jetpack / jetpack_vendor / automattic / jetpack-waf / src / class-waf-initializer.php

class-waf-initializer.php in Jetpack – WP Security, Backup, Speed, & Growth 16.2, at jetpack_vendor/automattic/jetpack-waf/src/class-waf-initializer.php

246 lines 7.4 KB

Raw Download Zip

1	<?php
2	/**
3	* Class use to initialize the WAF module.
4	*
5	* @package automattic/jetpack-waf
6	*/
7
8	namespace Automattic\Jetpack\Waf;
9
10	use Automattic\Jetpack\Waf\Brute_Force_Protection\Brute_Force_Protection;
11	use WP_Error;
12	use WP_Upgrader;
13
14	/**
15	* Initializes the module
16	*/
17	class Waf_Initializer {
18
19	/**
20	* Option for storing whether the WAF files are potentially out of date.
21	*
22	* @var string NEEDS_UPDATE_OPTION_NAME
23	*/
24	const NEEDS_UPDATE_OPTION_NAME = 'jetpack_waf_needs_update';
25
26	/**
27	* Initializes the configurations needed for the waf module.
28	*
29	* @return void
30	*/
31	public static function init() {
32	// Do not run in unsupported environments
33	add_action( 'jetpack_get_available_modules', __CLASS__ . '::remove_module_on_unsupported_environments' );
34	add_action( 'jetpack_get_available_standalone_modules', __CLASS__ . '::remove_standalone_module_on_unsupported_environments' );
35
36	// Ensure backwards compatibility
37	Waf_Compatibility::add_compatibility_hooks();
38
39	// Register REST routes. Use a static callable so the controller class is not
40	// loaded into memory/opcache on requests that never reach `rest_api_init`.
41	add_action( 'rest_api_init', array( REST_Controller::class, 'register_rest_routes' ) );
42
43	// Update the WAF after installing or upgrading a relevant Jetpack plugin
44	add_action( 'upgrader_process_complete', __CLASS__ . '::update_waf_after_plugin_upgrade', 10, 2 );
45
46	// Check for compatibility updates
47	add_action( 'admin_init', __CLASS__ . '::check_for_updates' );
48
49	// WAF activation/deactivation hooks
50	add_action( 'jetpack_activate_module_waf', __CLASS__ . '::on_waf_activation' );
51	add_action( 'jetpack_deactivate_module_waf', __CLASS__ . '::on_waf_deactivation' );
52
53	// Brute force protection activation/deactivation hooks
54	add_action( 'jetpack_activate_module_protect', __CLASS__ . '::on_brute_force_protection_activation' );
55	add_action( 'jetpack_deactivate_module_protect', __CLASS__ . '::on_brute_force_protection_deactivation' );
56
57	// Run brute force protection
58	Brute_Force_Protection::initialize();
59
60	// Run the WAF
61	if ( Waf_Runner::is_supported_environment() ) {
62	Waf_Runner::initialize();
63	}
64	}
65
66	/**
67	* Activate the WAF on module activation.
68	*
69	* @return bool\|WP_Error True if the WAF activation is successful, WP_Error otherwise.
70	*/
71	public static function on_waf_activation() {
72	update_option( Waf_Runner::MODE_OPTION_NAME, 'normal' );
73	add_option( Waf_Rules_Manager::AUTOMATIC_RULES_ENABLED_OPTION_NAME, false );
74
75	try {
76	Waf_Runner::activate();
77	( new Waf_Standalone_Bootstrap() )->generate();
78	} catch ( Waf_Exception $e ) {
79	return $e->get_wp_error();
80	}
81
82	return true;
83	}
84
85	/**
86	* Activate the Brute force protection on module activation.
87	*
88	* @return bool True if the Brute force protection activation is successful
89	*/
90	public static function on_brute_force_protection_activation() {
91	$brute_force_protection = Brute_Force_Protection::instance();
92	$brute_force_protection->on_activation();
93
94	return true;
95	}
96
97	/**
98	* Deactivate the WAF on module deactivation.
99	*
100	* @return bool\|WP_Error True if the WAF deactivation is successful, WP_Error otherwise.
101	*/
102	public static function on_waf_deactivation() {
103	try {
104	Waf_Runner::deactivate();
105	} catch ( Waf_Exception $e ) {
106	return $e->get_wp_error();
107	}
108
109	return true;
110	}
111
112	/**
113	* Deactivate the Brute force protection on module deactivation.
114	*
115	* @return bool True if the Brute force protection deactivation is successful.
116	*/
117	public static function on_brute_force_protection_deactivation() {
118	$brute_force_protection = Brute_Force_Protection::instance();
119	$brute_force_protection->on_deactivation();
120
121	return true;
122	}
123
124	/**
125	* Updates the WAF after upgrader process is complete.
126	*
127	* @param WP_Upgrader $upgrader WP_Upgrader instance. In other contexts this might be a Theme_Upgrader, Plugin_Upgrader, Core_Upgrade, or Language_Pack_Upgrader instance.
128	* @param array $hook_extra Array of bulk item update data.
129	*
130	* @return void
131	*/
132	public static function update_waf_after_plugin_upgrade( $upgrader, $hook_extra ) {
133	$jetpack_text_domains_with_waf = array( 'jetpack', 'jetpack-protect' );
134	$jetpack_plugins_with_waf = array( 'jetpack/jetpack.php', 'jetpack-protect/jetpack-protect.php' );
135
136	$hook_extra['type'] ??= null;
137	$hook_extra['action'] ??= null;
138	$hook_extra['plugins'] ??= array();
139
140	// Only run on upgrades affecting plugins
141	if ( 'plugin' !== $hook_extra['type'] ) {
142	return;
143	}
144
145	// Only run on updates and installations
146	if ( 'update' !== $hook_extra['action'] && 'install' !== $hook_extra['action'] ) {
147	return;
148	}
149
150	// Only run when Jetpack plugins were affected
151	if ( 'update' === $hook_extra['action'] &&
152	! empty( $hook_extra['plugins'] ) &&
153	empty( array_intersect( $jetpack_plugins_with_waf, $hook_extra['plugins'] ) )
154	) {
155	return;
156	}
157	if ( 'install' === $hook_extra['action'] &&
158	! empty( $upgrader->new_plugin_data['TextDomain'] ) &&
159	empty( in_array( $upgrader->new_plugin_data['TextDomain'] ?? null, $jetpack_text_domains_with_waf, true ) )
160	) {
161	return;
162	}
163
164	update_option( self::NEEDS_UPDATE_OPTION_NAME, true );
165	}
166
167	/**
168	* Check for WAF update
169	*
170	* Updates the WAF when the "needs update" option is enabled.
171	*
172	* @return bool\|WP_Error True if the WAF is up-to-date or was sucessfully updated, WP_Error if the update failed.
173	*/
174	public static function check_for_updates() {
175	if ( get_option( self::NEEDS_UPDATE_OPTION_NAME ) ) {
176	if ( Waf_Runner::is_supported_environment() ) {
177	// Compatiblity patch for cases where an outdated WAF_Constants class has been
178	// autoloaded by the standalone bootstrap execution at the beginning of the current request.
179	if ( ! method_exists( Waf_Constants::class, 'define_mode' ) ) {
180	try {
181	( new Waf_Standalone_Bootstrap() )->generate();
182	} catch ( Waf_Exception $e ) {
183	return $e->get_wp_error();
184	}
185	}
186
187	Waf_Compatibility::run_compatibility_migrations();
188
189	try {
190	Waf_Rules_Manager::generate_ip_rules();
191	Waf_Rules_Manager::generate_rules();
192	( new Waf_Standalone_Bootstrap() )->generate();
193	} catch ( Waf_Exception $e ) {
194	return $e->get_wp_error();
195	}
196	} else {
197	// If the site doesn't support the request firewall,
198	// just migrate the IP allow list used by brute force protection.
199	Waf_Compatibility::migrate_brute_force_protection_ip_allow_list();
200	}
201
202	update_option( self::NEEDS_UPDATE_OPTION_NAME, false );
203	}
204
205	return true;
206	}
207
208	/**
209	* Disables the WAF module when on an unsupported platform in Jetpack.
210	*
211	* @param array $modules Filterable value for `jetpack_get_available_modules`.
212	*
213	* @return array Array of module slugs.
214	*/
215	public static function remove_module_on_unsupported_environments( $modules ) {
216	if ( ! Waf_Runner::is_supported_environment() ) {
217	// WAF should never be available on unsupported platforms.
218	unset( $modules['waf'] );
219	}
220
221	return $modules;
222	}
223
224	/**
225	* Disables the WAF module when on an unsupported platform in a standalone plugin.
226	*
227	* @param array $modules Filterable value for `jetpack_get_available_standalone_modules`.
228	*
229	* @return array Array of module slugs.
230	*/
231	public static function remove_standalone_module_on_unsupported_environments( $modules ) {
232	if ( ! Waf_Runner::is_supported_environment() ) {
233	// WAF should never be available on unsupported platforms.
234	$modules = array_filter(
235	$modules,
236	function ( $module ) {
237	return $module !== 'waf';
238	}
239	);
240
241	}
242
243	return $modules;
244	}
245	}
246