settings_logs_firewall_log.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall 4.9

ninjafirewall / lib / settings_logs_firewall_log.php

ninjafirewall / lib Last commit date

settings_logs_firewall_log.php

342 lines

1	<?php
2	/*
3	+---------------------------------------------------------------------+
4	\| NinjaFirewall (WP Edition) \|
5	\| \|
6	\| (c) NinTechNet - https://nintechnet.com/ \|
7	+---------------------------------------------------------------------+
8	\| This program is free software: you can redistribute it and/or \|
9	\| modify it under the terms of the GNU General Public License as \|
10	\| published by the Free Software Foundation, either version 3 of \|
11	\| the License, or (at your option) any later version. \|
12	\| \|
13	\| This program is distributed in the hope that it will be useful, \|
14	\| but WITHOUT ANY WARRANTY; without even the implied warranty of \|
15	\| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the \|
16	\| GNU General Public License for more details. \|
17	+---------------------------------------------------------------------+
18	*/
19
20	if (! defined( 'NFW_ENGINE_VERSION' ) ) { die( 'Forbidden' ); }
21
22	nf_not_allowed( 'block', __LINE__ );
23
24	$nfw_options = nfw_get_option( 'nfw_options' );
25
26	$tz = get_option('timezone_string');
27	if (! empty( $tz ) ) {
28	date_default_timezone_set( $tz );
29	}
30
31	$log_dir = NFW_LOG_DIR . '/nfwlog/';
32	$monthly_log = 'firewall_' . date( 'Y-m' ) . '.php';
33
34	if ( ! is_file( $log_dir . $monthly_log ) ) {
35	nf_sub_log_create( $log_dir . $monthly_log );
36	}
37
38	if (! is_writable( $log_dir . $monthly_log ) ) {
39	$write_err = sprintf( __('the current month log (%s) is not writable. Please chmod it and its parent directory to 0777', 'ninjafirewall'), htmlspecialchars( $log_dir . $monthly_log ) );
40	} elseif (! is_writable( $log_dir ) ) {
41	$write_err = sprintf( __('the log directory (%s) is not writable. Please chmod it to 0777', 'ninjafirewall'), htmlspecialchars($log_dir ) );
42	}
43
44	global $available_logs;
45	$available_logs = nf_sub_log_find_local( $log_dir );
46
47	/**
48	* Save options.
49	*/
50	if (! empty( $_POST['nfw_act'] ) ) {
51	/**
52	* Use the same nonce for all actions.
53	*/
54	if ( empty( $_POST['nfwnonce'] ) \|\| ! wp_verify_nonce( $_POST['nfwnonce'], 'settings_log') ) {
55	wp_nonce_ays('settings_log');
56	}
57	if ( $_POST['nfw_act'] == 'save_options') {
58	nf_sub_log_save_options( $nfw_options );
59	$ok_msg = __('Your changes have been saved.', 'ninjafirewall');
60	/**
61	* Save/delete public key.
62	*/
63	} elseif ( $_POST['nfw_act'] == 'pubkey') {
64	/**
65	* Clear the key.
66	*/
67	if (isset( $_POST['delete_pubkey'] ) ) {
68	$_POST['nfw_options']['clogs_pubkey'] = '';
69	$ok_msg = __('Your public key has been deleted', 'ninjafirewall');
70	} else {
71	$ok_msg = __('Your public key has been saved', 'ninjafirewall');
72	}
73	nf_sub_log_save_pubkey( $nfw_options );
74	}
75	/**
76	* Update options.
77	*/
78	$nfw_options = nfw_get_option( 'nfw_options' );
79	}
80
81	$max_lines = 1500;
82
83	if ( isset( $_GET['nfw_logname'] ) ) {
84	if ( empty( $_GET['nfwnonce'] ) \|\| ! wp_verify_nonce($_GET['nfwnonce'], 'settings_log') ) {
85	wp_nonce_ays('settings_log');
86	}
87	$data = nf_sub_log_read_local( $_GET['nfw_logname'], $log_dir, $max_lines );
88	}
89
90	if ( isset( $_GET['nfw_logname'] ) && ! empty( $available_logs[$_GET['nfw_logname']] ) ) {
91	$selected_log = $_GET['nfw_logname'];
92	} else {
93	$selected_log = $monthly_log;
94	$data = nf_sub_log_read_local( $monthly_log, $log_dir, $max_lines );
95	}
96
97	// Display a one-time notice after two weeks of use:
98	nfw_rate_notice( $nfw_options );
99
100	if ( ! empty( $write_err ) ) {
101	echo '<div class="error notice is-dismissible"><p>' . __('Error', 'ninjafirewall') . ': ' . $write_err . '</p></div>';
102	}
103
104	if ( ! empty( $ok_msg ) ) {
105	echo '<div class="updated notice is-dismissible"><p>' . $ok_msg . '</p></div>';
106	}
107	if ( isset( $data['lines'] ) && $data['lines'] > $max_lines ) {
108	echo '<div class="notice-info notice is-dismissible"><p>' .
109	__('Note', 'ninjafirewall') . ': ' .
110	sprintf(
111	__('your log has more than %s lines. I will display the last %s lines only.', 'ninjafirewall'),
112	$max_lines,
113	$max_lines
114	) .
115	'</p></div>';
116	}
117
118	echo '<center>' . __('Viewing:', 'ninjafirewall') . ' <select onChange=\'window.location="?page=nfsublog&nfwnonce='. wp_create_nonce('settings_log') .'&nfw_logname=" + this.value;\'>';
119	foreach ($available_logs as $log_name => $tmp) {
120	echo '<option value="' . $log_name . '"';
121	if ( $selected_log == $log_name ) {
122	echo ' selected';
123	}
124	$log_stat = stat($log_dir . $log_name);
125	echo '>' . str_replace('.php', '', $log_name) . ' (' . number_format_i18n($log_stat['size']) .' '. __('bytes', 'ninjafirewall') . ')</option>';
126	}
127	echo '</select></center>';
128
129	$levels = array( '', 'MEDIUM', 'HIGH', 'CRITICAL', 'ERROR', 'UPLOAD', 'INFO', 'DEBUG_ON' );
130
131	$logline = '';
132	if ( isset( $data['log'] ) && is_array( $data['log'] ) ) {
133	foreach ( $data['log'] as $line ) {
134	if ( preg_match( '/^\[(\d{10})\]\s+\[.+?\]\s+\[(.+?)\]\s+\[(#\d{7})\]\s+\[(\d+)\]\s+\[(\d)\]\s+\[([\d.:a-fA-Fx, ]+?)\]\s+\[.+?\]\s+\[(.+?)\]\s+\[(.+?)\]\s+\[(.+?)\]\s+\[(hex:\|b64:)?(.+)\]$/', $line, $match ) ) {
135	if ( empty( $match[4]) ) { $match[4] = '-'; }
136	if ( $match[10] == 'hex:' ) { $match[11] = @pack('H*', $match[11]); }
137	if ( $match[10] == 'b64:' ) { $match[11] = base64_decode( $match[11]); }
138	$res = date( 'd/M/y H:i:s', $match[1] ) . ' ' . $match[3] . ' ' .
139	str_pad( $levels[$match[5]], 8 , ' ', STR_PAD_RIGHT) .' ' .
140	str_pad( $match[4], 4 , ' ', STR_PAD_LEFT) . ' ' . str_pad( $match[6], 15, ' ', STR_PAD_RIGHT) . ' ' .
141	$match[7] . ' ' . $match[8] . ' - ' . $match[9] . ' - [' . $match[11] . '] - ' . $match[2];
142	$logline .= htmlentities( $res ."\n" );
143	}
144	}
145	}
146	if ( defined('NFW_TEXTAREA_HEIGHT') ) {
147	$th = (int) NFW_TEXTAREA_HEIGHT;
148	} else {
149	$th = '450';
150	}
151	?>
152	<form name="frmlog">
153	<table class="form-table">
154	<tr>
155	<td width="100%">
156	<textarea name="txtlog" class="large-text code" style="height:<?php echo $th; ?>px;" wrap="off" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"><?php
157	if ( ! empty( $logline ) ) {
158	echo ' DATE INCIDENT LEVEL RULE IP REQUEST' . "\n";
159	echo $logline;
160	} else {
161	if (! empty( $data['err_msg'] ) ) {
162	echo esc_textarea( "\n\n > {$data['err_msg']}" );
163	} else {
164	echo esc_textarea( "\n\n > " . __( 'The selected log is empty.', 'ninjafirewall' ) );
165	}
166	}
167	?></textarea>
168	<center>
169	<p class="description"><?php _e('The log shows all threats that were blocked by the firewall, unless stated otherwise. It is rotated monthly.', 'ninjafirewall') ?></p>
170	</center>
171	</td>
172	</tr>
173	</table>
174	</form>
175	<?php
176
177	if ( empty( $nfw_options['auto_del_log'] ) ) {
178	$nfw_options['auto_del_log'] = 0;
179	}
180
181	?>
182	<h3><?php _e('Log Options', 'ninjafirewall') ?></h3>
183	<form method="post" action="?page=nfsublog"><?php wp_nonce_field('settings_log', 'nfwnonce', 0); ?>
184	<table class="form-table nfw-table">
185	<tr>
186	<th scope="row" class="row-med"><?php _e('Auto-delete log', 'ninjafirewall') ?></th>
187	<td>
188	<?php
189	$input = '<input type="number" name="nfw_options[auto_del_log]" min="0" value="'. (int) $nfw_options['auto_del_log'] .'" class="small-text" />';
190	printf( __('Automatically delete logs older than %s days', 'ninjafirewall' ), $input );
191	?>
192	<p class="description"><?php _e('Set this option to 0 to disable it.', 'ninjafirewall' ) ?></p>
193	</td>
194	</tr>
195	</table>
196	<br />
197	<input type="hidden" name="nfw_act" value="save_options" />
198	<input type="submit" class="button-primary" value="<?php _e('Save Log Options', 'ninjafirewall') ?>" name="savelog" />
199	<input type="hidden" name="tab" value="firewalllog" />
200	</form>
201
202	<a name="clogs"></a>
203	<form name="frmlog2" method="post" action="?page=nfsublog" onsubmit="return nfwjs_check_key();">
204	<?php
205
206	wp_nonce_field('settings_log', 'nfwnonce', 0);
207	if ( empty( $nfw_options['clogs_pubkey'] ) \|\| ! preg_match( '/^[a-f0-9]{40}:(?:[a-f0-9:.]{3,39}\|\*)$/', $nfw_options['clogs_pubkey'] ) ) {
208	$nfw_options['clogs_pubkey'] = '';
209	}
210
211	?>
212	<br />
213
214	<a name="clogs"></a>
215	<h3><?php _e('Centralized Logging', 'ninjafirewall') ?> <span class="ninjafirewall-tip" data-tip="<?php esc_attr_e('In the Premium version of NinjaFirewall, Centralised Logging lets you remotely access the firewall log of all your NinjaFirewall protected websites from one single installation.', 'ninjafirewall' ) ?>"></span></h3>
216	<table class="form-table nfw-table">
217	<tr>
218	<th scope="row" class="row-med"><?php _e('Enter your public key (optional)', 'ninjafirewall') ?></th>
219	<td>
220	<input id="clogs-pubkey" class="large-text" type="text" maxlength="80" name="nfw_options[clogs_pubkey]" value="<?php echo htmlspecialchars( $nfw_options['clogs_pubkey'] ) ?>" autocomplete="off" />
221	<p class="description"><?php printf( __('<a href="%s">Consult our blog</a> if you want to enable centralized logging.', 'ninjafirewall'), 'https://blog.nintechnet.com/centralized-logging-with-ninjafirewall/' ) ?></p>
222	</td>
223	</tr>
224	</table>
225
226	<br />
227	<input type="hidden" name="nfw_act" value="pubkey" />
228	<input class="button-primary" name="save_pubkey" value="<?php _e('Save Public Key', 'ninjafirewall') ?>" type="submit" />
229
230	<input class="button-secondary" style="color:#ba0000;border-color:#ba0000;" name="delete_pubkey" value="<?php _e('Delete Public Key', 'ninjafirewall') ?>" type="submit"<?php disabled($nfw_options['clogs_pubkey'], '' ) ?> />
231	<input type="hidden" name="tab" value="firewalllog" />
232
233	</form>
234	<?php
235
236	// ---------------------------------------------------------------------
237
238	function nf_sub_log_save_options( $nfw_options ) {
239
240	if ( empty( $_POST['nfw_options']['auto_del_log'] ) \|\| ! preg_match( '/^\d+$/', $_POST['nfw_options']['auto_del_log'] ) ) {
241	$nfw_options['auto_del_log'] = 0;
242	} else {
243	$nfw_options['auto_del_log'] = (int) $_POST['nfw_options']['auto_del_log'];
244	}
245	// We need to keep the log for more than 24 hours otherwise
246	// the daily report will be empty
247	if ( $nfw_options['auto_del_log'] == 1 ) {
248	$nfw_options['auto_del_log'] = 2;
249	}
250
251	nfw_update_option( 'nfw_options', $nfw_options );
252
253	}
254
255	// ---------------------------------------------------------------------
256
257	function nf_sub_log_create( $log ) {
258
259	file_put_contents( $log, "<?php exit; ?>\n" );
260
261	}
262
263	// ---------------------------------------------------------------------
264
265	function nf_sub_log_find_local( $log_dir ) {
266
267	$available_logs = array();
268	if ( is_dir( $log_dir ) ) {
269	if ( $dh = opendir( $log_dir ) ) {
270	while ( ($file = readdir($dh) ) !== false ) {
271	if (preg_match( '/^(firewall_(\d{4})-(\d\d)(?:\.\d+)?\.php)$/', $file, $match ) ) {
272	$available_logs[$match[1]] = 1;
273	}
274	}
275	closedir($dh);
276	}
277	}
278	krsort($available_logs);
279
280	return $available_logs;
281	}
282
283	// ---------------------------------------------------------------------
284
285	function nf_sub_log_save_pubkey( $nfw_options ) {
286
287	if ( empty( $_POST['nfw_options']['clogs_pubkey'] ) \|\|
288	! preg_match( '/^[a-f0-9]{40}:(?:[a-f0-9:.]{3,39}\|\*)$/', $_POST['nfw_options']['clogs_pubkey'] ) ) {
289	$nfw_options['clogs_pubkey'] = '';
290	} else {
291	$nfw_options['clogs_pubkey'] = $_POST['nfw_options']['clogs_pubkey'];
292	}
293
294	nfw_update_option( 'nfw_options', $nfw_options);
295
296	}
297
298	// ---------------------------------------------------------------------
299
300	function nf_sub_log_read_local( $log, $log_dir, $max_lines ) {
301
302	if (! preg_match( '/^(firewall_\d{4}-\d\d(?:\.\d+)?\.)php$/', trim( $log ) ) ) {
303	wp_nonce_ays('settings_log');
304	}
305
306	$data = [];
307	$data['type'] = 'local';
308
309	if (! is_file( $log_dir . $log ) ) {
310	$data['err_msg'] = __('The requested log does not exist.', 'ninjafirewall');
311	return $data;
312	}
313
314	$fp = fopen( $log_dir . $log, 'r');
315	if ( $fp === false ) {
316	$data['err_msg'] = __('Unable to open the log for read operation.', 'ninjafirewall');
317	return $data;
318	}
319	while(! feof( $fp ) ) {
320	$line = fgets( $fp, 8192 );
321	if (! preg_match('`^\[\d{10}\]`', $line ) ) {
322	continue;
323	}
324	$data['log'][] = $line;
325	$data['lines'] = count( $data['log'] );
326	if ( $data['lines'] > $max_lines ) {
327	array_shift( $data['log'] );
328	}
329	}
330	fclose( $fp );
331
332	if ( empty( $data['log'] ) ) {
333	$data['err_msg'] = __('The selected log is empty.', 'ninjafirewall');
334	}
335
336	return $data;
337
338	}
339
340	// ---------------------------------------------------------------------
341	// EOF
342