settings_security_rules_editor.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall trunk

ninjafirewall / lib / settings_security_rules_editor.php

ninjafirewall / lib Last commit date

settings_security_rules_editor.php

162 lines

1	<?php
2	/*
3	+---------------------------------------------------------------------+
4	\| NinjaFirewall (WP Edition) \|
5	\| \|
6	\| (c) NinTechNet - https://nintechnet.com/ \|
7	+---------------------------------------------------------------------+
8	\| This program is free software: you can redistribute it and/or \|
9	\| modify it under the terms of the GNU General Public License as \|
10	\| published by the Free Software Foundation, either version 3 of \|
11	\| the License, or (at your option) any later version. \|
12	\| \|
13	\| This program is distributed in the hope that it will be useful, \|
14	\| but WITHOUT ANY WARRANTY; without even the implied warranty of \|
15	\| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the \|
16	\| GNU General Public License for more details. \|
17	+---------------------------------------------------------------------+ i18n+ / sa / 2
18	*/
19
20	if (! defined('NFW_ENGINE_VERSION') ) {
21	die('Forbidden');
22	}
23
24	// Block immediately if user is not allowed
25	nf_not_allowed('block', __LINE__ );
26
27	$nfw_rules = nfw_get_option('nfw_rules');
28	$is_update = 0;
29
30	if ( isset( $_POST['sel_e_r'] ) ) {
31	if ( empty( $_POST['nfwnonce'] ) \|\| ! wp_verify_nonce( $_POST['nfwnonce'], 'editor_save') ) {
32	wp_nonce_ays('editor_save');
33	}
34	$rule_id = absint( $_POST['sel_e_r'] );
35	if ( $rule_id < 1 ) {
36	echo '<div class="error notice is-dismissible"><p>' . __('Error: you did not select a rule to disable.', 'ninjafirewall') .'</p></div>';
37	} else if ( ( $rule_id == 2 ) \|\| ( $rule_id > 499 && $rule_id < 600 ) ) {
38	echo '<div class="error notice is-dismissible"><p>' . __('Error: to change this rule, use the "Firewall Policies" menu.', 'ninjafirewall') .'</p></div>';
39	} else if (! isset( $nfw_rules[ $rule_id ] ) ) {
40	echo '<div class="error notice is-dismissible"><p>' . __('Error: this rule does not exist.', 'ninjafirewall') .'</p></div>';
41	} elseif ( $rule_id != 999 ) {
42	$nfw_rules[ $rule_id ]['ena'] = 0;
43	$is_update = 1;
44	echo '<div class="updated notice is-dismissible"><p>' . sprintf( esc_html__('Rule ID %s has been disabled.', 'ninjafirewall'), $rule_id ) .'</p></div>';
45	}
46
47	} else if ( isset( $_POST['sel_d_r'] ) ) {
48	if ( empty( $_POST['nfwnonce'] ) \|\| ! wp_verify_nonce( $_POST['nfwnonce'], 'editor_save') ) {
49	wp_nonce_ays('editor_save');
50	}
51	$rule_id = absint( $_POST['sel_d_r'] );
52	if ( $rule_id < 1 ) {
53	echo '<div class="error notice is-dismissible"><p>' . __('Error: you did not select a rule to enable.', 'ninjafirewall') .'</p></div>';
54	} else if ( ( $rule_id == 2 ) \|\| ( $rule_id > 499 && $rule_id < 600 ) ) {
55	echo '<div class="error notice is-dismissible"><p>' . __('Error: to change this rule, use the "Firewall Policies" menu.', 'ninjafirewall') .'</p></div>';
56	} else if (! isset( $nfw_rules[ $rule_id ] ) ) {
57	echo '<div class="error notice is-dismissible"><p>' . __('Error: this rule does not exist.', 'ninjafirewall') .'</p></div>';
58	} elseif ( $rule_id != 999 ) {
59	$nfw_rules[ $rule_id ]['ena'] = 1;
60	$is_update = 1;
61	echo '<div class="updated notice is-dismissible"><p>' . sprintf( esc_html__('Rule ID %s has been enabled.', 'ninjafirewall'), $rule_id ) .'</p></div>';
62	}
63	}
64	if ( $is_update ) {
65	nfw_update_option('nfw_rules', $nfw_rules);
66	}
67
68	$disabled_rules = $enabled_rules = array();
69
70	if ( empty( $nfw_rules ) ) {
71	echo '<div class="error notice is-dismissible"><p>' . __('Error: no rules found.', 'ninjafirewall') .'</p></div></div>';
72	return;
73	}
74
75	foreach ( $nfw_rules as $rule_key => $rule_value ) {
76	if ( $rule_key == 999 ) { continue; }
77	// Ingore firewall policies:
78	if ( $rule_key == 2 \|\| ( $rule_key > 499 && $rule_key < 600 ) ) {
79	continue;
80	}
81	if (! empty( $nfw_rules[$rule_key]['ena'] ) ) {
82	$enabled_rules[] = $rule_key;
83	} else {
84	$disabled_rules[] = $rule_key;
85	}
86	}
87
88	$nonce = wp_nonce_field('editor_save', 'nfwnonce', 0, 0);
89
90	echo '<h3>' . __('NinjaFirewall built-in security rules', 'ninjafirewall') .'</h3>
91	<table class="form-table nfw-table">
92	<tr>
93	<th scope="row" class="row-med">' . __('Select the rule you want to disable or enable', 'ninjafirewall') .'</th>
94	<td>
95	<form method="post">'. $nonce . '
96	<select name="sel_e_r" style="font-family:Consolas,Monaco,monospace;">
97	<option value="0">' . __('Total rules enabled', 'ninjafirewall') .' : ' . count( $enabled_rules ) . '</option>';
98	sort( $enabled_rules );
99	$count = 0;
100	$desr = '';
101	foreach ( $enabled_rules as $key ) {
102	if ( $key < 100 ) {
103	$desc = ' ' . __('Remote/local file inclusion', 'ninjafirewall');
104	} elseif ( $key < 150 ) {
105	$desc = ' ' . __('Cross-site scripting', 'ninjafirewall');
106	} elseif ( $key < 200 ) {
107	$desc = ' ' . __('Code injection', 'ninjafirewall');
108	} elseif ( $key > 249 && $key < 300 ) {
109	$desc = ' ' . __('SQL injection', 'ninjafirewall');
110	} elseif ( $key < 350 ) {
111	$desc = ' ' . __('Various vulnerability', 'ninjafirewall');
112	} elseif ( $key < 400 ) {
113	$desc = ' ' . __('Backdoor/shell', 'ninjafirewall');
114	} elseif ( $key > 999 && $key < 1300 ) {
115	$desc = ' ' . __('Application specific', 'ninjafirewall');
116	} elseif ( $key > 1349 ) {
117	$desc = ' ' . __('WordPress vulnerability', 'ninjafirewall');
118	}
119	echo '<option value="' . htmlspecialchars($key) . '">' . __('Rule ID', 'ninjafirewall') .' : ' . htmlspecialchars($key) . $desc . '</option>';
120	++$count;
121	}
122	echo '</select>  <input class="button-secondary" type="submit" name="disable" value="' . __('Disable it', 'ninjafirewall') .'"' . disabled( $count, 0) .'>
123	<input type="hidden" name="tab" value="editor" />
124	</form>
125	<br />
126	<form method="post">'. $nonce . '
127	<select name="sel_d_r" style="font-family:Consolas,Monaco,monospace;">
128	<option value="0">' . __('Total rules disabled', 'ninjafirewall') .' : ' . count( $disabled_rules ) . '</option>';
129	sort( $disabled_rules );
130	$count = 0;
131	foreach ( $disabled_rules as $key ) {
132	if ( $key < 100 ) {
133	$desc = ' ' . __('Remote/local file inclusion', 'ninjafirewall');
134	} elseif ( $key < 150 ) {
135	$desc = ' ' . __('Cross-site scripting', 'ninjafirewall');
136	} elseif ( $key < 200 ) {
137	$desc = ' ' . __('Code injection', 'ninjafirewall');
138	} elseif ( $key > 249 && $key < 300 ) {
139	$desc = ' ' . __('SQL injection', 'ninjafirewall');
140	} elseif ( $key < 350 ) {
141	$desc = ' ' . __('Various vulnerability', 'ninjafirewall');
142	} elseif ( $key < 400 ) {
143	$desc = ' ' . __('Backdoor/shell', 'ninjafirewall');
144	} elseif ( $key > 999 && $key < 1300 ) {
145	$desc = ' ' . __('Application specific', 'ninjafirewall');
146	} elseif ( $key > 1349 ) {
147	$desc = ' ' . __('WordPress vulnerability', 'ninjafirewall');
148	}
149	echo '<option value="' . htmlspecialchars($key) . '">' . __('Rule ID', 'ninjafirewall') .' #' . htmlspecialchars($key) . $desc . '</option>';
150	++$count;
151	}
152
153	echo '</select>  <input class="button-secondary" type="submit" name="disable" value="' . __('Enable it', 'ninjafirewall') .'"' . disabled( $count, 0) .'>
154	<input type="hidden" name="tab" value="editor" />
155	</form>
156	</td>
157	</tr>
158	</table>
159	';
160	// ---------------------------------------------------------------------
161	// EOF
162