install_default.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall 4.9

ninjafirewall / lib / install_default.php

ninjafirewall / lib Last commit date

install_default.php

321 lines

1	<?php
2	/*
3	+---------------------------------------------------------------------+
4	\| NinjaFirewall (WP Edition) \|
5	\| \|
6	\| (c) NinTechNet - https://nintechnet.com/ \|
7	+---------------------------------------------------------------------+
8	\| This program is free software: you can redistribute it and/or \|
9	\| modify it under the terms of the GNU General Public License as \|
10	\| published by the Free Software Foundation, either version 3 of \|
11	\| the License, or (at your option) any later version. \|
12	\| \|
13	\| This program is distributed in the hope that it will be useful, \|
14	\| but WITHOUT ANY WARRANTY; without even the implied warranty of \|
15	\| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the \|
16	\| GNU General Public License for more details. \|
17	+---------------------------------------------------------------------+ i18n++ / sa
18	*/
19
20	if (! defined( 'NFW_ENGINE_VERSION' ) ) { die( 'Forbidden' ); }
21
22	// ---------------------------------------------------------------------
23	// Load and save default config
24
25	function nfw_load_default_conf() {
26
27	$nfw_rules = array();
28
29	$logo = plugins_url() . '/ninjafirewall/images/ninjafirewall_75.png';
30	$logo = preg_replace( '/^https?:/', '', $logo );
31
32	$nfw_options = array(
33	// ---------------------------------------------------------------
34	// The next 6 keys must always be present because they are used
35	// by the nfw_validate_option() function to check whether $nfw_options
36	// is corrupted or not:
37	'enabled' => 1,
38	'blocked_msg' => base64_encode(NFW_DEFAULT_MSG),
39	'logo' => $logo,
40	'ret_code' => 403,
41	'scan_protocol' => 3,
42	'get_scan' => 1,
43	'widgetnews' => 4,
44	// ---------------------------------------------------------------
45	'anon_ip' => 0,
46	'debug' => 0,
47	'uploads' => 1,
48	'sanitise_fn' => 0,
49	'get_sanitise' => 0,
50	'post_scan' => 1,
51	'cookies_scan' => 1,
52	'cookies_sanitise'=> 0,
53	'ua_scan' => 1,
54	'ua_sanitise' => 1,
55	'referer_scan' => 0,
56	'referer_sanitise'=> 1,
57	'referer_post' => 0,
58	'no_host_ip' => 0,
59	'allow_local_ip' => 1, // 1 == no !
60	'php_superglobals'=> 1,
61	'php_errors' => 1,
62	'php_self' => 1,
63	'php_path_t' => 1,
64	'php_path_i' => 1,
65	'wp_dir' => '/wp-admin/(?:css\|images\|includes\|js)/\|' .
66	'/wp-includes/(?!ms-files\.php)(?:(?:css\|images\|js(?!/tinymce/wp-tinymce\.php)\|theme-compat)/\|[^/]+\.php)\|' .
67	'/'. basename(WP_CONTENT_DIR) .'/(?:uploads\|blogs\.dir)/',
68	'no_post_themes' => 0,
69	'force_ssl' => 0,
70	'disallow_edit' => 0,
71	'disallow_mods' => 0,
72	// 3.8.2:
73	'disable_error_handler' => 0,
74
75	'wl_admin' => 1,
76	// v1.0.4
77	'a_0' => 1,
78	'a_11' => 1,
79	'a_12' => 1,
80	'a_13' => 0,
81	'a_14' => 0,
82	'a_15' => 1,
83	'a_16' => 0,
84	'a_21' => 1,
85	'a_22' => 1,
86	'a_23' => 0,
87	'a_24' => 0,
88	'a_25' => 0,
89	'a_31' => 1,
90	// v1.3.3 :
91	'a_41' => 1,
92	// v1.3.4 :
93	'a_51' => 1,
94	'sched_scan' => 0,
95	'report_scan' => 0,
96	// 4.1
97	'secupdates' => 1,
98	// v1.7 (daily report cronjob) :
99	'a_52' => 1,
100	// v3.8.3 :
101	'a_61' => 1,
102
103	'alert_email' => get_option('admin_email'),
104	// v1.1.0 :
105	'alert_sa_only' => 1,
106	'nt_show_status' => 1,
107	'post_b64' => 1,
108	// v3.6.7:
109	'disallow_creation' => 0,
110	// 4.5.9
111	'disallow_deletion' => 0,
112	// v3.7.2:
113	'disallow_settings' => 1,
114	// v4.0.6
115	'disallow_privesc' => 1,
116	// v4.2.6
117	'disallow_privesc_mu' => 0,
118	// v4.2
119	'disallow_publish' => 0,
120
121	// v1.1.2 :
122	'no_xmlrpc' => 0,
123	// v1.7 :
124	'no_xmlrpc_multi' => 0,
125	// v3.3.2
126	'no_xmlrpc_pingback'=> 0,
127	// 4.3.1
128	'no_appswd' => 0,
129
130	// v1.1.3 :
131	'enum_archives' => 0,
132	'enum_sitemap' => 0,
133	'enum_login' => 0,
134	// v4.2
135	'enum_feed' => 0,
136	'no_restapi' => 0,
137	'restapi_loggedin'=> 0,
138	// v1.2.1 :
139	'fg_enable' => 0,
140	'fg_mtime' => 10,
141	'fg_exclude' => '',
142	// Log:
143	'auto_del_log' => 0,
144	// Updates :
145	'enable_updates' => 1,
146	'sched_updates' => 1,
147	'notify_updates' => 1,
148	// Centralized Logging:
149	'clogs_enable' => 0,
150	'clogs_pubkey' => '',
151
152	'rate_notice' => time() + 86400 * 15,
153	'welcome' => 1
154	);
155	// v1.3.1 :
156	// Some compatibility checks:
157	// 1. header_register_callback(): requires PHP >=5.4
158	// 2. headers_list() and header_remove(): some hosts may disable them.
159	if ( function_exists('header_register_callback') && function_exists('headers_list') && function_exists('header_remove') ) {
160	// X-XSS-Protection:
161	$nfw_options['response_headers'] = '0003000000';
162	}
163	$nfw_options['referrer_policy_enabled'] = 0;
164
165	define('NFUPDATESDO', 2);
166	@nf_sub_updates();
167
168	if (! $nfw_rules = @unserialize(NFW_RULES) ) {
169	$err_msg = esc_html__('Error: The installer cannot download the security rules from wordpress.org website.', 'ninjafirewall');
170	$err_msg.= '<ol><li>'. esc_html__('The server may be temporarily down or you may have network connectivity problems? Please try again in a few minutes.', 'ninjafirewall') . '</li>';
171	$err_msg.= '<li>'. esc_html__('NinjaFirewall downloads its rules over an HTTPS secure connection. Maybe your server does not support SSL? You can force NinjaFirewall to use a non-secure HTTP connection by adding the following directive to your <strong>wp-config.php</strong> file:', 'ninjafirewall') . ' <p><code>define("NFW_DONT_USE_SSL", 1);</code></p></li></ol>';
172	exit( '<font style="font-size:14px;">'. $err_msg .'</font>' );
173	}
174
175	// dropins code:
176	if ( isset( $nfw_rules['dropins'] ) ) {
177	if ( $nfw_rules['dropins'] == 'delete' ) {
178	if ( is_file( NFW_LOG_DIR .'/nfwlog/dropins.php' ) ) {
179	@unlink( NFW_LOG_DIR .'/nfwlog/dropins.php' );
180	}
181	} else {
182	$dropins = base64_decode( $nfw_rules['dropins'], true );
183	if ( $dropins !== false ) {
184	@file_put_contents( NFW_LOG_DIR .'/nfwlog/dropins.php', $dropins, LOCK_EX );
185	}
186	}
187	unset( $nfw_rules['dropins'] );
188	}
189
190	$nfw_options['engine_version'] = NFW_ENGINE_VERSION;
191	$nfw_options['rules_version'] = NFW_NEWRULES_VERSION; // downloaded rules
192
193	// If the user is using WP-CLI, we populate DOCUMENT_ROOT with ABSPATH:
194	if ( defined('WP_CLI') && WP_CLI ) {
195	$_SERVER['DOCUMENT_ROOT'] = ABSPATH;
196	}
197	// Create but disable by default "Block the DOCUMENT_ROOT server variable in HTTP request" rule
198	if ( strlen( $_SERVER['DOCUMENT_ROOT'] ) > 5 ) {
199	$nfw_rules[NFW_DOC_ROOT]['cha'][1]['wha'] = str_replace( '/', '/[./]*', $_SERVER['DOCUMENT_ROOT'] );
200	} elseif ( strlen( getenv( 'DOCUMENT_ROOT' ) ) > 5 ) {
201	$nfw_rules[NFW_DOC_ROOT]['cha'][1]['wha'] = str_replace( '/', '/[./]*', getenv( 'DOCUMENT_ROOT' ) );
202	}
203	$nfw_rules[NFW_DOC_ROOT]['ena'] = 0;
204
205	// ------------------------------------------------------------------
206	// Update DB options and rules BEFORE (re)enabling scheduled tasks
207	// (the garbage collect should be ran/scheduled last):
208	nfw_update_option( 'nfw_options', $nfw_options);
209	nfw_update_option( 'nfw_rules', $nfw_rules);
210	// Create conjobs
211	nfw_create_scheduled_tasks();
212	// ------------------------------------------------------------------
213
214	nfw_create_log_dir();
215
216	}
217	// ---------------------------------------------------------------------
218	// Create NinjaFirewall's log & cache folders.
219
220	function nfw_create_log_dir() {
221
222	$deny_rules = "<Files \"*\">
223	<IfModule mod_version.c>
224	<IfVersion < 2.4>
225	Order Deny,Allow
226	Deny from All
227	</IfVersion>
228	<IfVersion >= 2.4>
229	Require all denied
230	</IfVersion>
231	</IfModule>
232	<IfModule !mod_version.c>
233	<IfModule !mod_authz_core.c>
234	Order Deny,Allow
235	Deny from All
236	</IfModule>
237	<IfModule mod_authz_core.c>
238	Require all denied
239	</IfModule>
240	</IfModule>
241	</Files>";
242
243	if (! is_writable(NFW_LOG_DIR) ) {
244	$err_msg = sprintf( esc_html__('NinjaFirewall cannot create its <code>nfwlog/</code>log and cache folder; please make sure that the <code>%s</code> directory is writable', 'ninjafirewall'), htmlspecialchars( NFW_LOG_DIR ) );
245	exit( '<font style="font-size:14px;">'. $err_msg .'</font>' );
246	}
247
248	if (! is_dir( NFW_LOG_DIR .'/nfwlog') ) {
249	mkdir( NFW_LOG_DIR .'/nfwlog', 0755 );
250	/**
251	* 2025-09-03: We temporarily force NinjaFirewall session on all new installs.
252	*/
253	touch( NFW_LOG_DIR .'/nfwlog/ninjasession');
254	}
255	if (! is_dir( NFW_LOG_DIR .'/nfwlog/cache') ) {
256	mkdir( NFW_LOG_DIR .'/nfwlog/cache', 0755 );
257	}
258
259	touch( NFW_LOG_DIR . '/nfwlog/index.html' );
260	touch( NFW_LOG_DIR . '/nfwlog/cache/index.html' );
261	@file_put_contents(NFW_LOG_DIR . '/nfwlog/.htaccess', $deny_rules, LOCK_EX);
262	@file_put_contents(NFW_LOG_DIR . '/nfwlog/cache/.htaccess', $deny_rules, LOCK_EX);
263	@file_put_contents(
264	NFW_LOG_DIR . '/nfwlog/readme.txt',
265	"This is NinjaFirewall's logs, loader and cache directory. DO NOT alter or remove it as long as NinjaFirewall is running!\n\nIf you just uninstalled NinjaFirewall, WAIT 5 MINUTES before deleting this folder, otherwise your site will likely crash.",
266	LOCK_EX
267	);
268	nfw_create_loader();
269	}
270
271	// ---------------------------------------------------------------------
272	// Create NF's loader.
273
274	function nfw_create_loader() {
275
276	$nfw_options = nfw_get_option( 'nfw_options' );
277
278	// Firewall loader
279	$loader = "<?php
280	// ===============================================================//
281	// NinjaFirewall's loader. //
282	// DO NOT alter or remove it as long as NinjaFirewall is running. //
283	// If this file is corrupted or wrong, you can re-generate it //
284	// by deactivating and reactivating NinjaFirewall from your //
285	// WordPress dashboard. //
286	// ===============================================================//";
287
288	if (! empty( $nfw_options['exclude_waf_list'] ) ) {
289	$string = '';
290	$exclude_waf_list = json_decode( $nfw_options['exclude_waf_list'] );
291	foreach( $exclude_waf_list as $folder ) {
292	if ( is_dir( ABSPATH . $folder ) ) {
293	$string .= "'$folder',";
294	}
295	}
296	$string = rtrim( $string, ',' );
297	if (! empty( $string ) ) {
298	$loader .= "
299	\$nfw_exclude_waf_list = array($string);
300	foreach( \$nfw_exclude_waf_list as \$nfw_exclude_waf_folder ) {
301	if (strpos(\$_SERVER['SCRIPT_FILENAME'], \"". ABSPATH ."\$nfw_exclude_waf_folder/\") === 0) {
302	return;
303	}
304	}";
305	}
306	}
307
308	$loader .= "
309	if ( is_file('". __DIR__ .'/firewall.php' . "') ) {
310	@include_once '". __DIR__ .'/firewall.php' . "';
311	}
312	// EOF
313	";
314	file_put_contents( NFW_LOG_DIR .'/nfwlog/ninjafirewall.php', $loader, LOCK_EX );
315	return;
316
317	}
318
319	// ---------------------------------------------------------------------
320	// EOF //
321