| 1 |
<?php |
| 2 |
/** |
| 3 |
* MainWP Security Issues page |
| 4 |
* |
| 5 |
* This page is used to manage child site security issues. |
| 6 |
* |
| 7 |
* @package MainWP/Securtiy_Issues |
| 8 |
*/ |
| 9 |
|
| 10 |
namespace MainWP\Dashboard; |
| 11 |
|
| 12 |
/** |
| 13 |
* Class MainWP_Security_Issues |
| 14 |
* |
| 15 |
* Detect, display & fix known Security Issues. |
| 16 |
*/ |
| 17 |
class MainWP_Security_Issues { // phpcs:ignore Generic.Classes.OpeningBraceSameLine.ContentAfterBrace -- NOSONAR. |
| 18 |
|
| 19 |
/** |
| 20 |
* Method get_class_name() |
| 21 |
* |
| 22 |
* @return string __CLASS__ Class Name |
| 23 |
*/ |
| 24 |
public static function get_class_name() { |
| 25 |
return __CLASS__; |
| 26 |
} |
| 27 |
|
| 28 |
/** |
| 29 |
* Method render() |
| 30 |
* |
| 31 |
* @param null $website Child Site ID. |
| 32 |
* |
| 33 |
* @uses \MainWP\Dashboard\MainWP_DB::get_website_by_id() |
| 34 |
* @uses \MainWP\Dashboard\MainWP_System_Utility::can_edit_website() |
| 35 |
*/ |
| 36 |
public static function render( $website = null ) { |
| 37 |
|
| 38 |
if ( empty( $website ) ) { |
| 39 |
$id = isset( $_REQUEST['id'] ) ? intval( $_REQUEST['id'] ) : false; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.NonceVerification.Recommended |
| 40 |
if ( ! $id ) { |
| 41 |
return; |
| 42 |
} |
| 43 |
$website = MainWP_DB::instance()->get_website_by_id( $id ); |
| 44 |
} |
| 45 |
|
| 46 |
if ( ! MainWP_System_Utility::can_edit_website( $website ) ) { |
| 47 |
return; |
| 48 |
} |
| 49 |
$unset_scripts = apply_filters( 'mainwp_unset_security_scripts_stylesheets', true ); |
| 50 |
?> |
| 51 |
<table class="ui table" id="mainwp-security-issues-table" un-set="<?php echo $unset_scripts ? 'versions,registered_versions' : ''; ?>"> |
| 52 |
<thead> |
| 53 |
<tr> |
| 54 |
<th scope="col" class="collapsing"><?php esc_html_e( 'Status', 'mainwp' ); ?></th> |
| 55 |
<th scope="col" ><?php esc_html_e( 'Detected Issues', 'mainwp' ); ?></th> |
| 56 |
<th scope="col" class="collapsing"></th> |
| 57 |
</tr> |
| 58 |
</thead> |
| 59 |
<tbody> |
| 60 |
<tr> |
| 61 |
<td> |
| 62 |
<span id="listing_loading"><i class="notched circle big loading icon"></i></span> |
| 63 |
<span id="listing_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 64 |
<span id="listing_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 65 |
</td> |
| 66 |
<td> |
| 67 |
<strong id="listing-status-nok"><?php esc_html_e( '/wp-content/, /wp-content/plugins/, /wp-content/themes/ and /wp-content/uploads/ directories listing has not been prevented', 'mainwp' ); ?></strong> |
| 68 |
<strong id="listing-status-ok" style="display: none;"><?php esc_html_e( '/wp-content/, /wp-content/plugins/, /wp-content/themes/ and /wp-content/uploads/ directories listing has been prevented', 'mainwp' ); ?></strong> |
| 69 |
<br /> |
| 70 |
<em><?php esc_html_e( 'After fixing this issue, an empty index.php will be inserted in these directories to prevent listing.', 'mainwp' ); ?></em> |
| 71 |
</td> |
| 72 |
<td> |
| 73 |
<span id="listing_fix" style="display: none"><a href="#" class="ui mini green fluid button"><?php esc_html_e( 'Fix', 'mainwp' ); ?></a></span> |
| 74 |
</td> |
| 75 |
</tr> |
| 76 |
<tr> |
| 77 |
<td> |
| 78 |
<span id="wp_version_loading"><i class="notched circle big loading icon"></i></span> |
| 79 |
<span id="wp_version_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 80 |
<span id="wp_version_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 81 |
</td> |
| 82 |
<td> |
| 83 |
<strong id="wp_version-status-nok"><?php esc_html_e( 'WordPress version has not been hidden', 'mainwp' ); ?></strong> |
| 84 |
<strong id="wp_version-status-ok" style="display: none;"><?php esc_html_e( 'WordPress version has been hidden', 'mainwp' ); ?></strong> |
| 85 |
<br /> |
| 86 |
<em><?php esc_html_e( 'After fixing this issue, WordPress generator meta tag will be removed from the head sections of the Child Site', 'mainwp' ); ?></em> |
| 87 |
</td> |
| 88 |
<td> |
| 89 |
<span id="wp_version_fix" style="display: none"><a href="#" class="ui mini green fluid button"><?php esc_html_e( 'Fix', 'mainwp' ); ?></a></span> |
| 90 |
<span id="wp_version_unfix" style="display: none"><a href="#" class="ui mini fluid button"><?php esc_html_e( 'Unfix', 'mainwp' ); ?></a></span> |
| 91 |
</td> |
| 92 |
</tr> |
| 93 |
<tr> |
| 94 |
<td> |
| 95 |
<span id="rsd_loading"><i class="notched circle big loading icon"></i></span> |
| 96 |
<span id="rsd_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 97 |
<span id="rsd_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 98 |
</td> |
| 99 |
<td> |
| 100 |
<strong id="rsd-status-nok"><?php esc_html_e( 'Really Simple Discovery meta tag has not been removed from front-end', 'mainwp' ); ?></strong> |
| 101 |
<strong id="rsd-status-ok" style="display: none;"><?php esc_html_e( 'Really Simple Discovery meta tag has been removed from front-end', 'mainwp' ); ?></strong> |
| 102 |
<br /> |
| 103 |
<em><?php esc_html_e( 'After fixing this issue, RSD meta tag will be removed from head sections of the Child Site', 'mainwp' ); ?></em> |
| 104 |
</td> |
| 105 |
<td> |
| 106 |
<span id="rsd_fix" style="display: none"><a href="#" class="ui mini green fluid button"><?php esc_html_e( 'Fix', 'mainwp' ); ?></a></span> |
| 107 |
<span id="rsd_unfix" style="display: none"><a href="#" class="ui mini fluid button"><?php esc_html_e( 'Unfix', 'mainwp' ); ?></a></span> |
| 108 |
</td> |
| 109 |
</tr> |
| 110 |
<tr> |
| 111 |
<td> |
| 112 |
<span id="wlw_loading"><i class="notched circle big loading icon"></i></span> |
| 113 |
<span id="wlw_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 114 |
<span id="wlw_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 115 |
</td> |
| 116 |
<td> |
| 117 |
<strong id="wlw-status-nok"><?php esc_html_e( 'Windows Live Writer meta tag has not been removed from front-end', 'mainwp' ); ?></strong> |
| 118 |
<strong id="wlw-status-ok" style="display: none;"><?php esc_html_e( 'Windows Live Writer meta tag has been removed from front-end', 'mainwp' ); ?></strong> |
| 119 |
<br /> |
| 120 |
<em><?php esc_html_e( 'After fixing this issue, WLW meta tag will be removed from head sections of the Child Site', 'mainwp' ); ?></em> |
| 121 |
</td> |
| 122 |
<td> |
| 123 |
<span id="wlw_fix" style="display: none"><a href="#" class="ui mini fluid green button"> <?php esc_html_e( 'Fix', 'mainwp' ); ?></a></span> |
| 124 |
<span id="wlw_unfix" style="display: none"><a href="#" class="ui mini fluid button"><?php esc_html_e( 'Unfix', 'mainwp' ); ?></a></span> |
| 125 |
</td> |
| 126 |
</tr> |
| 127 |
<tr> |
| 128 |
<td> |
| 129 |
<span id="db_reporting_loading"><i class="notched circle big loading icon"></i></span> |
| 130 |
<span id="db_reporting_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 131 |
<span id="db_reporting_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 132 |
</td> |
| 133 |
<td> |
| 134 |
<strong id="db_reporting-status-nok"><?php esc_html_e( 'Database error reporting has not been disabled', 'mainwp' ); ?></strong> |
| 135 |
<strong id="db_reporting-status-ok" style="display: none;"><?php esc_html_e( 'Database error reporting has been disabled', 'mainwp' ); ?></strong> |
| 136 |
<br /> |
| 137 |
<em><?php esc_html_e( 'After fixing this issue, database error reporting will be disabled', 'mainwp' ); ?></em> |
| 138 |
</td> |
| 139 |
<td> |
| 140 |
<span id="db_reporting_fix" style="display: none"><a href="#" class="ui mini fluid green button"><?php esc_html_e( 'Fix', 'mainwp' ); ?></a></span> |
| 141 |
<span id="db_reporting_unfix" style="display: none"><a href="#" class="ui mini fluid button"><?php esc_html_e( 'Unfix', 'mainwp' ); ?></a></span> |
| 142 |
</td> |
| 143 |
</tr> |
| 144 |
<tr> |
| 145 |
<td> |
| 146 |
<span id="php_reporting_loading"><i class="notched circle big loading icon"></i></span> |
| 147 |
<span id="php_reporting_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 148 |
<span id="php_reporting_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 149 |
</td> |
| 150 |
<td> |
| 151 |
<strong id="php_reporting-status-nok"><?php esc_html_e( 'PHP error reporting has not been disabled', 'mainwp' ); ?></strong> |
| 152 |
<strong id="php_reporting-status-ok" style="display: none;"><?php esc_html_e( 'PHP error reporting has been disabled', 'mainwp' ); ?></strong> |
| 153 |
<br /> |
| 154 |
<em><?php esc_html_e( 'After fixing this issue, PHP error reporting will be disabled', 'mainwp' ); ?></em> |
| 155 |
</td> |
| 156 |
<td> |
| 157 |
<span id="php_reporting_fix" style="display: none"><a href="#" class="ui mini fluid green button"> <?php esc_html_e( 'Fix', 'mainwp' ); ?></a></span> |
| 158 |
<span id="php_reporting_unfix" style="display: none"><a href="#" class="ui mini fluid button"><?php esc_html_e( 'Unfix', 'mainwp' ); ?></a></span> |
| 159 |
</td> |
| 160 |
</tr> |
| 161 |
<?php if ( ! $unset_scripts ) { ?> |
| 162 |
<tr> |
| 163 |
<td> |
| 164 |
<span id="versions_loading"><i class="notched circle big loading icon"></i></span> |
| 165 |
<span id="versions_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 166 |
<span id="versions_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 167 |
</td> |
| 168 |
<td> |
| 169 |
<strong id="versions-status-nok"><?php esc_html_e( 'Scripts and Stylesheets version information has not been removed from URLs', 'mainwp' ); ?></strong> |
| 170 |
<strong id="versions-status-ok" style="display: none;"><?php esc_html_e( 'Scripts and Stylesheets version information has been removed from URLs', 'mainwp' ); ?></strong> |
| 171 |
<br /> |
| 172 |
<em><?php esc_html_e( 'After fixing this issue, versions will be removed', 'mainwp' ); ?></em> |
| 173 |
</td> |
| 174 |
<td> |
| 175 |
<span id="versions_fix" style="display: none"><a href="#" class="ui mini green fluid button"><?php esc_html_e( 'Fix', 'mainwp' ); ?></a></span> |
| 176 |
<span id="versions_unfix" style="display: none"><a href="#" class="ui mini fluid button"><?php esc_html_e( 'Unfix', 'mainwp' ); ?></a></span> |
| 177 |
</td> |
| 178 |
</tr> |
| 179 |
<tr> |
| 180 |
<td> |
| 181 |
<span id="registered_versions_loading"><i class="notched circle big loading icon"></i></span> |
| 182 |
<span id="registered_versions_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 183 |
<span id="registered_versions_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 184 |
</td> |
| 185 |
<td> |
| 186 |
<strong id="registered_versions-status-nok"><?php esc_html_e( 'Scripts and Stylesheets registered version information has not been removed from URLs', 'mainwp' ); ?></strong> |
| 187 |
<strong id="registered_versions-status-ok" style="display: none;"><?php esc_html_e( 'Scripts and Stylesheets registered version information has been removed from URLs', 'mainwp' ); ?></strong> |
| 188 |
<br /> |
| 189 |
<em><?php esc_html_e( 'After fixing this issue, registered versions will be removed', 'mainwp' ); ?></em> |
| 190 |
</td> |
| 191 |
<td> |
| 192 |
<span id="registered_versions_fix" style="display: none"><a href="#" class="ui mini fluid green button"><?php esc_html_e( 'Fix', 'mainwp' ); ?></a></span> |
| 193 |
<span id="registered_versions_unfix" style="display: none"><a href="#" class="ui mini fluid button"><?php esc_html_e( 'Unfix', 'mainwp' ); ?></a></span> |
| 194 |
</td> |
| 195 |
</tr> |
| 196 |
<?php } ?> |
| 197 |
<?php |
| 198 |
$is_wpengine = false; |
| 199 |
if ( property_exists( $website, 'wpe' ) && 1 === (int) $website->wpe ) { |
| 200 |
$is_wpengine = true; |
| 201 |
} |
| 202 |
?> |
| 203 |
<tr> |
| 204 |
<td> |
| 205 |
<span id="readme_loading"><i class="notched circle big loading icon"></i></span> |
| 206 |
<span id="readme_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 207 |
<span id="readme_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 208 |
</td> |
| 209 |
<td> |
| 210 |
<strong id="readme-status-nok"><?php esc_html_e( 'readme.html file has not been removed from WordPress root', 'mainwp' ); ?></strong> |
| 211 |
<strong id="readme-status-ok" style="display: none;"><?php esc_html_e( 'readme.html file has been removed from WordPress root', 'mainwp' ); ?></strong> |
| 212 |
<br /> |
| 213 |
<em><?php esc_html_e( 'After fixing this issue, the readme.html file will be removed from the Child Site root directory', 'mainwp' ); ?></em> |
| 214 |
<?php if ( $is_wpengine ) { ?> |
| 215 |
<strong id="readme-wpe-nok"><?php esc_html_e( 'Removing the file on WPEngine hosting can cause issues. If you need to remove the file, please consult the WPEngine support first.', 'mainwp' ); ?></strong> |
| 216 |
<?php } ?> |
| 217 |
</td> |
| 218 |
<td> |
| 219 |
<?php if ( ! $is_wpengine ) { ?> |
| 220 |
<span id="readme_fix" style="display: none"><a href="#" class="ui mini green fluid button"><?php esc_html_e( 'Fix', 'mainwp' ); ?></a></span> |
| 221 |
<?php esc_html_e( 'You need to re-upload the readme.html file manually to unfix this.', 'mainwp' ); ?></span> |
| 222 |
<?php } else { ?> |
| 223 |
<span><a href="javascript:void(0)" class="ui mini fluid button"><?php esc_html_e( 'Fix', 'mainwp' ); ?></a> |
| 224 |
<?php } ?> |
| 225 |
</td> |
| 226 |
</tr> |
| 227 |
<tr> |
| 228 |
<td> |
| 229 |
<span id="admin_loading"><i class="notched circle big loading icon"></i></span> |
| 230 |
<span id="admin_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 231 |
<span id="admin_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 232 |
</td> |
| 233 |
<td> |
| 234 |
<strong id="admin-status-nok"><?php esc_html_e( 'Administrator username should not be "admin"', 'mainwp' ); ?></strong> |
| 235 |
<strong id="admin-status-ok" style="display: none;"><?php esc_html_e( 'Administrator username is not "admin"', 'mainwp' ); ?></strong> |
| 236 |
<br /> |
| 237 |
<em><?php esc_html_e( 'You have to change this yourself. If this user was used as your MainWP Secure Link Admin, you will need to change your Administrator Username in the MainWP Dashboard for the site.', 'mainwp' ); ?></em> |
| 238 |
</td> |
| 239 |
<td></td> |
| 240 |
</tr> |
| 241 |
|
| 242 |
<tr> |
| 243 |
<td> |
| 244 |
<span id="wp_uptodate_loading"><i class="notched circle big loading icon"></i></span> |
| 245 |
<span id="wp_uptodate_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 246 |
<span id="wp_uptodate_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 247 |
</td> |
| 248 |
<td> |
| 249 |
<strong id="wp_uptodate-status-nok"><?php esc_html_e( 'WordPress is not up to date.', 'mainwp' ); ?></strong> |
| 250 |
<strong id="wp_uptodate-status-ok" style="display: none;"><?php esc_html_e( 'WordPress is up to date.', 'mainwp' ); ?></strong> |
| 251 |
<br /> |
| 252 |
<em><?php esc_html_e( 'Checks if WP is up to date. You have to change this yourself.', 'mainwp' ); ?></em> |
| 253 |
</td> |
| 254 |
<td></td> |
| 255 |
</tr> |
| 256 |
<tr> |
| 257 |
<td> |
| 258 |
<span id="phpversion_matched_loading"><i class="notched circle big loading icon"></i></span> |
| 259 |
<span id="phpversion_matched_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 260 |
<span id="phpversion_matched_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 261 |
</td> |
| 262 |
<td> |
| 263 |
<strong id="phpversion_matched-status-nok"><?php esc_html_e( 'PHP version does not match the WordPress requirement', 'mainwp' ); ?></strong> |
| 264 |
<strong id="phpversion_matched-status-ok" style="display: none;"><?php esc_html_e( 'PHP version matches the WordPress requirement', 'mainwp' ); ?></strong> |
| 265 |
<br /> |
| 266 |
<em><?php esc_html_e( 'Checks if PHP version matches the WP requirement. You have to change this yourself.', 'mainwp' ); ?></em> |
| 267 |
</td> |
| 268 |
<td></td> |
| 269 |
</tr> |
| 270 |
|
| 271 |
<tr> |
| 272 |
<td> |
| 273 |
<span id="sslprotocol_loading"><i class="notched circle big loading icon"></i></span> |
| 274 |
<span id="sslprotocol_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 275 |
<span id="sslprotocol_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 276 |
</td> |
| 277 |
<td> |
| 278 |
<strong id="sslprotocol-status-nok"><?php esc_html_e( 'SSL protocol is not in place', 'mainwp' ); ?></strong> |
| 279 |
<strong id="sslprotocol-status-ok" style="display: none;"><?php esc_html_e( 'SSL protocol is in place', 'mainwp' ); ?></strong> |
| 280 |
<br /> |
| 281 |
<em><?php esc_html_e( 'Checks if SSL protocol is in place. You have to change this yourself.', 'mainwp' ); ?></em> |
| 282 |
</td> |
| 283 |
<td></td> |
| 284 |
</tr> |
| 285 |
|
| 286 |
<tr> |
| 287 |
<td> |
| 288 |
<span id="debug_disabled_loading"><i class="notched circle big loading icon"></i></span> |
| 289 |
<span id="debug_disabled_ok" style="display: none;"><i class="big check circle green icon"></i></span> |
| 290 |
<span id="debug_disabled_nok" style="display: none;"><i class="big times circle red icon"></i></span> |
| 291 |
</td> |
| 292 |
<td> |
| 293 |
<strong id="debug_disabled-status-nok"><?php esc_html_e( 'WP Config debugging is enabled', 'mainwp' ); ?></strong> |
| 294 |
<strong id="debug_disabled-status-ok" style="display: none;"><?php esc_html_e( 'WP Config debugging is disabled', 'mainwp' ); ?></strong> |
| 295 |
<br /> |
| 296 |
<em><?php esc_html_e( 'Checks if WP Config debugging is disabled. You have to change this yourself.', 'mainwp' ); ?></em> |
| 297 |
</td> |
| 298 |
<td></td> |
| 299 |
</tr> |
| 300 |
|
| 301 |
</tbody> |
| 302 |
<?php |
| 303 |
$is_demo = MainWP_Demo_Handle::is_demo_mode(); |
| 304 |
?> |
| 305 |
<tfoot class="full-width"> |
| 306 |
<tr> |
| 307 |
<th scope="col" colspan="3"> |
| 308 |
<?php if ( ! $is_demo ) : ?> |
| 309 |
<input type="button" id="securityIssues_fixAll" class="ui green button right floated" value="<?php esc_html_e( 'Fix All', 'mainwp' ); ?>"/> |
| 310 |
<input type="button" id="securityIssues_refresh" class="ui green basic button" value="<?php esc_html_e( 'Refresh', 'mainwp' ); ?>"/> |
| 311 |
<input type="hidden" id="securityIssueSite" value="<?php echo intval( $website->id ); ?>"/> |
| 312 |
<?php endif; ?> |
| 313 |
</th> |
| 314 |
</tr> |
| 315 |
</tfoot> |
| 316 |
</table> |
| 317 |
<?php |
| 318 |
} |
| 319 |
|
| 320 |
|
| 321 |
/** |
| 322 |
* Method Fetch Security Issues |
| 323 |
* |
| 324 |
* Fetch stored known Child Site Security Issues from DB that were found during Sync. |
| 325 |
* |
| 326 |
* @uses \MainWP\Dashboard\MainWP_Connect::fetch_url_authed() |
| 327 |
* @uses \MainWP\Dashboard\MainWP_DB::get_website_by_id() |
| 328 |
* @uses \MainWP\Dashboard\MainWP_System_Utility::can_edit_website() |
| 329 |
*/ |
| 330 |
public static function fetch_security_issues() { |
| 331 |
$id = isset( $_REQUEST['id'] ) ? intval( $_REQUEST['id'] ) : false; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.NonceVerification.Recommended |
| 332 |
if ( ! $id ) { |
| 333 |
return ''; |
| 334 |
} |
| 335 |
$website = MainWP_DB::instance()->get_website_by_id( $id ); |
| 336 |
|
| 337 |
if ( ! MainWP_System_Utility::can_edit_website( $website ) ) { |
| 338 |
return ''; |
| 339 |
} |
| 340 |
|
| 341 |
$information = MainWP_Connect::fetch_url_authed( $website, 'security' ); |
| 342 |
|
| 343 |
/** |
| 344 |
* Filters security issues |
| 345 |
* |
| 346 |
* Filters the default security checks and enables user to disable certain checks. |
| 347 |
* |
| 348 |
* @param bool false Whether security issues should be filtered. |
| 349 |
* @param object $information Object containing data from che chid site related to security issues. |
| 350 |
* Available options: 'listing', 'wp_version', 'rsd', 'wlw', 'db_reporting', 'php_reporting', 'versions', 'registered_versions', 'readme'. |
| 351 |
* @param object $website Object containing child site data. |
| 352 |
* |
| 353 |
* @since 4.1 |
| 354 |
*/ |
| 355 |
$filterStats = apply_filters( 'mainwp_security_issues_stats', false, $information, $website ); |
| 356 |
if ( false !== $filterStats && is_array( $filterStats ) ) { |
| 357 |
$information = array_merge( $information, $filterStats ); |
| 358 |
} |
| 359 |
return $information; |
| 360 |
} |
| 361 |
|
| 362 |
/** |
| 363 |
* Method Fix Security Issues |
| 364 |
* |
| 365 |
* Fix the selected security issue. |
| 366 |
* |
| 367 |
* @uses \MainWP\Dashboard\MainWP_Connect::fetch_url_authed() |
| 368 |
* @uses \MainWP\Dashboard\MainWP_DB::get_website_by_id() |
| 369 |
* @uses \MainWP\Dashboard\MainWP_Sync::sync_information_array() |
| 370 |
* @uses \MainWP\Dashboard\MainWP_System_Utility::can_edit_website() |
| 371 |
*/ |
| 372 |
public static function fix_security_issue() { // phpcs:ignore -- NOSONAR - complex. |
| 373 |
$id = isset( $_REQUEST['id'] ) ? intval( $_REQUEST['id'] ) : false; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.NonceVerification.Recommended |
| 374 |
if ( ! $id ) { |
| 375 |
return ''; |
| 376 |
} |
| 377 |
$website = MainWP_DB::instance()->get_website_by_id( $id ); |
| 378 |
|
| 379 |
if ( ! MainWP_System_Utility::can_edit_website( $website ) ) { |
| 380 |
return ''; |
| 381 |
} |
| 382 |
|
| 383 |
if ( '' !== $website->sync_errors || MainWP_System_Utility::is_suspended_site( $website ) ) { |
| 384 |
return ''; |
| 385 |
} |
| 386 |
|
| 387 |
$skip_features = array( |
| 388 |
'listing', |
| 389 |
'wp_version', |
| 390 |
'rsd', |
| 391 |
'wlw', |
| 392 |
'db_reporting', |
| 393 |
'php_reporting', |
| 394 |
'versions', |
| 395 |
'registered_versions', |
| 396 |
'readme', |
| 397 |
'wp_uptodate', |
| 398 |
'phpversion_matched', |
| 399 |
'sslprotocol', |
| 400 |
'debug_disabled', |
| 401 |
); |
| 402 |
|
| 403 |
/** |
| 404 |
* Filters security issues from fixing |
| 405 |
* |
| 406 |
* Filters the default security checks and enables user to disable certain issues from being fixed by using the Fix All button. |
| 407 |
* |
| 408 |
* @param bool false Whether security issues should be filtered. |
| 409 |
* @param object $skip_features Object containing data from che chid site related to security issues. |
| 410 |
* Available options: 'listing', 'wp_version', 'rsd', 'wlw', 'db_reporting', 'php_reporting', 'versions', 'registered_versions', 'readme'. |
| 411 |
* @param object $website Object containing child site data. |
| 412 |
* |
| 413 |
* @since 4.1 |
| 414 |
*/ |
| 415 |
$skip_features = apply_filters( 'mainwp_security_post_data', false, $skip_features, $website ); |
| 416 |
|
| 417 |
$feature = isset( $_REQUEST['feature'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['feature'] ) ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.NonceVerification.Recommended |
| 418 |
$post_data = array( 'feature' => $feature ); |
| 419 |
if ( ! empty( $skip_features ) && is_array( $skip_features ) ) { |
| 420 |
$post_data['skip_features'] = $skip_features; |
| 421 |
} |
| 422 |
|
| 423 |
$unset_scripts = apply_filters( 'mainwp_unset_security_scripts_stylesheets', true ); |
| 424 |
if ( $unset_scripts ) { |
| 425 |
if ( ! isset( $post_data['skip_features'] ) ) { |
| 426 |
$post_data['skip_features'] = array(); |
| 427 |
} |
| 428 |
|
| 429 |
if ( ! in_array( 'versions', $post_data['skip_features'] ) ) { |
| 430 |
$post_data['skip_features'][] = 'versions'; |
| 431 |
} |
| 432 |
|
| 433 |
if ( ! in_array( 'registered_versions', $post_data['skip_features'] ) ) { |
| 434 |
$post_data['skip_features'][] = 'registered_versions'; |
| 435 |
} |
| 436 |
} |
| 437 |
|
| 438 |
$information = MainWP_Connect::fetch_url_authed( $website, 'securityFix', $post_data ); |
| 439 |
if ( isset( $information['sync'] ) && ! empty( $information['sync'] ) ) { |
| 440 |
MainWP_Sync::sync_information_array( $website, $information['sync'] ); |
| 441 |
unset( $information['sync'] ); |
| 442 |
} |
| 443 |
|
| 444 |
return $information; |
| 445 |
} |
| 446 |
|
| 447 |
/** |
| 448 |
* Method un-Fix Security Issues |
| 449 |
* |
| 450 |
* Un-Fix the selected security issue. |
| 451 |
* |
| 452 |
* @uses \MainWP\Dashboard\MainWP_Connect::fetch_url_authed() |
| 453 |
* @uses \MainWP\Dashboard\MainWP_DB::get_website_by_id() |
| 454 |
* @uses \MainWP\Dashboard\MainWP_Sync::sync_information_array() |
| 455 |
* @uses \MainWP\Dashboard\MainWP_System_Utility::can_edit_website() |
| 456 |
*/ |
| 457 |
public static function unfix_security_issue() { |
| 458 |
$id = isset( $_REQUEST['id'] ) ? intval( $_REQUEST['id'] ) : false; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.NonceVerification.Recommended |
| 459 |
if ( ! $id ) { |
| 460 |
return ''; |
| 461 |
} |
| 462 |
$website = MainWP_DB::instance()->get_website_by_id( $id ); |
| 463 |
|
| 464 |
if ( ! MainWP_System_Utility::can_edit_website( $website ) ) { |
| 465 |
return ''; |
| 466 |
} |
| 467 |
|
| 468 |
if ( '' !== $website->sync_errors || MainWP_System_Utility::is_suspended_site( $website ) ) { |
| 469 |
return ''; |
| 470 |
} |
| 471 |
|
| 472 |
$feature = isset( $_REQUEST['feature'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['feature'] ) ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.NonceVerification.Recommended |
| 473 |
|
| 474 |
$information = MainWP_Connect::fetch_url_authed( $website, 'securityUnFix', array( 'feature' => $feature ) ); |
| 475 |
if ( isset( $information['sync'] ) && ! empty( $information['sync'] ) ) { |
| 476 |
MainWP_Sync::sync_information_array( $website, $information['sync'] ); |
| 477 |
unset( $information['sync'] ); |
| 478 |
} |
| 479 |
|
| 480 |
return $information; |
| 481 |
} |
| 482 |
} |
| 483 |
|
