class-import-export.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall trunk

ninjafirewall / lib / class-import-export.php

ninjafirewall / lib Last commit date

class-import-export.php

303 lines

1	<?php
2	/*
3	+=====================================================================+
4	\| _ _ _ _ _____ _ _ _ \|
5	\| \| \ \| (_)_ __ (_) __ _\| ___(_)_ __ _____ ____ _\| \| \| \|
6	\| \| \\| \| \| '_ \ \| \|/ _` \| \|_ \| \| '__/ _ \ \ /\ / / _` \| \| \| \|
7	\| \| \|\ \| \| \| \| \|\| \| (_\| \| _\| \| \| \| \| __/\ V V / (_\| \| \| \| \|
8	\| \|_\| \_\|_\|_\| \|_\|/ \|\__,_\|_\| \|_\|_\| \___\| \_/\_/ \__,_\|_\|_\| \|
9	\| \|__/ \|
10	\| (c) NinTechNet Limited ~ https://nintechnet.com/ \|
11	+=====================================================================+
12	*/
13
14	if ( class_exists('NinjaFirewall_ImpExp') ) {
15	return;
16	}
17
18	class NinjaFirewall_ImpExp {
19
20	/**
21	* Import the firewall configuration.
22	*/
23	public static function import( $file ) {
24
25	/**
26	* Security nonce is checked in the calling function.
27	*/
28
29	$err_msg = __('Uploaded file is either corrupted or its format is not supported (#%s)',
30	'ninjafirewall');
31
32	$data = file_get_contents( $file );
33	if (! $data) {
34	return sprintf( $err_msg, 1 );
35	}
36
37	$data = str_replace('<?php exit; ?>', '', $data );
38	/**
39	* Base64-encoded (since v4.3.5) ?
40	*/
41	if ( $data[0] == 'B') {
42	/**
43	* Decode it.
44	*/
45	$data = ltrim( $data, 'B');
46	$data = base64_decode( $data );
47	}
48	@ list ( $nfw_options, $rules, $bf ) = @ explode("\n:-:\n", "$data\n:-:\n");
49
50	/**
51	* Remove any potential Unicode BOM.
52	*/
53	if ( preg_match('/^\xef\xbb\xbf/', $nfw_options ) ) {
54	$nfw_options = preg_replace('/^\xef\xbb\xbf/', '', $nfw_options );
55	}
56
57	if (! $nfw_options \|\| ! $rules ) {
58	return sprintf( $err_msg, 2 );
59	}
60
61	$nfw_options = json_decode( $nfw_options, true );
62	$nfw_rules = json_decode( $rules, true );
63	if (! empty( $bf ) ) {
64	$bf_conf = json_decode( $bf, true );
65	}
66
67	if ( empty( $nfw_options['engine_version'] ) ) {
68	return sprintf( $err_msg, 3 );
69	}
70
71	/**
72	* Make sure the major version numbers match (3.x, 4.x etc).
73	*/
74	list ( $major_current ) = explode('.', NFW_ENGINE_VERSION );
75	list ( $major_import ) = explode('.', $nfw_options['engine_version'] );
76	if ( $major_current != $major_import ) {
77	return __('The imported file is not compatible with that version of NinjaFirewall',
78	'ninjafirewall');
79	}
80	if ( $major_import < '4' ) {
81	if ( empty( $nfw_options['allow_local_ip'] ) ) {
82	$nfw_options['allow_local_ip'] = 1;
83	} else {
84	$nfw_options['allow_local_ip'] = 0;
85	}
86	}
87
88	/**
89	* We cannot import WP+ config.
90	*/
91	if ( isset( $nfw_options['shmop'] ) ) {
92	return sprintf( $err_msg, 4 );
93	}
94
95	if ( empty( $nfw_rules[1] ) ) {
96	return sprintf( $err_msg, 5 );
97	}
98
99	/**
100	* Dropins rules.
101	*/
102	if ( isset( $nfw_rules['dropins'] ) ) {
103	if ( $nfw_rules['dropins'] == 'delete') {
104	if ( file_exists( NFW_LOG_DIR .'/nfwlog/dropins.php') ) {
105	@ unlink( NFW_LOG_DIR .'/nfwlog/dropins.php');
106	}
107	} else {
108	$dropins = base64_decode( $nfw_rules['dropins'], true );
109	if ( $dropins !== false ) {
110	@ file_put_contents( NFW_LOG_DIR .'/nfwlog/dropins.php', $dropins, LOCK_EX );
111	}
112	}
113	unset( $nfw_rules['dropins'] );
114	}
115
116	/**
117	* Fix paths and directories.
118	*/
119	$nfw_options['logo'] = plugins_url('images/ninjafirewall_75.png', dirname( __FILE__ ) );
120	$nfw_options['logo'] = preg_replace('/^https?:/', '', $nfw_options['logo'] );
121
122	/**
123	* We must preserve the previous option, but we still need to adjust
124	* the paths because WP_CONTENT_DIR can be user-defined and thus different
125	* (e.g., server migration).
126	*/
127	if ( isset( $nfw_options['wp_dir'] ) ) {
128
129	$nfw_options['wp_dir'] = preg_replace(
130	'`(^\|\\|)/([^/]+)(/$\?:uploads\\|blogs\\\.dir$/)`',
131	"$1/" .basename(WP_CONTENT_DIR). "$3",
132	$nfw_options['wp_dir']
133	);
134	}
135
136	if (! empty( $_FILES['ninjafirewall_import']['tmp_name'] ) &&
137	$file == $_FILES['ninjafirewall_import']['tmp_name'] ) {
138
139	/**
140	* We don't import the File Check 'snapshot directory' path
141	* (applies to imported configuration, not to restoration of configuration backup).
142	*/
143	$nfw_options['snapdir'] = '';
144	$nfw_options['sched_scan'] = '';
145	}
146
147	/**
148	* Check compatibility before importing HSTS headers configuration or unset the option.
149	*/
150	if (! function_exists('header_register_callback') \|\|
151	! function_exists('headers_list') \|\| ! function_exists('header_remove') ) {
152
153	if ( isset( $nfw_options['response_headers'] ) ) {
154	unset( $nfw_options['response_headers'] );
155	}
156	}
157
158	/**
159	* If brute force protection is enabled, we need to create a new config file.
160	*/
161	$nfwbfd_log = NFW_LOG_DIR .'/nfwlog/cache/bf_conf.php';
162	if (! empty( $bf_conf ) ) {
163	$fh = fopen( $nfwbfd_log, 'w');
164	fwrite( $fh, $bf_conf );
165	fclose( $fh );
166	} else {
167	/*
168	* ...or delete the current one, if any.
169	*/
170	if ( file_exists( $nfwbfd_log ) ) {
171	unlink( $nfwbfd_log );
172	}
173	}
174
175	/**
176	* Save options.
177	*/
178	nfw_update_option('nfw_options', $nfw_options );
179
180	/**
181	* Add the correct DOCUMENT_ROOT.
182	*/
183	if ( strlen( $_SERVER['DOCUMENT_ROOT'] ) > 5 ) {
184	$nfw_rules[ NFW_DOC_ROOT ]['cha'][1]['wha'] =
185	str_replace('/', '/[./]*', $_SERVER['DOCUMENT_ROOT'] );
186	} elseif ( strlen( getenv( 'DOCUMENT_ROOT' ) ) > 5 ) {
187	$nfw_rules[ NFW_DOC_ROOT ]['cha'][1]['wha'] =
188	str_replace('/', '/[./]*', getenv( 'DOCUMENT_ROOT' ) );
189	} else {
190	$nfw_rules[ NFW_DOC_ROOT ]['ena'] = 0;
191	}
192
193	/**
194	* Save rules.
195	*/
196	nfw_update_option('nfw_rules', $nfw_rules );
197
198	/**
199	* Recreate cron events if needed.
200	*/
201	nfw_create_scheduled_tasks();
202
203	/**
204	* Alert the admin about the changes.
205	*/
206	self::email_admin('fw_override');
207
208	return;
209	}
210
211
212	/**
213	* Export the firewall configuration.
214	*/
215	public static function export( $file = '') {
216
217	$nfw_options = nfw_get_option('nfw_options');
218	$nfw_rules = nfw_get_option('nfw_rules');
219
220	/**
221	* Check nonce.
222	*/
223	if ( empty( $_POST['nfwnonce'] ) \|\|
224	! wp_verify_nonce( $_POST['nfwnonce'], 'options_save') ) {
225
226	wp_nonce_ays('options_save');
227	}
228
229	/**
230	* Export login protection if it exists too.
231	*/
232	$nfwbfd_log = NFW_LOG_DIR .'/nfwlog/cache/bf_conf.php';
233	if ( file_exists( $nfwbfd_log ) ) {
234	$bd_data = json_encode( file_get_contents( $nfwbfd_log ) );
235	} else {
236	$bd_data = '';
237	}
238
239	/**
240	* Dropins, if applicable.
241	*/
242	if ( file_exists( NFW_LOG_DIR .'/nfwlog/dropins.php') ) {
243	$nfw_rules['dropins'] = base64_encode(
244	file_get_contents( NFW_LOG_DIR .'/nfwlog/dropins.php')
245	);
246	}
247	$data = json_encode( $nfw_options ) ."\n:-:\n". json_encode( $nfw_rules ) ."\n:-:\n$bd_data";
248
249	/**
250	* Download or save to disk (WP CLI).
251	*/
252	if (! defined('WP_CLI') ) {
253	header('Content-Type: text/plain');
254	header('Content-Length: '. strlen( $data ) );
255	header('Content-Disposition: attachment; filename="nfwp.'. NFW_ENGINE_VERSION .'.dat"');
256	echo $data;
257
258	exit;
259	}
260
261	return file_put_contents( $file, $data );
262	}
263
264
265	/**
266	* Alert the admin if needed.
267	*/
268	public static function email_admin( $template ) {
269
270	global $current_user;
271	$current_user = wp_get_current_user();
272
273	/**
274	* Home URL.
275	*/
276	if ( is_multisite() ) {
277	$url = network_home_url('/');
278	} else {
279	$url = home_url('/');
280	}
281
282	/**
283	* Template to load.
284	*/
285	if ( $template != 'disabled' && $template != 'debugging') {
286	$template = 'fw_override';
287	}
288
289	/**
290	* Email notification.
291	*/
292	$subject = [ ];
293	$content = [ "{$current_user->user_login} ({$current_user->roles[0]})",
294	NFW_REMOTE_ADDR, ucfirst( date_i18n('F j, Y @ H:i:s O') ), $url ];
295
296	NinjaFirewall_mail::send( $template, $subject, $content, '', [], 1 );
297
298	}
299	}
300
301	// =====================================================================
302	// EOF
303