| 1 |
<?php |
| 2 |
// Exit if accessed directly. |
| 3 |
if ( ! defined( 'ABSPATH' ) ) { |
| 4 |
exit; |
| 5 |
} |
| 6 |
|
| 7 |
/** |
| 8 |
* Disable XML-RPC and block direct access to xmlrpc.php. |
| 9 |
* |
| 10 |
* If the "Disable XML-RPC" option is enabled, this function disables the XML-RPC functionality, |
| 11 |
* blocks direct access to xmlrpc.php by sending a 403 Forbidden header, and modifies the .htaccess file |
| 12 |
* to deny access to xmlrpc.php. If the option is disabled, any previously added block is removed. |
| 13 |
* |
| 14 |
* @return void |
| 15 |
*/ |
| 16 |
function ns_shield_disable_xml_rpc() { |
| 17 |
global $wp_filesystem; |
| 18 |
|
| 19 |
// Initialize the filesystem if not yet set up. |
| 20 |
if ( empty( $wp_filesystem ) ) { |
| 21 |
require_once ABSPATH . 'wp-admin/includes/file.php'; |
| 22 |
WP_Filesystem(); |
| 23 |
} |
| 24 |
|
| 25 |
// Check if the "Disable XML-RPC" switch is enabled. |
| 26 |
$is_xmlrpc_disabled = get_option( 'ns_shield_xml_rpc', false ); |
| 27 |
|
| 28 |
if ( $is_xmlrpc_disabled ) { |
| 29 |
// Disable XML-RPC functionality. |
| 30 |
add_filter( 'xmlrpc_enabled', '__return_false' ); |
| 31 |
|
| 32 |
// Block direct access to xmlrpc.php. |
| 33 |
add_action( 'init', function() { |
| 34 |
if ( isset( $_SERVER['REQUEST_URI'] ) && strpos( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ), 'xmlrpc.php' ) !== false ) { |
| 35 |
header( 'HTTP/1.1 403 Forbidden' ); |
| 36 |
$user_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : ''; |
| 37 |
if ( stripos( $user_agent, 'curl' ) !== false ) { |
| 38 |
exit( 'Protected by Netsensai Shield' ); |
| 39 |
} else { |
| 40 |
exit( 'XML-RPC is disabled on this site.' ); |
| 41 |
} |
| 42 |
} |
| 43 |
} ); |
| 44 |
|
| 45 |
// Edit .htaccess to block xmlrpc.php. |
| 46 |
$htaccess_file = ABSPATH . '.htaccess'; |
| 47 |
$htaccess_code = "<Files xmlrpc.php>\n order deny,allow\n deny from all\n</Files>\n"; |
| 48 |
|
| 49 |
if ( $wp_filesystem->exists( $htaccess_file ) && $wp_filesystem->is_writable( $htaccess_file ) ) { |
| 50 |
$htaccess_content = $wp_filesystem->get_contents( $htaccess_file ); |
| 51 |
if ( strpos( $htaccess_content, 'xmlrpc.php' ) === false ) { |
| 52 |
$wp_filesystem->put_contents( $htaccess_file, $htaccess_code . $htaccess_content, FS_CHMOD_FILE ); |
| 53 |
} |
| 54 |
} |
| 55 |
} else { |
| 56 |
// If the switch is disabled, remove any xmlrpc.php block from .htaccess. |
| 57 |
$htaccess_file = ABSPATH . '.htaccess'; |
| 58 |
$htaccess_code = "<Files xmlrpc.php>\n order deny,allow\n deny from all\n</Files>\n"; |
| 59 |
|
| 60 |
if ( $wp_filesystem->exists( $htaccess_file ) && $wp_filesystem->is_writable( $htaccess_file ) ) { |
| 61 |
$htaccess_content = $wp_filesystem->get_contents( $htaccess_file ); |
| 62 |
$updated_content = str_replace( $htaccess_code, '', $htaccess_content ); |
| 63 |
$wp_filesystem->put_contents( $htaccess_file, $updated_content, FS_CHMOD_FILE ); |
| 64 |
} |
| 65 |
} |
| 66 |
} |
| 67 |
add_action( 'init', 'ns_shield_disable_xml_rpc' ); |
| 68 |
|
