string.
200	200	*
201		- * @return array|WP_Error
	201	+ * @param string $body API response body.
	202	+ * @param array $constants Expected constant keys.
	203	+ *
	204	+ * @return array|false
202	205	*/
203		- private function get_salts(): WP_Error|array {
204		- $response = wp_safe_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' );
205		-
206		- if ( is_wp_error( $response ) ) {
207		- return new WP_Error(
208		- 'defender_salts_not_found',
209		- esc_html__( 'Unable to generate salts. Please try again.', 'defender-security' )
210		- );
211		- }
212		-
213		- $raw_salts = explode( "\n", wp_remote_retrieve_body( $response ) );
	206	+ private function parse_and_validate_salts( string $body, array $constants ): array|false {
	207	+ $raw_salts = explode( "\n", $body );
214	208	$salts = array();
	209	+ $values = array();
	210	+ $index = 0;
215	211
216	212	foreach ( $raw_salts as $salt ) {
217	213	$salt = trim( $salt );
218	214	if ( '' === $salt ) {
		@@ -217,12 +213,65 @@
217	213	$salt = trim( $salt );
218	214	if ( '' === $salt ) {
219	215	continue;
220	216	}
221		- $salts[] = stripslashes( $salt );
	217	+
	218	+ $salt = stripslashes( $salt );
	219	+ $expected_const = $constants[ $index ] ?? null;
	220	+
	221	+ if (
	222	+ null === $expected_const ||
	223	+ 0 !== strpos( $salt, 'define(' ) ||
	224	+ 1 !== preg_match( '/^define\(\s*[\'"]' . preg_quote( $expected_const, '/' ) . '[\'"]\s*,\s*[\'"](.*?)[\'"]\s*\)\s*;$/s', $salt, $matches )
	225	+ ) {
	226	+ return false;
	227	+ }
	228	+
	229	+ $val = $matches[1];
	230	+ if ( 'put your unique phrase here' === $val || strlen( $val ) < 64 || isset( $values[ $val ] ) ) {
	231	+ return false;
	232	+ }
	233	+
	234	+ $values[ $val ] = true;
	235	+ $salts[] = $salt;
	236	+ ++$index;
222	237	}
223	238
	239	+ if ( count( $salts ) !== count( $constants ) ) {
	240	+ return false;
	241	+ }
	242	+
224	243	return $salts;
	244	+ }
	245	+
	246	+ /**
	247	+ * Get salts to be placed in wp-config.php.
	248	+ *
	249	+ * @return array|WP_Error
	250	+ */
	251	+ private function get_salts(): WP_Error|array {
	252	+ $constants = $this->get_constants();
	253	+ $max_attempts = 3;
	254	+ $attempt = 0;
	255	+
	256	+ while ( $attempt < $max_attempts ) {
	257	+ ++$attempt;
	258	+ $response = wp_safe_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' );
	259	+
	260	+ if ( is_wp_error( $response ) || 200 !== (int) wp_remote_retrieve_response_code( $response ) ) {
	261	+ continue;
	262	+ }
	263	+
	264	+ $salts = $this->parse_and_validate_salts( wp_remote_retrieve_body( $response ), $constants );
	265	+ if ( false !== $salts ) {
	266	+ return $salts;
	267	+ }
	268	+ }
	269	+
	270	+ return new WP_Error(
	271	+ 'defender_salts_not_found',
	272	+ esc_html__( 'Unable to generate salts. Please try again.', 'defender-security' )
	273	+ );
225	274	}
226	275
227	276	/**
228	277	* Get how long the wp-config file is last updated.