install_default.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall trunk

ninjafirewall / lib / install_default.php

ninjafirewall / lib Last commit date

install_default.php

324 lines

1	<?php
2	/*
3	+---------------------------------------------------------------------+
4	\| NinjaFirewall (WP Edition) \|
5	\| \|
6	\| (c) NinTechNet - https://nintechnet.com/ \|
7	+---------------------------------------------------------------------+
8	\| This program is free software: you can redistribute it and/or \|
9	\| modify it under the terms of the GNU General Public License as \|
10	\| published by the Free Software Foundation, either version 3 of \|
11	\| the License, or (at your option) any later version. \|
12	\| \|
13	\| This program is distributed in the hope that it will be useful, \|
14	\| but WITHOUT ANY WARRANTY; without even the implied warranty of \|
15	\| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the \|
16	\| GNU General Public License for more details. \|
17	+---------------------------------------------------------------------+ i18n++ / sa
18	*/
19
20	if (! defined( 'NFW_ENGINE_VERSION' ) ) { die( 'Forbidden' ); }
21
22	// ---------------------------------------------------------------------
23	// Load and save default config
24
25	function nfw_load_default_conf() {
26
27	$nfw_rules = array();
28
29	$logo = plugins_url() . '/ninjafirewall/images/ninjafirewall_75.png';
30	$logo = preg_replace( '/^https?:/', '', $logo );
31
32	$nfw_options = array(
33	// ---------------------------------------------------------------
34	// The next 6 keys must always be present because they are used
35	// by the nfw_validate_option() function to check whether $nfw_options
36	// is corrupted or not:
37	'enabled' => 1,
38	'blocked_msg' => base64_encode(NFW_DEFAULT_MSG),
39	'logo' => $logo,
40	'ret_code' => 403,
41	'scan_protocol' => 3,
42	'get_scan' => 1,
43	'widgetnews' => 4,
44	// ---------------------------------------------------------------
45	'anon_ip' => 0,
46	'debug' => 0,
47	'uploads' => 1,
48	'sanitise_fn' => 0,
49	'get_sanitise' => 0,
50	'post_scan' => 1,
51	'post_sanitise' => 0,
52	'cookies_scan' => 1,
53	'cookies_sanitise'=> 0,
54	'ua_scan' => 1,
55	'ua_sanitise' => 1,
56	'referer_scan' => 0,
57	'referer_sanitise'=> 1,
58	'referer_post' => 0,
59	'no_host_ip' => 0,
60	'allow_local_ip' => 1, // 1 == no !
61	'php_superglobals'=> 1,
62	'php_errors' => 1,
63	'php_self' => 1,
64	'php_path_t' => 1,
65	'php_path_i' => 1,
66	'wp_dir' => '/wp-admin/(?:css\|images\|includes\|js)/\|' .
67	'/wp-includes/(?!ms-files\.php)(?:(?:css\|images\|js(?!/tinymce/wp-tinymce\.php)\|theme-compat)/\|[^/]+\.php)\|' .
68	'/'. basename(WP_CONTENT_DIR) .'/(?:uploads\|blogs\.dir)/',
69	'no_post_themes' => 0,
70	'force_ssl' => 0,
71	'disallow_edit' => 0,
72	'disallow_mods' => 0,
73	// 3.8.2:
74	'disable_error_handler' => 0,
75
76	'wl_admin' => 1,
77	// v1.0.4
78	'a_0' => 1,
79	'a_11' => 1,
80	'a_12' => 1,
81	'a_13' => 0,
82	'a_14' => 0,
83	'a_15' => 1,
84	'a_16' => 0,
85	'a_21' => 1,
86	'a_22' => 1,
87	'a_23' => 0,
88	'a_24' => 0,
89	'a_25' => 0,
90	'a_31' => 1,
91	// v1.3.3 :
92	'a_41' => 1,
93	// v1.3.4 :
94	'a_51' => 1,
95	'sched_scan' => 0,
96	'report_scan' => 0,
97	// 4.1
98	'secupdates' => 1,
99	// v1.7 (daily report cronjob) :
100	'a_52' => 1,
101	// v3.8.3 :
102	'a_61' => 1,
103
104	'alert_email' => get_option('admin_email'),
105	// v1.1.0 :
106	'alert_sa_only' => 1,
107	'nt_show_status' => 1,
108	'post_b64' => 1,
109	// v3.6.7:
110	'disallow_creation' => 0,
111	// 4.5.9
112	'disallow_deletion' => 0,
113	// v3.7.2:
114	'disallow_settings' => 1,
115	// v4.0.6
116	'disallow_privesc' => 1,
117	// v4.2.6
118	'disallow_privesc_mu' => 0,
119	// v4.2
120	'disallow_publish' => 0,
121
122	// v1.1.2 :
123	'no_xmlrpc' => 0,
124	// v1.7 :
125	'no_xmlrpc_multi' => 0,
126	// v3.3.2
127	'no_xmlrpc_pingback'=> 0,
128	// 4.3.1
129	'no_appswd' => 0,
130
131	// v1.1.3 :
132	'enum_archives' => 0,
133	'enum_sitemap' => 0,
134	'enum_login' => 0,
135	// v4.2
136	'enum_feed' => 0,
137	'no_restapi' => 0,
138	'restapi_loggedin'=> 0,
139	// v1.1.6 :
140	'request_sanitise'=> 0,
141	// v1.2.1 :
142	'fg_enable' => 0,
143	'fg_mtime' => 10,
144	'fg_exclude' => '',
145	// Log:
146	'auto_del_log' => 0,
147	// Updates :
148	'enable_updates' => 1,
149	'sched_updates' => 1,
150	'notify_updates' => 1,
151	// Centralized Logging:
152	'clogs_enable' => 0,
153	'clogs_pubkey' => '',
154
155	'rate_notice' => time() + 86400 * 15,
156	'welcome' => 1
157	);
158	// v1.3.1 :
159	// Some compatibility checks:
160	// 1. header_register_callback(): requires PHP >=5.4
161	// 2. headers_list() and header_remove(): some hosts may disable them.
162	if ( function_exists('header_register_callback') && function_exists('headers_list') && function_exists('header_remove') ) {
163	// X-XSS-Protection:
164	$nfw_options['response_headers'] = '0003000000';
165	}
166	$nfw_options['referrer_policy_enabled'] = 0;
167
168	define('NFUPDATESDO', 2);
169	@nf_sub_updates();
170
171	if (! $nfw_rules = @unserialize(NFW_RULES) ) {
172	$err_msg = esc_html__('Error: The installer cannot download the security rules from wordpress.org website.', 'ninjafirewall');
173	$err_msg.= '<ol><li>'. esc_html__('The server may be temporarily down or you may have network connectivity problems? Please try again in a few minutes.', 'ninjafirewall') . '</li>';
174	$err_msg.= '<li>'. esc_html__('NinjaFirewall downloads its rules over an HTTPS secure connection. Maybe your server does not support SSL? You can force NinjaFirewall to use a non-secure HTTP connection by adding the following directive to your <strong>wp-config.php</strong> file:', 'ninjafirewall') . ' <p><code>define("NFW_DONT_USE_SSL", 1);</code></p></li></ol>';
175	exit( '<font style="font-size:14px;">'. $err_msg .'</font>' );
176	}
177
178	// dropins code:
179	if ( isset( $nfw_rules['dropins'] ) ) {
180	if ( $nfw_rules['dropins'] == 'delete' ) {
181	if ( is_file( NFW_LOG_DIR .'/nfwlog/dropins.php' ) ) {
182	@unlink( NFW_LOG_DIR .'/nfwlog/dropins.php' );
183	}
184	} else {
185	$dropins = base64_decode( $nfw_rules['dropins'], true );
186	if ( $dropins !== false ) {
187	@file_put_contents( NFW_LOG_DIR .'/nfwlog/dropins.php', $dropins, LOCK_EX );
188	}
189	}
190	unset( $nfw_rules['dropins'] );
191	}
192
193	$nfw_options['engine_version'] = NFW_ENGINE_VERSION;
194	$nfw_options['rules_version'] = NFW_NEWRULES_VERSION; // downloaded rules
195
196	// If the user is using WP-CLI, we populate DOCUMENT_ROOT with ABSPATH:
197	if ( defined('WP_CLI') && WP_CLI ) {
198	$_SERVER['DOCUMENT_ROOT'] = ABSPATH;
199	}
200	// Create but disable by default "Block the DOCUMENT_ROOT server variable in HTTP request" rule
201	if ( strlen( $_SERVER['DOCUMENT_ROOT'] ) > 5 ) {
202	$nfw_rules[NFW_DOC_ROOT]['cha'][1]['wha'] = str_replace( '/', '/[./]*', $_SERVER['DOCUMENT_ROOT'] );
203	} elseif ( strlen( getenv( 'DOCUMENT_ROOT' ) ) > 5 ) {
204	$nfw_rules[NFW_DOC_ROOT]['cha'][1]['wha'] = str_replace( '/', '/[./]*', getenv( 'DOCUMENT_ROOT' ) );
205	}
206	$nfw_rules[NFW_DOC_ROOT]['ena'] = 0;
207
208	// ------------------------------------------------------------------
209	// Update DB options and rules BEFORE (re)enabling scheduled tasks
210	// (the garbage collect should be ran/scheduled last):
211	nfw_update_option( 'nfw_options', $nfw_options);
212	nfw_update_option( 'nfw_rules', $nfw_rules);
213	// Create conjobs
214	nfw_create_scheduled_tasks();
215	// ------------------------------------------------------------------
216
217	nfw_create_log_dir();
218
219	}
220	// ---------------------------------------------------------------------
221	// Create NinjaFirewall's log & cache folders.
222
223	function nfw_create_log_dir() {
224
225	$deny_rules = "<Files \"*\">
226	<IfModule mod_version.c>
227	<IfVersion < 2.4>
228	Order Deny,Allow
229	Deny from All
230	</IfVersion>
231	<IfVersion >= 2.4>
232	Require all denied
233	</IfVersion>
234	</IfModule>
235	<IfModule !mod_version.c>
236	<IfModule !mod_authz_core.c>
237	Order Deny,Allow
238	Deny from All
239	</IfModule>
240	<IfModule mod_authz_core.c>
241	Require all denied
242	</IfModule>
243	</IfModule>
244	</Files>";
245
246	if (! is_writable(NFW_LOG_DIR) ) {
247	$err_msg = sprintf( esc_html__('NinjaFirewall cannot create its <code>nfwlog/</code>log and cache folder; please make sure that the <code>%s</code> directory is writable', 'ninjafirewall'), htmlspecialchars( NFW_LOG_DIR ) );
248	exit( '<font style="font-size:14px;">'. $err_msg .'</font>' );
249	}
250
251	if (! is_dir( NFW_LOG_DIR .'/nfwlog') ) {
252	mkdir( NFW_LOG_DIR .'/nfwlog', 0755 );
253	/**
254	* 2025-09-03: We temporarily force NinjaFirewall session on all new installs.
255	*/
256	touch( NFW_LOG_DIR .'/nfwlog/ninjasession');
257	}
258	if (! is_dir( NFW_LOG_DIR .'/nfwlog/cache') ) {
259	mkdir( NFW_LOG_DIR .'/nfwlog/cache', 0755 );
260	}
261
262	touch( NFW_LOG_DIR . '/nfwlog/index.html' );
263	touch( NFW_LOG_DIR . '/nfwlog/cache/index.html' );
264	@file_put_contents(NFW_LOG_DIR . '/nfwlog/.htaccess', $deny_rules, LOCK_EX);
265	@file_put_contents(NFW_LOG_DIR . '/nfwlog/cache/.htaccess', $deny_rules, LOCK_EX);
266	@file_put_contents(
267	NFW_LOG_DIR . '/nfwlog/readme.txt',
268	"This is NinjaFirewall's logs, loader and cache directory. DO NOT alter or remove it as long as NinjaFirewall is running!\n\nIf you just uninstalled NinjaFirewall, WAIT 5 MINUTES before deleting this folder, otherwise your site will likely crash.",
269	LOCK_EX
270	);
271	nfw_create_loader();
272	}
273
274	// ---------------------------------------------------------------------
275	// Create NF's loader.
276
277	function nfw_create_loader() {
278
279	$nfw_options = nfw_get_option( 'nfw_options' );
280
281	// Firewall loader
282	$loader = "<?php
283	// ===============================================================//
284	// NinjaFirewall's loader. //
285	// DO NOT alter or remove it as long as NinjaFirewall is running. //
286	// If this file is corrupted or wrong, you can re-generate it //
287	// by deactivating and reactivating NinjaFirewall from your //
288	// WordPress dashboard. //
289	// ===============================================================//";
290
291	if (! empty( $nfw_options['exclude_waf_list'] ) ) {
292	$string = '';
293	$exclude_waf_list = json_decode( $nfw_options['exclude_waf_list'] );
294	foreach( $exclude_waf_list as $folder ) {
295	if ( is_dir( ABSPATH . $folder ) ) {
296	$string .= "'$folder',";
297	}
298	}
299	$string = rtrim( $string, ',' );
300	if (! empty( $string ) ) {
301	$loader .= "
302	\$nfw_exclude_waf_list = array($string);
303	foreach( \$nfw_exclude_waf_list as \$nfw_exclude_waf_folder ) {
304	if (strpos(\$_SERVER['SCRIPT_FILENAME'], \"". ABSPATH ."\$nfw_exclude_waf_folder/\") === 0) {
305	return;
306	}
307	}";
308	}
309	}
310
311	$loader .= "
312	if ( is_file('". __DIR__ .'/firewall.php' . "') ) {
313	@include_once '". __DIR__ .'/firewall.php' . "';
314	}
315	// EOF
316	";
317	file_put_contents( NFW_LOG_DIR .'/nfwlog/ninjafirewall.php', $loader, LOCK_EX );
318	return;
319
320	}
321
322	// ---------------------------------------------------------------------
323	// EOF //
324