install.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall trunk

ninjafirewall / lib / install.php

ninjafirewall / lib Last commit date

install.php

365 lines

1	<?php
2	/*
3	+---------------------------------------------------------------------+
4	\| NinjaFirewall (WP Edition) \|
5	\| \|
6	\| (c) NinTechNet - https://nintechnet.com/ \|
7	+---------------------------------------------------------------------+
8	\| This program is free software: you can redistribute it and/or \|
9	\| modify it under the terms of the GNU General Public License as \|
10	\| published by the Free Software Foundation, either version 3 of \|
11	\| the License, or (at your option) any later version. \|
12	\| \|
13	\| This program is distributed in the hope that it will be useful, \|
14	\| but WITHOUT ANY WARRANTY; without even the implied warranty of \|
15	\| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the \|
16	\| GNU General Public License for more details. \|
17	+---------------------------------------------------------------------+ i18n+ / sa
18	*/
19
20	if (! defined( 'NFW_ENGINE_VERSION' ) ) { die( 'Forbidden' ); }
21
22	// ---------------------------------------------------------------------
23	// Installation constants.
24
25	function nfw_get_constants() {
26
27	if ( defined('NFW_HTACCESS_BEGIN') ) { return; }
28
29	if (! function_exists( 'get_home_path' ) ) {
30	include_once ABSPATH .'wp-admin/includes/file.php';
31	}
32	$NFW_ABSPATH = get_home_path();
33
34	if ( PHP_MAJOR_VERSION > 7 ) {
35	$php_major_version = '';
36	} else {
37	$php_major_version = PHP_MAJOR_VERSION;
38	}
39
40	define( 'NFW_HTACCESS_BEGIN', '# BEGIN NinjaFirewall' );
41	define( 'NFW_HTACCESS_DATA', '<IfModule mod_php'. $php_major_version .'.c>' ."\n" .
42	' php_value auto_prepend_file "'. NFW_LOG_DIR .'/nfwlog/ninjafirewall.php"' ."\n" .
43	'</IfModule>');
44	define( 'NFW_LITESPEED_DATA', '<IfModule Litespeed>' ."\n" .
45	' php_value auto_prepend_file "'. NFW_LOG_DIR .'/nfwlog/ninjafirewall.php"' ."\n" .
46	'</IfModule>');
47	define( 'NFW_APACHELSAPI_DATA', '<IfModule lsapi_module>' ."\n" .
48	' php_value auto_prepend_file "'. NFW_LOG_DIR .'/nfwlog/ninjafirewall.php"' ."\n" .
49	'</IfModule>');
50	define( 'NFW_OPENLITESPEED_DATA', 'php_value auto_prepend_file "'. NFW_LOG_DIR .'/nfwlog/ninjafirewall.php"' );
51	define( 'NFW_SUPHP_DATA', '<IfModule mod_suphp.c>' ."\n" .
52	' suPHP_ConfigPath '. rtrim( $NFW_ABSPATH, '/') ."\n" .
53	'</IfModule>');
54	define( 'NFW_HTACCESS_END', '# END NinjaFirewall' );
55	define( 'NFW_PHPINI_BEGIN', '; BEGIN NinjaFirewall' );
56	define( 'NFW_PHPINI_DATA', 'auto_prepend_file = "'. NFW_LOG_DIR .'/nfwlog/ninjafirewall.php"' );
57	define( 'NFW_PHPINI_END', '; END NinjaFirewall' );
58
59	// WordPress WAF in NinjaFirewall < 4.0
60	define( 'NFW_WP_CONFIG_BEGIN', '// BEGIN NinjaFirewall' );
61	define( 'NFW_WP_CONFIG_END', '// END NinjaFirewall' );
62	}
63
64	// ---------------------------------------------------------------------
65	// Add firewall's directive to the .htaccess.
66
67	function nfw_fullwaf_htaccess( $httpserver ) {
68
69	nfw_get_constants();
70
71	$htaccess_content = '';
72
73	if (! function_exists( 'get_home_path' ) ) {
74	include_once ABSPATH .'wp-admin/includes/file.php';
75	}
76	$NFW_ABSPATH = get_home_path();
77
78	// Back-up existing .htaccess
79	if ( file_exists( $NFW_ABSPATH .'.htaccess' ) ) {
80	if (! is_writable( $NFW_ABSPATH .'.htaccess' ) ) {
81	return sprintf(
82	__('Error: Your .htaccess file is not writable, please change its permissions: %s', 'ninjafirewall' ),
83	htmlspecialchars( $NFW_ABSPATH .'.htaccess' )
84	);
85	}
86	$backup_file = time();
87	@copy( $NFW_ABSPATH .'.htaccess', $NFW_ABSPATH .".htaccess.ninja{$backup_file}" );
88
89	// Remove potential NF directives
90	nfw_remove_directives();
91
92	$htaccess_content = file_get_contents( $NFW_ABSPATH .'.htaccess' );
93	}
94
95	// Write new content depending on HTTP server type
96
97	if ( $httpserver == 1 ) { // Apache mod_php
98	$data = NFW_HTACCESS_BEGIN ."\n". NFW_HTACCESS_DATA ."\n". NFW_HTACCESS_END ."\n\n". $htaccess_content;
99
100	} elseif ( $httpserver == 5 ) { // LiteSpeed
101	$data = NFW_HTACCESS_BEGIN ."\n". NFW_LITESPEED_DATA ."\n". NFW_HTACCESS_END ."\n\n". $htaccess_content;
102
103	} elseif ( $httpserver == 3 ) { // Apache + suPHP
104	$data = NFW_HTACCESS_BEGIN ."\n". NFW_SUPHP_DATA ."\n". NFW_HTACCESS_END ."\n\n". $htaccess_content;
105
106	} elseif ( $httpserver == 8 ) { // Apache + LSAPI
107	$data = NFW_HTACCESS_BEGIN ."\n". NFW_APACHELSAPI_DATA ."\n". NFW_HTACCESS_END ."\n\n". $htaccess_content;
108
109	} else {
110	return sprintf( __('Error: wrong parameter value (%s).', 'ninjafirewall'), 'HTTP server' );
111	}
112
113	// Write content
114	$res = @file_put_contents( $NFW_ABSPATH .'.htaccess', $data, LOCK_EX );
115	if ( $res === false ) {
116	return sprintf(
117	__('Error: The following file is not writable, please change its permissions: %s', 'ninjafirewall' ),
118	htmlspecialchars( $NFW_ABSPATH .'.htaccess' )
119	);
120	}
121
122	// Sandbox
123	$res = nfw_waf_sandbox();
124	if ( $res !== true ) {
125	// Undo
126	@file_put_contents( $NFW_ABSPATH .'.htaccess', $htaccess_content, LOCK_EX );
127	return $res;
128	}
129
130	return true;
131	}
132
133	// ---------------------------------------------------------------------
134	// Sandbox.
135
136	function nfw_waf_sandbox() {
137
138	// Bypass (undocumented):
139	if ( defined('NFW_BYPASS_SANDBOX') && NFW_BYPASS_SANDBOX == true ) {
140	return true;
141	}
142
143	NinjaFirewall_session::close();
144
145	$sandbox_error = __('NinjaFirewall detected that the requested changes seemed to crash your blog. %s', 'ninjafirewall') ."\n".
146	__('Changes have been undone. You may need to modify your selection and try again.', 'ninjafirewall' );
147	$headers['Cache-Control'] = 'no-cache';
148
149	$url = home_url( '/' ) .'?'. time();
150	global $wp_version;
151	$opts = array(
152	'timeout' => 20,
153	'httpversion' => '1.1' ,
154	'user-agent' => 'Mozilla/5.0 (compatible; NinjaFirewall/'.
155	NFW_ENGINE_VERSION .'; WordPress/'. $wp_version . ')',
156	// We don't want a fatal error if we're running on localhost e.g., dev site etc
157	'sslverify' => apply_filters( 'https_local_ssl_verify', false )
158	);
159	$res = wp_remote_get( $url, $opts );
160
161	$blogname = get_option( 'blogname' );
162	if (! is_wp_error( $res ) ) {
163	// Look for HTTP error
164	if ( $res['response']['code'] >= 400 ) {
165	$error_msg = sprintf(
166	$sandbox_error,
167	sprintf(
168	__('The website front-end returned: HTTP %s %s.', 'ninjafirewall'),
169	(int) $res['response']['code'],
170	esc_js( $res['response']['message'] )
171	)
172	);
173	return $error_msg;
174	}
175	if ( stripos( $res['body'], $blogname ) === false ) {
176	$error_msg = sprintf(
177	$sandbox_error,
178	__('The website front-end did not return the expected page.', 'ninjafirewall')
179	);
180	return $error_msg;
181	}
182
183	} else {
184	$error_msg = sprintf(
185	$sandbox_error,
186	sprintf(
187	__('The website front-end returned a fatal error: %s.', 'ninjafirewall'),
188	esc_js( $res->get_error_message() )
189	)
190	);
191	return $error_msg;
192	}
193
194	return true;
195	}
196
197	// ---------------------------------------------------------------------
198
199	function nfw_fullwaf_ini( $httpserver, $initype ) {
200
201	nfw_get_constants();
202
203	if (! function_exists( 'get_home_path' ) ) {
204	include_once ABSPATH .'wp-admin/includes/file.php';
205	}
206	$NFW_ABSPATH = get_home_path();
207
208	$ini_content = '';
209
210	// [1] .user.ini
211	// [2] php.ini
212	if ( $initype == 2 ) {
213	$initype = 'php.ini';
214	} else {
215	$initype = '.user.ini';
216	}
217
218	// Back-up existing INI file
219	if ( file_exists( $NFW_ABSPATH . $initype ) ) {
220	if (! is_writable( $NFW_ABSPATH . $initype ) ) {
221	return sprintf(
222	__('Error: The following file is not writable, please change its permissions: %s', 'ninjafirewall' ),
223	htmlspecialchars( $NFW_ABSPATH . $initype )
224	);
225	}
226	$backup_file = time();
227	@copy( $NFW_ABSPATH .$initype, $NFW_ABSPATH ."{$initype}.ninja{$backup_file}" );
228
229	// Remove potential NF directives
230	nfw_remove_directives();
231
232	$ini_content = file_get_contents( $NFW_ABSPATH . $initype );
233	}
234
235	// Write new content
236	$res = @file_put_contents(
237	$NFW_ABSPATH . $initype,
238	NFW_PHPINI_BEGIN . "\n" . NFW_PHPINI_DATA . "\n" . NFW_PHPINI_END . "\n\n" . $ini_content,
239	LOCK_EX
240	);
241	if ( $res === false ) {
242	return sprintf(
243	__('Error: The following file is not writable, please change its permissions: %s', 'ninjafirewall' ),
244	htmlspecialchars( $NFW_ABSPATH . $initype )
245	);
246	}
247
248	// Sandbox
249	$res = nfw_waf_sandbox();
250	if ( $res !== true ) {
251	// Undo
252	@file_put_contents( $NFW_ABSPATH . $initype, $ini_content, LOCK_EX );
253	return $res;
254	}
255
256	return true;
257	}
258
259	// ---------------------------------------------------------------------
260	// Remove all directives from .htaccess, INI files and wp-config.php.
261
262	function nfw_remove_directives( $ini = true, $htaccess = true, $wp_config = true ) {
263
264	if ( defined('NFW_REMOVED_DIRECTIVES') ) { return; }
265
266	define('NFW_REMOVED_DIRECTIVES', true);
267
268	if (! function_exists( 'get_home_path' ) ) {
269	include_once ABSPATH .'wp-admin/includes/file.php';
270	}
271	$NFW_ABSPATH = get_home_path();
272
273	$res = array( 'ini' => true, 'htaccess' => true, 'wp-config' => true );
274
275	// wp-config.php
276	if ( $wp_config == true ) {
277	$wp_config = ABSPATH .'wp-config.php';
278	if ( file_exists( $wp_config ) ) {
279	if ( is_writable( $wp_config ) ) {
280	$wp_config_content = file_get_contents( $wp_config );
281	if ( preg_match( '`'. NFW_WP_CONFIG_BEGIN .'.+?'. NFW_WP_CONFIG_END .'`s', $wp_config_content ) ) {
282	$wp_config_content = preg_replace( '`\s?'. NFW_WP_CONFIG_BEGIN .'.+?'. NFW_WP_CONFIG_END .'[^\r\n]*\s?`s' , "\n", $wp_config_content);
283	file_put_contents( $wp_config, $wp_config_content, LOCK_EX );
284	}
285	} else {
286	$res['wp-config'] = __('File is not writable', 'ninjafirewall');
287	}
288	}
289	}
290
291	// .htaccess
292	if ( $htaccess == true ) {
293	$htaccess = $NFW_ABSPATH .'.htaccess';
294	$mods = 0;
295	if ( file_exists( $htaccess ) ) {
296	if ( is_writable( $htaccess ) ) {
297	$htaccess_content = file_get_contents( $htaccess );
298	if ( preg_match( '`'. NFW_HTACCESS_BEGIN .'.+?'. NFW_HTACCESS_END .'`s', $htaccess_content ) ) {
299	$htaccess_content = preg_replace( '`\s?'. NFW_HTACCESS_BEGIN .'.+?'. NFW_HTACCESS_END .'[^\r\n]*\s?`s' , "\n", $htaccess_content);
300	$mods = 1;
301	}
302	// Comment out existing directive(s) left:
303	if ( preg_match( '`[^#]php_value\s*auto_prepend_file`', $htaccess_content ) ) {
304	$htaccess_content = preg_replace( '`php_value\s*auto_prepend_file`' , '#php_value auto_prepend_file', $htaccess_content);
305	$mods = 1;
306	}
307	if ( $mods == 1 ) {
308	@file_put_contents( $htaccess, $htaccess_content, LOCK_EX );
309	}
310	} else {
311	$res['htaccess'] = __('File is not writable', 'ninjafirewall');
312	}
313	}
314	}
315
316	// .ini
317	if ( $ini == true ) {
318	$ini = $NFW_ABSPATH .'php.ini';
319	$mods = 0;
320	if ( file_exists( $ini ) ) {
321	if ( is_writable( $ini ) ) {
322	$ini_content = file_get_contents( $ini );
323	if ( preg_match( '`'. NFW_PHPINI_BEGIN .'.+?'. NFW_PHPINI_END .'`s', $ini_content ) ) {
324	$ini_content = preg_replace( '`\s?'. NFW_PHPINI_BEGIN .'.+?'. NFW_PHPINI_END .'[^\r\n]*\s?`s' , "\n", $ini_content);
325	$mods = 1;
326	}
327	// Comment out existing directive(s) left:
328	if ( preg_match( '`[^;]auto_prepend_file`', $ini_content ) ) {
329	$ini_content = preg_replace( '`auto_prepend_file`' , ';auto_prepend_file', $ini_content);
330	$mods = 1;
331	}
332	if ( $mods == 1 ) {
333	@file_put_contents( $ini, $ini_content, LOCK_EX );
334	}
335	} else {
336	$res['ini'] = __('File is not writable', 'ninjafirewall');
337	}
338	}
339	$ini = $NFW_ABSPATH .'.user.ini';
340	$mods = 0;
341	if ( file_exists( $ini ) ) {
342	if ( is_writable( $ini ) ) {
343	$ini_content = file_get_contents( $ini );
344	if ( preg_match( '`'. NFW_PHPINI_BEGIN .'.+?'. NFW_PHPINI_END .'`s', $ini_content ) ) {
345	$ini_content = preg_replace( '`\s?'. NFW_PHPINI_BEGIN .'.+?'. NFW_PHPINI_END .'[^\r\n]*\s?`s' , "\n", $ini_content);
346	$mods = 1;
347	}
348	// Comment out existing directive(s) left:
349	if ( preg_match( '`[^;]auto_prepend_file`', $ini_content ) ) {
350	$ini_content = preg_replace( '`auto_prepend_file`' , ';auto_prepend_file', $ini_content);
351	$mods = 1;
352	}
353	if ( $mods == 1 ) {
354	@file_put_contents( $ini, $ini_content, LOCK_EX );
355	}
356	} else {
357	$res['ini'] = __('File is not writable', 'ninjafirewall');
358	}
359	}
360	}
361	}
362
363	// ---------------------------------------------------------------------
364	// EOF //
365