PluginProbe
NETSENSAI Shield / 1.4
NETSENSAI Shield v1.4
1.6.1 trunk 1.1 1.2 1.3 1.4 1.4.1 1.4.2 1.4.3 1.4.5 1.4.6 1.4.7 1.4.8 1.4.9 1.6.0
netsensai-shield / netsensai-shield.php

netsensai-shield.php in NETSENSAI Shield 1.4, at netsensai-shield.php

403 lines 18.5 KB
No matching file
Up and down to move Enter to open Esc to close
Raw Download Zip
1 <?php
2 /**
3 * NETSENSAI Shield
4 *
5 * Plugin Name: NETSENSAI Shield
6 * Plugin URI: https://www.netsensai.pl/store/
7 * Description: NETSENSAI Shield is a security plugin designed to enhance WordPress site protection by offering essential security features based on best practice principles.
8 * Version: 1.4
9 * Author: Rafał Gierlicki
10 * Author URI: https://www.netsensai.pl
11 * Text Domain: netsensai-shield
12 * Contributors: netsensai
13 * License: GPLv2 or later
14 * License URI: http://www.gnu.org/licenses/gpl-2.0.html
15 */
16
17 // Exit if accessed directly.
18 if ( ! defined( 'ABSPATH' ) ) {
19 exit;
20 }
21
22 /**
23 * Filter admin title so it's never null.
24 *
25 * @param string $title Admin page title.
26 * @return string Modified title.
27 */
28 function ns_shield_fix_admin_title( $title ) {
29 return (string) $title;
30 }
31 add_filter( 'admin_title', 'ns_shield_fix_admin_title', 0, 1 );
32
33 /**
34 * Define tooltip function for login URL explanation.
35 */
36 if ( ! function_exists( 'ns_shield_get_login_url_tooltip' ) ) {
37 function ns_shield_get_login_url_tooltip() {
38 return __(
39 'Changing the login URL helps protect your site from brute-force attacks aimed at the default wp-login.php endpoint. If the default URL remains unchanged, attackers could easily target it to attempt password cracking or credential stuffing attacks.',
40 'netsensai-shield'
41 );
42 }
43 }
44
45 /**
46 * Include plugin function files.
47 */
48 require_once plugin_dir_path( __FILE__ ) . 'includes/login_url_functions.php';
49 require_once plugin_dir_path( __FILE__ ) . 'includes/disable_wp_api_json.php';
50 require_once plugin_dir_path( __FILE__ ) . 'includes/disable_xml_rpc.php';
51 require_once plugin_dir_path( __FILE__ ) . 'includes/disable_app_passwords.php';
52 require_once plugin_dir_path( __FILE__ ) . 'includes/disable_file_editor.php';
53 require_once plugin_dir_path( __FILE__ ) . 'includes/apply_security_headers.php';
54 require_once plugin_dir_path( __FILE__ ) . 'includes/disable_directory_indexing.php';
55 require_once plugin_dir_path( __FILE__ ) . 'includes/disable_default_admin.php';
56 require_once plugin_dir_path( __FILE__ ) . 'includes/apply_hsts_header.php';
57 //require_once plugin_dir_path( __FILE__ ) . 'includes/integrations/class-ns-shield-cache-integrator.php';
58 // Wczytaj integracje
59 $integration_dir = plugin_dir_path( __FILE__ ) . 'includes/integrations/';
60 if ( is_dir( $integration_dir ) ) {
61 foreach ( glob( $integration_dir . '*.php' ) as $integration_file ) {
62 require_once $integration_file;
63 }
64 }
65 /**
66 * Enqueue styles and scripts for the admin area.
67 */
68 function ns_shield_enqueue_styles_scripts() {
69 wp_enqueue_style(
70 'ns_shield-style',
71 plugin_dir_url( __FILE__ ) . 'assets/style.css',
72 array(),
73 filemtime( plugin_dir_path( __FILE__ ) . 'assets/style.css' )
74 );
75 wp_enqueue_script(
76 'ns_shield-script',
77 plugin_dir_url( __FILE__ ) . 'assets/script.js',
78 array(),
79 '1.0',
80 true
81 );
82 }
83 add_action( 'admin_enqueue_scripts', 'ns_shield_enqueue_styles_scripts' );
84
85 // Inicjalizacja integratora cache
86 function ns_shield_init_cache_integrator() {
87 new NS_Shield_Cache_Integrator();
88 }
89 add_action( 'plugins_loaded', 'ns_shield_init_cache_integrator' );
90
91 /**
92 * Add settings link on the plugins page.
93 *
94 * @param array $links Array of action links.
95 * @return array Modified links.
96 */
97 function ns_shield_settings_link( $links ) {
98 $settings_link = '<a href="options-general.php?page=secure-options">' . esc_html__( 'Settings', 'netsensai-shield' ) . '</a>';
99 array_unshift( $links, $settings_link );
100 return $links;
101 }
102 add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), 'ns_shield_settings_link' );
103
104 /* =====================
105 SETTINGS PAGE
106 ===================== */
107
108 /**
109 * Display the settings page.
110 */
111 function ns_shield_secure_options_page() {
112 if ( ! current_user_can( 'manage_options' ) ) {
113 wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'netsensai-shield' ) );
114 }
115
116 // Ścieżka do logo
117 $logo_url = plugin_dir_url( __FILE__ ) . 'assets/ns_logo.png';
118
119 // Tworzymy treść dla popupu z możliwości�
120 tłumaczenia.
121 // Używamy __() dla tekstu zawieraj�
122 cego znaczniki <a> aby linki były działaj�
123 ce.
124 $enable_html = sprintf(
125 '<div class="ns-popup-logo-container">
126 <img src="%1$s" alt="%2$s" class="ns-popup-logo" />
127 </div>
128 <div class="ns-popup-text">
129 <p>%3$s</p>
130 <p>%4$s</p>
131 <p>%5$s</p>
132 <p><strong>%6$s</strong> <a href="https://netsensai.pl/store" target="_blank">netsensai.pl/store</a></p>
133 </div>
134 <div class="ns-popup-button-container">
135 <button id="ns-shield-modal-ok" class="ns-modal-ok-button">%7$s</button>
136 </div>',
137 esc_url( $logo_url ),
138 esc_attr__( 'Netsensai Shield Logo', 'netsensai-shield' ),
139 // Używamy __() zamiast esc_html__() dla akapitu ze znacznikami <a>
140 __( 'Your website now achieves top scores in the most popular security scanners. (Check <a href="https://securityheaders.com" target="_blank">securityheaders.com</a> or <a href="https://observatory.mozilla.org" target="_blank">Mozilla Observatory</a>) Great job!', 'netsensai-shield' ),
141 esc_html__( 'But in the PRO Club, we do even more: we detect, block, and support.', 'netsensai-shield' ),
142 esc_html__( 'If an attack occurs, you get 3 months of assistance on us!', 'netsensai-shield' ),
143 esc_html__( 'Check out:', 'netsensai-shield' ),
144 esc_html__( 'OK', 'netsensai-shield' )
145 );
146
147 $disable_html = sprintf(
148 '<h2 style="text-align:center; font-size:1.3em; margin-bottom:10px; color:#000;">%1$s</h2>
149 <p style="font-size:1.1em; line-height:1.4; color:#000;">%2$s</p>',
150 esc_html__( 'Oops...', 'netsensai-shield' ),
151 esc_html__( 'The option has been disabled.', 'netsensai-shield' )
152 );
153 ?>
154 <div id="netsensai-shield-plugin" class="wrap">
155
156 <!-- PRO version banner -->
157 <div style="border: 1px solid #555; padding: 5px; margin: 5px 0; background-color: transparent; text-align: center; color: #fff;">
158 <p style="font-size: 1.2em; font-weight: bold; margin-bottom: 5px;">
159 <?php esc_html_e( 'Upgrade to NETSENSAI-SHIELD PRO for enhanced protection and advanced features.', 'netsensai-shield' ); ?>
160 </p>
161 <p>
162 <?php esc_html_e( 'Get yours now at:', 'netsensai-shield' ); ?>
163 <a href="https://netsensai.pl/store" target="_blank" rel="noopener noreferrer" style="color: #fff; text-decoration: underline;">
164 https://netsensai.pl/store
165 </a>
166 </p>
167 </div>
168
169 <h2><?php echo esc_html__( 'Security Options', 'netsensai-shield' ); ?></h2>
170
171 <!-- Logos display -->
172 <div style="display: flex; align-items: center; gap: 20px; margin-bottom: 10px;">
173 <a href="https://www.netsensai.pl/store/" target="_blank" style="display: flex; align-items: center; gap: 20px;">
174 <img src="<?php echo esc_url( plugin_dir_url( __FILE__ ) . 'assets/ns_logo.png' ); ?>"
175 alt="<?php echo esc_attr__( 'Netsensai-Shield Logo', 'netsensai-shield' ); ?>"
176 style="width: 200px; height: auto; margin-bottom: -20px;">
177 <img src="<?php echo esc_url( plugin_dir_url( __FILE__ ) . 'assets/netsensai.pl_logo.png' ); ?>"
178 alt="<?php echo esc_attr__( 'Netsensai-Logo', 'netsensai-shield' ); ?>"
179 style="width: 220px; height: auto; margin-bottom: -20px;">
180 </a>
181 </div>
182
183 <!-- Konfiguracja modala -->
184 <script type="text/javascript">
185 window.nsShieldModalConfig = {
186 modalShownFor: '',
187 enableContentHTML: <?php echo wp_json_encode( $enable_html ); ?>,
188 disableContentHTML: <?php echo wp_json_encode( $disable_html ); ?>
189 };
190 </script>
191
192 <form method="post" action="options.php">
193 <?php
194 settings_fields( 'ns_shield_options_group' );
195 do_settings_sections( 'secure-options' );
196 submit_button();
197 ?>
198 </form>
199
200 <!-- Include modal popup file from includes/ -->
201 <?php
202 $modal_file = plugin_dir_path( __FILE__ ) . 'includes/modal_popup.php';
203 if ( file_exists( $modal_file ) ) {
204 include $modal_file;
205 }
206 // Jeśli plik nie zostanie znaleziony, nie rób nic – error_log() zostało usunięte.
207 ?>
208 </div> <!-- End of wrap -->
209 <?php
210 }
211
212 /**
213 * Add settings menu in the admin.
214 */
215 function ns_shield_secure_options_menu() {
216 add_options_page(
217 esc_html__( 'Security Options', 'netsensai-shield' ),
218 esc_html__( 'Security Options', 'netsensai-shield' ),
219 'manage_options',
220 'secure-options',
221 'ns_shield_secure_options_page'
222 );
223 }
224 add_action( 'admin_menu', 'ns_shield_secure_options_menu' );
225
226 /**
227 * Register settings and fields.
228 */
229 function ns_shield_secure_options_settings() {
230 register_setting( 'ns_shield_options_group', 'ns_shield_login_url', 'sanitize_text_field' );
231 register_setting( 'ns_shield_options_group', 'ns_shield_login_url_enabled', 'sanitize_text_field' );
232 register_setting( 'ns_shield_options_group', 'ns_shield_wp_api_json', 'sanitize_text_field' );
233 register_setting( 'ns_shield_options_group', 'ns_shield_xml_rpc', 'sanitize_text_field' );
234 register_setting( 'ns_shield_options_group', 'ns_shield_file_editor', 'sanitize_text_field' );
235 register_setting( 'ns_shield_options_group', 'ns_shield_app_passwords', 'absint' );
236 register_setting( 'ns_shield_options_group', 'ns_shield_security_headers', 'sanitize_text_field' );
237 register_setting( 'ns_shield_options_group', 'ns_shield_directory_indexing', 'sanitize_text_field' );
238 register_setting( 'ns_shield_options_group', 'ns_shield_default_admin', 'absint' );
239 register_setting( 'ns_shield_options_group', 'ns_shield_new_admin_login', 'sanitize_text_field' );
240 register_setting( 'ns_shield_options_group', 'ns_shield_hsts', 'sanitize_text_field' );
241 register_setting( 'ns_shield_options_group', 'ns_shield_debug', 'sanitize_text_field' );
242 // Register new settings for CSP headers.
243 register_setting( 'ns_shield_options_group', 'ns_shield_csp_header_light', 'intval' );
244 register_setting( 'ns_shield_options_group', 'ns_shield_csp_header_hard', 'ns_shield_sanitize_csp_hard' );
245
246 // Level 1: Basic Security (login URL options etc.)
247 add_settings_section( 'ns_shield_level_1', esc_html__( 'Level 1: Basic Security', 'netsensai-shield' ), null, 'secure-options' );
248 add_settings_field( 'ns_shield_login_url', esc_html__( 'Change Login URL', 'netsensai-shield' ), 'ns_shield_change_login_url', 'secure-options', 'ns_shield_level_1' );
249 add_settings_field( 'ns_shield_default_admin', esc_html__( 'Disable Default Admin', 'netsensai-shield' ), 'ns_shield_disable_default_admin', 'secure-options', 'ns_shield_level_1' );
250 add_settings_field( 'ns_shield_xml_rpc', esc_html__( 'Disable XML-RPC', 'netsensai-shield' ), 'ns_shield_field_xml_rpc', 'secure-options', 'ns_shield_level_1' );
251
252 // Level 2: Intermediate Security
253 add_settings_section( 'ns_shield_level_2', esc_html__( 'Level 2: Intermediate Security', 'netsensai-shield' ), null, 'secure-options' );
254 add_settings_field( 'ns_shield_wp_api_json', esc_html__( 'Disable WP API JSON', 'netsensai-shield' ), 'ns_shield_field_wp_api_json', 'secure-options', 'ns_shield_level_2' );
255 add_settings_field( 'ns_shield_file_editor', esc_html__( 'Disable File Editor', 'netsensai-shield' ), 'ns_shield_field_file_editor', 'secure-options', 'ns_shield_level_2' );
256 add_settings_field( 'ns_shield_app_passwords', esc_html__( 'Disable WordPress Application Passwords', 'netsensai-shield' ), 'ns_shield_field_app_passwords', 'secure-options', 'ns_shield_level_2' );
257
258 // Level 3: Advanced Security
259 add_settings_section( 'ns_shield_level_3', esc_html__( 'Level 3: Advanced Security', 'netsensai-shield' ), null, 'secure-options' );
260 add_settings_field( 'ns_shield_directory_indexing', esc_html__( 'Disable Directory Indexing', 'netsensai-shield' ), 'ns_shield_field_directory_indexing', 'secure-options', 'ns_shield_level_3' );
261 add_settings_field( 'ns_shield_hsts', esc_html__( 'Enable HSTS', 'netsensai-shield' ), 'ns_shield_field_hsts', 'secure-options', 'ns_shield_level_3' );
262 add_settings_field( 'ns_shield_security_headers', esc_html__( 'Apply Security Headers', 'netsensai-shield' ), 'ns_shield_field_security_headers', 'secure-options', 'ns_shield_level_3' );
263 }
264 add_action( 'admin_init', 'ns_shield_secure_options_settings' );
265
266 /* =====================
267 FIELD CALLBACKS
268 ===================== */
269
270 function ns_shield_field_xml_rpc() {
271 $checked = get_option( 'ns_shield_xml_rpc', 0 ) ? 'checked' : '';
272 echo '<label class="switch">';
273 echo '<input type="checkbox" name="ns_shield_xml_rpc" value="1" ' . esc_attr( $checked ) . '>';
274 echo '<span class="slider round"></span>';
275 echo '<div class="tooltip">' .
276 esc_html__(
277 'Disabling XML-RPC blocks unauthorized remote access attempts, which can enhance security. If XML-RPC remains enabled, hackers might attempt to perform DDoS attacks by sending multiple requests or brute-force password attacks to gain control over your site.',
278 'netsensai-shield'
279 ) .
280 '</div>';
281 echo '</label>';
282 }
283
284 function ns_shield_field_wp_api_json() {
285 $checked = get_option( 'ns_shield_wp_api_json', 0 ) ? 'checked' : '';
286 echo '<label class="switch">';
287 echo '<input type="checkbox" name="ns_shield_wp_api_json" value="1" ' . esc_attr( $checked ) . '>';
288 echo '<span class="slider round"></span>';
289 echo '<div class="tooltip">' .
290 esc_html__(
291 'Disabling WP API JSON can protect your site from unauthorized access to sensitive data through the API. If left enabled, hackers may exploit WP API JSON to gather information about your site’s structure or perform enumeration attacks on users, which can lead to brute-force attacks.',
292 'netsensai-shield'
293 ) .
294 '</div>';
295 echo '</label>';
296 }
297
298 function ns_shield_field_file_editor() {
299 $checked = get_option( 'ns_shield_file_editor', 0 ) ? 'checked' : '';
300 echo '<label class="switch">';
301 echo '<input type="checkbox" name="ns_shield_file_editor" value="1" ' . esc_attr( $checked ) . '>';
302 echo '<span class="slider round"></span>';
303 echo '<div class="tooltip">' .
304 esc_html__(
305 'Disabling the file editor in the WP dashboard prevents unauthorized or accidental code changes. If left enabled, attackers who gain access to your admin panel could inject malicious code into your theme or plugin files, leading to a defacement of the site or the deployment of malware.',
306 'netsensai-shield'
307 ) .
308 '</div>';
309 echo '</label>';
310 }
311
312 function ns_shield_field_app_passwords() {
313 $checked = get_option( 'ns_shield_app_passwords', 0 ) ? 'checked' : '';
314 echo '<label class="switch">';
315 echo '<input type="checkbox" name="ns_shield_app_passwords" value="1" ' . esc_attr( $checked ) . '>';
316 echo '<span class="slider round"></span>';
317 echo '<div class="tooltip">' .
318 esc_html__(
319 'Disabling application passwords secures against creating unauthorized accesses to your site’s API. If left enabled, hackers may exploit application passwords to gain persistent access to your site, enabling them to execute unauthorized API requests or even escalate their privileges.',
320 'netsensai-shield'
321 ) .
322 '</div>';
323 echo '</label>';
324 }
325
326 function ns_shield_field_security_headers() {
327 $checked = get_option( 'ns_shield_security_headers', 0 ) ? 'checked' : '';
328 echo '<label class="switch">';
329 echo '<input type="checkbox" name="ns_shield_security_headers" id="ns-shield-preload-checkbox" value="1" ' . esc_attr( $checked ) . '>';
330 echo '<span class="slider round"></span>';
331 echo '<div class="tooltip">' .
332 esc_html__(
333 'Applying security headers can protect your site from XSS attacks and other threats. Without them, your site could be vulnerable to cross-site scripting (XSS) attacks or clickjacking, allowing attackers to steal sensitive data or trick users into executing malicious actions.',
334 'netsensai-shield'
335 ) .
336 '</div>';
337 echo '</label>';
338 }
339
340 /**
341 * FIELD CALLBACK: Directory Indexing.
342 */
343 function ns_shield_field_directory_indexing() {
344 $checked = get_option( 'ns_shield_directory_indexing', 0 ) ? 'checked' : '';
345 echo '<label class="switch">';
346 echo '<input type="checkbox" name="ns_shield_directory_indexing" value="1" ' . esc_attr( $checked ) . '>';
347 echo '<span class="slider round"></span>';
348 echo '<div class="tooltip">' .
349 esc_html__(
350 'Directory indexing allows attackers to list and access files in directories that lack an index file, exposing sensitive files and configurations. If directory indexing is not disabled, attackers can execute Directory Traversal attacks, gaining access to configuration files, logs, or even databases.',
351 'netsensai-shield'
352 ) .
353 '</div>';
354 echo '</label>';
355 }
356
357 /**
358 * FIELD CALLBACK: HSTS.
359 */
360 function ns_shield_field_hsts() {
361 $checked = get_option( 'ns_shield_hsts', 0 ) ? 'checked' : '';
362 echo '<label class="switch">';
363 echo '<input type="checkbox" name="ns_shield_hsts" value="1" ' . esc_attr( $checked ) . '>';
364 echo '<span class="slider round"></span>';
365 echo '<div class="tooltip">' .
366 esc_html__(
367 'HTTP Strict Transport Security (HSTS) enforces HTTPS, ensuring that all communication between the browser and the server is encrypted. This is critical for protecting sensitive user data and preventing man-in-the-middle attacks.',
368 'netsensai-shield'
369 ) .
370 '</div>';
371 echo '</label>';
372 }
373
374 /**
375 * Flush rewrite rules after settings update.
376 */
377 function ns_shield_flush_rewrite_rules_on_settings_update() {
378 if ( is_admin() && isset( $_GET['settings-updated'] ) && 'true' === $_GET['settings-updated'] ) {
379 flush_rewrite_rules();
380 }
381 }
382 add_action( 'admin_init', 'ns_shield_flush_rewrite_rules_on_settings_update', 20 );
383
384 /**
385 * Flush rewrite rules on plugin activation.
386 */
387 function ns_shield_activation_flush() {
388 if ( function_exists( 'ns_shield_add_rewrite_rule' ) ) {
389 ns_shield_add_rewrite_rule();
390 }
391 flush_rewrite_rules();
392 }
393 register_activation_hook( __FILE__, 'ns_shield_activation_flush' );
394
395 /**
396 * Flush rewrite rules on plugin deactivation.
397 */
398 function ns_shield_deactivation_flush() {
399 flush_rewrite_rules();
400 }
401 register_deactivation_hook( __FILE__, 'ns_shield_deactivation_flush' );
402 ?>
403